Feedback on Embedded Firebird

[Xancholy]

I've needed a way to deploy my apps without allowing users to mess with my distributed database (usually Access).

It appears that embedded databases may be one solution.

I found this topic on Embedded Firebird in apps very interesting.

Does anyone have experience that they could share - is Firebird the way to go or SQLite ?

What are the security dangers of embedded Firebird ?

Thanks for any info.

[jmcilhinney]

I think you may misunderstand what that article is saying. It's saying that the database engine is embedded, not the data file. This is basically the same setup as SQL Server CE, although the technical details may differ. The first point says:

The embedded runtime is < 2 MB (starting at just one DLL + one .NET assembly). The runtime is deployed by simple copying, no installation or component registration is required.

The second point says:

The database file (it's just a single file) can have any name and extension. You can associate the extension with your application.

So, that article itself states that the database engine is distributed as libraries that form part of your application while the data file is a separate entity. It's not like the data is stored in the binary code of your EXE or anything. SQL Server CE is basically the same deal. I think it's a few more libraries though. I've never tried but I'd assume that you can change the extension of a SQL Server CE data file to whatever you want too. ".sdf" is the default but as long as you use the correct name in the connection string it shouldn't matter.

So, with Firebird or SQL Server CE, the user can only open your database with an application that is written to do so as there's no server to attach it to. They certainly could write their own app if they wanted to though.

[Xancholy]

Thank you. I read an interesting Firebird vs SQL Server 2005/8 Express comparison

I'm at that starting stage where I need to make an educated decision. The sheer filesize difference (2MB vs 160MB) makes Firebird appear more appealing.

Is there any way to keep users out of a SQL Server CE or Firebird database or SQLite ?

[jmcilhinney]

That's hardly a fair comparison because SQL Server Express is a server-based database. SQL Server CE is a different product and is what you should be comparing against Embedded Firebird. "Embedded" in this sense means that the database engine is part of your application instead of a separate process, which is the case for SQL Server CE but not for SQL Server Express. I'm not saying you should necessarily use SQL Server CE rather than Firebird but you need to understand what it is you're using and why to make an informed decision.

[LinXG]

Hi Xancholy;

I've been using Firebird for several years and really like it. This was back when MS SQL Server cost money to buy and I didn't have any to spend.

I originally looked at MySQL, Postgres and MS Access and settled with Firebird. It is very easy to setup and install. You can download all versons of it for free.

There is an excellent book called the Firebird Book by Helen Borrie available from iPress. Yahoo Groups has an excellent support group that is very active.

If you are going to use Firebird a lot you might want to look at an admin tool like IBExpert (they have a free home user version) or Firebird Maestro (30 day demo version).

I don't know much about the embedded version but if you have questions just post and I will see what I can come up with.

[Xancholy]

Thanks LinXG. It's nice to hear from a user. Thanks for the info. I am trying to move away from ms-access but need to keep the app lite, so SQL Server XPress/CE overhead size may not do.

Is there any way to secure a Firebird database file ? When you distribute your apps, how do you secure it to keep users out and prevent them from using your database to create their own apps ?

[LinXG]

Here is more information on embedded Firebird

InterBase Embedded SQL Guide (http://www.ibphoenix.com/downloads/60EmbedSQL.zip)

I'm not a security expert by any means.

Is there any way to secure a Firebird database file? You can't open a firebird database with something like a word processor and get anything out of it. The only access a user has is through a user/password combination and the owner has lots of control over what a user can do. So unless you're in the habit of handing out Administrator passwords you should be OK.

I believe that with the most recent versions of Firebird you can't even gain access to a backup copy unless you're the owner. You will have to do your own research on this. It was an issue with Firebird 1.5.

When you distribute your apps... Over simplified but in my case I distribute the application which you the user then use to communicate with my Firebird database server.

As a general comment to this concern, if I were sophisicated enough to delve into your database design with a view to creating my own application then I would probably attempt to reverse engineer it rather than have to deal with the possible legal consequences of stealing your property. Hopefully your potential clients are not a bunch of thieving bastards!

[Xancholy]

Here is more information on embedded Firebird

InterBase Embedded SQL Guide (http://www.ibphoenix.com/downloads/60EmbedSQL.zip)

Hopefully your potential clients are not a bunch of thieving bastards!

Sorry, the link doesn't work for me. Please can you repost ?

In my experience it's the friends of the clients who are thieves !

Thanks for the intel !

[LinXG]

Try this site: http://docs.codegear.com/

Scroll to the bottom of the page, there will be pdf's for Interbase 2009, 2007 and 7.5. Take your pick.

[jmcilhinney]

I am trying to move away from ms-access but need to keep the app lite, so SQL Server XPress/CE overhead size may not do.

You still seem to be under some misconception about SQL Server CE. It is a completely different product to SQL Server Express. SQL Server Express is a cut down version of SQL Server. It is installed as a server on the local machine or another machine on a network and you connect to the server. SQL Server CE is completely different. There is no server. You simply distribute the data file and a few DLLs with your app. It is designed with mobile devices in mind but can be used on PCs too. It is an embedded database exactly as Embedded Firebird is, i.e. the database engine is deployed as part of your app, not as a separate server.

I don't know all the details but I believe that SQL Server CE supports encryption too, which would certainly solve your security issue.

Again, I'm not necessarily saying that you should use SQL Server CE over Firebird. Firebird may well support similar encryption and may be smaller than CE. I just want to make sure that you actually understand what you're choosing not to use and why.

[Xancholy]

You still seem to be under some misconception about SQL Server CE.

You're probably right. Thanks for the info. I need to look into this but based on your recommendations I willl look into SQL Server CE.

Is there any GUI recommended for setting up CE ?

[jmcilhinney]

You're probably right. Thanks for the info. I need to look into this but based on your recommendations I willl look into SQL Server CE.

Is there any GUI recommended for setting up CE ?

VS has in-built support for SSCE, which is one of the reasons that it's attractive. In VS 2008, when you add a new item to your project, two of the options under Data are Server-based Database and Local Database, or names to that effect. A server-based database is an MDF file for SQL Server Express, while a local database is an SDF file for SQL Server CE. In both cases you will then access your database via the Server Explorer or Database Explorer window to manipulate the schema and data.