| As with many things in life, it is a matter of requirements and risk management. If the requirements specify a certain level of performance then you must make sure any proposed solution can meet those requirements. If you are afraid of memory leaks and cannot get access to the source code for the extended stored proc then this may be a risk you simply cannot take. (I like to see source code myself) Keep in mind that moving unknown code to other tiers just means the memory leaks will happen somewhere else - not exactly the best situation.
I recommend you only go with a solution that meets your individual requirements and risks. Every person's situation is different and that's why I can't give you a blanket answer. Whatever path you choose, just make sure you test, test, test. For the record I am partial to a non-extended stored proc approach because I find my applications scale better when I do crypto on the BOL layers that usually exist in web or component farms.
Chip
|