Rudolf said:
I hope I am not off-topic. My question is, what is the main advantage
of .NET? If I want to sell my boss .NET for a Web/Desktop/Mobile
solution, where is the main advantage? What is "new", "better" or
"innovative" in .NET? What is now, with .NET, possible? What business
challenges can be solved with .NET better than ever before?
Security.
1 Access to all memory is bounds checked, so there are no buffer overruns
2 String formating checks the parameters, so there's sprintf-like exploits
[1]
3 .NET sits over NT security, so you get everything that is already
available through NT security
4 Code Access Security checks the source (ie where it was downloaded from)
of the code that's about to run and gives the code appropriate
permissions. The permissions are used to determine if the code can call
other code, and if so, what it can do.
[1] but note that SQL injection is still possible, so if you create a SQL
string from data provided by a user, you'll still have to check *all* of
the parameters to make sure they don't add extra SQL.
#4 is incredibly useful and has no equivalent at all in Win32. In Win32 if
you use a ActiveX control, the control runs under *your* access token and
can do everything that *you* can do. Under .NET a component will be given
permissions according to 'evidence', and by default this is the location
where the component was downloaded from (but you can configure this), so
if the component comes from the internet it will *not* have access to your
hard disk. It gets better: when code requests that the framework checks
permissions (which the framework library classes will do) a stack walk is
performed and *every* assembly (ie DLL) in the stack is checked to see if
it has the required permission. There's no way you can do that in Win32.
Richard