15

I want to migrate my webapp from cloudfoundry to heroku. But there is still one thing i'm confused about.

Everytime you want to deploy your application to heroku, you've to push your source code to their git repository. How secure is this repository? What if i don't want to give my source code into someone others hands?

What's your opinion about that?

whitenexx
  • 1,350
  • 2
  • 25
  • 53
  • 1
    I assume cloudfoundry hosts your application, so you'll have to give them your source as well. So...? – Reactormonk Jun 20 '12 at 08:52
  • 1
    You may want to clarify your question with specific security concerns. Opinion-based questions are often closed. – David Cain Jun 20 '12 at 08:55
  • Are you afraid that the Heroku git repository would be public? I doubt that would be the case. – lanzz Jun 20 '12 at 08:59
  • 1
    At cloudfoundry: Your IDE compiles your source code and then pushes the bytecode (war file) to cloudfoundry. So cloudfoundry never has access to your source code. At heroku, you push your source code to heroku. Why should i trust the heroku employees? – whitenexx Jun 20 '12 at 09:42

3 Answers3

16

The Problem

You aren't understanding how interpreted languages or hosting providers work. If you're using an interpreted language like Ruby, you need to have your source on the service platform. Even if your code is compressed, obfuscated, or byte-compiled, it has to be on the service platform to be served up, so this is going to be a problem for you with any language or hosting provider.

You're also not understanding the nature of byte code. A byte code interpreter can read your files. In addition, there are Java decompilers out there to turn byte code back into source code. A search Stack Overflow will show you posts discussing Java decompilers. Unless you think "security through obscurity" is useful, you should probably stop thinking of your byte code as secure in any meaningful way.

The Solutions

  1. Build good software, run a good business, and don't lose sleep worrying about someone copying your for-loops. This is probably your easiest solution.
  2. If you don't trust hosting providers or co-location facilities, then you'll have to host your own files internally. Even then, you'll have to trust someone to maintain the systems, unless you plan to do it all yourself.
  3. Consider some tin-foil haberdashery.

Git repositories on Herku are not public repositories like you'd find on GitHub. It's no less "safe" than transferring your files around by any other means, and certainly more secure than the usual FTP uploads on many service platforms.

Security is always a trade-off. It's definitely important, but unless you've defined a better threat model than general distrust, you won't be able develop adequate controls.

Community
  • 1
  • 1
Todd A. Jacobs
  • 81,402
  • 15
  • 141
  • 199
  • Hi CodeGnome, thanks for your answer. I do understand how interpreted languages or hosting providers work. I should have said that i'm using a language wich gets compiled into bytecode for the jvm. I also know that a bytecode interpreter is able to turn the bytecode back to code but i think it's more complicated than the direct code access, because you need more knowledge for that. I also know that most git transfer goes over ssh connection so it's more secure than ftp. I think about cases when for e.g. heroku gets hacked and someone gains code access...with all comments + business strategy... – whitenexx Jun 20 '12 at 11:01
3

It depends

Cause to measure "security" you have to think about possible "risk". Is the investigation of stealing source code from such a platform worth the effort? So, how much value can people get from your source code?

I think nobody was really successful by simply stealing source code. It is more about stealing ideas. To maintain and extend code you have not written is hard. You will need time to get comfortable with the source code (month / years, depending on the code base). Loosing all this time and effort. Experts who learn faster can also start from scratch, maybe they will end up with a better result.

  • Facebook publishes strategies, papers and technological insights. A lot of Facebook copycats are around there, nobody cares.

  • Success with your business it is not only about software. Important parts are the brand loyalty/trust in your product, the user experience and the visible overall success.

  • Why is your source code so special compared to thousands of applications that are running on Heroku. It will be even hard to find your repository between all this nice stuff there. Things that will have success and some that will not, nobody knows.

But, if a few single technical algorithms are your core business (crypto software, graphic driver algorithms,...) and they are simply adoptable, it may be worth to steal it.

data vs. code

Things you can worry about: Where to store sensitive customer information? The most people have a much bigger interest in selling email addresses, phone numbers, names, financial information about your business and your customers. But,... If you have not enough sensible data, you are not interesting. So, does your application contain 100 million Sony Network credit card accounts? ;)

Okay, if the application contain all blueprints, data, secret ideas and designs of the IPhone 5 & 6 it may be also interesting.

Community
  • 1
  • 1
Martin K.
  • 4,669
  • 7
  • 35
  • 49
  • Yes, "it depends" sounds good. For some people there might be an interesting algorithm in your source code (for example the google ranking algorithm) and for some not. Decompiling the google search engine would be fine, or not? ;) Last but not least, there is no way to make your software 100% secure against stealing or copying. It depends about your reach and brand how long you can be on the market. So i'll push my code to heroku. ;) – whitenexx Jun 21 '12 at 09:45
2

You are using somebody's service to run your app. There's no way to do that without giving your code to them, no matter what service you use. Even if you forget about the cloud and colocate your own server, it will still be in the hands of the people running your data center.

lanzz
  • 42,060
  • 10
  • 89
  • 98
  • At cloudfoundry: Your IDE compiles your source code and then pushes the bytecode (war file) to cloudfoundry. They never have access to my source code, only to bytecode. – whitenexx Jun 20 '12 at 09:43
  • 4
    You are wrong (or Richard Stallman and his whole Idea about free software). You really think that there is no difference between sourcecode and compiled executables? Cause there are decompilers?,... If you want somebody your app to run, you have simply to give him your app. No sourcecode needed, or do you have the Windows Sourcecode? – Martin K. Jun 21 '12 at 08:55