IE9 - XBAPs Disabled in the Internet Zone

re: IE9 - XBAPs Disabled in the Internet Zone

Richard Hammond — Sat, 05 Jan 2013 18:07:00 GMT

Eric - if my website has purchased a Trusted Site certificate (e.g. from Verisign et. al.) will an IE9 browser accept an XBAP from me 'automatically' without prompting the user to change their IE9 settings before loading and running it? Thanks Richard

EricLaw -- There's really no such thing as a "Trusted Site" certificate. And no, it doesn't matter what certificate is used to sign your site or the XBAP, the restrictions mentioned here still apply.

re: IE9 - XBAPs Disabled in the Internet Zone

Chris — Thu, 15 Nov 2012 14:47:22 GMT

homedepot.bighammer.com/.../DIY is a site that uses XBAPs and no longer works.

re: IE9 - XBAPs Disabled in the Internet Zone

Ling — Fri, 15 Apr 2011 13:54:46 GMT

What is the rationale this change? I understand that the popular website may not use XBAP, but what's the harm to leave IE9 with the same XBAP support as IE8 or below? Did Microsoft experience any problems supporting XBAP in IE9? What about IE10 or above? Will Microsoft drop support for XBAP completely?

[EricLaw: XBAPs expose a variety of powerful capabilities which represent a significant attack surface that is not present in the comparable alternative of ClickOnce. We have no current plans to remove XBAP entirely.]

re: IE9 - XBAPs Disabled in the Internet Zone

WPFUser — Fri, 25 Mar 2011 21:54:35 GMT

@EricLaw: I am not making that mistake, although reading literally, one could so interpret your words. I do find it ironic that it's now Firefox that runs xbaps (when properly equipped), while IE9 doesn't. So, we'll have to NOT recommend using IE9 in order to run a .NET page...?!

I'd be a bit more comfortable with this new restriction if the official message was that specific vulnerabilities--real or even potential--prompted the trust limitation. Doesn't seem to be the case. But if not that, why bother restricting?

re: IE9 - XBAPs Disabled in the Internet Zone

BigHammer — Tue, 22 Mar 2011 22:54:05 GMT

I think Microsoft understated the use of XBAPs in the field. http://www.bighammer.com/

re: IE9 - XBAPs Disabled in the Internet Zone

EricLaw [ex-MSFT] — Mon, 21 Mar 2011 19:34:20 GMT

@WPFUser: Don't make the mistake of thinking that we ~only~ looked at the top 100,000 sites.

re: IE9 - XBAPs Disabled in the Internet Zone

WPFUser — Tue, 15 Mar 2011 18:50:27 GMT

I think there is actually a flaw in that adoption test. If one checks the top 100,000 most popular websites, then there indeed must be 0 instances of xbap, simply because most popular websites are those that use Mac-proof Linux-proof technologies, which xbap is not. That doesn't mean that a 100,000 of less popular websites don't use them, those that only target Windows. Of course, one could also reroute pages based on the browser information, and only show an xbap if requirements are met. That also isn't something that a widest-reach oriented website would do. But if you do, you can use the entire WPF framework.

re: IE9 - XBAPs Disabled in the Internet Zone

Tue, 15 Mar 2011 08:24:35 GMT

Well, I was using it. Silverlight doesn't support 3d without much workaround, so it was logical to use pages with, xbap at least until SL5 comes around.

re: IE9 - XBAPs Disabled in the Internet Zone

asf — Thu, 10 Mar 2011 21:11:53 GMT

Is this the same thing that keeps forcing a firefox add-on on me?

[EricLaw]: It's hard to tell if you're just trolling here. The original .NET Framework 3.5 installer did offer a Firefox addon for XBAP support, but it was removed from Win7 and .NET 4.0.