Solution changes: strong name signing, conditional AllowNonTrustedCode, package examples in the same integration cycle about autofac HOT 5 CLOSED

From [email protected] on February 02, 2008 15:50:37

Labels: Milestone-Release1.1

from autofac.

From [email protected] on February 07, 2008 23:32:13

If AllowPartiallyTrustedCallers was always set, what kind of vulnerabilities would be
possible? Substitution of services in a container creating trusted components?

Status: Started

from autofac.

From rinat.abdullin on February 08, 2008 00:46:25

I'm not that experienced with the CAS yet.

All I know is that:

1. MVPs advise to use APTCA with a great care (avoid where possible)
2. Castle project explicitly compiles everything without it
3. Sometimes it is needed to turn the attribute on for the Medium Trust environments.

PS: yes, the Named/Typed Services for the schema manager come right from the autofac.
I've just posted one more article on that.

from autofac.

From [email protected] on February 08, 2008 01:00:39

Okay - I will omit APTCA from the default build. It just occurred to me that anyone
using APTCA will probably want to generate their own strong-name key anyway, as will
some people deploying in FullTrust scenarios. For now lets perhaps encourage those
people to build the project themselves.

from autofac.

From [email protected] on February 09, 2008 00:55:23

Strong naming committed, closing, will wait to see whether enough people require
APTCA that it warrants inclusion in a conditional build.

Status: Verified

from autofac.