Posted by TC on 07/25/06 15:07

Harlan Messinger wrote:
> TC wrote:
> > Harlan Messinger wrote:
> >> TC wrote:
> >
> >>> In days gone by, the Local zone had *less*
> >>> restrictions than the Internet zone. So local files were *more capable*
> >>> than remote ones. Now days, the Local zone has *more* restrictions than
> >>> the Internet zone, so local files are (by default) *less* capable than
> >>> remote ones.
> >> Oh? I've observed the opposite, and this would make no sense, the whole
> >> point being that you trust your own resources more than you trust other
> >> people's.
> >
> > No, I believe that I'm right. Check the link Ed Mullen posted. "The
> > role of the MOTW is more prominent with Internet Explorer 6 for
> > Microsoft Windows XP Service Pack 2 (SP2) because of increased security
> > restrictions in the Local Machine zone. When you are developing Web
> > content, the MOTW enables you to test your active HTML documents in the
> > security zone where you intend the pages to run" [instead of in the
> > increased security restrictions of the Local Machine zone]
>
> The clearer explanation is at the bottom: "Because the Local Machine
> zone has so few security restrictions, active HTML documents running on
> the local machine have access to the computer's entire file system. The
> MOTW aids Internet Explorer in protecting the user from the risks of
> running these documents in the Local Machine zone. By referencing the
> MOTW, Internet Explorer can force these Web pages into a zone that has
> more restrictions, such as the Internet zone. At the same time, the MOTW
> cannot be used to elevate Web pages to a zone with fewer restrictions.
> Forced out of the Local Machine zone, the active content has no access
> to the computer's file system."
>
> It moves the files *into* the Internet zone = "zone that has more
> restrictions", because otherwise they'd be treated as Local Machine
> files with few restrictions.

You missed the next statement: "Note: Windows XP SP2 applications
including Internet Explorer 6 that take advantage of the Local Machine
Zone Lockdown security feature run in an even more restricted
environment than the Internet zone."

In XP SP2, with the Local Machine lockdown, the local zone has *more*
restrictions than the Internet zone. This was an important change in
SP2.

If you don't believe me, try it yourself. Create a simple web page that
includes some javascript. Run it from your local hard disk. On XP SP2,
IE6 will ask you to confirm the script. Now add an MOTW & run it again.
Now IE6 *will not* ask, it will run the script without asking. The MOTW
moves the script from a *more* restrictive execution environment (the
Local zone), to a *less* restrictive one (the Internet one).

HTH,
TC (MVP MSAccess)
http://tc2.atspace.com

[Back to original message]