>I have 2 questions,
>
> The first is, should I take a "StrongNamed" assembely and edit it with
> a hex editor to change something in one of its resource files I need
> changed, it barks about the Signature not matching.
>
> No Suprise there,
>
> BUT I have a different process whereby I can modify a StongNamed
> assembely (not even my own) to me hearts content and there is NO
> PROBLEM and the Signature remains intact (The ORIGINAL Signature) sn
> -T returns the original value before AND after modification in this
> manner.

> Isnt that a HUGE Bug and/or security risk ? (To the point StrongNamed
> ass are used to ensure security) ?????

> If it is just me misunderstanding the nature of SN Assy ?

> If this is a BUG/Security Issue, what is the "Proper" way through MS
> Channels to report it and the correct time period for a fix to be
> applied before releasing the issue to the world abroad.
>
> The funny/sad part is this bug/feature is beneficial to me at the
> moment, but the ability to add any code I want to anyones assembely
> (MS Included) and have its SN Signature match what it did before it
> was modified seems a bit spooky.

> I can't see a security bug. Try to load the strongly named assembly you
> modified into the CLR and you'll get an error.
>

"Christian Heide Damm" <chrishd@microsoft.com> wrote in message news:<#S7yZ$QiEHA.1384@TK2MSFTNGP10.phx.gbl>...
> sn.exe doesn't load the assembly for execution, so it's not the CLR that's
> doing the loading, and hence no strong name verification is performed.
>
> Same if you open your assembly in Notepad: no strong name verification.
>
> But you can't load the assembly in to the CLR.
>
> Christian
>
> ---
>
> "WertmanTheMad" <cwertman@webchamps.com> wrote in message
> news:13990782.0408230348.ba0f4eb@posting.google.com...
> >> I can't see a security bug. Try to load the strongly named assembly you
> >> modified into the CLR and you'll get an error.
> >>
> >
> > That is true if I load one modified with a hex ed, eveen 1 byte change
> > and it fails. BUT When I do it another way I can change as much as I
> > like and it SUCCEEDS,
> >
> > Thats what I am trying to say shouldnt it FAIL after being modified ,
> > even heavily modified ?
> >
> > I mean changing only 1 charachter in a resource file with a hex editor
> > it fails, if I do it the other way I stumbled upon (probably a result
> > of having no clue and not knowing better) it doen NOT Fail to load and
> > plays nice with all the other SN assy that are part of the application
> > (And are not written by me)
> >