Yes I agree. That is pretty messed up. Specially for a production web server. I think if this is a vendor, I sure hope they get called on it by Apple. If this is Apple, well, I sure hope customers make sure Apple learns to develop secure .Net apps.