I have very little experience with web development, so my question might be a bit naive. Basically, I have developed an algorithm that several potential clients would like to try out. I see two possible roads to go down: the first is the provide them with trial software that would 'expire'. I don't like this for two reasons: first, I have no experience in this field. Second, I want to keep the algorithm on my end. The second possible road would be to develop a web page, that allows clients to log in and test out the algorithm by inputting their own data. This would definitely be the way to go -- except for a full-on business, I don't have the expertise to develop a secure, stable, and well-designed website. I would need to out-source that task. Except I don't want to outsource the implementation of the algorithm itself. I know that I could get the implementer to sign a legal document ... blah blah blah ..., but I would be much more content if I could somehow package the algorithm into a shared library of some sort that he could link to when he needs to make function calls. That way I can provide an API for him to implement with while keeping the 'real' algorithm hidden. So my question is, is there anyway to do this in web programming? Can I write a &#106avascript library, or something like that? How can I keep the algorithm well hidden to the outside, as well as developers. What security precautions should I take? What kind of permissions do I have to set on the files themselves to prevent the shared library from being used besides anything but the calling script? Assume I have absolutely zero knowledge of security. Thanks for the advice! Corey

Quote:Original post by visage
So my question is, is there anyway to do this in web programming? Can I write a &#106avascript library, or something like that?

Java, Adobe Flex and Silverlight all come to mind. JavaScript is a no-no; the source has to be available to the browser for it to run.

Quote:Original post by visage
So my question is, is there anyway to do this in web programming? Can I write a &#106avascript library, or something like that? How can I keep the algorithm well hidden to the outside, as well as developers. What security precautions should I take? What kind of permissions do I have to set on the files themselves to prevent the shared library from being used besides anything but the calling script?

Since &#106avascript normally is used as a client side scripting language, including it in a web page will automatically distribute the algorithm to anyone who uses it, not just the developer. Secondly, no matter how much you obfuscate it, it can always be reverse engineered quite easily.<br><br>Writing and compiling a .Net library that can be linked (server-side) to the developer's web project would be much nicer, however it can be still decompiled/reflected by anyone who has access to it (in this case &#111;nly the web developer).<br><br>I guess you could create a web service that &#111;nly exposes a call to a function that returns the result of using your algorithm, but not the code of the algorithm itself. This could be done in many technologies, but I personally I would prefer a .Net solution.<br><br>Summarizing: if you're going to distribute something, you'll always run into the risk of someone 'hacking' it. You can make it harder &#111;n them by compiling/encrypting/obfuscating it, but will never be a hundred percent secure. It isn't really a web development specific problem in that respect.

Looks like Java or .NET would be the way to go here. I assume .NET would require a windows server...

I don't even know what I should be googling here for tutorials in this area. Any recommendations, for either the Java or .NET way?

Thanks for the help so far.

Since I am trying to only expose the front-end to clients, as well as my web developer, does Ruby on Rails seem like an appropriate solution? I have experience with it, and it just struck me that I might be able to hide my algorithm within the MVC paradigm...

Technically, you could write it in any language and have the http server (apache or lighttpd) listening to the app on a given port. the advantage here is you can code it in any language you like, and communicate with the web server in a protocol they can both understand (HTTP).

Edit: whoops. seems Sander has said more or less the same thing above me :P