Question

I have been issued a problem with security. A bank will not allow use of DLL’s in the project. What sort of structure would be needed to allow DataAccess and or the use of external services (like an email client mailchimp, icontct).

has anyone else encountered this sort of problem before? If they have how should the project be structured (.net 3.5+).

Thanks,
KJ

Answer 1

Do you mean that no external DLLs can be used? .NET is basically a series of DLLs (the BCL) + the runtime. However, I can imagine that this bank wants to be able to inspect your application code without having to inspect any external assemblies by using .NET Reflector. In that scenario even using ILMerge won’t do the trick, because this doesn’t make the security problem go away. It will just hide those external assemblies inside your application assemblies and make everything even harder to inspect.

I think you only option is to use as little external frameworks as possible and if you use them, let the bank inspect them with .NET Reflector and show exactly which configuration you use.

To be honest, I think it is pretty hard to be very productive without the use of external libraries. Take for instance a logging framework. Even the simplest application benefits from having a logging framework.

---

While it is not uncommon for these types of organizations to be very conservative, not being able to use any external dll is very extreme. These organizations usually have a white list of versions of particular frameworks they do trust. You should ask for that list. They should have one.