World: r3wp

A legitimate webbug wouldn't be worried about showing a security 
update. An illegitimate one would be directly interested in hiding 
one since it may be depending on the security hole for exploit code.

It would be more noticeable, at least.

Yes, we're assuming that the web site has no control over the security 
check, nor the security_min_version (that would come from RT)

3. No action required.

I think you may be right about popups. It seems we can't avoid them.

So, we have a few different scenarios (using the numbering from above):

 1. In this case, the activex system in IE will force the download 
 of the (digitally signed) CAB found in the htm, which will come from 
 RT, and contain the Plugin version that works with this system. Nothing 
 new is required, this is how it works now.

 2. Here we need to enhance REBOL somehow to check for a security 
 update, prompt the user, and download an updater EXE. This is where 
 I think I will work next.

I prefer to think of these as alerts. Popups (initiated by the script) 
are another matter.

3. Maybe we shouldn't do anything at all here.

I'll leave it here for tonight. good discussion, thanks for all the 
feedback.

We could be conservative and not make unrequested non-security updates.

Alerts, ok.

Goodnight Josh. Good to chat with you.

Good night!

What  method for plugin update checking does firefox recommend? I 
already have a number of plugins that prompt me when a newer version 
is available, so I assume they is a standard method for it.

Ah yes... I think there must be some API for it.

Does Firefox check for updates to its plugins? I thought it just 
checked for updates to its themes and extensions but let the plugins 
update themselves. It does seem to provide a plugin registry though.

I think you're right there.

Assuming the plugin will become wildly successful, maybe there should 
be a way to have the initial plugin download and subsequent updates 
come from a site other than rebol.com so that any outage there wouldn't 
affect users hitting a page calling for the plugin. I wonder how 
high load is handled for the Flash plugin?

That's a good question. I'm also curious about how Firefox's plugin 
registry works, how to get a plugin there.

Does the current plugin have the ability to "pop-out" the browser 
window and create a self-standing application window like a Java 
applet?

So that you wouldn't be limited by a restrictive client area.

the first window you create is inside the browser, and the ones after 
that are outside.

Well, that's a good question. I'd prefer the "wild web" version of 
the plugin to be restricted to the browser client area. (popups are 
evil). But the question is, is it possible to resize the client area 
in the browser ?

@Graham - So it's not quite like applets where the applet can jump 
out of and back into the page?

For that matter, is it possible to specify the size of the client 
area relative to the page size, have it resize with the page, and 
have the REBOL layout inside handle the resize as if a View window 
had been resized by the user?

Adrian, no, that's right, you can't relocate windows.

Brian, I notice the Google Videos do this, don't they ?

yes, I believe they can

Aha! A good reason to post this crazy video:

Russian Climbing:

http://video.google.com/videoplay?docid=515642196227308929&pl=true

That's a great video - was totally amazed the first time I saw it

Looking at the source....

I belive the Windows media player can also be made to come out of 
the browser page (I don't mean full screen)

At least I'm pretty sure I've seen the latest version do this

Google uses Flash and they use javascript's onresize to call the 
flash script's window resize function.

Yeah, it just creates another browser window to pop up in - thought 
I remembered it creating a system window.

Russian Climbing
? I thought the French invented parkour.

French wrap songs, but at the end the guys are speaking Russian (I 
think. Definitely not French, though).

Yeah, it is definitely Russians climbing, but they are doing French 
parkour. The French rap was pretty funny though.

The javascript looks like:
	window.onresize = onWindowResize;
where onWindowResize seems to be defined by the Flash.

Will there be any way to control the browser so that it opens inside 
a rebol window?

this is pretty much the only way to show html

To much here to keep up, just picking " The problem is, then you 
have 5 "REBOL/Plugin" objects in Downloaded Program FIles. Thoughts 
on that approach?":

AFAIK with COM, a CLSID is not bound to a file. You can "serve" multiple 
clasids from the same file.  The idea is, that interfaces are frozen, 
if you need more functions you add another interface. which may include 
the same functions as the old one. So instead of using multiple files, 
you can have  the newest one implementing the old interfaces too. 
But then you have to be exactly compatible when using the old interfaces, 
at least thats the  idea. As firefox clones COM, i guess they have 
a similar feature.

Volker, that is true. But the problem here is not COM interface/version 
compatibility. The problem here is: "Which REBOL binary to load?" 
Very simply put, if a web site relies upon plugin version 1.3.2, 
we must make sure that 1.3.2 -- or a later version backwards-compatible 
with 1.3.2 -- loads on their computer. At the same time, we need 
to deliver critical security updates and other non-breaking updates 
to users in a seamless manner.

I'd like to focus the discussion around one unanswered question regarding 
installation: do we inform the user -- in any way -- of a major REBOL 
+ plugin update (i.e. REBOL 3.0)?

If so, how? Popup/message box? Something else?

Yes, you have to, it is the only way to track bugs, and yey, with 
a popup.

(note: I am referring to IE plugin; I know there may be additional 
support in FireFox, but we're focusing on IE 1.3.3 right now)

I think there's no need to inform the user, unless a web page needs 
it.

Reichart, I don't understand what you mean. Can you explain in more 
detail what you mean by "track bugs" ?