The .NET Core example in the article uses the ASP.NET Core Kestrel server which operates entirely in user mode.
I know about Kestrel, I'm responding to that particular phrase in the comment :)
Re:WordPress on .NET
by drzaiusapelord on Tuesday February 28, 2017 @12:56PM
(#13755819)
That's mostly client-side and easily avoided by not using IE/Edge. .NET uses its own library as well I believe. Not sure what the default is.
Historically, the schannel infrastructure has been secure, especially as compared to openssl.
>How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library?
Because, lets face it, openssl is a shit project of legacy code no one wants to fix and https a design by committee standard no one can work well?
"an attacker would have to send a specially crafted HTTP request to the affected system"
"Disable IIS kernel caching"
That's definitely not client-side at all. IIS is the thing that uses http.sys, and classic ASP.NET apps (not the new Core stuff) are usually deployed with IIS.
http.sys has ifdefs to support one platform, in one configuration. Meanwhile, https://mta.openssl.org/pipermail/openssl-dev/2015-January/0...
The number of config permutations in openssl is staggering, and that has to have an effect on the overall test coverage - which probably affects the number of bug that pass through testing.
How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library?
http.sys is a fundamentally horrendous idea, see CVE-2015-1635 https://technet.microsoft.com/library/security/MS15-034 An exploited HTTP parser shouldn't lead to RCE "in the context of the System account".