Re: .Net and security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

- --On Dienstag, 23. November 2004 13:12 -0500 Tim Hoolihan 
<[email protected]> wrote:

>> 3) Also are there better security advantages using J# , C# over VB in
>> .Net?
> All of these languages are compiled into the same language (read up on
> the CLR), so in theory they are each as secure as each other.
> However, I would want to know more about how each language handles
> variable typing to be certain.  I can only speak to C# on this, but it
> requires explicit conversions and seems to have a lot of safegaurds.

As far as I understand the CLR specification, this is a requirement for all 
languages bound to it. There have been several articles on the net about 
VB# being far more strict then plain-old VB was, making the transition for 
the average VB-Programmer a lot more difficult then, say, from C++ to C#.

As for J#, I would suspect the same.

The really interesting point here is the quality of the compilers, I think.

I have worked with the .NET C# Compiler from Microsoft for quite some time 
now, and I'm a bit impressed how good it is able to find common coding 
errors like, as you said, missed typecasts etc. So, if you are talking 
about VB# or J#, this should be one point to consider. A compiler, which 
doesn't allow unsecure code, is a great help, independantly from the 
Language actually in use.

Apart from this, there is another point. Much common errors are intercepted 
by the .NET runtime while your application is executing, resulting in 
Exceptions, which are definitly independant of the language you actually 
used to create your code.

So, generally speaking, I do think that .NET is a good advancement in 
secure programming out-of-the-box. On the other hand, the centralized 
framework makes off a good single point of failure, and I have no idea how 
many loopholes still remain in the Microsoft CLR. Maybe the open source 
Mono project might be of interest here, especially in high-security 
environments. (Besides, the Mono CLR has the reputation of beeing more 
performant than the Microsoft one.)


What I have not yet looked into is the Security Framework .NET has in it. 
You can set a whole lot of permissions for code being executed on a given 
Machine depending on another whole lot of sources, where the application is 
coming from. Just copying a applicatoin from a local hard drive to a 
network share in your little private LAN at home might make an application 
unusable without changing permissions. I think the Socket Connection to 
MySQL is causing this, but I'm not sure.


Live long and Prosper!
Torben Nehmer

- -- 
Torben Nehmer, Guenzburg, Bavaria, Germany
http://www.nathan-syntronics.de, mailto:[email protected]
PGP Public Key: https://www.link-m.de/pgp/t.nehmer.asc
-----BEGIN PGP SIGNATURE-----
Version: Mulberry PGP Plugin v3.0
Comment: processed by Mulberry PGP Plugin

iQA/AwUBQaQ1gCT4eCp+neRWEQK3HQCgpQ7s6vIte83NqrQr6LWKeWaGvg4AoLWs
SXC2H1DQ5PuluCUijMM67FPW
=KDQf
-----END PGP SIGNATURE-----