Changes to Functionality in Microsoft Windows XP Service Pack 2. This document focuses on the changes in Windows XP Service Pack 2 and its implications for developers. Examples and details are provided for several of the technologies that are experiencing the biggest changes. Future versions of this document will cover all new and changed technologies. [via Microsoft Download Center]
Significantly more detailed than the web page available previously.....
Users will be able to view, enable, and disable the add-ons used by Internet Explorer, and identify add-ons that might be related to Internet Explorer crashes. Administrators can enforce a list of add-ons that are allowed or disallowed and restrict the ability of users to manage add-ons..... Windows Error Reporting data has shown that add-ons are a major cause of stability issues in Internet Explorer.
But this is really weird:
The concept of a disabled add-on only applies to instances of Internet Explorer (Iexplore.exe) and Windows Explorer (Explorer.exe). Currently, other programs based on Internet Explorer components, such as the WebBrowser control, do not respect the disabled state.
Begs the question why, and where this functionality is being implemented.
Note that the binary behaviours change has been fed through to custom security managers.
This feature dramatically restricts HTML in the Local Machine zone and HTML that is hosted in Internet Explorer. This helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious HTML code. All application developers should review this feature. Applications that host local HTML files in Internet Explorer are likely to be impacted. Developers of stand-alone applications should plan to adopt changes in their applications that host Internet Explorer.
And finally......
By default, the Pop-up Manager functionality does not apply to applications that host the WebBrowser control or MSHTML. These applications have the ability to use or extend Pop-up Manager, use their own pop-up manager, or disable pop-up management for their application through the INewWindowManager interface.
Sounds like fun, but no documentation available.
Lots of people are going to need to get the beta and check their stuff ain't broken.