OK. So when does what we write become a coding template and just a simple example???
I was reading through Fritz Onion’s most excellent expose of ASP.NET (Essential ASP.NET). In the VB.NET version of the book (and I am sure somewhere in the C# version) on page 76, when discussing configuration files, the example on page 76 has a DSN with User=SA and Password = nothing. Now this has been something that has been preached for the longest time (well before he wrote the book at least). Do I think that Mr. Onion is implicitly recommending that you use SA/No password? No. Are there some who would see this code and follow the example?—why…yes I do—I’ve seen it. Further, I have seen a fair number of applications where the username and password is in plain text in the web.config file.
How come there aren’t any books out there that address encrypting sensitive information in configuration files? Is it the complexity? Is it the “secret code I don’t want to share”? I tried doing it for a client, but they didn’t understand what all the process was doing, so they had me take it out. Go figure. No wonder we can’t write secure applications. But that is a rant for another day.