SharePoint 2010 to CAS or not to CAS

Came across a statement by MS which got me thinking

"Untrusted solutions – Deploying custom code in bin folders can cause slow server performance. Every time a page containing untrusted code is requested, SharePoint Server 2010 must perform security checks before the page can be loaded.Unless there is a specific reason to deploy untrusted code, you should install custom assemblies in the GAC to avoid unnecessary security checking."

http://technet.microsoft.com/en-us/library/ff758647.aspx

So now GAC is good and CAS is bad?

Ok folks, let's all stop adhering to a least priviledge concept and start giving our code full trust every time we deploy something. Because if we don't, we'll slow down SharePoint.

I don't think so!

Although I understand the implications of having to check security of the code when Code Access Security Policies are involved, is the overhead of checking the policy when the assembly is loaded really that high? So far I have found no evidence of this causing a noticeable performance degradation other than in theory.

But hey, we have Sandboxed solutions now! So no need for CAS?
Although Sandboxed solutions take away a lot of headache from Server Administrators that previously had to chase down developers to find out why their server just crashed, they are not the golden bullet to all security issues. The question still remains, how much do you trust the code to do what it is supposed to do and not expose loopholes for others to exploit? Especially when installing third party features I personally would think twice about putting the dlls into the GAC of my production machines.

Sadly enough, there are loads of scenarios where you have no other choice but to run the code in the GAC and thus I am very grateful for the Sandbox, where I can run the code in a controlled environment before letting it loose on the whole farm.

For those of you who actually want to know how CAS works in practice, check out this little gem. It is based on .NET 1.1, but is still relevant today.
http://msdn.microsoft.com/en-us/library/ff648663.aspx

oh, and in .NET 4.0 some things have changed in regards to CAS, especially when calling GAC assemblies from partially trusted dlls. check it out here:
http://msdn.microsoft.com/en-us/library/dd984947.aspx