| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
Beware of Fully Trusted Code | |
|
||
| Time: 00:00 EST/05:00 GMT | News Source: Microsoft | Posted By: Robert Stein | ||
|
The vast majority of managed applications run with full trust, but based on my experience teaching .NET security to developers with a broad range of experience, most really don't understand the implications of fully trusted code. So I've pulled together a number of examples where fully trusted code can skirt around common language runtime (CLR) security features, starting each with a question that seems to have an obvious answer. | ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 148 Last | Next |
The time now is
10:12:33 PM
ET.
Any comment problems? E-mail us |
| #1 By 2332 (65.221.182.2) at 4/9/2004 9:37:15 AM |
|
#1 - However leaving the choice of how much to trust an application to the user seems most sensible.
No, it doesn't. Leaving a choice up to somebody who almost certainly has no clue what they're doing is probably not the best choice. Why do you think spyware is so rampant? It's because when users see the ActiveX prompt, the almost invariably click "yes". The choice for how much to trust an application should first be left up to the administrator of the system. It should be controlled by policy set ahead of time. The user should never see a prompt asking them if they want to run in "full trust" mode. Instead, it should simply say "the application could not be run because it requires a greater level of permissions than what it has been granted." Only then could a user go and modify their security policy to allow that application to run. Since most users are clueless, they will not be able to do this. It's better to prevent a application from running than it is to open a machine to attack by default. The way Palladium/NGSCB is designed, it does not make sense to use the word "trust," but rather "closed." It is a closed systaem which can only be accessed in authorized ways. NGSCB is a police state for the PC. How so? Granted, NGSCB is a way to allow for software and content publishers to be sure that software runs as they designed it to run. But it is also a way for users to determine exactly who has access to what information on their machine. NGSCB greatly improves the control owners have over their own data. That includes both software/content publishers and users. Just because it will prevent people from stealing online content or pirating software doesn't make it a police state. |
|
Write Comment
Return to News |
Displaying 1 through 25 of 148 Last | Next |
The time now is
10:12:33 PM
ET.
Any comment problems? E-mail us |
