Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I would like to redistribute my app (PHP) in a way that the user gets the front end (presentation) layer which is using the API on my server through a web service. I want the user to be able to alter his part of the app but at the same time exclude such altered app from the normal support and offer support on pay by the hour basis.

Is there a way to check if the source code was altered? Only solution I can think of would be to get check sums of all the files then send it through my API and compare them with the original app. Is there any more secure way to do it so it would be harder for the user to break such protection?

share|improve this question

4 Answers 4

Nope, you cannot trust any data the client sends you. It can and will be spoofed.

Spending engineering time adding tests is a tradeoff vs what value you expect to lose from these modifications going undetected.

You should stipulate the modification terms in your license, and that should give you enough ground to act.

share|improve this answer

Is there a way to check if the source code was altered? Only solution I can think of would be to get check sums of all the files then send it through my API and compare them with the original app. Is there any more secure way to do it so it would be harder for the user to break such protection?

No, you can not trust the code metrics from client. Because, that code might be hacked/modified or spoofed during the transportation. Unless, your clients do not communicate with your API through trusted secure channels, there is no way to validate the authenticity of information.

Basically, you need to come up with securing your channel of communication through certificates or SSL, as well as identification/registration of client applications.

share|improve this answer
1  
Who's going to go to all that trouble? They're going to be found out anyway, if the application ever needs genuine support. –  Robert Harvey Dec 13 '12 at 19:50
    
I think you misunderstood my question I need a way to determine if the code was altered not to prevent it but because support of the altered app will not be covered by normal monthly fee. I'm aware that there will be no 100% bulletproof solution but something that would require some level of experience with the PHP to bypass would be sufficient. –  onlineapplab.com Dec 13 '12 at 20:18

A checksum / hashing algorithm like you're suggesting will work well enough.

It's not foolproof, as you suggest. But it doesn't need to be. The people who can "crack" the protection mechanism you're putting in place are the same people who won't be utilizing your hourly services for support.

All likely scenarios that involve support effort on your part will lead you to discovering the modified code. So I'd say that what you've suggested is sufficient. Go for it and give it a try.

share|improve this answer

Have you considered hosting the frontend on your servers, then accepting uploads from the client? That way you can keep a record of whether or not they've customized it by whether or not they've submitted an updated version, and you have the file locally to compare if it's ever in doubt.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.