Charles Petzold

The XBAP is a WPF executable that represents a compromise between XAML and EXE. The XBAP application includes some code (or perhaps more than one XAML file), and that's why it needs to be compiled. But XBAPs are hosted in the browser just like XAML files, and they run in a sandbox so they require only partial trust.

All of this is great, but in my opinion, XBAPs have a big problem:

The XBAP isn't just one file. It's three files. Besides a file with a .xbap extension, you need a file with a .exe extension and a file with a .exe.manifest extension. These three files are created when you build an XBAP project with Visual Studio or MSBuild, and they are copied to a Web page with ClickOnce deployment. (See http://msdn2.microsoft.com/en-gb/library/aa969776.aspx.)

But what this means is that you can't just email an XBAP file to a buddy and say "Hey, check out this neat WPF app I just wrote" like you can with a XAML file. You need to first deploy the app on your Web site, and then say "Hey, check out this neat WPF app I wrote by clicking this URL on my Web site. Oh, I forgot. I don't have a Web site. That's why I've included three files as an attachment. Save them all to the same directory, and then launch the one with the .xbap extension. I know that one of the three files has a .exe extension, which has probably caused your email program to display message boxes warning you of imminent dangers, or even to classify the entire email as malignant, but don't worry — that's not actually the file you need to run, despite the fact that 20 years of experience has taught you that you run .exe files . You need to run the one with the .xbap extension."

I think that any WPF application that is as safe to run as a XAML file should also be as easy to exchange and launch as a XAML file. Either XBAP needs to be fixed or we need a new executable file format.