2 ms·
> This comment is nonsensical; it says that one bug damns all of > Microsoft as a "huge pile of crap", even though that one bug is > basically shared by eve
by alecco 16y ago
> This comment is nonsensical; it says that one bug damns all of
> Microsoft as a "huge pile of crap", even though that one bug is
> basically shared by everyone who has implemented AES.
I'm not talking about bad use of crypto, I'm talking about: "the web.config thing" as an example of poor architecture legacy. Without all the issues in ASP.NET internal design, the Padding Oracle attack wouldn't be as serious as it is (IMHO.)
> total non sequitor opportunity to pick a fight about Microsoft
Again... I think Microsoft is doing an amazing job at security. But they still have a huge pile of legacy crap they need to address and sometimes, like ASP.NET "config thing", redesign.
Your comments on this bug are very insightful and I do not want to pick a pointless fight over MS with you. I clearly failed to try to make you see my point of view (and perhaps not agree with but at least see it isn't just a bashing rant.)
- euroclydon 16y agoReally? What is your favorite non-config-file-using web framework?
- alecco 16y agoCalm, I didn't mean no config file. But any file with sensitive information should be stored in a safe directory (not the root, for example) and with strict permissions. Also any sensitive data within that file should be protected if possible. This applies to any remotely accessed application, of course. Also, how does a process working with remote clients have full access to a sensible file like that? Aren't there ACL features or something like that that can block that access? (No sarcasm meant.)
- tptacek 16y agoSorry. I'm a bit defensive about this, given the crazy people running around saying "see, all you have to do is turn on customErrors to fix this flaw".
- alecco 16y agoDude, it's an amazing job you're doing on this ASP.NET discussion. Keep it up.