Newbie: How safe is source code?

Hi

I am a complete newbie and am contemplating moving to asp.net from asp. How
protected is an asp.net web site source code should it be delivered to a
client?

Thanks

RegardsMy opinion:

If your concern is about protecting access to the code itself, then ASP.NET
source is much safer than classic ASP, because the deliverable is actually a
set of compiled .dll's, rather than a set of vbscript files.

However, you should be aware that it is notoriously easy to decompile a .NET
assembly into very clean source code. If this worries you, you should
consider using an obfuscator to "scramble" the dll code so that decompiling
either doesn't work or doesn't work very well.

-Michael

"John" <john@.nospam.infovis.co.uk> wrote in message
news:Oo1BKKIpDHA.2732@.TK2MSFTNGP11.phx.gbl...
> Hi
> I am a complete newbie and am contemplating moving to asp.net from asp.
How
> protected is an asp.net web site source code should it be delivered to a
> client?
> Thanks
> Regards
Hi John,

You should obfuscate your ASP.NET with Dotfuscator (a .NET
obfuscator).
A lite version is included inside VS.NET 2003 under the tools menu.
This will make reverse engineered code harder to understand.

If you want more protection that significantly hinders reverse
engineering by crashing or stopping decompilers and support look at
Dotfuscator Professional Edition.

For more info: www.preemptive.com/dotfuscator

Best Regards,
Dotfuscator Team

> "John" <john@.nospam.infovis.co.uk>
> > Hi
> > I am a complete newbie and am contemplating moving to asp.net from asp.
> How
> > protected is an asp.net web site source code should it be delivered to a
> > client?
I agree. But what about 'Whidbey' (new VS 2004)? I think we going
back to no code-behind'.

-----------------------
http://www.naptaxes.com/AAJ/
[AllAmericanJobs - Searching jobs from your desktop and automatically
sends resume.]
Even with 'no code behind' isn't the result still .NET code which can be decompiled?

> I agree. But what about 'Whidbey' (new VS 2004)? I think we going
> back to ?no code-behind'.

newbie: I don't want my .aspx and .cs files to have the source viewable by the client

I'm creating a C# .net project, for a client. However they only have the
right to the binaries, not the source code. Is there a way to compile it so
that I just give them dll's? or do they need the .aspx pages. I read
somewhere that I could probably make assemblies (excuse my bad terminology)
of the source code, but that it is quiet easy to disassemble the assemblies,
so that does not seem to afford read protection.
or am I just all over nothing!
thanksYou need to give them the ASPX pages and the compiled DLLs, but you do not
need to give them the .CS source code files.
If they are unethical they could decombile the DLLs to get a rough
approximation of the source code, but you can thwart them with an
Obfuscator.
Visual Studio 2003 has a basic built in obfuscator, but for 2002 you'll need
a 3rd party solution.
Here's more information on obfuscators:
http://www.abderaware.com/WhitePapers/Obfuscator.htm
http://www.preemptive.com/dotfuscator/index.html
http://www.devx.com/SummitDays/Article/11351
http://www.lesser-software.com/ilobf.htm
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
"Seth Broomer" <asdf@.asdsd.com> wrote in message
news:eWLgn06jEHA.1656@.TK2MSFTNGP09.phx.gbl...
> I'm creating a C# .net project, for a client. However they only have the
> right to the binaries, not the source code. Is there a way to compile it
> so
> that I just give them dll's? or do they need the .aspx pages. I read
> somewhere that I could probably make assemblies (excuse my bad
> terminology)
> of the source code, but that it is quiet easy to disassemble the
> assemblies,
> so that does not seem to afford read protection.
> or am I just all over nothing!
> thanks
>

newbie: I dont want my .aspx and .cs files to have the source viewable by the client

I'm creating a C# .net project, for a client. However they only have the
right to the binaries, not the source code. Is there a way to compile it so
that I just give them dll's? or do they need the .aspx pages. I read
somewhere that I could probably make assemblies (excuse my bad terminology)
of the source code, but that it is quiet easy to disassemble the assemblies,
so that does not seem to afford read protection.

or am I just all confused over nothing!

thanksYou need to give them the ASPX pages and the compiled DLLs, but you do not
need to give them the .CS source code files.
If they are unethical they could decombile the DLLs to get a rough
approximation of the source code, but you can thwart them with an
Obfuscator.
Visual Studio 2003 has a basic built in obfuscator, but for 2002 you'll need
a 3rd party solution.

Here's more information on obfuscators:
http://www.abderaware.com/WhitePapers/Obfuscator.htm
http://www.preemptive.com/dotfuscator/index.html
http://www.devx.com/SummitDays/Article/11351
http://www.lesser-software.com/ilobf.htm

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net

"Seth Broomer" <asdf@.asdsd.com> wrote in message
news:eWLgn06jEHA.1656@.TK2MSFTNGP09.phx.gbl...
> I'm creating a C# .net project, for a client. However they only have the
> right to the binaries, not the source code. Is there a way to compile it
> so
> that I just give them dll's? or do they need the .aspx pages. I read
> somewhere that I could probably make assemblies (excuse my bad
> terminology)
> of the source code, but that it is quiet easy to disassemble the
> assemblies,
> so that does not seem to afford read protection.
> or am I just all confused over nothing!
> thanks
FYI - Just remember there are Deobfuscator out there. But at least you are
taking some sort of measure to secure the DLLs.

"Steve C. Orr [MVP, MCSD]" wrote:

> You need to give them the ASPX pages and the compiled DLLs, but you do not
> need to give them the .CS source code files.
> If they are unethical they could decombile the DLLs to get a rough
> approximation of the source code, but you can thwart them with an
> Obfuscator.
> Visual Studio 2003 has a basic built in obfuscator, but for 2002 you'll need
> a 3rd party solution.
> Here's more information on obfuscators:
> http://www.abderaware.com/WhitePapers/Obfuscator.htm
> http://www.preemptive.com/dotfuscator/index.html
> http://www.devx.com/SummitDays/Article/11351
> http://www.lesser-software.com/ilobf.htm
> --
> I hope this helps,
> Steve C. Orr, MCSD, MVP
> http://Steve.Orr.net
>
> "Seth Broomer" <asdf@.asdsd.com> wrote in message
> news:eWLgn06jEHA.1656@.TK2MSFTNGP09.phx.gbl...
> > I'm creating a C# .net project, for a client. However they only have the
> > right to the binaries, not the source code. Is there a way to compile it
> > so
> > that I just give them dll's? or do they need the .aspx pages. I read
> > somewhere that I could probably make assemblies (excuse my bad
> > terminology)
> > of the source code, but that it is quiet easy to disassemble the
> > assemblies,
> > so that does not seem to afford read protection.
> > or am I just all confused over nothing!
> > thanks
>

newbie: ItemDataBound and XPath

hey

asp.net 2.0

I have a DataList which has a XmlDataSource as its data source.

This code crash because I use XPath in the ItemDataBound event:
protected void DataList1_ItemDataBound(object sender, DataListItemEventArgs
e)
{
Label label = (Label)e.Item.FindControl("lblTitle");
label.Text = XPath("title").ToString();
label = (Label)e.Item.FindControl("lblStory");
label.Text = XPath("description").ToString();
}

Any suggestion how this should be done in a ItemDataBound event?

Jeff"Jeff" <it_consultant1@.hotmail.com.NOSPAMwrote in message
news:eCAL$KttGHA.2160@.TK2MSFTNGP04.phx.gbl...

Quote:

Originally Posted by

hey
>
asp.net 2.0
>
I have a DataList which has a XmlDataSource as its data source.
>
This code crash because I use XPath in the ItemDataBound event:
protected void DataList1_ItemDataBound(object sender,
DataListItemEventArgs e)
{
Label label = (Label)e.Item.FindControl("lblTitle");
label.Text = XPath("title").ToString();
label = (Label)e.Item.FindControl("lblStory");
label.Text = XPath("description").ToString();
}
>
Any suggestion how this should be done in a ItemDataBound event?
>
Jeff
>

Jeff look at this sample here at:-
http://www.msdner.com/forum/thread467894.html
Patrick

"Jeff" <it_consultant1@.hotmail.com.NOSPAMwrote in message
news:eCAL$KttGHA.2160@.TK2MSFTNGP04.phx.gbl...

Quote:

Originally Posted by

hey
>
asp.net 2.0
>
I have a DataList which has a XmlDataSource as its data source.
>
This code crash because I use XPath in the ItemDataBound event:
protected void DataList1_ItemDataBound(object sender,
DataListItemEventArgs e)
{
Label label = (Label)e.Item.FindControl("lblTitle");
label.Text = XPath("title").ToString();
label = (Label)e.Item.FindControl("lblStory");
label.Text = XPath("description").ToString();
}
>
Any suggestion how this should be done in a ItemDataBound event?
>
Jeff
>

newbie: Problem with CreateUserWizard

Hey

Below is the source code of the CreateUserWizard placed on one my web pages
(asp.net 2.0).

The problem is that the AssignUserToRole method isn't triggered when
clicking on the finish button (that Images/Go.gif image).

So I'm wondering what I'm doing wrong here

******************* markup ********************
<asp:CreateUserWizard FinishDestinationPageUrl="~/Default.aspx"
ID="CreateUserWizard1"
Width="300px" runat="server"
LoginCreatedUser="false"
CreateUserButtonType="Image"
CreateUserButtonImageUrl="Images/Go.gif"
OnFinishButtonClick="AssignUserToRole">

<WizardSteps>
<asp:CreateUserWizardStep ID="CreateUserWizardStep1" runat="server">
<ContentTemplate>
<label for="Username">User name:</label>
<asp:TextBox id="Username" runat="server" />

<label for="Password">Password:</label>
<asp:TextBox id="Password" runat="server"
TextMode="Password" />

<label for="ConfirmPassword">Confirm
Password:</label>
<asp:TextBox id="ConfirmPassword" runat="server"
TextMode="Password" />

<label for="Email">Email</label>
<asp:TextBox id="Email" runat="server" />

<label for="Question">Security question:</label>
<asp:TextBox id="Question" runat="server" />

<label for="Answer">Security answer:</label>
<asp:TextBox id="Answer" runat="server" />

</ContentTemplate>
</asp:CreateUserWizardStep>

<asp:CompleteWizardStep ID="CompleteWizardStep1" runat="server">
<ContentTemplate>rrrr</ContentTemplate>
</asp:CompleteWizardStep>
</WizardSteps>
</asp:CreateUserWizard>

***************** AssignUserToRole code **********************
protected void AssignUserToRole(object sender, EventArgs e)
{
MembershipUser user = Membership.GetUser();
user.IsApproved = false;
MailMessage mail = new MailMessage("name@dotnet.itags.org.somewhere.domain", user.Email,
"Thank you", "Hello World");
SmtpClient smtpClient = new SmtpClient();
smtpClient.Send(mail);
mail.Dispose();
}

Any suggestions?I put the functionality into the CreatedUser event

Jeff

"Jeff" <it_consultant1@.hotmail.com.NOSPAMwrote in message
news:e7LUO45SHHA.920@.TK2MSFTNGP05.phx.gbl...

Quote:

Originally Posted by

Hey
>
Below is the source code of the CreateUserWizard placed on one my web
pages (asp.net 2.0).
>
The problem is that the AssignUserToRole method isn't triggered when
clicking on the finish button (that Images/Go.gif image).
>
So I'm wondering what I'm doing wrong here
>
******************* markup ********************
<asp:CreateUserWizard FinishDestinationPageUrl="~/Default.aspx"
ID="CreateUserWizard1"
Width="300px" runat="server"
LoginCreatedUser="false"
CreateUserButtonType="Image"
CreateUserButtonImageUrl="Images/Go.gif"
OnFinishButtonClick="AssignUserToRole">
>
<WizardSteps>
<asp:CreateUserWizardStep ID="CreateUserWizardStep1" runat="server">
<ContentTemplate>
<label for="Username">User name:</label>
<asp:TextBox id="Username" runat="server" />
>
<label for="Password">Password:</label>
<asp:TextBox id="Password" runat="server"
TextMode="Password" />
>
<label for="ConfirmPassword">Confirm
Password:</label>
<asp:TextBox id="ConfirmPassword"
runat="server" TextMode="Password" />
>
<label for="Email">Email</label>
<asp:TextBox id="Email" runat="server" />
>
<label for="Question">Security
question:</label>
<asp:TextBox id="Question" runat="server" />
>
<label for="Answer">Security answer:</label>
<asp:TextBox id="Answer" runat="server" />
>
>
</ContentTemplate>
</asp:CreateUserWizardStep>
>
<asp:CompleteWizardStep ID="CompleteWizardStep1"
runat="server">
<ContentTemplate>rrrr</ContentTemplate>
</asp:CompleteWizardStep>
</WizardSteps>
</asp:CreateUserWizard>
>
***************** AssignUserToRole code **********************
protected void AssignUserToRole(object sender, EventArgs e)
{
MembershipUser user = Membership.GetUser();
user.IsApproved = false;
MailMessage mail = new MailMessage("name@.somewhere.domain", user.Email,
"Thank you", "Hello World");
SmtpClient smtpClient = new SmtpClient();
smtpClient.Send(mail);
mail.Dispose();
}
>
Any suggestions?
>
>