https://bugs.freedesktop.org/show_bug.cgi?id=78862

--- Comment #3 from Ralf <[email protected]> ---
I focus the following discussion on topic "a) Secure cell protection with
strong encryption" and structure my contribution along these sections:

1. Demand for solutions
2. Feasible solution is add-on rather than change of concept
3. Commercially viable development set-up

1. Demand for solutions

Currently workaround solutions do not exist for LibreOffice and ODS files. Of
course encrypting a disk, a file container or a file can result in high data
security for the encrypted spreadsheet as a whole. However, there are
situations when one wants to distribute a spreadsheet but when one wants to
hide or protect some or all formulas in the spreadsheet, so that the suggested
method to encrypt a disk does not help. The main area of concern for partial
file encryption is protection of intellectual capital. Another example is
protection of confidential business information, which is required in the
calculation procedure.

An internet search about hiding and protecting cells and formulas in
spreadsheets shows the high level of interest in the topic. Such an internet
research also reveals that only a minority seems to be aware that common
spreadsheet applications "protect" the cells with a password, but that a
serious security level is not provided.

An OpenOffice.org forum discussion about "Calc How to Protect & Secure
Documents" (thread from Oct 2010 until Feb 2011,
http://www.oooforum.org/forum/viewtopic.phtml?t=108588) provides some (partly
outdated and incomplete) information about solutions offered in the market.
Unfortunately, these solutions and also other searchable solutions rely on
Excel and work as add-ins to Excel.

The high coverage of the topic in the internet and the existence of a market
for commercial solutions show the demand for such security features.

2. Feasible solution is add-on rather than change of concept

I agree that a solution is hard to accomplish and conveys complications for
interoperability if one wants to change the current concept of cell protection.
However, one can consider an additional layer similar to the different add-in
solutions for Excel. Then interoperability is not an issue anymore. I also
consider solving the problem more practicable. At least there is a sort of
proof of concept due to the different add-in solutions for Excel.

Most Excel add-ins produce an executable file. Cell entries can be changed, but
formulas are not visible anymore. Such solutions lock all formulas irrespective
of the specific cell protection status.

A more flexible solution relies on macro programming. This approach can result
in strong encryption in line with the cell protection selected for each cell
individually. A third-party vendor offers such a solution for Excel
off-the-shelf.

An implementation could be part of the general LibreOffice code. It could also
be a LibreOffice Extension, which is probably easier to develop due to its
independence from the general code.

3. Commercially viable development set-up

I understand the suggestion to pay for the development of commercially
interesting enhancements of LibreOffice. However, my enterprise takes a
different route. Switching to Excel and purchasing a commercially available
off-the-shelf security add-in solution is far more economical than paying for
the development of a security mechanism for ODS files and LibreOffice.

Nevertheless I consider the development of such security tools as a business
opportunity for a developer, for a group of developers or for a company, which
already operates in the LibreOffice environment. An extension could be marketed
similarly as the add-in solutions for Excel based on license sales. As
LibreOffice has grown considerably, the market size could be sufficient for a
LibreOffice/ODS product.

-- 
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
Libreoffice-bugs mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs

Reply via email to