Anil John wrote:
You can write insecure code in pretty much any language and platform of your
choice..
I much prefer C or asm for writing insecure code. That way you can also
be somewhat sure that the code you write won't behave differently
because someone fixes something in the underlying engine.
If you are focusing on writing secure web applications using
ASP.NET, I would suggest that you check out the following resources:
Building Secure ASP.NET Applications: Authentication, Authorization, and
Secure Communication
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/ht
ml/secnetlpMSDN.asp?frame=true
Improving Web Application Security: Threats and Countermeasures
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/ht
ml/ThreatCounter.asp
Both provide specific and actionable ways to write secure ASP.NET
applications.
Regards,
- Anil
--------------------------------------------------------------
-- http://SecureCoder.com
-- Architecture & Security in an Imperfect World
--------------------------------------------------------------
-----Original Message-----
From: Bénoni MARTIN [mailto:Benoni.MARTIN@libertis.ga]
Sent: Friday, October 08, 2004 4:06 AM
To: webappsec@securityfocus.com
Subject: ASP vs. ASP.NET
Hi list!
I was wondering if if was a real lack of security developping nowadays in
ASP instead of ASP.NET. According to some people, if everything is well
written and the web server fully patched and uptodate, ASP is quite good.
For others ASP.NET is really more powerfull than ASP and the latter is
old-fashuined ...
So what about you, MS users ?
Thanks !
