Re: Arbitrary Sandbox

[Georg Bauhaus <rm.dash-bauhaus@futureapps.de>]

On 10.02.12 03:21, Rob Shea wrote:

> My bad... I will not be doing any coding on this project. I have been
> dropped in to get the client's/investor's/internal technical teams all
> on the same page as there has been much bickering.

That sounds like there is an opportunity to force either
camp to respond to some questions that do not allow much
bickering. The answers should influence the language choice
(if any). As a bonus, answers based on facts should help
everyone saving face.

The starting point is whether the two options Ada vs C# will
"provide important security features", or whether they
are sold with a promise of providing important security
features. Is this enough?

The necessary follow-up question addresses whether the project
would need

- a secured system, or
- a secure system, or
- something that (how exactly, given the context?)
  provides security features?

Can members of either party claim anything of the above
at some level of expertise, and at a sufficient level of detail?
Can they name meaningful definitions of the above terms?
Can they exemplify how these things mentioned will interact,
specifically, with the choice of language?


Some subjects:

Security experts have explained that the shift from
Windows Vista to Windows 7 has meant more user satisfaction
with UAC at the price of UAC defaulting to insecure.
Does access control, in general, matter? In which ways?
Should it be part of testing applications?

(I imagine that some will answer in the style of "you just
have to change the defaults..." which seems technically
correct to some extent. Should help to put the requirements
in focus, in any case. The more often someone says the words
"your just have to...", the less the built-in security seems
to be, and the more diligence is needed.)

By which technique do the C# compiler and then the .NET
JIT compiler produce safer executables than a compiler
that produces executables directly?
This question should test actual knowledge.

Is the goal to produce applications that mainly add
MVC glue to existing .NET classes?

Catch question: Is VB.NET more or less secure than C#?
Why not VB.NET, then?