Re: security issues with a dll

From:

"William DePalo [MVP VC++]" <willd.no.spam@mvps.org>

Newsgroups:

microsoft.public.vc.language

Date:

Wed, 7 Mar 2007 00:44:34 -0500

Message-ID:

<eFW6wuHYHHA.4264@TK2MSFTNGP05.phx.gbl>

"Brian Muth" <bmuth@mvps.org> wrote in message
news:e3KjWsFYHHA.3520@TK2MSFTNGP04.phx.gbl...
[replies inline and out of order]

I was hesitant to mention it at all since there is a very large body of
knowledge that must be understood to accomplish this. Too much for a
novice, but obviously within your realm of expertise (if you were so
inclined).

You give me too much credit, Brian. I've _never_ been able to grok COM. :-)

No passwords are stored anywhere, since Component Services determines the
SID at the time the COM+ application is configured. (The password is
provided at that time).

Ah. Adding SID to the google query string makes all the difference and
yields the mother lode:

http://www.microsoft.com/msj/1199/comsecurity/comsecurity.aspx

With COM, there is always somebody saying something like this - which I took
from the article

<quote>
Perhaps you are wondering why COM+ needs a special security model. Windows
is a secure operating system platform, so why can't COM+ components simply
take advantage of that security model? The answer is that they can?but they
shouldn't. Neither Windows 95 nor Windows 98 supports many of these security
functions. COM+ requires a security model that can be supported on all
platforms on which COM+ services are available.
</quote>

and which causes my head to hurt. ;-)

Regards,
Will