First, before anyone but Miguel reads this post, please read Miguel's comment on Longhorn changes.

I'll wait.

No, go read it first, this post will still be here after you are done.

Ok, now that we all have the same context, let's continue.

Security

I totally agree, this is a huge issue. Phishing attacks, spyware, malware, viruses, and more are out there and probably the largest problem facing computer science today. This isn't a Microsoft, Linux, or Java issue - this is a "good guys" issue. Windows XP SP2 is probably the best response to Miguel's security concerns. The integrated firewall, security center, and dozens of other security related features are really the first line of defense.

After the basics are resolved there, I would say that the new enhancements to the security system in Avalon are a great step. Not only is Avalon built from the ground up to be secure, but we are enhancing the security system for better application level security, and simpler more understandable presentation of security decisions to the user (hopefully in most cases this means no decision).

As to the specific issue of Phishng that Miguel brings up, that is still mostly a research level issue, which I'd love to see creative solutions to. In Windows today there is the secure desktop, but you must press Ctrl+Alt+Delete to get to it first.

Complexity

Ouch, I take this one to heart. As an architect on Avalon I find it to be my failing when someone says that it is too complex. To be honest, the specific issue that Miguel raises around the object hierarchy is something that I hoped most people wouldn't find to be a huge issue. I figured that most people would look at the features available on the class they were using (like Button), instead of digging into the object browser. The factoring (or over factoring) is our attempt to have a clean model.

From experience, I can think about WinForms. There we had a significantly large simple base class - Control. It implemented almost all the functionality common to the framework, but as such, it implemented properties that some controls outright ignored. Some folks claimed this made WinForms too complex because you couldn't know which properties would affect which controls.

I'm not claiming that Avalon has it right, the object model depth is something we continue to debate, but I will say that we did made a conscious descion to balance OM cleanliness with OM hierarchy.

As for the "fully cooked" argument... come on Miguel. You are looking at something that isn't even a beta product.

Ignoring Standards

Interestingly enough, we never "ignored" standards. We spent a huge amount of time understanding and evaluating the existing standards. SVG and CSS both were passed on because they weren't adaquate to meet our needs. WinFX is a platform for the next decade or longer - we can't start with a base that doesn't meet our needs.

Wesner posted about this a while ago... I posted about it also...

Canvas model

I'm pretty sure that Miguel is talking about "retained mode graphics" here, not our Canvas layout panel...

Avalon is actually more of a smart caching model for graphics. In fact we can run in fully immediate mode, where the visual provides the drawing instructions when needed. The big delta with Avalon is that the display is always buffered, primarily for compositing reasons (we use compositing instead of clipping like User32).

Lack of a GUI designer

This is spot on - I completely agree. Luckily this isn't the first that we've heard this issue, and I'm hoping that we have a great story when we release.

Final Thoughts

Miguel closes with some comments about the "death march" that may happen: "I realized that the Avalon folks now must do two products instead of one: they need to build an Avalon for Longhorn, and another Avalon that will run on XP. It seems that they just added a pile of work to a team that was not ready to release their software."

I'm not sure where Miguel got the idea that we would have a different source base for Longhorn and XP. The "pile of work" is there - shipping for multiple platforms is a lot harder than one - but this isn't an order of magnitude difference.

Miguel, thank you for a very well thought out post, with a lot of good feedback. I disagree with a lot of your points, but you have a lot of valid concerns. I'm particularly concerned/interested in more issues around complexity. As the title of my blog indicates, I believe strongly in simplicity. Every day I try to make Avalon simpler - in fact I really do have a review goal to make the beta of Avalon simpler than the PDC build.

For everyone else out there - keep the feedback coming. We are listening!

[updated: fixed a spelling error]