Re: .Net and security

In-Reply-To: <[email protected]>

Hi Anton,

1) Is the .Net programming environment by default more secure then what ASP is/was?

Yes, at least Microsoft starts to build programming environment with security in their mind.  .Net is by default more secure because managed code gets rid of buffer overflow.  In terms of user inputs, .net has a set of built-in validators for you to sanitize the inputs before processing.  Also, you may specify code access security policies to limit what your assemblies can / cannot do.  However, if you cannot write secure code, a different programming environment would not make much difference.

2) Are there any security issues with the "view state" that .Net holds?

Yes, there is a chance that your view state be tampered by malicious users on the client side.  This msdn article has a short description on how to protect the view state.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnaspnet/html/asp11222001.asp

3) Also are there better security advantages using J# , C# over VB in .Net?

I don't see an obvious answer for this one, as Tim pointed out they all compile into CLR.  However, when I read new .NET security technical articles, I noticed that most code samples are given in C# and/or VB.NET.  Perhaps if you want to easily adopt the code, you would prefer choosing these more popular languages.