WPF bugfix and IE8 hotfix

[Dogway]

First and foremost, do I need Windows Presentation Cache?

And/or does Firefox (or other web browser) need its plugin?

I have read several pages but still can't make up my mind, information is very technical.

In case I need it, the question is the next. The WPF plugin for firefox has a bug documented in the MS09-054 bulletin. Its hotfix is ultimately superseeded by KB2647516 which is a "Cumulative Security Update for Internet Explorer", and it comes in 2 flavours: WindowsXP-KB2647516-x86-ENU.exe and IE8-WindowsXP-KB2647516-x86-ENU.exe. Let's say I use both IE8 and firefox which one do I install so it fixes the WPF bug and updates the security files of IE8? and another one, if I am going to add IE8 as an addon do I need to slipstream IE8-WindowsXP-KB2647516-x86-ENU.exe to the IE8 executable for the addon creation, or just install WindowsXP-KB2647516-x86-ENU.exe as a normal hotfix in nlite? which one will fix both things?

[Guest]

First and foremost, do I need Windows Presentation Cache?

And/or does Firefox (or other web browser) need its plugin?

Woody Leonhard suggests that Firefox does not need its plugin.

While MS09-054 was supposed to fix the hole in Firefox introduced by Microsoft, it’s much smarter to simply disable Microsoft’s .NET Framework Assistant for Firefox. That’s exactly what Firefox has done. (Indeed, it’s what Microsoft recommended!)

Let's say I use both IE8 and firefox which one do I install so it fixes the WPF bug and updates the security files of IE8?

Use IE8-WindowsXP-KB2647516-x86-ENU.exe.

if I am going to add IE8 as an addon do I need to slipstream IE8-WindowsXP-KB2647516-x86-ENU.exe to the IE8 executable for the addon creation, or just install WindowsXP-KB2647516-x86-ENU.exe as a normal hotfix in nlite? which one will fix both things?

If you're using an updated addon for Windows XP then you do not need either of those files in nLite.

[Dogway]

Nice read. I extended my read with the "official" note on the microsoft side http://blogs.technet.com/b/srd/archive/2009/10/12/ms09-054.aspx

All the latest official updates state that it is safe:

http://blogs.technet.com/b/srd/archive/2009/10/12/ms09-054.aspx

http://blog.mozilla.com/security/2009/10/16/net-framework-assistant-blocked-to-disarm-security-vulnerability/

http://shaver.off.net/diary/2009/10/18/update-net-framework-assistant-clickonce-support-unblocked/

What it depicts is that the .NET Framework Assistant add-on and the WPF plugin are related, and that they don't need the bugfix because it was a "false alarm" (?). However they didn't mention anything about IE8 being secure as you can see in their microsoft blog post footnote:

http://blogs.technet.com/b/srd/archive/2009/10/12/ms09-054.aspx

So IE8 still needs the bugfix through the KB2647516 hotfix. Is it true? If so then I guess you are including it in your addon. I ask because I'm building it by myself for Spanish OS.

But I still wonder what is WPF for, I read it is to make some web applications GUI more dinamic... I also read the Presentation Font Cache is to make a fonts prefetch for some programs which makes the launch and handling faster, I did search for programs that makes use of it and all of them looked somewhat bloatware... . All in all, at some point Microsoft didn't seem too concerned about turning the thing off so that makes me think that it's not a very useful feature(?)

Do you think is better to directly disable the "Windows Presentation Foundation Font Cache 3.0.0.0" service?

[Guest]

IE8 needs KB2647516, and it is in my addon. OnePiece has a tool you can use to create your own Spanish IE8 addon for XP.

Wikipedia has a page on WPF. To me it seems like another abstraction layer between the programmer and the OS that can potentially slow things down. I don't know how useful it is because I haven't tried developing in .NET yet.

I have no opinion on disabling services. I don't disable them.

[Dogway]

Thank you. Yes, I was already using OnePiece's tool for that : )

edit:

btw I found some useful information on WPF:

http://www.hanselman.com/blog/FirefoxWPFAndXBAP.aspx

It just talks about the browser extensions, and not too much on the benefits for the stand alone applications. I think I can get rid of them for firefox, although not too sure about the service. I have it setted "not started" and automatic, but after a while it initializes itself, so I must have some application that makes use of it, acrobat probably but not sure...

Edited February 27, 2012 by Dogway