I am in the conceptual phase of a .net web application project and have some concerns over the end users reverse-engineering what I am building. I would, of course, like to prevent this from happening.
My client will sell this product to their clients. They currently have about 50 organizations that they will sell it to, but this number could grow significantly. At each organization, there could be anywhere from 10 to over a hundred users, all accessing this thing simultaneously.
I will develop he product using .NET, SQL Server 2000, and Crystal Reports. There are basically two options for the overall architecture that I can think of. I am, of course, very open to any other (better) suggestions.
The first option is to host the entire thing centrally, using a single web server with the .NET aspx pages (and other associated files of course) with either a single high-end SQL Server box or clustered servers if it becomes necessary. I dont have too many concerns over reverse-engineering with this option, since I could build most of the logic into stored procedures that the end users could not see. The advantages that I could see would be the difficulty of reverse engineering, ease of updates, and eliminating the possibility of end users being on different versions. The disadvantages would be more development time (though not a lot more) and the much greater hardware and bandwidth requirements (the bandwidth mostly needed to run large reports frequently by many users at once).
The second (more likely) option that I can imagine is to provide each of their organizations with a SQL Server box and a web server that has everything loaded on it and they can take it back to their site and be up and running. The advantages would be that we wouldnt need superpowered servers to handle all of the processing and we could make money on the bundled hardware, networking, and services associated with them. Some disadvantages would be more difficult updates and troubleshooting bugs (would need to collect data to reproduce problems from time to time Im sure).
What really concerns me about this option is that they would, of course, have access to the database, along with the table designs, stored procedures, DTS packages, etc. etc. Would you suggest building more of the logic into the .NET web files and compiling them somehow (is this even possible? Modules? Classes? I am relatively new to .NET development).
I really appreciate any help and advice that more experienced developers could offer to me. This decision will obviously greatly impact how I develop this thing, so thanks so much in advance for any help that you can offer!
