Question security (1 Viewer)

[mpj]

Hi people,

I'm new to Access and sorry if this is a newbie question but I'm migrating from Excel in an attempt to get a little more security.

I intend to transform a calculation system, originally developed in Excel, and add new functionalities.

It is a calculation oriented system so the database part "does not" have sensitive content.

The most important is the actual code!!!

So, I question if simply publishing my file in .accde format I guarantee the security of my code or can I still have problems?

 

[theDBguy]

Hi. As long as you put all your calculation code in a module, creating ACCDE file should keep them secured.

 

[plog]

What is your definition of "security"? What are you afraid of occuring?

 

[Pat Hartman]

You can prevent people from accidentally changing things but no Access app is ever actually secure in the larger sense. After compiling to .accde, you should also rename the file to .accdr. This tells Access to pretend to be the Access Run Time so no one can even get to the navigation pane to open objects. Of course, the user can rename back to .accde and that gives them access to tables/queries/macros.

Your app should use a menu or switchboard to guide all actions so users only get to interact with forms and reports.

 

[mpj]

What is your definition of "security"? What are you afraid of occuring?

I'm afraid that someone will be able to access the forms and modules and see my codes.

That's why I asked if my file in .accde format would protect my application or if for an advanced user, for example, this wouldn't be an impediment.

 

[theDBguy]

I'm afraid that someone will be able to access the forms and modules and see my codes.

That's why I asked if my file in .accde format would protect my application or if for an advanced user, for example, this wouldn't be an impediment.

Basically, if you create an ACCDE, no one should be able to see any code in a module. However, they can see the code in macros.

 

[isladogs]

Have a look at the info in my two part article:

Improve Access Security

This article summarises some of the main steps that developers should take to improve security in Access databases

www.isladogs.co.uk

The second part is a detailed tutorial and includes a sample database that you can use for testing purposes.
However, whilst you can lock down your database reasonable securely for most purposes, no Access database can ever be 100% secure from a skilled and determined hacker.

 

[Pat Hartman]

I'm afraid that someone will be able to access the forms and modules and see my codes.

Why do you care if they see your code (not codes)? Unless you are selling this application, all you need to worry about is preventing accidental modifications.

 

[GPGeorge]

Hi people,

I'm new to Access and sorry if this is a newbie question but I'm migrating from Excel in an attempt to get a little more security.

I intend to transform a calculation system, originally developed in Excel, and add new functionalities.

It is a calculation oriented system so the database part "does not" have sensitive content.

The most important is the actual code!!!

So, I question if simply publishing my file in .accde format I guarantee the security of my code or can I still have problems?

PMFJI: "Guarantee" is too strong a word, in any event. You can make it harder to steal your code, using the methods Colin suggests. Guarantee? Not possible.

BTW: Who are you worried about possibly wanting to steal your code?

 

[mpj]

Basically, if you create an ACCDE, no one should be able to see any code in a module. However, they can see the code in macros.

Thanks.

 

[mpj]

Have a look at the info in my two part article:
Isladogs.co.uk/improve-security/index.html

The second part is a detailed tutorial and includes a sample database that you can use for testing purposes.
However, whilst you can lock down your database reasonable securely for most purposes, no Access database can ever be 100% secure from a skilled and determined hacker.

Thank you for the link.

 

[mpj]

Why do you care if they see your code (not codes)? Unless you are selling this application, all you need to worry about is preventing accidental modifications.

That's my intention for the future.

 

[mpj]

PMFJI: "Guarantee" is too strong a word, in any event. You can make it harder to steal your code, using the methods Colin suggests. Guarantee? Not possible.

BTW: Who are you worried about possibly wanting to steal your code?

Mu intention for the future is to sell my system, so...

 

[Pat Hartman]

I have an Access app that I sell. It is rationally secured but Access files can always be broken so I don't believe it is actually safe. The product is semi-custom and the clients are large companies and they sign contracts. Even that isn't sufficient. We have no way of knowing if a company decides to crack our code and build their own version of the app. The data is theirs so we don't make any effort to hide the schema. Besides, most clients choose the SQL Server BE rather than the ACE BE so clearly, they have access to the schema and that is the heart of the issue.

Access is a poor choice for a shrink-wrapped product. There are too many installation issues when you have no control over the environment.

 

[KitaYama]

I've always wondered what the law says in cases like this.
In my profession, if we sell something, the drawing belongs to the customer not to us. Because they've ordered something, we have made the order and they have paid for it. (again in my profession : Manufacturing)

Just like a house. When we buy a house, the electric drawing, the construction drawing and any other details about the house belongs to us.

What about a software? If I order a software and someone make it for me, does the code belong to me or not?

Note: I think the code of a commercial software sold in market, doesn't belong to me. It's not written for me. I simply purchase something available.

 

[moke123]

I think that has to be spelled out in the contract. Who owns it and who has license to use it.

Many years ago my company partnered with a software company to develop a new system. While it was custom built for us, it was the software companies intention to market it to others. We were essentially their guinea pigs but in the long term we had no residual license fees.

 

[Pat Hartman]

You can patent your code but not the idea of the app. So, if someone were to steal the code and then sell it, that would be a violation but if they were to steal the "idea" but built the product themselves, you wouldn't have any recourse. If they were to steal the code and reuse it internally, you probably wouldn't have any way of detecting that.

 

[CJ_London]

It also depends under what conditions the app was built and the law of the land where you are.

I intend to transform a calculation system, originally developed in Excel, and add new functionalities.

If this transformation is being done during your employers time and therefore at their expense or you are being paid by someone to create the code, then technically the code belongs to them and not to you.

It is a grey area but it can also be argued that if the excel app was developed by your employer or others and you are simply 'translating' it to work on a different platform then they will have some rights over the new app, particularly if you do not have the skillset to have developed those algorithms/calculations originally and they are not in the public domain. It is one of the reasons you will see copyright notices all over complex working code examples you can find on the net, usually accompanied with a license setting out the terms under which it can be used.

@moke123 - hope your company had a good discount for acting as guinea pig!

 

[oleronesoftwares]

What about a software? If I order a software and someone make it for me, does the code belong to me or not?

If there was an agreement prior to sales, that the software developer will hand over the source code to the company then it belongs to the company, if not it belongs to the software developer.

 

[KitaYama]

If this transformation is being done during your employers time and therefore at their expense or you are being paid by someone to create the code, then technically the code belongs to them and not to you.

I doubt about it. Or at least it's different on this side of the ocean.

It's a famous story. A guy was employed in a company for more than 20 years as a researcher in a company. Finally he and his team developed the first blue LED light. All of a sudden, the company's stock went sky high.
The company paid more than a million dollar to each member of the team as a bonus for their hard work. But for the team's members, it wasn't enough.
The leader sued the company and asked for 5% of the whole blue LED income.
the company claimed they have paid them for more than 20 years without any result, all the expenses of those long years have been on the company, it's been their job to do what they did and a lot of other reasons.

To my surprise, the guy won and the company was ordered to pay an enormous amount of money, but not 5% of the whole income.
For the judge, it has been the hard work of the team that brought that success. And even if it's been their job and they have been paid, there are so many others that couldn't do what they did.