Browse by Tags

• Aargh!
• ASP
• bad jokes
• BBC Television
• Begging the question
• Books
• Breaking Changes
• C#
• CAPTCHA
• certificates
• Channel 9
• Code Generation
• COM Programming
• cryptography
• Dialogue
• digital signatures
• friend assemblies
• JScript
• Lambda Expressions
• Metablogging
• Performance
• Rants
• Salt
• Scripting
• strong names
• VBScript
• Video
• VSTO

• Sorry about the CAPTCHA

  A quick metablogging note. Those of you who comment on this blog (6700+ comments and counting, thank you all) have probably noticed that it now has a CAPTCHA, that little "please prove you're a human" test before the comment is posted. I understand why. Read More... Posted Thursday, September 10, 2009 6:28 AM by Eric Lippert | 18 Comments Filed under: Security, Metablogging, CAPTCHA

• What's the Difference, Part Five: certificate signing vs strong naming

  Both strong naming and digital signatures use public key cryptography to provide evidence about the origin of an assembly, so that you can apply security policy to determine what permissions are granted to the assembly . They differ most importantly not Read More... Posted Thursday, September 03, 2009 6:48 AM by Eric Lippert | 5 Comments Filed under: Security, cryptography, digital signatures, certificates, strong names

• Alas, Smith and Jones

  We have a feature in C# which allows you to declare a " friend assembly ". If assembly Smith says that assembly Jones is its friend, then code in Jones is allowed to see "internal" types of Smith as though they were public(*). It's a pretty handy feature Read More... Posted Thursday, June 04, 2009 7:04 AM by Eric Lippert | 14 Comments Filed under: Security, C#, strong names, BBC Television, friend assemblies

• Preventing third-party derivation, part two

  If you find a class in a library that has all private/internal constructors, it is pretty clear that the author of the class is sending you the deliberate message that this class is not to be extended by you. In our previous example, it was not so clear. Read More... Posted Monday, October 06, 2008 7:50 AM by Eric Lippert | 8 Comments Filed under: Security, C#

• Preventing third-party derivation, part one

  In this episode of FAIC, a conversation I had with a C# user recently. Next time, some further thoughts on how to use the CLR security system in this sort of scenario. Him: I have this abstract class defined in one assembly: // Assembly FooBar.DLL public Read More... Posted Friday, September 26, 2008 8:17 AM by Eric Lippert | 27 Comments Filed under: Security, C#, Dialogue, Begging the question

• Tasty Beverages

  “ Diet Dr. Pepper tastes more like regular Dr. Pepper.” That was a previous advertising slogan for Diet Dr. Pepper, my personal favourite source of both caffeine and phenylalanine; I’m drinking it right now as I write this. The present slogan is the brain-achingly Read More... Posted Tuesday, August 19, 2008 2:09 PM by Eric Lippert | 35 Comments Filed under: Security, Rants

• Protected Member Access, Part Four

  In Part Two I asked a couple of follow-up questions, the first of which was: Suppose you were a hostile third party and you wanted to mess up the parenting invariant. Clearly, if you are sufficiently trusted, you can always use private reflection or unsafe Read More... Posted Friday, May 02, 2008 9:13 AM by Eric Lippert | 1 Comments Filed under: Security, C#

• Why Can't I Access A Protected Member From A Derived Class, Part Two: Why Can I?

  This is a follow-up to my 2005 post on the same subject which I believe sets a personal record for the longest time between parts of a series. (Of course, I didn't know it was a series when I started it.) Please read the previous article in this series, Read More... Posted Friday, March 28, 2008 4:30 PM by Eric Lippert | 36 Comments Filed under: Security, C#, Breaking Changes

• How do I mitigate a SQL injection vuln?

  Joel points out today that SQL injection vulnerabilities are common and bad, bad, bad. He does a good job of describing the attack but doesn't really talk about how to mitigate it. When I advise people on how to close security holes like this I always Read More... Posted Wednesday, November 01, 2006 1:32 PM by Eric Lippert | 22 Comments Filed under: Security

• Why are base class calls from anonymous delegates nonverifiable?

  I'm still learning my way around the C# codebase – heck, I'm still learning my way around the Jscript codebase and I've been working on it for nine years, not nine weeks. Here's something I stumbled across while refactoring the anonymous method binding Read More... Posted Monday, November 14, 2005 11:28 AM by Eric Lippert | 17 Comments Filed under: Security, C#, Lambda Expressions, Code Generation

• Do not use string hashes for security purposes

  A recent question I got about the .NET CLR's hashing algorithm for strings is apropos of our discussion from January on using salted hashes for security purposes. (If you missed it, you can read it here: Part One , Part Two , Part Three and Part Four Read More... Posted Monday, October 24, 2005 7:00 AM by Eric Lippert | 12 Comments Filed under: Security, Breaking Changes

• How To Obtain The Name Of The Client From The ASP Server

  Here's a question about client side vs. server side scripting that I got recently: I want to get the machine name of the client the request is being made from. With ASP I can get the IP address using this code: ipaddr = Request.ServerVariables("REMOTE_ADDR") Read More... Posted Monday, May 09, 2005 12:18 PM by Eric Lippert | 15 Comments Filed under: Scripting, Security, ASP, Performance

• A Face Made For Email, Part Two

  One year ago this week I was the Channel Nine guinea pig -- I'm still not sure why, but for some reason The Scobelizer and his cohort chose me to be the first guy interviewed for their project. (Probably because I'm mostly harmless.) Channel Nine has Read More... Posted Friday, April 01, 2005 9:45 AM by Eric Lippert | 5 Comments Filed under: Security, VSTO, Video, Channel 9

• You Want Salt With That? Part Four: Challenge-Response

  My friend Kristen asked me over the weekend when I was going to stop blogging about crypto math and say something funny again. Everyone's a critic! Patience. my dear. Today, the final entry in my series on salt. Tomorrow, who knows? *********************** Read More... Posted Monday, February 07, 2005 10:28 AM by Eric Lippert | 21 Comments Filed under: Security, Salt

• You Want Salt With That? Part Three: Salt The Hash

  Last time we were considering what happens if an attacker gets access to your server's password file. If the passwords themselves are stored in the file, then the attacker's work is done. If they're hashed and then stored, and the hash algorithm is strong, Read More... Posted Thursday, February 03, 2005 6:53 AM by Eric Lippert | 21 Comments Filed under: Security, Salt