July 2004 - Posts
[By way of Dana]
Looks like Robert cornered Frank and video taped him talking about his Threat Modeling tool I reported about back in May.
The book he refers to in the video is actually CALLED Threat Modeling, which you can now order on Amazon. (Mine should be arriving any day now)
If you want to understand how and why you should use this tool, check out the Channel9 video!
As I mentioned previously, I received my copy of the Threat Modeling book and so far, it is excellent! I will post a review this week sometime.
A couple of .NET happenings in the Boston area:
1. Jason Haley organized the 1st Boston .NET Blogger Dinner, and now has organized the second one:
Boston's 2nd .Net Blogger Dinner
Are you in Downtown Boston and are a Blogger or developer? do you read weblogs about .Net?
The 2nd blogger dinner is going to be next week
Date: Tuesday, July 13, 2004
Time: 5:30 pm - 7:30pm - come any time
Elephant & Castle, 161 Devonshire Street, Boston, MA (see map
Sorry I missed the last one, but I plan to attend this one!
2. The new Downtown Boston .NET User Group is in the early stages of a website
feed)! More to come!
For the C#ies:
this.age++; // = 36
For the VB.NETer:
Me.age += 1 ' = 36
If you happen to be in the Burlington, Vermont area next Monday on July 12, be sure to catch Don Kiely at the Vermont .NET Users Group (one of the best user groups led by the fabulous Julie Lerman) meeting from 6-9 PM. Don is speaking on a topic I am very interested in: Security through Least Privilege.
ASP.NET apps are server apps, and that means that you need admin privileges to develop them, right? No! In fact, developing apps on a machine where you have admin privileges can lead to some nasty security holes in your app!. Least Privilege is one of the first principles of developing secure applications. But what does it mean? How do you do it? Why is it so critical? This session will explore how to develop apps that give the absolute minimum permissions to every user and login and still meet application and user requirement, as well as explore-gasp!-why developing without admin privileges on your development machine leads to much stronger and secure apps. Least privilege is not easy to use or implement, but in this day and age it is the only way you and your users have reasonable confidence in the security of an application.
Too bad I am not in the area, though I did make the 5-6 hour trip last fall.
For CLR wonks (and all others interested in the whys and hows of the .Net Framework), Jim Miller, best known as a CLR Architect and author of the book The Common Language Infrastructure Annotated Standard (a great book, by the way, if you want to read the ECMA specs in book form that Jim Miller wrote, along with annotations), has been interviewed on The ServerSide.NET by Ted Neward. See the interview here.
NOTE: A transcript is available as well if you are not able to view the video.
Have you heard about SecureString in Whidbey/VS 2005? This was built to help solve some of the problems of storing sensitive and secret information in System.String:
- It's not pinned, so the garbage collector can move it around at will leaving several copies in memory
- It's not encrypted, so anyone who can read your process' memory will be able to see the value of the string easily. Also, if your process gets swapped out to disk, the unencrypted contents of the string will be sitting in your swap file.
- It's not mutable, so whenever you need to modify it, there will be the old version and the new version both in memory
- Since it's not mutable, there's no effective way to clear it out when you're done using it [by way of Shawn Farkcas]
Hernan de Lahitte has put together a sample class that works in a similar way as SecureString for .Net 1.1.
Along with speaking at the Boston .NET User Group (at the Microsoft offices in Waltham, MA) on July 14, I will be speaking to the new Downtown Boston .NET User Group on August 5 at 5:30 PM. This group started on July 1 in Boston, and is being held at the Adesso Systems offices.
Rather than present the same topic twice, I will be presenting a general security overview for the developer in Waltham, and a more specific introduction to .Net Security in Boston with a look at Code Access Security:
In unmanaged Win32 applications, the operating system authorized access to resources based solely on who was running the program. In today's highly distributed, component-oriented environment, you need a security model based on what a given piece of code, a component, is allowed to do. .NET allows you to configure permissions for components, and provide an evidence to prove that it has the right credentials to access a resource or perform some sensitive work. This talk will cover evidence, policy, permissions, and runtime enforcement (stalk walking, etc.) I will also show how to manage application security using the .Net configuration tool and programmatically.
I have found that CAS is probably one of the most difficult areas in .Net Security to master, yet it will prove to be more and more important to understand for developing secure applications now and in the future (especially with Longhorn). Don't miss it!
Update: To try to reduce confusion, the official names of the Boston .NET Groups are as follows:
1. Boston .NET User Group (Waltham, MA)
2. Downtown Boston .NET User Group (Boston, MA)
Sam talks about his experiences with the new SQL Express Beta 2 Edition. He is frustrated by the lack of UI tools (in particular, the publicized tool called “XM”), the lack of sample databases, and the lack of clear guidance on how to fully utilize the new database, especially for new developers looking at the Express product line. As I mentioned on my SQL Server blog last week, I also got a chance to install SQL Server Express. I also installed the other Express line of tools, and finally the full Visual Studio 2005 Beta 1 this past weekend.
I first noticed that sample databases were missing. This didn't bother me as much as others, as I have been in the habit lately of removing sample databases as per my reading of SQL Server Security. My first test, though, was to add a new database. Uh oh, no UI. Fortunately, I also installed the C# Express tool, and started to use that to create the new database. Unfortunately, I got this nasty error: “Insufficient memory to continue the execution of the program.“ Yuck. I also downloaded Visual C++ Express as well and tried that. Success! I looked to file a bug, saw that it was already filed, and added my workaround. It turns out that the Visual Basic Express version worked as well. Also, sqlcmd.exe can be used to do the same thing (through the command-line, of course).
Now, having created a new database, try to delete that database. Guess what? You can't through the Express tools! Plus, I found you can't through the full Visual Studio Beta 1 either! How? Through sqlcmd.exe again!
I typically use command-lines daily with Oracle, but I thought this would at least be an improvement as Microsoft has produced some of the best UI tools for SQL Server over the last few years (with 7.0 and 2000). Obviously, not all of this is done and ready (yes, of course, I know it is still a Beta product!). But, I can imagine it would be very frustrating for new developers trying to work their way through these steps.
In the meantime, get familiar with the sqlcmd tool. I keep a printout of the commands near my computer at the moment.
As Sam says
Today I Turn the Universal Answer for Life and the Universe
Hmm ... sounds like 42 candles on that cake! I am close behind next week ... -)
Congratulations and have a great day!
I missed this the last couple of days, but Frank Swiderski (of Threat Modeling fame) is blogging. Subscribed! I am looking forward to meeting Frank at WIN-DEV 2004 later this year.
More Posts « Previous page
- Next page »