Why I have to use fully qualified assembly name for local assemblies?

Question

In many places, like in app.config/web.config files I have to specify types using this verbose fully qualified names, like

<add name="myListener" type="System.Diagnostics.TextWriterTraceListener, System, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />

This MSDN site says, that

Partial binding, which specifies only an assembly name, is not permitted when referencing assemblies in the .NET Framework.

Ok, good - but why in some places, like when defining my own custom trace listener can't I use partial binding when I'm referencing my own, non-strongly named, locally deployed assemblies? Is there any deeper reason for this?

Answer 1

I imagine that part of it has to do with this:

http://blogs.msdn.com/suzcook/archive/2003/05/30/57159.aspx

LoadWithPartialName was depreciated in v2 which I assume was used in a number of places to handle assembly names in config files.

While it should work (it was only depreciated, not removed), I imagine they made the changes internally to anything that called it, including how config files were processed.

Answer 2

It's a security issue. The binder follows a specific set of directories when it looks for an assembly. If I wanted to break your application maliciously, I could place in an assembly which defined your type in an appropriate spot. Your code would load this unsigned, untrusted assembly and start executing my code with whatever privilege your code is running at.

Secondly, the version is important, because it allows a deployed application relying on shared assemblies to be safely updated, as .net allows you to specify an updated policy on an assembly in the GAC.

Finally, in .net it is perfectly legal to have two assemblies which define the same type, that may have been written by different authors or companies, so the fully qualified name protects your code from doing the wrong thing.