This post originated from an RSS feed registered with .NET Buzz by Robert Hurlbut. Original Post: Speaking at WinDev 2004 Feed Title: Robert Hurlbut's .Net Blog Feed URL: http://www.asp.net/err404.htm?aspxerrorpath=/rhurlbut/Rss.aspx Feed Description: Development with .Net, Rotor, Distributed Architectures, Security, Extreme Programming, and Databases Latest .NET Buzz Posts Latest .NET Buzz Posts by Robert Hurlbut Latest Posts From Robert Hurlbut's .Net Blog

I haven't been blogging much lately as I have been very busy getting a Release 2.0 shipped.  In the past month, though, I have been working on some ideas for an upcoming conferance.  Yesterday, I got confirmation I will be speaking at WinDev 2004 this coming October.  I will be speaking under the new Security for Developers track headed by Keith Brown.

The speaker page has not been updated yet, but these are the topics:

Writing least privilege apps
Most users work on computers where they don't have administrator privileges. Some applications require administrator privileges, hence forcing users to either run with higher privileges, or not use the products at all. Running with higher privileges can lead to serious security problems.

The solution is for developers to learn to write least-privileged applications. Writing least-privileged applications is not easy--it is something that needs to be learned as well as learning a new lifestyle. In this talk, I will introduce practical ways to develop least-privileged applications in .Net. Also, the developer will learn the lifestyle changes recommended for writing effective least-privileged applications.

Hosting applications in secure AppDomains
The .Net Framework gives developers the ability to write trusted applications that can load and control other assemblies. This technique is called hosting and it is a powerful way to extend the .Net Framework security system when developing pluggable components. In this talk, I will describe how AppDomains can be created and used to isolate assemblies as well as how to control the trust levels associated with code in the AppDomains. I will also introduce developers to the CLR hosting API, as well as techniques used to secure unmanaged clients.