Re: VB6 versus VBNet Challenge

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

On Nov 30, 8:29 am, "Steve Gerrard" <mynameh...@xxxxxxxxxxx> wrote:
"Tom Shelton" <tom_shel...@xxxxxxxxxxx> wrote in message

news:1c47a0fc-f978-4914-8316-77dd0e78d315@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

On Nov 30, 12:52 am, "Steve Gerrard" <mynameh...@xxxxxxxxxxx> wrote:
"Tom Shelton" <tom_shel...@xxxxxxxxxxx> wrote in message

Again - that isn't true. It is just like any other C# code - except
that the runtime can't verify all the actions, so it disables bounds
checking etc. All the normal security checks are still done - hence
the fact that you can't run unsafe code in certain security contexts.
The fact is that once ANY sub is running, .NET is out of the picture.
All .NET code runs as native code. All the runtime does is do
security checks, and compile the IL into native code. Execution, is
the same as any other native code.

Hi Tom,

What I am after is finding examples of things you can do with the .Net tool set
that you can't do in earlier languages.

Why? .NET supports a lot of those earlier languages. There is very
little that .NET can do that can't be done in an earlier language, or
even another non-.net language. Most of the productivity I find
from .NET revolves around garbage collection and the Framework
library.

For me, posting an example of C# code
that could just as easily have been written in MS C++ 10 years ago doesn't
really demonstrate anything useful to know about .Net.

Again why? You don't think it useful to know about a tool in your
tool box? To be honest, I have almost never used unsafe code. There
are very few reasons to even justify it's use. The only time I have
used in a real project was not in .NET at all - it was in Mono on my
Gentoo Linux box. I was creating a wrapper for ncurses. I used it to
gain access to some variables that ncurses stores in memory - but I
digress.

We can give it a rest,
though, we are not really disputing facts, just our sense of how relevant they
are.


That's fine. I don't really mean to argue.

The fact is that once ANY sub is running, .NET is out of the picture.

Is that really true? For all the "safe" functions, I think there is more array
bound checking, etc. going on at runtime. Of course everything is in machine
code by the time it gets executed, but whether or not there are array bounds
checks built into every step makes a big difference.

There are arraybounds checks and some other checks compiled into the
code. Some of those are disabled in unsafe code, like arraybounds
checks, null pointer checks, etc - but other's are not, uch as CAS.
So, I guess it is wrong to say that runtime isn't there during
execution :)

--
Tom Shelton

.

Relevant Pages

  • Re: Running renamed executables with CMD.EXE
    ... security products) is typical, then this hasn't been a problem for a while. ... branch of the attack tree. ... no reason it should be for people who start with XP. ... I'm not saying that cmd's content-inspection execution heuristics are good, ...
    (NT-Bugtraq)
  • RE: Running renamed executables with CMD.EXE
    ... security products) is typical, then this hasn't been a problem for a while. ... branch of the attack tree. ... no reason it should be for people who start with XP. ... I'm not saying that cmd's content-inspection execution heuristics are good, ...
    (Bugtraq)
  • [NT]InstallShield Update Agent "Rule Script" Code Execution Vulnerability
    ... Get your security news from a reliable source. ... InstallShield Update Agent "Rule Script" Code Execution Vulnerability ... Arbitrary remote code execution is possible on all known product versions. ... the client agent reports its product ...
    (Securiteam)
  • Re: Public disclosure of discovered vulnerabilities
    ... What about your claim that no one knew anything about security before ... Even now that we have higher-level languages like C, ... Why would that be a disaster? ... For every BIND buffer overflow ...
    (sci.crypt)
  • Re: XP SP2 IE6 vulnerability
    ... Since SP2, IE's behavior has been modified and now I call it a vulnerability ... because it allows security checks to be bypassed. ... the execution of some components in pages stored on the local disk, ... To me this is a facet of IE's poor design. ...
    (microsoft.public.security)