Re: .Net and security

In-Reply-To: <6693bbb704112310122220e3cc@mail.gmail.com>

Hi Anton,

1) Is the .Net programming environment by default more secure then what ASP 
is/was?

Yes, at least Microsoft starts to build programming environment with security 
in their mind.  .Net is by default more secure because managed code gets rid of 
buffer overflow.  In terms of user inputs, .net has a set of built-in 
validators for you to sanitize the inputs before processing.  Also, you may 
specify code access security policies to limit what your assemblies can / 
cannot do.  However, if you cannot write secure code, a different programming 
environment would not make much difference.

2) Are there any security issues with the "view state" that .Net holds?

Yes, there is a chance that your view state be tampered by malicious users on 
the client side.  This msdn article has a short description on how to protect 
the view state.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnaspnet/html/asp11222001.asp

3) Also are there better security advantages using J# , C# over VB in .Net?

I don't see an obvious answer for this one, as Tim pointed out they all compile 
into CLR.  However, when I read new .NET security technical articles, I noticed 
that most code samples are given in C# and/or VB.NET.  Perhaps if you want to 
easily adopt the code, you would prefer choosing these more popular languages.