4 ms·
The difference is that things like enabling remote errors or disabling request validation in ASP.NET requires that you explicitly change those settings. The def
by Encosia 14y ago
The difference is that things like enabling remote errors or disabling request validation in ASP.NET requires that you explicitly change those settings. The default config doesn't expose either of those issues.
- gregors 14y agoI've got a screen capture with bing showing me remote errors. People do make mistakes.
- meaty 14y agoBing are Microsoft dogfooding new tech. They will make mistakes. For those of us who are conservative there are very few opportunities to make mistakes. We have checklists, security policies, code reviews and even protection components in our framework as well as completely segregated web and back end systems.
- Encosia 14y agoOf course people make mistakes. The point is that the framework doesn't expose you to those risks by default. You have to explicitly make those mistakes yourself. Further, when ASP.NET does have the odd vulnerability crop up, patches roll out automatically as critical updates via Windows Update. So, these things get patched quickly even if the app or server is no longer actively maintained, as is the case with so much code out there on every platform. Ironically, it's a bit like Windows Server is the Google Chrome of server environments when it comes to frequency and pervasiveness of updates.