Consequences of deploying a debug build of an application?

Question

I would like to know the pros and cons for deciding to deploy an application that was created in Debug (with a debug symbol table), and against Release mode, in which the characters are deleted. Other permutations exist, such as enabling optimizations for Debug and enabling debugging symbols for Release.

Areas that I think may be troubling (you may know others):

• Security
• Performance
• Stability

But I'm not an expert, so I'm not sure about the implications for deploying a Debug application in these areas.

This may not be relevant, but this application is a C # .Net framework 3.5 (a business application that manages terrabytes data) for interested parties. This application is for the client (paid).

Are there any clear advantages or disadvantages to choosing this?

Answer 1

Security: Debugged and freed managed code, such as C #, is already vulnerable if not confused. Protect your code with obfuscation, otherwise it can be easily copied, stolen, any protection, such as encryption, is broken (in this case, you specified Terrabytes data for the client). I answered the obfuscation question here . In addition, create a key file and sign your assemblies.

Performance . Debugging is definitely slower, it should never release a debug assembly. If using AJAX will make requesting each page much more difficult since the debug version is larger. Set the debug flag to false of your application configuration file, I have included several similar reminders in this other question .

Stability: Debugging uses more memory and may be less stable if the server has low memory. The advantage of having DLL debugging in case of application failure, your pdb files will already be in place. Best practice is to provide a reliable debug build for each release version that you create. If the client requires debugging, back up its folder and replace it with the corresponding debug builds.

I developed an archiving product that also archived Terrabytes data, and I would NOT recommend deploying the debug assembly and making sure it was rooted and the file encryption methods encrypted with Dotfuscator.

Answer 2

You can also provide them with a release build with debugging information.