Secure application code from host

2014-01-28 Thread Richard White
Hi, We have an online web application built using CF. We completely host and manage our software and provide users with an annual subscription. A large client would like to use the software in a country that has limited internet connection. Therefore, we have the possibility of providing them

Re: Secure application code from host

2014-01-28 Thread Russ Michaels
CFML can be encoded, which will be sufficient to stop the average person. If you want to go a step further then you can compile your app down to class files and only distribute those. On Tue, Jan 28, 2014 at 11:46 AM, Richard White rich...@re-base.net wrote: Hi, We have an online web

Re: Secure application code from host

2014-01-28 Thread Ricardo Russon
This might get you in the right direction. http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=deploying_5.html On Tue, Jan 28, 2014 at 9:46 PM, Richard White rich...@re-base.net wrote: Hi, We have an online web application built using CF. We completely host and manage our

Re: Secure application code from host

2014-01-28 Thread Steve 'Cutter' Blades
It is possible to compile your application down to a deployable WAR file. Steve 'Cutter' Blades Adobe Community Professional Adobe Certified Expert Advanced Macromedia ColdFusion MX 7 Developer http://cutterscrossing.com Co-Author Learning Ext JS 3.2 Packt Publishing 2010

Re: Secure application code from host

2014-01-28 Thread Byron Mann
I would suggest working with an attorney to make sure you have a proper licensing agreement in place. While I've never had occasion to package a CF app as a WAR, I doubt it obfuscates the classes. So it too would be easily decompiled. I searched around and this seems to be a somewhat popular

Re: Secure application code from host

2014-01-28 Thread Jochem van Dieten
On Tue, Jan 28, 2014 at 2:35 PM, Byron Mann wrote: While I've never had occasion to package a CF app as a WAR, I doubt it obfuscates the classes. So it too would be easily decompiled. But it would be decompiled to Java,. And that Java bears absolutely zero resemblance to the original CFML.

Re: Secure application code from host

2014-01-28 Thread Richard White
Thanks guys for your suggestions, i will take a look into your suggestions. BW Richard Hi, We have an online web application built using CF. We completely host and manage our software and provide users with an annual subscription. A large client would like to use the software in a

Re: Secure application code from host

2014-01-28 Thread Cameron Childress
On Tue, Jan 28, 2014 at 8:35 AM, Byron Mann wrote: I would suggest working with an attorney to make sure you have a proper licensing agreement in place. An attorney who understands IP law in this country without internet. -Cameron -- Cameron Childress -- p: 678.637.5072 im: cameroncf

Viviotech?

2014-01-28 Thread Money Pit
Anyone hear anything from them? They've been completely off the air for about an hour. Fast busy signal on the phone. Was originally just 'busy' so I'm wondering if someone got thru to them before the phone went down. -- --m@Robertson-- Janitor, The Robertson Team mysecretbase.com

Re: Viviotech?

2014-01-28 Thread Kelly Matthews
I think they had some issues. Several of my sites went down, also I think their support number is tied to their network so if the network goes down so do their phones. If that's still the case, I really wish that's something they would fix, it's my only gripe. :) However, my sites seem to be

Re: Viviotech?

2014-01-28 Thread Money Pit
Yup sure enough mine just came back up too. I've noticed the same thing over the years, re: the phones go down when they do as they're all on some sort of shared platform. I have two VPN's with them and talked to a colleague; we were all down so whatever it was it was widespread. --

Re: Viviotech?

2014-01-28 Thread Wil Genovese
I was on the phone with Vivio. The claim there was or is some sort of DDOS against one or more of the sites hosted there. We have a client that has been down for about at hour at Vivio and SSH to their server is essentially not possible. Wil Genovese Sr. Web Application Developer/ Systems

Re: Viviotech?

2014-01-28 Thread Jon Clausen
Looks like it was an exploit on some servers which use KloxoCP: https://twitter.com/VivioSupport/status/428245229737492480 that affected the whole network. On Jan 28, 2014, at 2:16 PM, Money Pit websitema...@gmail.com wrote: Yup sure enough mine just came back up too. I've noticed the

Re: Viviotech?

2014-01-28 Thread Jordan Michaels
I think they had some issues. Several of my sites went down, also I think their support number is tied to their network so if the network goes down so do their phones This used to be true but thankfully it's no longer the case. Vivio's VOIP system now has backup POTS lines that are used

Re: Viviotech?

2014-01-28 Thread Wil Genovese
Those files were then hit remotely and caused the exploited servers to send massive amounts of ARP requests off to an IP belonging to Chase bank. I never did trust Chase! :D BUT! This is interesting to note. If the IP really belongs to Chase as in inside Chase then what exactly at Chase

Re: Viviotech?

2014-01-28 Thread Kelly Matthews
Cool thanks for the clarification Jordan I wasn't sure about the phones! :) On 28 Jan 2014, at 17:53, Jordan Michaels wrote: I think they had some issues. Several of my sites went down, also I think their support number is tied to their network so if the network goes down so do their phones

Re: Viviotech?

2014-01-28 Thread Jochem van Dieten
On Tue, Jan 28, 2014 at 11:53 PM, Jordan Michaels wrote: A 0-day (previously unknown) exploit was used against the Kloxo control panel to upload malicious php files to the kloxo default site. Those files were then hit remotely and caused the exploited servers to send massive amounts of ARP

Re: Viviotech?

2014-01-28 Thread Russ Michaels
perhaps this will help. http://www.watchguard.com/infocenter/editorial/135324.asp although in general ARP attacks happen within a network. On Wed, Jan 29, 2014 at 12:46 AM, Jochem van Dieten joch...@gmail.comwrote: On Tue, Jan 28, 2014 at 11:53 PM, Jordan Michaels wrote: A 0-day

Re: Viviotech?

2014-01-28 Thread Byron Mann
Not really a Chase compromise. Sounds like this was an outbound attack on Chase from Viviotech servers with Kloxo installed. Byron Mann Lead Engineer Architect HostMySite.com On Jan 28, 2014 6:02 PM, Wil Genovese jugg...@trunkful.com wrote: Those files were then hit remotely and caused