Question

I have a question… I am creating a software for my (last year) school project. The project will be a mix of Steam, App Store and Ubuntu Software Center, where everyone can download games, create and publish them (free or not), synchronize their music and listen everywhere and more…

The problem is, I have to deal with 2 (for now) important types of data that only I can view, I am talking about the sql code (to check if the user can or not download something if he has already pay for it for example) which involves connections to my personal Sql Server, and the payments (Receiving and Sending money using paypal…).

But if I make the code, and then put it online anyone can use the code to change it, improve it etc.. (which I want!), or, to change the structure so he can have free stuff without paying or sending a lot of spam or even fake stuff with virus (which I don’t want)…

Is there a way to make the two work together :S ?

Thanks in Advance,
Luis Da Costa

Answer 1

To solve the issue of keeping personal info in the application, here’s what you do:

1. Factor all the personal/sensitive info into some kind of config/settings file
2. Create a file that is an example of a config file and call it <realfilename>.sample
3. Use whatever version control system you’re using’s mechanism to ignore the actual config file (e.g. put it in your .gitignore, .hgignore, etc.)

That way, people that want to use your application on their own server won’t have access to your personal info but can still know how to run their own version of the application.

As for your concerns about people writing malicious code, this is unlikely, especially if you watch what code is going in to your codebase. It should be pretty easy to recognize malicious stuff (if someone ever tries, which is unlikely). If you’re concerned about people altering their clients, then you’ll need to implement some checks to make sure the client is plain-vanilla.