RE: Re: encrypting credentials is done plain wrong

Dmitry,
could you please read Raymond Chen's blog (http://blogs.msdn.com/b/oldnewthing/) and especially series about "on the other side of this airtight hatchway".

You'll stop wasting time of others. (I am suprised Stefan Küng commited "it" - since it is extremenly ineffective)

http://blogs.msdn.com/search/searchresults.aspx?q=%22airtight+hatchway%22

Like:
"If you have full trust, then you can do anything, so don't be surprised that you can do bad things, too":
http://blogs.msdn.com/b/oldnewthing/archive/2009/01/21/9353310.aspx

"If you grant somebody SeDebugPrivilege, you gave away the farm":
http://blogs.msdn.com/b/oldnewthing/archive/2008/03/14/8080140.aspx

What you want is not what you get. You won't get security,just obfusction and considering it would be already running on same privlege level as is user's => other and more easier ways to get info you want. And obfuscation and opensource doesn't go well together anyway.

(P.S.:I know it is somewhat written in log,but this is needed in ML as well.)

------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=757&dsMessageId=2719912

To unsubscribe from this discussion, e-mail: [dev-unsubscribe_at_tortoisesvn.tigris.org].
Received on 2011-04-15 05:45:14 CEST