Anything wrong with NOT signing a .NET assembly?

One of my colleagues is very keen on signing assemblies. He literally tries to sign anything. Even when we use assemblies from Microsoft that are not signed, he will take the source code, sign it and then ask other developers to use his copy instead.

I can understand the basic idea behind signing an assembly: to ensure a particular assembly is not compromised by some dodgy hacker. So if we are a software development company, we should sign our assembly before releasing some .NET library to our customers.

However, we primarily develop web applications for our own use here, and I just can't see the point of signing every single assembly we use.

Am I missing something here?

.net strongname

Edit Report

One additional point: signing your assemblies breaks backward compatibility over versions. Your references all start to include version numbers and versions with other version numbers are considered non-compatible. This hinders upgrading to newer versions of distributed assemblies.

In my opinion, you should only code-sign assemblies if you see some concrete gain from it:

if you deploy to environments where untrusted people might touch your assemblies
in certain plug-in models, where you want to use the certificate as evidence for upgrading the trust
if your code should be callable from other signed code (a project like, say log4net, justifiably signs their code to be widely usable; they messed up hugely in compatibility by losing their secret key a few years ago, another risk of code-signing).
if you want to deploy to the GAC

answered 2009-09-01T18:07:59.703

Anything wrong with NOT signing a .NET assembly?

1 Answer

Your Answer