.NET code access security has been around for a long time, yet it seems to hardly ever be used in the real world.
To my way of thinking, this seems like an excellent concept, and one I had not seen prior to .NET. (Does it exist in other languages?)
I would like to know if anyone is proactively using it in their projects and why?
For those not using it, are there valid reasons beyond “we don’t have a budget for security” or “I don’t have the time to learn security”?
Finaly how effective is it at achieving it’s goals?
The real reason is that Microsoft gave no guidance and best practices on how to use code access security. So it never really took off. They never explained why you would want to protect your code. What happens when an exception occurs, how is it recovered from. I think those are the main problems.
Don’t confuse this with data access security which has been giving guidance and best practices.