Develop Reference

Where to store sensitive information needed for an application to run?

I am writing a c# winform desktop application that is in contact with a MYSQL database. Of course I cannot leave the database credentials out in the open hard-coded into the application, so where can I store this information so that a nosey customer will have an extremely tough time locating it?
I understand that if someone is very determined to find this information they will most likely do just that, but I want to be able to hide these credentials from the average Joe, leaving me with some peace of mind at the end of the day.
If your answer is to encrypt the credentials, and hard code the encrypted values into the program, please explain which encryption methods to use. Furthermore, where would I store the necessary decryption/encryption keys?
I very much look forward to some interesting responses.
Thank you,
Evan F.

http://www.ezzylearning.com/tutorial.aspx?tid=8067328
Store it in App.Config File.
Check out above tutorial.
You can also check this good article by Microsoft which teach you how to encrypt and retrieve.
http://msdn.microsoft.com/en-us/library/ms254494.aspx
One of Previous Posts
if you have installed Microsoft Enterprise Library, you can easily encrypt/decrypt using its tool as mentioned in this link
http://davidhayden.com/blog/dave/archive/2006/01/23/2744.aspx
http://davidhayden.com/blog/dave/archive/2006/03/02/2870.aspx
Also, after the installation, open the project in studio and right click on the web.config or app.config and you will see the option for the configuration though Enterprise Library. This option is available in Visual Studio 2005 but I cannot see this in Visual Studio 2008 yet. Not sure whether its not compatible with 2008 or I have to follow some installation sequences. I will let you guys know if I come across with any solutions.
This is the link which explains how to work with encryption within studio http://www.pnpguidance.net/Post/EnterpriseLibrary3VisualStudioIntegratedConfigurationEditor.aspx . Read, read & read...
Keep in mind that once you open the .config file you have luxuary of ecrypting each pieces/blocks seperately. Thats the beatuy of it.
For your information I am using Enterprise Library 3.1 which is the latest version and has tonnes of tools that makes your life a breeze. You can download this library at http://msdn2.microsoft.com/en-us/library/aa480453.aspx. Also, look forward for 4.0 at http://www.codeplex.com/entlib
Bottom line you can search google along these lines and I am sure it will give you the whole process.

AutoUpdate using Google Code

I want to make my software autoupdate itself, but I don't have extensive webdesign skills, nor any available website/online hosting. I want to do it in C#/WPF.
So I was wondering if there could be a way to make an autoupdate service using google code, something clean. I'm guessing I'm not the first one to think of it.
I'd do it this way:
1) Use a WebBrowser (silently) and navigate to my google code page. On that page I'd put a field where I enter the latest version number. (I need to somehow find that number in the page's content).
2) I compare that number to the version currently installed (I could put the CURRENT_VER_NUMBER in a *.txt in the software's folder for example).
3) If I conclude that a new version is available, I download it from the "Downloads" tab of my google code project, unzip it, overwrite the files in the installation directory, and restart the app.
First of all, would that work fine? When I imaginate it, it sounds like dirty code.
Then, I wouldn't know how to navigate to the downloads tab, even less how to select the latest version there (maybe by doing a very strict file naming), and download it.
And last but not least, If the application is already running in order to perform the update check, I couldn't overwrite the files without quitting the application, does that mean I have to make some kind of "master app" that performs the check before starting my software? Sounds dirty too =/
Any input is very welcome,
Have a nice day.

I suggest you take a look at ClickOnce. It doesn't require you to create a webpage. You only need to host 2 files: a .manifest file that contains information about your app (version, name and a link to the package that contains your application) and the latest version of your application package. The only thing you need to do is host those 2 files and put a link on your Google Code page to that .manifest file. Users click that link and .net will automatically install or check for the latest version and update if necessary.

You may want to have a look at a library I wrote and released as open-source to do just that transparently - including an external update application to do the actual cold update. See http://www.code972.com/blog/2010/08/nappupdate-application-auto-update-framework-for-dotnet/
The code is at http://github.com/synhershko/NAppUpdate (Licensed under the Apache 2.0 license)

I ran into a few problems, but overall it was not so hard. I think the approach is clean so I'm putting it out there if anyone ever wants to achieve something similar.
You'll have to check out: https://code.google.com/p/theomniscientchimp/ where the full source is available, and of course adjust it for your project.
Thanks for the comments on my original post, made me feel confident i was doing it right =)

Online updating a C# program

Greetings,
I'm sorry if this question has been asked already. I've tried using the search function but couldn't find any answer that suited my situation.
I have a real simple C# form application of only 1 file, a exe.
I distributed this currently by 4shared where people can download it as pleased.
However, every time I make changes to the program people will have to download the new version from 4shared.
Now this isn't a ideal situation and I'm a noob when it comes to creating upgrade but the situation I wish is that the program looks at a website / ftp server where I deploy a new version.
I'm looking for a way inside my program to look at the file on that website / ftp server and decide wether there's a new version available.
If there is a new version available in the website / ftp server I would like for the program to update itself to the newest version.
Hope you guys can help me out with this and I hope I explained my situation enough !

NetSparkle is a nice alternative to click-once with more deployment options. http://netsparkle.codeplex.com/

Have a look at ClickOnce. It will do this for you.

When I'm developing and publishing such applications, I usually do it the following way:
Develop a .NET Windows Forms application
Develop a tiny ASP.NET application with an ASMX web service.
Publish the ASMX web service to my public web site.
Add a WSDL reference for the web service to my Windows Forms application.
Create a setup (I prefer Unicode NSIS over ClickOnce).
The logic I implement in the SOAP web service is basically a single function:
[WebMethod]
public string CheckUpdateAvailable( string currentVersion )
{
...
}
The Windows Forms application calls this method (e.g. from a background thread upon program start), passing its current assembly version as a string to the function.
The WSDL function in turn checks the passed version against the newest setup version (e.g. being stored inside web.config or extracted live from the setup.exe on the server). If a newer version exists, it return a string with the URL to download from; otherwise it returns NULL.
When the caller of the WSDL function gets a non-NULL string, it can show a message to the user, asking whether he wants to download and install the executable and then simply execute the URL (via Process.Start).

WyUpdate is the way to go here. We've been using it for over a year with great results (they have excellent support too).
It actually uses patches to update files so that when a 5MB executable only has a small change, the client only has to download a file in the order of kilobytes.
They supply an automatic update component for either Windows Forms or WPF that looks nice and works great.
You can host the update files on either an FTP server or a normal website without any server-side configuration.
There's plenty more to it, and the best place to start is with their video tutorial of how to set up an update.

Here's an open-source library I wrote to address specific needs we had for WinForms and WPF apps. The general idea is to have the greatest flexibility, at the lowest overhead possible. All you'll have to do is create an update feed and reference the library from your app.
So, integration is super-easy, and the library does pretty much everything for you, including synchronizing operations. It is also highly flexible, and lets you determine what tasks to execute and on what conditions - you set the rules (or use some that are there already). Last by not least is the support for any updates source (web, BitTorrent, etc) and any feed format - whatever is not implemented you can just write for yourself.
Cold updates (requiring an application restart) is also supported, and done automatically unless "hot-swap" is specified for the task.
This all boils down to one DLL, less than 70kb in size.
More details at http://www.code972.com/blog/2010/08/nappupdate-application-auto-update-framework-for-dotnet/
Code is at http://github.com/synhershko/NAppUpdate (Licensed under the Apache 2.0 license)
I plan on extending it more when I'll get some more time, but honestly you should be able to quickly enhance it yourself for whatever it currently doesn't support.

Automatic update

I have a system with two web applications, one web service, one Windows service and a WPF application running 24 hours a day on a touch screen. All of them are connected to a database.
I want to be able to upgrade all of those applications by uploading upgrade files to the database and set the date and time for the upgrade to occur.
I have one idea on how to do this.
An application has a thread running to look for available upgrades.
When an upgrade is found, the file is downloaded to the application's computer.
When download is complete, the applications triggers a restart.
When application starts, it looks for an upgrade file on the local computer.
If upgrade is available, the application upgrades itself.
I'm not really sure how all these steps should be done yet, especially the last one. But I want some comments about this. Is this completely wrong? Am I on the right track? Any tips on how to do it like this or in another way?

I think you're going down the right lines here. A polling application to check the database for the existence of a new update followed by an xcopy deployment script would do it.
This might be doable from a PowerShell script too, that runs on a schedule, say every 10 minutes. It could check the database, close the process and service, xcopy the application (from a shared source) and restart the said service and app.
All this assumes that you are not using Windows Installer to package and deploy your application initially. Although an xcopy to directly replace binaries wouldn't hurt an MSI package, it's not recommended. We use AD MSI deployment at work and it's a pain at the best of times!
MSDN contains references for MSI vs XCopy deployment for WPF applications (as well as the security requirements).
This was the first link I found for querying SQL from PowerShell: http://elegantcode.com/2008/03/27/discovering-windows-powershell/
Good luck!

You will have trouble doing this with ClickOnce. ClickOnce would only work for your WPF app, it can't do anything with the services or web application. You could write a separate ClickOnce-deployed "Updater" app whose job is to update the other apps, but that still seems a little iffy.
It may sound stupid, but I'd start with the simplest thing I could think of. How about using Dropbox to push your update files; then an AutoHotKey script that runs on startup, watches the Dropbox folder for new updates, and runs them?
Sounds hokey, but it's something you could prove out in an hour or two.

Microsoft have an Updater Application Block which might be what you are looking for.

Do you really want to run an update from the database or is this just a possible solution? You are reinventing the wheel.
Have a look at ClickOnce deployment, everything you need is already done for you and integrated into VisualStudio. If you use something that already exists you have the benefit of existing documentation, helpful blogs of people who have already gone through the pain points and updates and fixes.
ClickOnce Deployment
ClickOnce Deployment in .NET Framework 2.0
How you want to use ClickOnce depends on what you want to get out of it. Out of the box you can very easily create a deployment that checks for an upgrade every time you run the application but you can also with a little bit of code have the application check for updates whilst it is running.
The Updater Application BlockVersion that Dominic Zukiewicz mentioned is the pre cursor to ClickOnce.
EDIT
ClickOnce provides a roll-back scenario on both the Server and Client end. The client can roll back to a previous version using the normal add remove programs dialogue and you can easily republish a previous version.

You could create another Windows Service that does the updates on a daily basis. The service would look on a specific folder if there are any updates to be process. For example it could look for an xml file which tells it the new version of the application and what the files to update are. It would shut down the application/services, backup the files that it needs to update, start the application/services, and clean up backup files keeping at least three backup files. The service should keep track of the last and current version installed so that when it reads the xml file it can check if it is a new update or not or you can simply delete the xml file when it completes.

How about Google Omaha? It's an open source tool, currently used to push updates of Google Chrome and Google Earth. Omaha can handle application installation, too. A high-level design overview can be found here.

Safe and Secure way to Update over Internet in C#

What would be the Most secure and Safe way to allow software to auto-update without opening too many holes to enable a hacker easy access to a system?

Have you looked into ClickOnce Deployment?
http://msdn.microsoft.com/en-us/library/t71a733d(VS.80).aspx
The short overview is here:
http://msdn.microsoft.com/en-us/library/142dbbz4(VS.80).aspx

I recommend not building your own auto-update, use ClickOnce if it works for you or a commercial auto-update component if not.
If you want to see what is involved I wrote a series about writing an auto-update component on my blog some time ago, the last post with links to all the posts in the series is at: http://www.nbdtech.com/blog/archive/2007/08/07/How-To-Write-an-Automatic-Update-System-Part-8.aspx

If you are going to make your own system then you will probably want to have a public/private key pair.
So, you would zip up the update.
Then encrypt with the private key on the server.
The client can then decrypt and unzip it, and then install it.
That way, as long as your private key is secure then you can ensure that the update is legit.
The only weakness here is that if someone changed the public key to some other key, then they could fool that program into thinking that a trojan is a valid update.
There are various schemes you can use to get around this, but that would depend on how much work you want to put into this.

ClickOnce auto update is all fair and well but anyone can admit that it is not the most of fashionable solution. I've recently developed a solution that requires such an auto-update feature. Here is a list of brief steps I took to deploying my very own updating service that also allows for roll-backs with 'minimal' know-how.
Add a Setup project to the solution so that the project could be wrapped up neatly in a .exe or .msi installer package.
The following is to setup a FTP server with your desired user credential that only your application knows. On the ftp server, setup a default directory for where you will put any new updates.
Your application will check for internet connection on start-up, log into your remote FTP server and check for any new files to download.
Download new updates to your client application and put them in a date-time named folder for future reference. Some checks need to be in place to make sure that you don't download the same old files.
Close the application and run the new installation. Depending on how you setup your Setup project, the installation wizard may remove the previous version completely or just update partial (patches, etc.).
Your application may have a feature to roll-back to previous version by going into the local update directory and fish out the previously downloaded files. This is where the date-time stamped files come in handy for reference.
This solution offers a level of customization that I think most Enterprise solutions will need and I found that it works very effectively for me. FTP servers are secure and reliable as far as file downloads are involved. You can find a lot of FTP download helper library on the internet so its a matter of making work the way you want and not worry too much about how it works.