{"action":"created","issue":{"url":"https://api.github.com/repos/AArnott/pinvoke/issues/202","repository_url":"https://api.github.com/repos/AArnott/pinvoke","labels_url":"https://api.github.com/repos/AArnott/pinvoke/issues/202/labels{/name}","comments_url":"https://api.github.com/repos/AArnott/pinvoke/issues/202/comments","events_url":"https://api.github.com/repos/AArnott/pinvoke/issues/202/events","html_url":"https://github.com/AArnott/pinvoke/issues/202","id":137074866,"number":202,"title":"SuppressUnmanagedCodeSecurity","user":{"login":"vbfox","id":131878,"avatar_url":"https://avatars.githubusercontent.com/u/131878?v=3","gravatar_id":"","url":"https://api.github.com/users/vbfox","html_url":"https://github.com/vbfox","followers_url":"https://api.github.com/users/vbfox/followers","following_url":"https://api.github.com/users/vbfox/following{/other_user}","gists_url":"https://api.github.com/users/vbfox/gists{/gist_id}","starred_url":"https://api.github.com/users/vbfox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vbfox/subscriptions","organizations_url":"https://api.github.com/users/vbfox/orgs","repos_url":"https://api.github.com/users/vbfox/repos","events_url":"https://api.github.com/users/vbfox/events{/privacy}","received_events_url":"https://api.github.com/users/vbfox/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/AArnott/pinvoke/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-28T17:25:19Z","updated_at":"2016-02-29T01:42:13Z","closed_at":"2016-02-29T01:42:13Z","body":"The `[SuppressUnmanagedCodeSecurity]` attribute is often placed on classes using PInvoke because otherwise any call to native dlls incur a performance cost.\r\n\r\nMultiple questions here that I don't have an answer to :\r\n* Is the performance problem still existing ?\r\n* Is the attribute still useful ? The security model of .NET changed a lot since it's introduction and the idea of the CLR acting as a security barrier now seem pretty dead (Or any user-level VM by the way, kernel-level isolation as used in Chrome or Store Apps being much more secure).\r\n\r\nI suspect that the performance cost is still there as CAS is deprecated since 4.0 but it's still partially present. If it's the case I think we should add the attribute everywhere as we want target relatively modern, 4.0+ apps & libraries."},"comment":{"url":"https://api.github.com/repos/AArnott/pinvoke/issues/comments/189992713","html_url":"https://github.com/AArnott/pinvoke/issues/202#issuecomment-189992713","issue_url":"https://api.github.com/repos/AArnott/pinvoke/issues/202","id":189992713,"user":{"login":"AArnott","id":3548,"avatar_url":"https://avatars.githubusercontent.com/u/3548?v=3","gravatar_id":"","url":"https://api.github.com/users/AArnott","html_url":"https://github.com/AArnott","followers_url":"https://api.github.com/users/AArnott/followers","following_url":"https://api.github.com/users/AArnott/following{/other_user}","gists_url":"https://api.github.com/users/AArnott/gists{/gist_id}","starred_url":"https://api.github.com/users/AArnott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AArnott/subscriptions","organizations_url":"https://api.github.com/users/AArnott/orgs","repos_url":"https://api.github.com/users/AArnott/repos","events_url":"https://api.github.com/users/AArnott/events{/privacy}","received_events_url":"https://api.github.com/users/AArnott/received_events","type":"User","site_admin":false},"created_at":"2016-02-29T01:42:13Z","updated_at":"2016-02-29T01:42:13Z","body":"Thanks. I wasn't familiar with this attribute. I suspect it's only allowed to appear in assemblies in Full Trust. But our assembly already requires that by virtue of doing nothing but P/Invoke. Still, I suppose we have to consider security implications of applying this. So I agree, let's not do anything with this attribute unless there's a need to revisit."}}