Monthly Archives: October 2007

Finally! Usernames over Transport Authentication in WCF

Posted on October 31, 2007 by Dominick Baier

Sometimes you have to wonder why the most basic features are missing in a v1 product… Imagine this scenario: You have a public facing web service. You want the widest possible reach and compatibility – so the perfect technologies for … Continue reading →

Posted in WCF | 3 Comments

Does Microsoft regret the Security Push?

Posted on October 31, 2007 by Dominick Baier

Well – at least parts of it – but this did get your attention, right? Not sure what to think about that. Remember the ILoveYou virus? It replicated itself to file shares to spread across intranets. I think the argument … Continue reading →

Posted in Uncategorized | Leave a comment

Try XSSDetect

Posted on October 25, 2007 by Dominick Baier

Exciting things are happening over at the ACE team at Microsoft. One is XSSDetect – a Visual Studio plugin that analyzes your code to find potential XSS vulnerabilities. Mark also gives a sneak preview of other upcoming tools. Interesting!  

Posted in Uncategorized | Leave a comment

ValidateRequest does not mitigate XSS completely

Posted on October 23, 2007 by Dominick Baier

I often mentioned that to customers and students. Here is the “official” word.  

Posted in ASP.NET | Leave a comment

.net@movies Episode 1 – Web Security

Posted on October 10, 2007 by Dominick Baier

Am 17.Dezember findet die erste Veranstaltung der brandneuen .net@movies Serie des ProDev Colleges statt. Bei diesem ersten Event geht es um ein Thema, das mir schon lange sehr am Herzen liegt: Web Security. Mein geschätzer Kollege Christian Wenz und ich … Continue reading →

Posted in Uncategorized | Leave a comment

Sichere Software mit Microsoft .NET entwickeln

Posted on October 4, 2007 by Dominick Baier

…ist der Titel eines neuen Buches vom Entwickler.Press Verlag. Darin könnt Ihr eine Artikelsammlung von Autoren wie Michael Howard, Steve Lippner, Christian Wenz, Darius Parys und mir finden. Behandelt werden Themen wie Windows, ASP.NET, .NET und WCF Security. Das ganze … Continue reading →

Posted in Uncategorized | Leave a comment

TechEd:Developer 2007 Security Track

Posted on October 4, 2007 by Dominick Baier

TechEd:Developer in Barcelona this year will be the first TechEd ever that has a “physical” security track. That’s great. There are great speakers and interesting sessions on this track, e.g. Michael Howard (SDL, Threat Modeling), Keith Brown (identity, claims and … Continue reading →

Posted in Uncategorized | Leave a comment