User-Interface-Technologien für das Web

Silverlight 2.0 - Microsoft’s RIA Platform Enters the Second Level
Department of Computer Science University of Technology Dresden Dresden, Germany

Thomas Gängler ABSTRACT
Microsoft Silverlight pushes fast into the diverse market of technologies, which mainly interact as browser plug-ins and deliver media experiences and Rich Internet Applications (RIAs). Where the first goal was almost reached with the first release of Silverlight; the second one might already have been provided by additional components of Silverlight 2. The new version comes along with useful adoptions of Microsoft’s .NET Framework and other interesting issues, for example the new Deep Zoom technology. These expansions build a common ground for a deep analysis of Silverlight 2. Therefore, questions like the following two ones will be answered with this paper. Will Silverlight fulfil all necessary requirements to build enriched RIAs? Can it keep up with the omnipresent competitor Adobe Flash by supporting extensive facilities? ing resources seemed to solve the problem to handle all new features. Rich user interface (UI) behaviours, more responsive, asynchronous communication and network efficient are explaining terms to describe the concept of Rich Internet Applications [23]. Therefore, RIAs have an enhanced client side technology which can execute instructions on client’s computer (client engine). Furthermore, additional characteristics are needed to express the full power of this Web application type. A RIA should be accessible from every kind of client, is not limited to a Web browser surrounding, but should run in a sandbox and can run offline, too1 . All these requirements offer (rich) user experience (UX), a part of end-to-end experience, as it is common with classical Desktop applications. RIAs try to combine the benefits of both Web and Desktop applications. Hence, it was a logical step that Microsoft continues to apply its renewed commitment to UX on this area as well. The company prefer to adapt its ongoing effort on including this end-to-end experience, which was reflected in some radical changes of the last versions of Windows and Office (Windows Vista, Microsoft Office 2007) [18]. After all, the result was a Web browser plug-in similar to Adobe Flash. At the beginning (December 2006), they called it Windows Presentation Foundation/ Everywhere (WPF/E) in relation to its origin from the .NET Framework component Windows Presentation Foundation (WPF). Later, in September 2007 Microsoft officially introduced its platform as Silverlight 1, which is a cross-platform, cross-browser and cross-device 2 technology for designing, developing and delivering media experiences and rich interactive applications 3 for the Web. Naturally, the development process of a new plug-in do not stop. A expansion of the first version of Silverlight with new features, especially an implementation of core elements of its .NET Framework, followed quickly. At the beginning, they called this version 1.1 Alpha, but later and with additional features version 2.0 Beta 1, which was released in March 2008. With this change Microsoft enlarged the possibilities of the developers in application development with Silverlight (especially for RIA development). Thus, up right now Silverlight application programmers are able to develop with any .NET Framework programming language (e.g. C# or Visual Basic). Hence, they are not instructed to only use JavaScript for developing large RIAs. Of course, the term Rich Internet Application was not just for a detailed description of RIA, please have a look at the diploma thesis of Florian Moritz [13] 2 this facility is still in development 3 Microsoft’s synonym for RIAs

Categories and Subject Descriptors
D.2.6 [Programming Environments]; D.2.12 [Interoperability]: [Interface definition languages]; H.5.2 [User Interfaces]: [Graphical user interfaces, User-centered design, Interaction styles]; H.5.4 [Hypertext/ Hypermedia]: [Architecture, Navigation, User issues, Screen design, Prototyping]

General Terms

Rich Internet Application, Microsoft, Silverlight, Moonlight, XAML, .NET, DLR



Time is right to push a new concept on top of Web application development. Since the type of traditional Web applications got more and more outdated because of a new complexity and adaptability, which were demanded of Internet users; a new balance between client and server comput-

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

introduced with Microsoft Silverlight. That’s why, numerous competitors have already existed in this market, e.g. the Curl platform, Sun JavaFX, Adobe Flash (with Adobe Flex and Adobe AIR), Google Web Toolkit or Open Lazlo. Every platform desires to win the challenge of market leadership. Obviously, Adobe Flash provides the most popular platform, but will it also fulfil all required features of a RIA? Clearly, it already consists of more components Silverlight 1. Accordingly, it will be difficult for Microsoft’s competitor in version one to be successful compared to Flash in version nine. However, let us see whether the expansion from WPF/E to Silverlight 2.0 Beta 1 provides a powerful platform that satisfies all requirements to build good RIAs while being able to change the predominance of Adobe Flash. Moreover, a comparison between all important rivals in the RIA market will be out of the focus of this paper. It will only give an insight into the Silverlight 2 platform with a conclusion that will only rate its chances on this market. Therefore, the paper’s body is divided into three main chapters. The first one will explain the Silverlight platform into detail (see Sec. 2). The second part will describe the facilities of support (see Sec. 3). Finally, the third chapter will present an overview of design and development tools for Silverlight applications (see Sec. 4). Naturally, a conclusion will follow after the body and will sum up and rank the described topics of the body. Before entering the body of this paper, here is a clear restriction of the topic. This article will only focus on version Silverlight 2.0 Beta 1 (Beta 2 is expected to be released in May 2008) that means it will include in general all features, which are supported by Silverlight 14 . Moreover, no specific separation of the features of these two versions will be given - only general differences will be mentioned. Furthermore, no detailed description of underlying components and libraries of the considered subset of the .NET Framework will be made. The development of a ready to Web (RTW) version of Silverlight 2 is, at the time of writing this paper, still in progress. That means, no books and scientific articles are currently available that describe Silverlight 2 and cover its features and components at once. Thus, this article is mainly based on the Silverlight documentation in the MSDN library [18], white paper articles on the Silverlight Web site [19] and the Silverlight development Web site [16] as well as many netblog entries of the Silverlight developers. Nevertheless, let us now start with a detailed description of Microsoft’s RIA platform.

Figure 1: Silverlight architecture [18] facilities will be described in the following subsections. Apart from the two major parts of the Silverlight platform, the plug-in consists of an installer and update component as well. This feature can easily be embedded into the host Web site of a Silverlight application. The JavaScript file for Silverlight plug-in checking is delivered with the Silverlight 2 SDK. Generally, this component simplifies the process of installing the application for first-time users, and subsequently provides low-impact, automatic updates [18]. However, as it is currently common in Web application development, the automatic update option without notifying the user is optin by default [19]. Hence, a user maybe has to change this feature manually. Anyway, let us now take a look at the interesting features and components of the Silverlight 2 platform.


The .NET Framework for Silverlight



To many modifications and extensions of components and features of Silverlight 1, initialized Microsoft to rename their following Silverlight version from 1.1 Alpha to 2.0 Beta 1. Where Silverlight 1 basically consists of components of the presentation core to deliver media experiences (see Sec. 2.2), Silverlight 2 enriches this ability by including important parts of the .NET Framework to enable RIA development (see Sec. 2.1). Figure 1 shows the differences of the architecture between the two version in a nutshell. On the one hand, light-blue parts are components, which are introduced with Silverlight 1. On the other hand, dark yellow rectangles include new features of the second version. All these
4 except for breaking changes of development from version 1.0 to 1.1 Alpha to 2.0 Beta 1

To be one step ahead of its competitors, Microsoft enriches the Silverlight platform with common parts of their .NET Framework to facilitate RIA development. Firstly, with important parts of the Base Class Library (BCL), which allow comfortable application programming, and a shortened Common Language Runtime (CLR). Secondly, with a subset of the WPF framework to enrich UI development (see Sec. 2.2.1). Thirdly, with a subset of the Windows Communication Foundation (WCF) framework to enable high-level communication with Web Services. Finally, with a very new component of the .NET Framework, the Dynamic Language Runtime (DLR), closes the enumeration of .NET components in Silverlight 2.


CoreCLR and BCL

Possibly, The developers of Silverlight made a good decision by conveying important parts of Microsoft’s implementation of the Common Language Infrastructure (CLI), the CLR, to Silverlight. To separate the CLR, as it is included in the .NET Framework, from the derived subset of the Silverlight framework, the Silverlight CLR is also known as

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

CoreCLR. This relates to the issue that the CLR in the .NET Framework provides even more facilities as are defined in the ECMA and ISO specification of the CLI, which cannot be fully integrated in the CoreCLR. Anyway, all features that are included in the CoreCLR are defined by the CLI specification. These features are: memory management, garbage collection, type safety checking (through generics) and exception handling [18]. To enable programmers with the possibility to write applications in a development language of their choice [18], the Common Type System (CTS) component of the CLI specification ensures the goal of language independence. As described in ECMA-335 standard [8], a Virtual Execution System (VES) implementation must be able to execute managed code. This code contains enough information to allow the CLI to provide a set of core services5 . Hence, every programming language (e.g. C# or VisualBasic) that fulfils the requirements as defined in the CLI specification produces managed code, which can be compiled to platform independent Common Intermediate Language (CIL) code. Finally, the CIL code will be compiled to native machine code by a just-in-time compiler of the VES, when the code is executed. This powerful concept presents the Silverlight platform new facilities to provide rich interactive applications. The second main component of the .NET Framework, the BCL, was adapted for the Silverlight framework, too. The included libraries provide essential programming functions [18], e.g. string handling, regular expressions, input and output handling, event handling, reflection, collections, cryptography, threading and globalisation [18]. Additionally, the so called HTML/JS bridge is embedded into Silverlight 2. This is a component, which enables to use JavaScript to call directly into managed code and access scriptable objects, properties, events, and methods. Wilco Bauwer [4] describes interesting details of the two-way interoperability layer (the HTML/JS bridge) in Silverlight and the problems of supporting RESTful services by all supported browsers of the Silverlight plug-in (see at section 2.1.2).To sum up, the mentioned subset of the .NET Framework BCL and the helpful Web development add-ons build a common ground for good Web application development. Naturally, the Silverlight BCL can be used with every .NET language. This feature facilitates .NET developers to easily get along with Silverlight development.


WCF, LINQ and Sockets

Web Services are main collaborators of RIAs. Therefore, Silverlight includes APIs to communicate via different protocol types with different Web Service types. This was realized within the adoption of the WCF framework, a part of the .NET Framework. These APIs contain out of the box support for the common syndication feed formats RSS 2.0 and Atom 1.0. Moreover, the common SOAP Service in version 1.1 is supported, with the restriction of not using SOAP extensions (SOAP custom headers) [18]. The Microsoft derivatives WCF Service and ASP.NET Web Service fulfil the range of Web Services in Silverlight 2. In practice, SOAP extensions are often used for the authentication process of users. To compensate this possibly disadvantage, this function can be replaced by several extensibility points of the WCF framework [3]. Another approach to identifying a user

is to make use of the Windows CardSpace service6 . This is an identity metasystem of the .NET Framework. There are also some APIs for simple HTTP communication. Firstly, a high-level API for easy downloading support. Secondly, basic APIs for low level access to the HTTP protocol features. Currently, only the GET and the POST method are supported by the protocol types HTTP and HTTPS [18]. Accordingly, not all methods of the Representational State Transfer (REST) definition are available via these APIs (PUT and DELETE is non-existent). Furthermore, features of the ADO.NET framework like DataSets are not integrated in Silverlight 2.0 Beta 1. Fortunately, the Astoria team is working on a version of their services for the next Silverlight Beta release to close this gap [10]. A library to consume ADO.NET Data Service (Astoria) from Silverlight is already available via Microsoft Download Center. Thus, CRUD (Create, Retrieve, Update, Delete) operations are possible in Silverlight. Unfortunately, this add-on is not compatible with the Beta 1 version and developers have to be patient and have to wait for a next Silverlight 2 update. Moreover, to interact with Web Services, often APIs are necessary to extract and pre-process an incoming data stream or to formulate queries for Web Services. Currently, Silverlight includes two implementations of the Language Integration Query (LINQ) framework: LINQ to Objects and LINQ to XML. These components enable easy transforming and querying of data [16]. APIs for serializing JavaScript Object Notation (JSON) and XML messages helping to preprocess data of Web Services. At last, APIs to work with XML documents complete the opportunity to consume Plain Old XML (POX). Another interesting feature was introduced with Silverlight 2 - sockets. This component enables developers to integrate for example chats within their Silverlight application. The socket package provides a mechanism for real-time duplex communication with the application’s host of origin and enables higher-level APIs to communicate over a bi-directional transport. Socket connections are only allowed back to the site or host of origin [18]. That means, an application can only connect to the host from which it was downloaded. Two sockets interface are supported - Windows Sockets and Berkeley Sockets. Summing up, Silverlight 2 provides good support for common Web scenarios with the component described above. After all, an important aspect is missed right now. What about, cross-Web domain, cross-scheme and cross-zone access? This features are fundamentally important today to work with Web Services. That’s why, a control mechanism to allow cross-domain calls was included into Silverlight 2. By default, a Silverlight application can only access Web Services that are hosted on the same domain. To enable communication for services, which are hosted on other domains, a cross-domain policy file must be placed in the root of the Web Service domain. Currently, two different mechanisms are supported. Firstly, Microsoft defines an own XML schema for cross-domain policies. This configuration enables to set access restriction to paths of the domain as well. Secondly, the cross-domain policy specification of Adobe Flash is supported. However, an access policy defined in this style can only allow access from all domains. Otherwise, it will

see [1] for a good explanation of managed code

Virbo Bertocci shows it in a tutorial [6]

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

not be recognized by Silverlight [18]. Except for path restriction as it is included into Microsoft’s cross-domain policy specification, Adobe’s derivative supports much more permission restrictions because it has a longer tradition (since 2003)7 . Maybe a consolidation of both specifications will provide an optimal support for cross-domain access control. Moreover, cross-scheme access is currently not allowed in combination with cross-domain access. Finally, the described versatile networking support can be implemented with the power of next subsection’s dynamic programming languages.

manual section about Silverlight 1 [18]. Nevertheless, this chapter will describe new features like support of the Digital Rights Management (DRM) technology, the expansion of integrating parts of the WPF framework and the new Deep Zoom technology. Furthermore, important characteristics, like media formats and integration, the Extensible Application Markup Language XAML or the streaming technology, are parts of this chapter.


WPF, XAML and Controls


DLR and Dynamic Programming Languages

The runtime environment for dynamic languages is an extension of the CLR of the .NET Framework. Accordingly, this set of services runs on top of the CoreCLR in Silverlight. Therefore, the DLR provides language services for several different dynamic languages. These services include: a dynamic type system (analogous to the CTS in the CLI definition), dynamic method dispatch, dynamic code generation and a hosting API (to enable interoperability with static Silverlight(-based) class libraries [19]). Currently, three dynamic languages run with the Silverlight DLR: Managed JScript, IronPython and IronRuby [19]. All these languages are .NET specific implementations of common programming languages (Python, Ruby and Microsoft’s ECMAScript implementation JScript). There is a separate SDK8 to programme Silverlight applications using dynamic languages [15]. A big advantage of using dynamic languages with Silverlight is that developers only need a simple texteditor for the development (no extra IDE is necessary). The Dynamic Silverlight SDK includes Chiron, a local Web server for testing and a build tool, which generates the DLR assemblies and put them together with the dynamic language engine into a .xap file9 per default [19]. It might be a disadvantage to include all language assemblies10 every time into this source file, which is only a compressed .zip file. Anyway, it was necessary to make them available for import into dynamic language code, because synchronous downloading, as it will be executed from Python code, is not supported by Silverlight (see Sec. 2.3.2). This enlarges the size of such applications. However, the build tool has a option to define an URL, where the needed assemblies can be out-sourced and loaded on runtime 11 . This fix reduces the size of the .xap file. Therefore, Jimmy Schementi suggests true extension support in Silverlight [15]. Finally, the DLR is at the time of writing just under development and customers of this feature may have to wait for further improvements.


The Presentation Core and WPF

This chapter explains the main features of the presentation core of Silverlight 2, which included a subset of the WPF framework. Clearly, this section may not fully cover and explain all already included features in detail, but readers who are interested in getting a deeper insight into explicit Silverlight 1 features, should have a look at the Silverlight for details see [2] the Silverlight 2 SDK includes it as well 9 the source file of a dynamic Silverlight application 10 they are not included in the Silverlight plug-in 11 see [15] for a description
8 7

The Silverlight 2 UI framework is a powerful upgrade of the graphics and animation features, which had been introduced with Silverlight 1. Through the adoption of the WPF framework, Silverlight enables capabilities for extensible controls, layout management, data-binding, styles and template skinning. These opportunities expand the already included APIs for input handling, media playback and the UI core (graphics and animation). Hence, the Silverlight 2 UI framework enables high level UI development and provides the opportunity to re-use skills, controls, code and content of already created WPF based Windows desktop applications and vice versa [16, 12]. However, it is important to differentiate between Silverlight applications and WPF based applications that run in a browser. These applications are called XAML browser applications (XBAP). In contrast to Silverlight applications, they are restricted through permissions set by the Code Access Security (CAS) component of the .NET Framework [17] (see Sec. 2.3.1). The important expansion of a rich set of built-in controls, enables developers to quickly build applications and easily create new extensions and templates for these controls. A good overview of common and interesting built-in controls and layout management components is given into Tab. 1. There are plans to expand this built-in control set in the next version of Silverlight 2 [22]. Nevertheless, support for 3D and GPU rendering, as it is available in the WPF framework, is currently not a part of Silverlight [16]. The markup language to describe all controls and features of the Silverlight UI framework (and of the WPF framework, too) is XAML. Of course, this declarative, XML-based language is a larger language concept. Thus, it is used in the Windows Workflow Foundation, which is another component of the .NET Framework, too [7]. Beside defining visible UI elements, XAML can be used to define an entry point (namespace) for the code-behind technique. This concept allows to out-source programming logic in managed code e.g. written in C#. Hence, a strict separation of presentation definition and programming logic is possible, particularly every event can be handled by a method of the related codebehind class. The complete UI definition can be accessed from code-behind programming code as well. That makes the manipulation of UI elements very easy, because XAML markup directly represents the instantiation of managed objects [17]. Moreover, the markup extensions concept for XAML came along with Silverlight 2. This technique allows to bind referenced objects to XAML properties in XAML attribute syntax12 . These markup extensions enable data binding, template binding and resource referencing from a resource dictionary. Another component of Silverlight 2 is a helpful

even if that property does not support an attribute syntax for direct object instantiation [18]

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

Table 1: Silverlight built-in controls and layout management classes overview [16, 18] type class TextBox CheckBox RadioButton HyperlinkButton ToggleButton WatermarkedTextButton StackPanel Grid Panel GridSplitter Slider ScrollViewer Calendar DataPicker ToolTip MultiScaleImage DataGrid ListBox RangeBase

form control

layout management

functionality control

data manipulation control

can trigger specific event during playback. This technique is complementary to the frame based synchronisation. Moreover, video projection on amorphous areas is to point out as well, e.g. on a shape of a text object. Even playlists are allowed in the Advanced Stream Redirector (ASX) format. This is important for the streaming of video and audio files (see Sec. 2.2.4). Support of image formats is restricted to common ones - JPG and PNG. At the moment, a support of the GIF and the SVG format is not planned [22]. This, might be a disadvantage but the architects of Silverlight are interested to keep the size of the plug-in small. Furthermore, vector graphics can be created and converted into XAML (see Sec. 4.3). Finally, Silverlight 2 came along with a DRM access control, to protect music and video contents. This feature is built on the Microsoft PlayReady content access technology and enables the Silverlight plug-in to provide a rights server with standard computer information, when requesting media usage rights. Standard computer information in the definition of Microsoft are: IP address, operating system version, browser version and hardware ID. This ID indicates the device manufacturer, device name, and version, application version (of the Silverlight plug-in) and user’s regional and language settings [19].

API to create managed objects from XAML input and works similar to the XmlReader API in Silverlight [18]. Finally, Microsoft has so far developed two ASP.NET server controls, which easily connect ASP.NET with Silverlight. The First one is the generic Silverlight Server Control, which enables a developer to integrate Silverlight support into an ASP.NET Web site with all its favourite facilities (XAML, managed code, dynamic language modules) [24]. The second control, called MediaPlayer Server Control, inherits from the Silverlight Server control and enables a developer to easily integrate media sources (e.g. WMA, WMV) into an ASP.NET Web site. Anyway, there is no extra knowledge about XAML or JavaScript required - the MediaPlayer Server Control will generate all appropriate markup automatically [24]. These ASP.NET server controls provide a solid basis for the collaboration with Silverlight and help to embed a media player in ASP.NET web sites, which deliver media files of the following formats.

Deep Zoom technology

With Silverlight 2, Microsoft introduced the Deep Zoom technology. This feature allows users smooth in-place zooming and panning of large images. The Deep Zoom technology arises from the SeaDragon project, which build the core of this feature13 . An extra tool is needed to create the prerendered input (see Sec. 4.1). The high performance is achieved by splitting the source image for different zooming levels. The Deep Zoom technology uses fragmented images to realise variable zooming and panning of a large image. After all, these images can be manipulated with standard Silverlight metaphors e.g. the storyboard.


Silverlight Streaming Service


Media Formats, Integration and DRM

The format variety for audio and video codecs is widely based on codecs created by Microsoft. Hence, the video format ranges from standard Windows Media Video (WMV79) codecs to the Windows Media Video Advanced (WMVA) codec, which is available with a Microsoft implementation of the VC-1 industry-standard (WMVC1) [18]. This is a High Definition (HD) quality standard video codec recognized by the Society of Motion Picture and Television Engineers (SMPTE) [16]. On the other side, the audio format ranges from standard Windows Media Audio (WMA79) codecs to the common MP3 codec. The disadvantage of missing support of further audio and video codecs can be bypassed by using the Microsoft Expression Encoder (see Sec. 4.1) and might be available over time through the evaluation of customer feedback [16]. Timeline markers (synchronisation points) can be applied to audio and video content and

A common example of usage is streaming of media content. Supported streaming protocols are: MMS, RTSP and RTSPT. However, every URL, which includes these protocols, will be translated to HTTP [18]. Along with streaming, Microsoft provides Silverlight Streaming via its Windows Live service. With this service, developers and designers are able to host two types of content: rich interactive applications and media (audio, video and image). During the current Beta status of Silverlight Streaming, customers of this service are allowed to store up to 10 gb of data with a traffic volume of up to 5 tb per month for free. When the final version of this service will be released, unlimited streaming will be available for free with advertising [29]. A comfortable upload of media content to the Silverlight Streaming service, will be supported through a plug-in for Microsoft Expression Encoder (see Sec. 4.1). Additionally, the service for invoking applications in Silverlight streaming, will be supported via a comfortable administration Web site. Furthermore, there is the opportunity to build custom applications, which includes content that is hosted by the Silverlight Streaming service. This content is protected by an ID, which validates the associated Silverlight application to the requested media

see [28] for more information

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

files [29]. Finally, the easy to handle Silverlight Streaming service with all its facilities pushes the distribution of the Silverlight platform. Developers, who would like to support streaming by their own server environment, are recommended to use the Windows Server 2008. For this server operating system, Microsoft created two add-ons, which facilitate to work with media hosting (audio and video). The first one is the IIS 7.0 Bit Rate Throttling module. This extension enables easy configuration of bandwidth throttling rules for any type of media content (including .WMV, .MOV, FLV and MP3 files). The second one is the Windows Media Services 2008 add-on. With this service, a developer is able to easily set up publishing points and host streams of playlists or single files. Accordingly, the built-in media streaming feature of Silverlight can use this streaming server to efficiently stream video or audio. After all, the employment of these environments speeds up and improves media experiences with Silverlight.

is acceptable (see Sec. 2.3.3). That means, a safe critical method will forward or pre-process a method call, if the callee was safe (verifiable). Finally, the CoreCLR Security Model only supplies the standard access rules of classes and methods (e.g. public, private, etc.)14 . After all, to draw parallels between the security model of Silverlight and this one of operating systems, here is a comparison: user mode code is transparent code, system calls are safe critical APIs and kernel code is native code [20]. Summing up the CoreCLR Security Model build the basis to run Silverlight applications in a secure sandbox.


Asynchronous Programming and Threading


Additional Programming Features

After having introduced main features of the Silverlight 2 platform within the last two chapters of this paper, this section deals with additional programming features, which have not been mentioned so far. Firstly, a description of the CoreCLR Security Model explains how developers of Silverlight can programme their applications safely. Secondly, the features of asynchronous programming and threading follow. Thirdly, a subsection about the Isolated Storage technology continues an explanation of security aspects in Silverlight 2 by an example. Finally, the last subsection in this chapter deals with the end to end application localisation.


CoreCLR Security Model

After a introduction in the mechanisms of enabling cross domain access (in section 2.1.2), here is a section about the security model of Silverlight. Since a slimmed down version of the CLR, the CoreCLR, was included into Silverlight, it was necessary to design a security model for it. This model is called CoreCLR Security Model and it is an enhanced version of the v2.0 transparency model [20]. Furthermore, this model replaces the CAS model of the CLR and simplifies the structure of it. There are three forms of code that means there are three layers of security. The first form is transparent code. Code of this layer cannot perform any action that would elevate the permissions of the call stack. Therefore, the entire code of a Silverlight application can only be transparent and must be verifiable. The second form is safe critical code. This code can only be contained in the Silverlight framework. These APIs are intended for security checking of the third layer of the CoreCLR Security Model. The third and last form is critical code. This code can only occur in the Silverlight framework, too. Especially, every method who calls native code of the operating system is based in this layer, for instance the operating system’s file I/O APIs. The secure mechanism of the CoreCLR Security Model works as it is described in the following. Every direct call of a critical method from transparent code throws an exception. Thus, it is only allowed to call transparent and safe critical APIs directly from transparent application code. Hence, safe critical APIs (e.g. the IsolatedStorage API) validate incoming parameters and ensure that the application state

Asynchronous programming is a very helpful, but in general more complex concept that is needed to interact with many Web Services. This is useful to do programming tasks in the background, while not blocking the UI of the application. Therefore, Silverlight 2 provides several APIs to work with threads. Firstly, two low-level APIs - one for threads in general and the other one to collect all threads in a thread pool. Secondly, two high-level APIs: the more important Background Worker and the Dispatcher. Each high-level API has a different concept. On the one hand, the Background Worker is responsible for executing work in the background of the UI by using a thread from the thread pool. On the other hand, the Dispatcher enables the developer to execute work directly on the UI thread. This is useful for updating the UI from a background thread [4]. Silverlight always has a single UI thread. Moreover, two restriction are related with asynchronous programming and threading in Silverlight. Firstly, only asynchronous requests of the low-level HTTP API are allowed. Secondly, these requests can only be invoked in the UI thread [18]. That means, no synchronous communication is available via this API. Unfortunately, this concept is applied to call several existing Web Service APIs and to do other tasks, for example loading needed assemblies with dynamic programming languages (see Sec. 2.1.3). Anyway, this communication type has a disadvantage. It can cause deadlocks in the browser application, if the server had not send a response message. Thus, developers of Silverlight recommend to apply the asynchronous model, which is more safe in this situation (by using time-outs) [4]. Another secure restriction is based on the Background Worker component. It is not allowed to directly call the HTML DOM or JavaScript functions from a background thread [4]. Fortunately, cross-thread calls from a background thread to the UI thread are possible (via events) [18]. After all, except of the restriction to only use asynchronous calls, the multithreading support in Silverlight provides a required demand for complex RIAs.


Isolated Storage and File Upload

Isolated Storage is a powerful feature of Silverlight 2, which provides safe access from the Silverlight client to the local machine’s file system. Accordingly, this facility bridges the gap between Silverlight applications and the critical I/O APIs of the operating system [20] (see Sec. 2.3.1). Thus, a Silverlight application runs in a secure sandbox as it is common for client based browser applications. That means the data is always isolated by the user in a virtual file system

a detailed description can be found at [20]

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

Table 2: Supported operating systems for the Silverlight plug-in [1] Apple OS X Tiger OS X Leopard Microsoft Windows Windows Windows Windows Vista Server 2003 XP 2000

Table 3: Supported browsers for the Silverlight plug-in [1] Microsoft Internet Explorer 8 Internet Explorer 7 Internet Explorer 6 Mozilla Firefox 3.0 Firefox 2.0 Firefox 1.0 Apple Safari 3.0 Safari 2.0

[18]. Each Silverlight application gets its own isolated store that will be accessible from every browser15 of an user’s local machine [4]. However, there is a limit that roaming of user profiles is not supported in Silverlight [18]. Furthermore, the default limit of the store is very small (100 kb). Fortunately, the quota can be increased by a user-initiated action in pre-defined steps (1 mb, 5 mb, 10 mb) or even unlimited. Up right now, each application of the same domain shares the same quota at an user’s local machine (or a server, if a Silverlight application will be used from other third-party Web sites). The security critical opportunity to access an isolate store of another Silverlight application of the same domain is prevented per default by the cross domain policy definition. Currently, Silverlight 2 is not able to entirely upload large files because the related HTTP API will buffer the requested data at once. This disadvantage depends on the fact that the related underlying API, provided by the specific browser, does not support streaming [4]. Fortunatelly, Wilco Bauwer provides a work around by uploading files in chunks, where he applied Isolated Storage to save information of the file upload for potential resuming of the transfer task [4]. This shows an advantage of enabling controlled file system access for Silverlight applications.


Globalisation and Localisation

Through the evolution of the Internet, globalisation and the related localisation become more and more important for developers of Internet applications. Therefore, Silverlight 2 provides end to end application localisation that means multilingualism support in Silverlight applications. Unfortunately, there are some problems with this feature in the Beta 1 version, which will be fixed in the next release [16]. Additional languages than merely English are planned for the installation and control runtime [16]. An advantage is the full support for East Asian languages for text object. Summing up this subsection, Silverlight is almost ready for a world wide distribution.

eration with Novell and is based on the Mono framework, which is the .NET derivative for non-Windows platforms. Currently, Moonlight is available in version 0.6 with profile 1.0 or 2.016 as binary for testing without media codes. A actual SVN version of Mono includes Moonlight with media codecs (ffmpeg codecs). For the official release a package of Microsoft’s codecs will be delivered with the Moonlight plug-in [26]. On the basis of the in-house support of Windows and Mac OS X, the Silverlight plug-in is compatible with browsers of the Internet Explorer family, Firefox family and Safari family (see Sec. 3 for an overview of supported versions). On the other side, the Moonlight plug-in is available for Firefox, Opera and Konqueror on Linux [12]. To sum up, all major browser are included in the deployment on the supported operating systems. To transfer the Silverlight powered experiences to mobile devices, Nokia has announced plans to make Silverlight available for S60 on Symbian OS in late 2008 and further more for Nokia Series 40 devices and Nokia Internet tablets [27]. Additionally, Microsoft has announced that Silverlight 1 for Mobile with support for Windows Mobile 6 will be available in the 2nd Quarter of 2008 as a Community Test Preview (CTP) version [19]. A CTP version for Silverlight 2.0 for Mobile is planned in the 4th Quarter of 2008 [19]. Accordingly, the Silverlight platform fulfils the cross-device feature, which will become more important in the near future. After all, let us now have a look at the tools to create a Silverlight application.





Microsoft likes to deploy Silverlight in diverse runtime environments (even devices). Thereby, the main focus is on cross-platform and cross-browser support. These facilities are very important for the success of the Silverlight plug-in. Therefore, it is enabled to run on operating systems of the Windows family, as well as on these by Apple (see Tab. 2 for an overview of the versions). Additionally, an extra browser plug-in is available to run on all Linux distributions [12]. The Linux implementation Moonlight is built by a coop15

Through the separation of the presentation layer and programming logic in the Silverlight architecture with the codebehind technique, it is easy to split the processes of development between programmers and designers. On the one hand, the designer is free to work on the XAML markup to design the user interface. On the other hand, the developer is able to individually update the programming logic of the application in the background. Naturally, Microsoft offers a more diverse package for Silverlight development, but this offer only runs on Windows. Indeed, the open source community from Mono work well to support Silverlight development on other operating systems than Windows. The last subsection of this chapter maybe interesting for designers.


Tools from Microsoft

Microsoft offers a broad range of development and design tools, which also support building of media experiences and rich interactive applications based on the Silverlight platform and complementary technologies like ASP.NET [16].

which is supported by Silverlight

that means with features of the Silverlight 1 or the Silverlight 2 plug-in

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

They split the role-specific tools in two suites. The first one is for designers and is called Microsoft Expression Studio. The second one is the very well known suite for .NET developers and is called Microsoft Visual Studio. Expression Studio includes five components. The most important tools for designers of Silverlight applications are Expression Blend, Expression Design and Expression Encoder. The first one is an authoring tool to easily create WPF or Silverlight based user interfaces17 . It offers the facility to design on a WYSIGWYG surface or to directly edit XAML code of the composition in a separate view with ad hoc reflection of the changes and vice versa [25]. The second mentioned tool for Silverlight development in this suite is Expression Design. This product is able to develop rich graphic content and export it to the XAML file format, which can be consumed by Expression Blend. The last tool is Expression Encoder, which enables the designer to encode, optimise and publish media content for Silverlight. It supports a variety of source formats (Quicktime, AVI, etc.), which can be transposed into formats that are supported by Silverlight [12, 16]. This tool is also very important for the Silverlight Streaming technology. On the other side, there is the suite for developers, Microsoft Visual Studio. This is a very complex suite which offers a wide range of software development support in its diversity. Especially important for Silverlight development is the add-on to create Silverlight applications using .NET, which is available for Visual Studio 2008 Standard or above. With this installation, this suite provides support for Silverlight development with managed code programming languages like VB and C# and dynamic programming languages like Managed JScript, IronPython or IronRuby [16]. A good feature is the ability to share projects between Expression Blend and Visual Studio, because of their similar structure. This enables good support for debugging Silverlight applications on demand and other enhanced development capabilities [25, 16]. Additionally, with the installation of a separate unit test framework for Silverlight, a developer is able to perform API-level and UI-level unit testing that is browser based [12]. Using Visual Studio enables functions of software development with modern IDEs, particularly features like IntelliSense or automated code generation for specific tasks. Finally, Microsoft offers two more tools with support for Silverlight development. The first one is called XAMLPad. This is a basic visual editor for creating, testing and debugging XAML markup and is included into the current Windows SDK [17]. The second one is called Deep Zoom Composer and helps to arrange images and to export the result for Silverlight 2 to use the Deep Zoom feature [14].

plug-ins Silverlight and Moonlight. Furthermore, Alan McGovern has developed a XAML designer as a native Desktop application for Linux, which is called Lunar Eclipse and is currently in an early state of development. Important is the basic idea behind the development of this designer tool. The WYSIWYG surface is written with the Moonlight SDK. That’ s why, the developers claimed that on the basis of that issue, it should be relatively easy to build a Web based frontend for Lunar Eclipse [9]. Thus, it will be possible to enable Mac OS X users the access to a XAML designer. This opportunity enforces the interests of the Silverlight architects to support full Silverlight application development on major operating systems.


Miscellaneous Tools

When XAML came up it caused a lot of trouble, because there was already an existing standard of W3C for vector graphics called SVG. However, Ian Griffiths19 said that XAML can do even more than the SVG format, especially working together with the WPF framework (mixed with every other kind of markup) [11]. Therefore, it was necessary to create a new standard called XAML. To solve the compatibility problem, the SVG/ WPF community has developed several converters to transpose SVG markup to XAML markup. Two examples of them are the free XAML export plug-in for Adobe Illustrator and a SVG viewer with XAML export functionality called ViewerSvg [21, 5]. Unfortunately, both of them do not support the complete schema of the XAML format, particularly not for included raster images [21]. Nevertheless, the efforts of the community to bridge this gap are be recognizable.




Tools from Mono

For Silverlight development on non-Windows platforms developers leaded by Miguel de Icaze created an SDK to develop against Silverlight and Moonlight APIs. This SDK is included in the current Mono version from SVN. Silverlight applications have to be compiled with an extra compiler, which embeds the Silverlight assemblies by default in a compilation 18 . These solutions are intended to be run on both

Expression Blend 2.5 March 2008 Preview or higher is required to create Silverlight 2 applications 18 for detailed information see [26]

After having introduced the wide range of design a development tools for Silverlight Applications, the conclusion tried to rank the current Silverlight version with all its facilities. Firstly, let us see whether Silverlight has fulfilled all required features to provide RIAs or not. Clearly, as Silverlight is a client-based platform, it meets the requirement to provide a client engine. Furthermore, rich UI behaviours are easily supported by extensible built-in controls, layout management, data-binding, styles and template skinning adapted from the WPF framework. More responsibility can be slightly handled by the code-behind technique, which combines UI markup with programming logic. The client engine of Silverlight also reduces network traffic, because the application can pre-evaluate user interactions on the client side while only exchanging necessary data with the server. Moreover, the Silverlight developers push the community to use asynchronous communication for interacting with the server. Unfortunately, some programming techniques require synchronous communication to be efficient and of course, some Web application programmers prefer the easier synchronous communication style. There is even a petition for the return of synchronous Web Service communication at the Silverlight forum. Anyway, let us have a look at characteristics that should be supported to build a good RIA. Firstly, it is no problem to access Silverlight applications from every kind of client. Major browsers on Windows, Mac OS X and Linux distributions are compatible to Silverlight. The user only has to

a leaded architect of WPF

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

download and install the Silverlight or Moonlight plug-in. Possibly, the available plug-in installation check script can be extended to provide a download option for Linux users. Secondly, with the forthcoming support for mobile devices it will be no problem to use a Silverlight application on this type of device. Thirdly, Isolated Storage allows to store data in a virtual file system and access the isolate store from each browser installed on an user’s local machine. This concept is build up on the CoreCLR Security Model, which enables a Silverlight application to run in a secure sandbox. However, right now RIAs developed with Silverlight are limited to a Web browser environment and can only be used online. Fortunately, Silverlight’s origin is in the WPF framework, and it is currently possible to re-use code and skills to create a WPF application from a Silverlight application. Hence, the moment to integrate these features is just a step ahead. On the other side, even with version 1.0, Silverlight is ready to deliver rich media experiences with all its facilities, e.g. HD video, cost-effective advanced streaming or unparalleled high-resolution interactivity with the Deep Zoom technology [16]. This is supported by Microsoft’s Expression Studio tools, Windows Server extensions or Silverlight Streaming as well. Furthermore, Silverlight application developers can take the advantage of choosing their favourite programming language out of several supported ones and programme their application maybe with the help of the Visual Studio IDE. This feature and the ability to strictly separate between UI and programming logic development, makes Silverlight to a very powerful platform to design, develop and deliver good RIAs. Additionally, the expanded networking support and the enriched BCL meet the requirements for RIA development. Because of the fact that Silverlight is still in the phase of development, some disadvantages and missed functions had to be mentioned. However, it already provides some interesting components. Accordingly, Microsoft puts much energy into involving the needs of the customers in their products. Even the support of the third party development Moonlight is to be commendable. Therefore, after this detailed presentation of the progress in development of the Silverlight platform, an advanced comparison between the competitors in the RIA market can be made. Instead of expanding this paper, the comparison should be explored in another following paper, because there are many interesting details to be investigated. After all, my own opinion is that Silverlight can win the challenge with this powerful package of features, but this might take some time. Naturally, the distribution will maybe going faster as happened with Adobe’s Flash before. Furthermore, it will possibly be easier to adapt and/or enrich components, which derived from the .NET Framework component pool. Anyway, the solid development foundation provided by the Silverlight platform has some gaps, too. For example I could not find anything about support for client side databases as it is provided e.g. by the DBMS SQLite. There are other RIA platforms that can interact with it. Additionally, there exist a list of wishes about features that users would like to have included into Silverlight 3. Maybe some wishes are hypothetical bubbles, but other features like 3D graphics support are imaginable. Finally, let us see how fast the Silverlight platform can fill the majority of Internet users with enthusiasm, as it has potentially won the race against Adobe Flash before by providing more features.



I would like to thank Scott Guthrie, Miguel de Icaza, Wilco Bauwer, Karen Corby, Tim Heuer, Jimmy Schementi, the Astoria Team, the Silverlight Web Services Team and all other people around for the great work on blogging all helpful information about the Silverlight platform including the Moonlight derivative.



[1] B. Abrams. Brad Abrams : Home [online]. Netblog. Available from: [cited 17 May 2008]. [2] Adobe Systems, Inc. Cross-domain policy file specification [online]. April 2008. Available from: crossdomain_policy_file_spec.html [cited 15 May 2008]. [3] N. Allen. SOAP Extensions [online]. October 2007. Available from: archive/2007/10/03/soap-extensions.aspx [cited 19 May 2008]. [4] W. Bauwer. Wilco Bauwer - Silverlight [online]. Netblog. Available from: Wilco/Silverlight/Default.aspx [cited 19 May 2008]. [5] A. Benedik. ViewerSvg - SVG to XAML converter [online]. 2007. Available from: [cited 26 May 2008]. [6] V. Bertocci. Silverlight [WPF/E] and Windows CardSpace or plugging RIA in the Identity Metasystem [online]. April 2007. Available from: 04/06/wpf-e-and-windows-cardspace-or-pluggingria-in-the-identity-metasystem.aspx [cited 19 May 2008]. [7] D. Chappell. Introducing Windows Workflow Foundation. whitepaper, Chappell & Associates, September 2007. [8] P. Charollais. Common Language Infrastructure (CLI). EMCA, 4th edition edition, June 2006. [9] M. de Icaza. Moonlight Designer [online]. August 2007. Available from: http: // [cited 20 May 2008]. [10] M. Flasko. Using REST Services in Silverlight 2 [online]. April 2008. Available from: http://blogs. [cited 20 May 2008]. [11] I. Griffiths. Introducing the New Avalon Graphics Model [online]. February 2004. Available from: [cited 26 May 2008]. [12] S. Guthrie. ScottGu’s Blog [online]. Netblog. Available from: [cited 20 May 2008]. [13] F. Moritz. Rich Internet Applications (RIA): A Convergence of User Interface Paradigms of Web and Desktop Exemplified by JavaFX. Master’s thesis, University of Applied Science Kaiserslautern, January 2008.

© TU Dresden

Hauptseminar MMT 2008


User-Interface-Technologien für das Web

[14] Sam. Deep zoom [online]. May April. Available from: 2008/04/24/deep-zoom-zooming-and-panningimages-using-silverlight-seadragon.aspx [cited 26 May 2008]. [15] J. Schementi. jimmy.thinking [online]. Netblog. Available from: [cited 13 May 2008]. [16] several. Microsoft Silverlight - Light Up the Web [online]. 2008. Available from: [cited 27 May 2008]. [17] several. .NET Development [online]. 2008. .NET documentation. Available from: [cited 27 May 2008]. [18] several. Silverlight [online]. 2008. online Silverlight documentation. Available from: [cited 27 May 2008]. [19] several. Silverlight [online]. 2008. Available from: [cited 27 May 2008]. [20] shawnfa. .NET Security [online]. May 2007. 4 blog entries about the Silverlight Security Model. Available from: tags/Silverlight/default.aspx [cited 28 May 2008]. [21] M. Swanson. Adobe Illustrator to XAML Export [online]. Available from: [cited 17 May 2008]. [22] A. Thapliyal. Silverlight Roadmap questions [online]. April 2008. Available from: 03/silverlight-roadmap-questions.aspx [cited 19 May 2008]. [23] unknown. Rich Internet Applications development platforms - Curl, Flex and Ajax. Technical report, Sonata, September 2007. [24] unknown. ASP.NET Controls for Silverlight [online]. 2008. Available from: [cited 27 May 2008]. [25] unknown. Microsoft Expression Studio [online]. 2008. Available from: [cited 20 May 2008]. [26] unknown. Moonlight [online]. 2008. Available from: [cited 13 May 2008]. [27] unknown. Nokia to bring Microsoft Silverlight powered experiences to millions of mobile users [online]. March 2008. Available from: [cited 20 May 2008]. [28] unknown. Seadragon [online]. 2008. Available from: [cited 26 May 2008]. [29] unknown. Silverlight Streaming SDK [online]. 2008. Sliverlight Streaming documentation. Available from: [cited 17 May 2008].

© TU Dresden

Hauptseminar MMT 2008


Sign up to vote on this title
UsefulNot useful