Shawn Farkas: CLR 4 - Inside the new Managed Security Model
- Posted: May 27, 2009 at 12:10 PM
- 50,133 Views
- 10 Comments
Download
How do I download the videos?
- To download, right click the file type you would like and pick “Save target as…” or “Save link as…”
Why should I download videos from Channel9?
- It's an easy way to save the videos you like locally.
- You can save the videos in order to watch them offline.
- If all you want is to hear the audio, you can download the MP3!
Which version should I choose?
- If you want to view the video on your PC, Xbox or Media Center, download the High Quality WMV file (this is the highest quality version we have available).
- If you'd like a lower bitrate version, to reduce the download time or cost, then choose the Medium Quality WMV file.
- If you have a Zune, WP7, iPhone, iPad, or iPod device, choose the low or medium MP4 file.
- If you just want to hear the audio of the video, choose the MP3 file.
Right click “Save as…”
- High Quality WMV (PC, Xbox, MCE)
- MP3 (Audio only)
- MP4 (iPod, Zune HD)
- Mid Quality WMV (Lo-band, Mobile)
- WMV (WMV Video)
Senior SDE Shawn Farkas digs into the new security model in CLR 4. Gone are the days of head scratching complexity when it comes to reasoning about security in the managed world. The main goal for CLR 4 security was simplicity, in design and implementation
for consumers (developers) of both security policy and secure design at the code level (both of these have been traditionally overly complex with a side effect of enabling insecurity rather than preventing it).
Shawn has been working on security inside the CLR (which of course manifests itself in the managed code and libraries you use to build your applications and services). He and team have been very, very busy over the past few years essentially rearchitecting the core security model of the CLR. What, exactly, have they done? Given the somewhat drastic changes, how does this impact compatibility (especially for those applications that took the leap and built complex CAS and policies into their applications)?
There's a lot of very useful information in this conversation with plenty of whiteboarding. It's great to see the managed security model evolve into a much more simple expressive model with policy patterns that mere mortals can understand and reason about. Great job Shawn and team! Thank you.
Tune in. Meet one of the minds behind CLR 4's security model.
Enjoy
Shawn has been working on security inside the CLR (which of course manifests itself in the managed code and libraries you use to build your applications and services). He and team have been very, very busy over the past few years essentially rearchitecting the core security model of the CLR. What, exactly, have they done? Given the somewhat drastic changes, how does this impact compatibility (especially for those applications that took the leap and built complex CAS and policies into their applications)?
There's a lot of very useful information in this conversation with plenty of whiteboarding. It's great to see the managed security model evolve into a much more simple expressive model with policy patterns that mere mortals can understand and reason about. Great job Shawn and team! Thank you.
Tune in. Meet one of the minds behind CLR 4's security model.
Enjoy
Comments Closed
Comments have been closed since this content was published more than 30 days ago, but if you'd like to continue the conversation,
please create a new thread in our Forums,
or
Contact Us and let us know.
Follow the Discussion
Lovely informational. I remember having used CAS and scratching my head a few times. The new model looks much simpler.
Thank God! Well done guys! As someone that has been working with the silverlight security model for some time now, I have to say its a hell of a lot easier to understand and work with. Glad to see that getting back into the core clr.
"There's a lot of very useful information in this conversation with plenty of whiteboarding."
I read that sentence as "... with plenty of water-boarding." Sheesh, sign of the times.
Personally the security model in .NET has mostly gone over my head.. I think its because in asp.net (where I spend most of my time), you get along perfectly fine without needing to understand it.. the only security concepts I really understand in asp.net world is trust levels (configured permission sets?) because most shared hosting implies medium trust and thus you need to be aware of operations that require full trust (and in some cases different hosts have 'variants' of medium trust, where permissions are stricter).
Edit: forgot to comment about the video, which was great- the silverlight security model is easy to understand (although I'm not entirely sure what that competes with).
so no more caspol? :O i *hate* caspol
Hey, we interned at the same time and started here in the same year!
I thought he looked familiar...
I don't think we interned together, but we did work on ClickOnce together back in the .NET 2.0 / VS 2005 days
Yep - since we're not applying CAS policy to apps that you just run as .exes by default anymore, there won't be any need to play with caspol to get those working.
-Shawn
i love you [and your team]
This security model reminds me a lot like how monads control side effects at a language level for I/O and managing complexity. I watched this video once more just to verify with Haskell's type system model as the parallel, and I found this to be ~80% mappable to the monad model. Maybe an opt-in plug-able type system for the CLR/DLR for security that includes these sort of checks based on Haskell's unmatchable type system may be a fun project to explore
Remove this comment
Remove this thread
close