I obviously need to read up on this more. I thought code access security by implementing security policies had to be accomplished by the system administrator outside of the dotnet app by using the .NET framework configuration tool Mscorcfg.msc or the Code Access Security Policy tool caspol.exe. Now I understand that this is indeed built into the framework, but it is not handled at the actual application level at all (in other words, handled by the developer in the app) but by the network or system administrator at the framework level on the network or workstation, correct? While the ability to control applicaiton and data security this way is terrific, this method is more along the lines of employing security policies at the OS level for VFP tables also. Am I missing something John? What else should I research on dotnet security to get more information? I am truly interested because application security has been an issue in the past as you know.


>Data security belongs with the database - which is something that is taken care of. Code obfuscation is really more of an IP issue - and is not something I had in mind when I made the statement. As far as code access security is concerned, I see the ability to implement a security policy in its own abstration level is a good thing. In the long run, it is more efficient and managable - also given that a role-based model exists. In Fox, you simply do not have the services - and must do a good deal of work "rolling your own".
>
>In a nutshell, that is my stance. Again, you can agree or disagree....