Compiler Switch - Helping Against Decompilation

I have VS.net 2003 standard.
I think vs.net 2003 architect have a tool for protect your assembly

Hm, anything you know of that's freewareish?  My budget is ... $0 dollars. Heh.

 - Joe

Dotfuscator can be found in your Visual Studio Tools menu, if you have Visual Studio installed on your machine.

Farshid

I only own the standard editions of C#, VB, and C++.  I was going to purchase the professional edition, though now VS 2005 will be out soon, so I'm just going to wait for that.

Dotfuscator is not listed in the tools in the VS Standard Editions.

 - Joe

Realize, though, that obfuscation just makes it harder, not impossible to read your code.  Also, there are some circumstances where obfuscation is undesirable:

Debugging
Obfuscated code is extremely difficult to debug. Variable names will no longer make sense, and the structure of the code itself will likely be modified into unrecognizability. This fact generally forces developers to maintain two builds: One that can be easily debugged, and another for release. Both builds should be tested to make sure they act identically.

Defective obfuscators
Occasionally an obfuscator may be buggy, in a difficult to reproduce way. There is little one can do except find a newer version or fiddle with any inputs to the obfuscator until it works.

Bob

Also, why is it a problem SECURITYWISE? If seeing your code exposes a security risk, you code is not well done, and no obfuscator will change that. Apart from that, obfuscated code may also break due to reflection usage, because the names of your objects will change.

This is for a ASP.NET application, which I have to have the connection string for the database in the program.  I have the string encrypted, though if the DLL is downloaded the entire application could be at risk.  I was just looking to see if anything was out there.  The security risk is overall minimal, though nearly completely compromised if it is taken.

I'm building a ASP.NET E-Commerce application, so I'm trying to see how I can best protect the application.  If obfuscator is the only option, then I guess I can either take the risk (Which overall is minimal, because they'd have to hack the server ... which isn't impossible, but fairly rare) or see if I can talk the boss into purchasing the program.

I'm confident in the hosting company I'm with, though like I said ... any more security I can put in on my part I'm trying to do.


 - Joe

Why do you need a full connection string anyways? Can't you use SSPI integrated authentication? Because this would allow you to avoid the use of a username and password; I think this is the safest method for SQL connections.

AvonWyss,

No, this is on a remote shared hosting server.  I could only go that option if I had a dedicated server subscription.

 - Joe

Well, I will contact my hosting company and double check to see if this is available.  I would much prefer to go that option.  I just had thought it wasn't available from what I had read in their "Knowledge Base" FAQ.  Their only advise that I found was "Don't include a string litteral in your web.config file" for your connection string.

 - Joe

The author look for more comments, but my first answer  tell him what he need.

There were suggestions and valuable information in this Q, I don't think that delete is appropriate - and neither points refunded.