#🔒 Desktop Application Security

36 messages · Page 1 of 1 (latest)

late marsh
#

Hello im working on a desktop application that I wish to publish but I don't want people easily to just reverse engineer my code if they really wanted to. I was thinking about python both frontend and backend. And for obfuscation using pyarmor Pro with Cython and pyinstaller for the executable. As well as paying for a azure signing certificate for trust. Do you generally think thats enough for commercial or do I need more security? I get that nothing will be secure 100% but I just dont want the average person to just steal my code simply... I do plan to implement a paymention option for some services within it as well. Any opinions or input on if im going the right direction?

agile vigilBOT
#

@late marsh

Python help channel opened

Remember to:

  • Ask your Python question, not if you can ask or if there's an expert who can help.
  • Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
  • Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.
vast spade
#

how is a signing cert going to help against reverse engineering?

late marsh
#

Not for that reason just for trust against virus detection

vast spade
#

right

#

well, you have already found the best tools in the trade

lethal bay
late marsh
#

I keep getting told that it should be done in like Java or C++ just because its more frownd upon doing it in python for desktop apps but I really dont get why..

vast spade
#

I have mixed experiences distributing Java desktop apps

late marsh
#

Care to share so I could understand?

vast spade
#

the story isn't really better than Python

#

well, I built and maintained an ERP app with a desktop client for several years

#

the client was Java

#

granted, the installation required users to install a JRE

#

that can be avoided but it means shipping a JRE with every installer

late marsh
#

gotcha

vast spade
#

and signing became a requirement later in the game, not by me or the customer but by the JRE itself

#

even then we saw some really bizarre issues that were not reproduceable across all machines

#

I would not go that route if I had to make an app like that again

late marsh
#

haha, makes sense. But why are some against python specifically for distribution?

vast spade
#

ignorance, perhaps?

late marsh
#

My guess too. I just couldnt find anything concrete myself

vast spade
#

Ren'py apps are good examples of well-planned Python distributable apps

#

they "just work" in my experience, and the Python stuff they come with is pretty non-intrusive

#

Nuitka is an alternative but I have mixed experiences with that – don't try a full compilation!

late marsh
#

I prefer python backened just because for this specific purpose of the app its not crazy complicated and I would like it done pretty fast honestly so python was my go to. However GUI side I used Qt framework but again its not crazy good compared to like what Java or C++ have to offer but its good enough..

vast spade
#

PyInstaller is the "safe" alternative

#

Qt is probably the best overall desktop UI framework out there

late marsh
#

Yea and after all of that thinking my last thought was just security considering I know how other covnert to binaries and stuff. Wasn't really sure how pyinstaller and others worked

#

Thats why I wanted to assk about security wise.

vast spade
#

PyArmor probably has some good docs on this

#

they have a free version which you've probably tried already

late marsh
#

Yup they do. I just wanted to consult with someone else about it before i commit. I was sepcifically gonna use the pro version since its commerical use.

#

But thanks again for everything.

agile vigilBOT
#
Python help channel closed for inactivity

This help channel has been closed. Feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.