Hiding the database from people

[patbucks]

Hi,
I'm developping an application with MS sql express.
I have about 20 tables that are all normalized.

I'm going to sell my application and I would like to make sure that they don't have access to my database after I sold the app.

Is there a way to encrypt all the database or to hide all the table structure to everyone?

I though I could configure my install package so it creates all the table in the database and then change the admin password and make sure nobody can browse my data, but is there an easier way?

 

[onpnt]

If you sell it then why are you worried about them messing with the database? Just make sure the agreements are in place so if they mess it up you are not responsible along with all the other legal corners are covered on them reselling etc..

_{____________ signature below ______________
You are a amateur developer until you realize all your code sucks.
Jeff Atwood}

 

[SQLSister]

I personally would never consider buying an application where I as the dba did not have access to the data. Yes, you can make the average user not have access, but the dbas need that access to do their jobs.

Questions about posting. See faq183-874

 

[SQLBill]

One thing to check on....I believe SQL Express is free unless you include it as part of an application that you then sell. You might want to check the licensing with Microsoft.

-SQLBill

Posting advice: FAQ481-4875

 

[onpnt]

No ties come with SQL Express

Microsoft SQL Server 2005 Express Edition with Advanced Services is a new, free, easy-to use version of SQL Server Express that includes more features and makes it easier than ever to start developing powerful data-driven applications for web or local desktop development.

There are no redistributable issues that I have ever read or heard of either with any express version. I would venture to say that includes sybase, oracle and the lot of them

_{____________ signature below ______________
You are a amateur developer until you realize all your code sucks.
Jeff Atwood}

 

[patbucks]

Well, it's great to konw what you all think about my issue.
But I do not want them to know how the database is build, it will be easy to copy it and do an other app based on my database schema.

I want to know how to hide the database from everyone so only my program can access/see it.

Anybody know how to do that?

 

[SQLBill]

Onpnt,

You said:

There are no redistributable issues that I have ever read or heard of either with any express version.

MSDE DID require registration to be able to redistribute it.

Can I include and redistribute MSDE as part of applications that I develop?

Yes, you can register to receive free redistribution rights for MSDE

ref:

http://www.microsoft.com/sql/prodinfo/previousversions/msde/msdeuse.mspx

So, yes, you could redistribute it for free, but first you had to register with Microsoft. I haven't found anything that says this for Express, but then I really haven't looked either.

-SQLBill


Posting advice: FAQ481-4875

 

[SQLBill]

patbucks...

If you remove Builtin\Administrator and SA logins (by using Windows Authentication only), then permit only your application to have access - that MIGHT resolve the issue.

Normally, people create views on the database and set their application to only use those views.

Give someone Visio Pro and your application login and they MIGHT be able to diagram the database.

What's to stop your client from stopping services, copying the .mdf/.ldf files, moving them to another SQL Server, attaching them, adding permissions, and viewing the database structure?

-SQLBill

Posting advice: FAQ481-4875

 

[onpnt]

Express versions meaning other database servers.

Yes I know of the redistributable registration. You seemed to have implied that it was only free unless....but not always free.

Point of the matter is this topic is side by side with hiding source code. If you are concerned about this type of issue you need to seek legal council regarding copywriting and such.

SQLSister brings up a valid point you need to consider. I don't know of anyone good enough to create a self healing database or one that can expand seamlessly without intervention by an administrator. You may creating a downfall for yourself before you start.

_{____________ signature below ______________
You are a amateur developer until you realize all your code sucks.
Jeff Atwood}

 

[patbucks]

Hi guys, thanks for you information.

I could give you a list of more then 100 apps that uses differents kind of database, and hides there data structure.

You have to be able to hide my data structure, if they want services on there database they will have to ask my company to do it.

As an analyst programmer if I could see the data structure of other apps, I would be able to design a new apps base the that structure. It would be very easy, specially if the database is very well normalized, it will be a piece of cake to rebuilt a new database and a new apps base on the nice model provided buy the copany that doesn't hide its data structure.

What's to stop your client from stopping services, copying the .mdf/.ldf files, moving them to another SQL Server, attaching them, adding permissions, and viewing the database structure?

I just want to have a data structure hidden from the user. I don't want them to see the tables. Maybe the only way to do that is to not use MS slq express.
So far I'm avoiding creating stored procedure and doing the relation in MSSQL. The apps will manage all that by it self.

Point of the matter is this topic is side by side with hiding source code. If you are concerned about this type of issue you need to seek legal council regarding copywriting and such.

I'm not sure what you mean here?
It's easy to protect copyright from people in USA, but try having your rights respected in Russia, or Africa?
The best proctection for your software is to hide the source code...

I doesn't look like it's possible in MSSQL express...

 

[AlexCuse]

If your tables are well normalized as you say, then I think any developer worth their salt is going to be able to figure out your data structure anyway. And they will have more motivation to write their own version, because they don't want to have to put up with your hidden database nonsense. No matter how well your source code and data structure are hidden, a good developer will be able to copy your app. What you need to do is make it good enough, and easy enough to use, that they do not want to.

Just a thought,

Alex

Ignorance of certain subjects is a great part of wisdom

 

[onpnt]

I think all the top MVPs in this forum which leaks into some of the most highly respected people in our development community in all have stated their 2 bits on how bad this idea is.

Performance will be shot
It is futile if someone can surf the web they can get it
and on....

To answer the question directly; Yes, SQL Server and any other structure can be encrypted. I just googled it and received 1,080,000 hits. I suggest you start there.

Good luck on you application

_{____________ signature below ______________
You are a amateur developer until you realize all your code sucks.
Jeff Atwood}

 

[onpnt]

Also, please do not double post. Seems you're going into the same topics here

http://www.tek-tips.com/viewthread.cfm?qid=1376538&page=1

_{____________ signature below ______________
You are a amateur developer until you realize all your code sucks.
Jeff Atwood}

 

[patbucks]

Also, please do not double post. Seems you're going into the same topics here

http://www.tek-tips.com/viewthread.cfm?qid=1376538&page=1

Sorry but they were asking questions and I had to explain the reason why I didn't want to go with stored procedure.

If your tables are well normalized as you say, then I think any developer worth their salt is going to be able to figure out your data structure anyway. And they will have more motivation to write their own version, because they don't want to have to put up with your hidden database nonsense. No matter how well your source code and data structure are hidden, a good developer will be able to copy your app. What you need to do is make it good enough, and easy enough to use, that they do not want to.

I really don't understand why you are saying it's a none sence. Look at

http://www.microworks.com,

http://www.simplyaccounting.com,

http://www.speedlinesolutions.com,

http://www.sungard.com,

etc... All of these company uses Databases, some use index file, Oracle, fox Pro, etc...
None of these company provide direct access to there database. So these company are all nonsense?

I think all the top MVPs in this forum which leaks into some of the most highly respected people in our development community in all have stated their 2 bits on how bad this idea is.

Performance will be shot
It is futile if someone can surf the web they can get it
and on....

To answer the question directly; Yes, SQL Server and any other structure can be encrypted. I just googled it and received 1,080,000 hits. I suggest you start there.

I knew I could encrypt but I didn't want to go that route because of performance issue. All I want do to is hide the metaschema from unauthorize access. I don't want them to browse the table access it, see the relation etc... Without encrypting everything.

Can you explain why it is a bad idea to not grant access to you data structure for copyrights reason? And why there is so much company doing it?

The tek-tips forum is not only for open source apps, I just want to do an app that I'm going to sell. And I wanted some information about data structure and preventing access to it, that's all.

 

[LNBruno]

Encrypt XML.

< M!ke >
Acupuncture Development: a jab well done.