Rich Newman  posted awesome guides for Composite Application Block (CAB) programming:

Table of Contents: Introduction to CAB/SCSF

Part 1 Modules and Shells

Part 2 WorkItems

Part 3 Introduction to Dependency Injection

Part 4 An Aside on Inversion of Control, Dependency Inversion and Dependency Injection

Part 5 Dependency Injection and the Composite Application Block

Part 6 Constructor Injection in the Composite Application Block

Part 7 Introduction to Services in the Composite Application Block

Part 8 Creating and Using Services in the Composite Application Block

Part 9 The Command Design Pattern

Part 10 Commands in the Composite Application Block

Part 11 Introduction to Events in the Composite Application Block

Part 12 Events in the Composite Application Block

Part 13 Introduction to UIExtensionSites

It is important to understand these core principles. Recently I was involved with a project where CAB was used extensively. Too extensively... The application was actually over-CAB'ed causing performance hit. When we ran the profiler we saw that many functions calls were empty while adding up to execution time. The only solution was redesigning the application and CAB usage.

Lessons Learned:

• Do not over CAB
• Load modules on demand
• Cache static data

Related resources:

• Notes on (extreme) Performance requirements for CAB
• Mobile Client Software Factory (includes includes CABgen and OBgen for NGEN'ing CAB modules)
• How To: load CAB modules on demand

Mark covers arsenal of security tools available from Microsoft ACE team. The tools are:

• Threat Analysis & Modeling Enterprise (TAM-E)
• CAT.NET (Code Analysis Tool)
• Spider TCM (Assessment and compliance tool)

XSSDetect public beta is now available for download on MSDN.

Overview

XSSDetect is a static code analysis tool that helps identify Cross-Site Scripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Basic .NET, J#) and analyze dataflow paths from sources of user-controlled input to vulnerable outputs. It also detects whether proper encoding or filtering has been applied to the data and will ignore such "sanitized" paths.

Related resources:

• Anti-Cross Site Scripting Library
• How To: Prevent Cross-Site Scripting in ASP.NET

My related posts:

• XSS? - Do not Make Me Laugh, We Use WinForms

Enjoy