Are there minimum quality standards for .NET applications?

Question

Does Microsoft require third party .NET applications to meet any minimum standards for things like application security or code quality?

Answer 1

Microsoft does not impose any minimum quality or security requirements on the applications built on the .NET on the desktop and on the web.

We all want applications to be secure and of high quality, but there is no certification process for desktop and web .NET applications. It is up to individual developers and their employers (if any) to ensure quality.

The .NET platform also extends to the mobile market and there Microsoft has application certification requirements that a Windows Phone application must meet in order to be listed in the Windows Phone Marketplace. According to that page, the core requirement categories are:

1. Reliability;
2. Efficient use of resources;
3. Lack of interference with other phone applications;
4. Absence of malicious software.

For games developed on the XNA platform, there are different standards for indie games and professional ones. Indie games go through a community-driven peer review before they can be published on XBox Live. I can't find a link to a description of the process major game releases go through, but from my combined developing and gaming experience I imagine it is also pretty rigorous.

Answer 2

You may be confusing the idea of Microsoft's ownership of the .NET platform with control of that platform. Although Microsoft can direct and modify the platform itself as they see fit, they do not exercise control or claim rights over any software written to target the platform. If they did, it would be platform suicide--few third-party software vendors would willingly write code that Microsoft could then "veto."

The same is true of the Java platform: Oracle controls its future direction, its development, and its core features, but third-party developers create software to run on the platform independently of Oracle.

Answer 3

Microsoft itself has common guidance on how secure your code should be. For starters, there is a Microsoft Security Development Lifecycle (SDL). The MS SDL also contains further guidance to fulfill common compliance such as HIPAA.

Visit Microsoft SDL: http://www.microsoft.com/security/sdl/default.aspx

Code quality in .NET can be achieved if you meet common guidelines for good codes (taken from Microsoft's best practices):

• Secure by default
• Secure by design
• Secure in deployment

More on this: MS SD3 Video

But the best way to implement these are by practising these into everyday habits of developing software, especially when writing codes.