A planned "Express" applications feature of the .NET Framework will enable Web developers to create applications hosted within Internet Explorer (IE) that run without being permanently installed on a user's system. Included in the latest build of Avalon—a new graphics subsystem that will be part of the next Windows client (code-named Longhorn) and also available for Windows XP—Express applications will support the same scenarios as Java applets. However, Java applets are already fighting an uphill battle against alternatives such as Flash and Ajax, and Express applications may face similar challenges.

Express Applications Hosted in Browser

Unlike stand-alone Avalon applications, Express applications run within the context of IE. Running within IE simplifies application installation and provides increased security compared with stand-alone applications.

Express applications can run without having to be permanently installed on a user's system. The mechanism used to download applications is based on ClickOnce—a technology included with version 2.0 of the .NET Framework—which aims to make it easier to download, install, and update thick-client applications. However, unlike ClickOnce, which permanently installs applications, Express applications are temporarily downloaded to IE's cache.

In addition, running within the browser means that an Express application runs with fewer security privileges (sometimes called running "in a sandbox.") Unlike stand-alone applications, which inherit the full set of privileges assigned to the user, Express applications run with the more limited settings associated with Web pages. In effect, Express applications provide the functionality associated with ActiveX controls, such as faster graphics, but without the security risks.

However, like stand-alone Avalon applications, Express applications will require the correct version of the .NET Framework on the client system. The required support will probably ship preinstalled in Windows Longhorn, but will have to be retrofitted onto Windows XP systems.

Not the Only Solution

Express applications are not the only means of providing higher levels of functionality to browser-based applications. Several alternatives are already available and have large numbers of users.

Java applets. Sun Microsystems pioneered the development of secure, browser-based applications with its Java applet architecture. Just as Express applications require the .NET Framework, running Java applets requires that users have the correct version of the Java runtime installed.

ActiveX controls. Like applets, ActiveX controls run within the browser. But unlike applets, ActiveX controls run with the full privileges associated with the user. To mitigate the security implications of running arbitrary code within the browser, Microsoft also provides the ability for ActiveX controls to be digitally signed, helping users identify the source of a control before allowing it to run. However, while some corporations continue to use ActiveX controls for internal applications, the combination of security holes, maliciously written controls, and the complexity of managing end-user security settings have greatly reduced the use of ActiveX controls on the public Internet.

Macromedia Shockwave Flash. Many Web developers aren't aiming to create applications with many features but merely want to create Web sites that contain more sophisticated multimedia graphics than provided by basic HTML. Macromedia's Flash or Shockwave technologies have proven to be popular for this purpose. Like Java applets, Flash and Shockwave require plug-ins to be installed on the user's system, but the widespread use of Flash on the Internet has caused many OEMs to preinstall it.

Ajax. While some vendors have been developing technologies to provide alternatives to HTML, others have been discovering how to use HTML and scripting to create ever more sophisticated user interfaces. Specifically, the combination of XHTML, XML, and JavaScript (sometimes referred to as "Ajax"—shorthand for "Asynchronous JavaScript with XML") is gaining popularity with Web developers such as Google, because it gives them more functionality without requiring any additional software to be downloaded or installed.

Given the wide range of comparable options, Avalon Express faces an uphill battle. For the small number of IT organizations using Java applets as part of their internal infrastructure, Avalon Express applications give them a way to move to the .NET Framework. But on the public Internet, it will be many years before the installed base of Avalon is large enough for Web developers to be able to assume a reasonable percentage of users have the technology on their systems.

Resources

For an overview of Avalon, see "Longhorn Preview Focuses on Developers" on page 3 of the Dec. 2003 Update.

Details on ClickOnce can be found in "ClickOnce Aims to Ease Installation" on page 24 of the Apr. 2004 Update.

For more information on Ajax, see "Dynamic HTML Rides Again" on page 20 of the June 2005 Update.