Threat Modeling by our own Frank Swiderski and Window Snyder is one of those books you should read. Threat modeling may not be new, but if you're new to threat modeling you should pick up this book.Threat modeling is about understanding threats to your application or feature and deciding how to mitigate those threats so that you aren't left with vu...

I previously mentioned how I worked on a project that deploys managed applications via the Internet or an intranet. Some of my initial research was into hosting managed controls in Internet Explorer. The .NET Framework 1.0 originally granted no permissions to the Internet_Zone code group so we had to deploy a small setup that used a custom class t...

QA uncovered a problem when testing our patches for .NET Framework 1.0 and 1.1 lately that will ship with an updated binary that now runs as a service under Windows NT platforms. The file version was incremented but in the log file we saw the following:MSI (s) (3F:2B): Executing op: FileCopy(SourceName=netfxupd.exe|netfxupdate.exe, SourceCabKey=DDP...

A frequently-asked question is how to install an assembly into the Global Assembly Cache (GAC) and overwrite the old assembly that has the same strong name. This is known as in-place updating.The first answer is "don't". Besides being a trusted global store for managed assemblies that is intrinsic to assembly resolution, the GAC also prov...

If you've tried to install the .NET Framework 2.0 Beta 2 redistributable for either ia64 or x64 from an administrative installation point, you might've seen an error like the following: While investigating patching scenarios for 64-bit SKUs I found that for source extraction and administrative installs the 32- and 64-bit files map to the same path...

A couple teams recently reported an issue where their script host hung due to deadlocks. Since jscript.dll was in the call stack for the hung thread it didn't take long for the bug to wind up in our lap, since CPX also sustains Windows Script. The problem was that as one thread was exiting and was passed to the callback in jscript.dll, the JScrip...

As a photography enthusiast and the son of a professional photographer (SLR, or "single lens reflex"), I am excited to read that Longhorn will support raw image formats from several manufacturers of digital cameras and digital SLRs.Raw images are pre-pixilated dumps from the image sensor - a CCD - that are comparable to film. Keeping raw image...

Today I released version 1.3.1976 of my Shell Extensions for .NET Assemblies. This version adds support for Windows Me and fixes a few bugs to provide column handlers and overlay icons for Windows Me, Windows 2000, and newer.Among the fixes was a crashing bug that occurred because of an access violation exception when sorting by the public key toke...

The Developer Division Customer Product-lifecycle Experience team has a new logo thanks to his impromptu logo contest on Channel9. CPX voted for several logos over the last couple of weeks and the winner was chosen.

We are going through test passes on some new functionality for our patch build system and ran into a bug in a service I wrote to handle post-reboot commands without requiring an interactive login. The documentation for the SERVICE_STATUS structure for NT Services (a.k.a. Windows Services) states that the SERVICE_ACCEPT_STOP (0x40) is not suppo...