views:

245

answers:

3

We produce a number of applications that share assemblies. Since memory or disk space is not a problem, we use private assemblies by duplicating the shared assemblies into each app's local folder. This avoids the issues caused by putting them into the GAC. I hear that strong names are a real good thing that is required if we share assemblies in the GAC.

Is there a good reason to use strong names for private assemblies?

BTW: Here is an excellent reference on assemblies: link text

A: 

If you strong named you assemblies you also solve a security issue. When you strong name your assembly you don't allow someone to tamper with your assembly or replace it with another one.

Vadim
This is not true; people can tamper with your assembly and / or replace it with another. Of course, executables won't link at runtime unless the validation has been disabled or the executables have been modified to remove the strong linking requirement. But if you're able to tamper with an assembly, the chances are you're able to tamper with the executable too.
Barry Kelly
+1  A: 

I should note that if you are moving files around directly, you are eliminating any benefits that the GAC provides you (most notably versioning).

For private assemblies which are not shared, strong-naming isn't vitally important. At most, it could prevent a malicious (non-admin) user from replacing your assembly with an unauthorized version. But then again, an administrator could disable strong name validation and allow this kind of "attack" relatively easily.

bobbymcr
A: 

Generally speaking, anywhere that assigning strong names is useful, it's also required, and vice versa.

Robert Rossney