RE: .Net and security

Something to take care with is the trust level of the application. If
the application is running under full trust, then it has nearly all of
the power of native code (minus direct buffer overruns). I'd personally
try to shoot for medium trust, or make a custom level that adds in only
the extra rights your app needs.

It's also possible to separate out your fully trusted code from your
less trusted code by putting the full trust bits into the GAC and
setting AllowPartiallyTrustedCallers. Obviously, if you set this, be
careful.

A good read to get you doing this right and understand the security
subsystem of .NET thoroughly is ".NET Framework Security", by Brian
LaMacchia, et. al.

The .NET Framework SDK also has some very good information and things to
look out for in the help system.

-----Original Message-----
From: Damhuis Anton [mailto:DamhuisA@aforbes.co.za] 
Sent: Monday, November 22, 2004 9:33 PM
To: secprog@securityfocus.com
Subject: .Net and security


Hi,

I'll try and get something started.

I have been programming in (Classic) ASP, and will be moving over to
.Net soon.

1) Is the .Net programming environment by default more secure then what
ASP is/was?

2) Are there any security issues with the "view state" that .Net holds?

3) Also are there better security advantages using J# , C# over VB in
.Net?

Regards
  Anton

Confidentiality Warning
=======================

The contents of this e-mail and any accompanying documentation are
confidential and any use thereof, in what ever form, by anyone other
than the addressee is strictly prohibited.