.net中客户端/服务器应用程序中dll文件的安全性

Question

I'm going to write a Client/Server application. There are some ambiguous concepts in this that I was not able to get answer to after many hours of searching.

As we all know one of the major caveats of the .Net framework is that the DLL files can be decompiled and reverse-engineered on the client's machine.

Now my question is can I put some of the DLL files required by the Client on the Server?

And if true, will it be completely secure or it will still be open to getting reverse-engineered/decompiled by crackers?

EDIT: The question is different as it asks for the security in the context of a Client/Server application.

Answer 1

For the client to use the dll files, it will have to download them from your server to the client. Thus making reverse engineering possible once again. It does not solve anything basically.

I think your goal should be to keep the client as thin as possible, doing most of your logic server-side. While I do not know the details of your client/server application, one could think of using a webservice which the client calls to access the server. That way you only have to make sure that client authentication to the webserver is solid and that you do sanity checks against any incoming input from clients.

Answer 2

That depends completely on your implementation - if you stream the modules to the client at some point, they can be dumped and reversed. If you keep the functionality purely on the server's end, and only return results to the client, you'd be a lot safer.

General rule of thumb with any software, and not just .NET, is that whatever is present can be reverse engineered. I wouldn't say that's "one of the major caveats of .NET" personally.

Basically, if you want to protect yourself against reverse engineering by going with a client/server model, there are a few rules of thumb that apply:

• The server should never trust the client
• Keep as much of your actual implementation on the server's end
• Do not stream modules to your client
• Use proper authentication and rate limit requests so your server can not be used to simply "dump" responses from