Microsoft .NET Framework

[beethoven]

I needed to burn an ISO file yesterday and since I had not installed a CD burner before, downloaded CDBurner XP. When trying to install, I got an alert that I needed to install Microsoft .Net Framework, so proceeded to also install this and the subsequent security patch.

I read up on Wikipedia and it seems that many new programs are coded based on this framework. I certainly don't understand enough but was irritated that hardly installed there were a number of requests for outbound connections (while I was not doing anything).

Do I really need this .Net framework? Doesit have to have permission to connect to the internet or can I leave my block in place? Are there any particular issues that I should be aware of?

[Kerodo]

I personally prefer to do without .NET if possible.. One thing you can do if you like, since the new CDBurnerXP Pro needs .NET, you might want to just go back to the previous version, which for me has always worked fine. Less bloat, less worries, and no problems.... :)

PS- Don't know why .NET should need any internet connection either, that sounds a little odd... perhaps it's only during installation? Otherwise I don't know bout that one...

[EASTER]

.NET is always been a sore spot for me also however it must make developing apps in it simpler for beginners to experts from what i read. Some of my special Vista-like enhancements for XP Pro require at least the 2 version, reluctant as i am to load ALL those seemingly thousands of registry entries just to get a single program to work. I have noticed of late some developers who previously compiled their products with it suddenly reversing that trend and offering NO .NET REQUIRED newest versions, so thats a little consolation.

I haven't experienced any calling out via internet issues but in my HIPS the .NET is frequently doing something in the background that makes my HIPS alert to it and thats a regular annoyance like it or not i live with so the programs that require it can run at all.

[beethoven]

-{ Quote: "I haven't experienced any calling out via internet issues but in my HIPS the .NET is frequently doing something in the background that makes my HIPS alert to it and thats a regular annoyance like it or not i live with so the programs that require it can run at all." }-

Ok, but then my conclusion would be that generally speaking .net framework only has to run when I intend to use the software that is relying on it. So in my case as the only prog is the cd burning software, there should be no harm in shutting it off at all other times and to prevent it from connecting to the net?
Or perhaps as Kerodo suggested, go back to the previous version.

[majoMo]

If you are thinking to uninstall .NET Framework you can try to use the ".NET Framework Cleanup Tool". The member Chalawah found this tool (I used it and works nicely). You can see the post here: http://www.wilderssecurity.com/showthread.php?t=194467

[HAN]

I too belong in the no software is installed unless I really need it. And that included .NET Framework. But as I wanted to run Paint.NET and CDBurnerXP, I went ahead and loaded it. To date, I've had no issues and can't remember it ever asking for web access through my ZAF. And after running the new version of CDBurnerXP, I would not want to give it up. It's my fav burner...

[Defcon]

I always see a lot of people on various forums question .NET and don't know whether it is a distrust of extra software, distrust of Microsoft, big download size, or all three.

As a developer I can tell you it is the best way to build apps for Windows and its only a matter of time before it becomes mandatory. Hell, Vista includes it and many times in the past Microsoft has come this close to including it in the various SP's, and you can bet we developers wish they had.

It does not contain any spyware call home processes, resident services or whatnot. I don't understand why software is given bad reviews because it happens to use .NET.

[TOMxEU]

You are right Defcon, though I have to admit, that I used to do the same, but I got over it, because ATI CCC needs it too. There are also a security issuees on XP, like installing .NET 2.0 will create a useless, but potentionally dangerous NET account, which can be deleted, .NET aplications will work without it. Well I see it now this way: .NET is just a buch of runtime files needed by aplications, like JRE, codecs or filters are, so there is no point avoiding except your 3 reasons. ;)

[Brian K]

beethoven.

You could use ImgBurn. I doubt it needs .NET Framework.

[Nick Rhodes]

Its a shame there is no option to only install the parts of the framework that are required (a bit like in MS office you have the install on first use for options).
.net is a darn good technology (I develop in asp.net/c# for a living), it does make development easier, it is highly tested (and secure) and also the fact there is an open source version Mono, means that MS must of come up with a good idea (you know the saying, imitation is the sincerest form of flattery).

Anyhow, I am of the opinion that if an apps needs it and you like the app, install it.
There is no harm in having lots of registry entries or a few (actually probably a hundred or so :D) megabytes of files on your hdd.

[Nick Rhodes]

-{ Quote: "There are also a security issuees on XP, like installing .NET 2.0 will create a useless, but potentionally dangerous NET account, which can be deleted, .NET aplications will work without it." }-

FYI It is a special limited user account - perfectly safe/secure. It is asp.net, but .net apps do not need it and is safe to delete. There is a command line to add the user if you ever run any asp.net.

[clambermatic]

".NET" has 3 version, installation of whichever version is solely to the end-users' discretion and each version does not need 'prerequisite version' either. In M$' way of doing things, the latest version3 got advances in security & applications more than v2 and so on. hence the choice is on end-users'.

IMO... .NET Does NOT call for any outbound connection once downloaded and installed (initial or not).

Therefore if these does happen, better close your net connection and run your default AV/Malware scanner ASAP! And also include scan repertoires with CureIT or Ewido Micro... as a precaution.

[Nick Rhodes]

-{ Quote: "
PS- Don't know why .NET should need any internet connection either, that sounds a little odd... perhaps it's only during installation? Otherwise I don't know bout that one..." }-

The framework itself does not having anything that runs as such, its a set of libraries of program functionality that needs an app to do anything useful.

Possibly the framework installer connects to the internet, but definately not the framework itself.

[Nick Rhodes]

-{ Quote: "In M$' way of doing things, the latest version3 got advances in security & applications more than v2 and so on. hence the choice is on end-users'.
" }-

V3 is purely Vista-type functionality added to V2 and does not add any extra security/bug fixes that cannot be got via service pack and patches for V2.

Installing V3 on top of V2 performs an upgrade adding these extra features.

[clambermatic]

-{ Quote: " ...Possibly the framework installer connects to the internet, but definately not the framework itself." }-

I agree with what "nickR" mentioned there. When only a .NET is downloaded from MSN Update site, that's only an installer. Once you run that, it will reconnect to winUpdate site for download of every needed .NET components based on what your rig's needs.

If your FW starts popping up requests for permission, monitor it closely and better yet... temporarily stop the installation and do a scan for precaution and repeat scan after components are done with.

[Nick Rhodes]

-{ Quote: ".NET is always been a sore spot for me also however it must make developing apps in it simpler for beginners to experts from what i read. " }-

yes it is not just simpler but unified and far more powerful than anything before, really is something MS got right (probably because it was developed for developers, by developers and MS developers are generally a good bunch).

-{ Quote: "
Some of my special Vista-like enhancements for XP Pro require at least the 2 version, reluctant as i am to load ALL those seemingly thousands of registry entries just to get a single program to work." }-

The registry is a database and a program reads from the registry ONLY the entries that are needed. The registry, in part or entirity does not sit resident in memory, so the extra entries will only take up extra diskspace.

[lucas1985]

A simple question,
Can .NET 3.0 (or the recently released 3.5) replace 2.0 entirely?
I usually install .NET 1.1 (plus SP, hotfix and language pack) and .NET 2.0 (plus hotfixes and language pack)
I use the offline installers.

[zapjb]

Net is evil imo.

[Defcon]

.NET 2.0, 1.1 and 1.0 are separate and independent.
3.0 is a layer on top of 2.0
3.5 is on top of 3.0

So 3.x won't replace 2.0

-{ Quote: "Net is evil imo." }-

This is exactly the kind of FUD I was talking about. Do you have any reason to say that other than the fact that its from MS?

[Kerodo]

-{ Quote: "

This is exactly the kind of FUD I was talking about. Do you have any reason to say that other than the fact that its from MS?" }-
It does seem to add another layer of "bloat" that so far I have been able to completely do without to date.. There have only been one or two apps I've used in 10 years that needed it, and rather than add .NET, I just found alternate apps.. Why install more stuff, more reg entries, more files etc if you don't need it?

[zapjb]

It is & lends a hand to sloppy inefficient programming.

[lucas1985]

-{ Quote: ".NET 2.0, 1.1 and 1.0 are separate and independent.
3.0 is a layer on top of 2.0
3.5 is on top of 3.0

So 3.x won't replace 2.0" }-
So, I should install 1.1, 2.0 and 3.5, right?

[Nick Rhodes]

-{ Quote: "It is & lends a hand to sloppy inefficient programming." }-

Can you explain why you think that.

In my personal, professional experience as Software Developer (web mostly) using MS technologies over the past 9 years I have found the opposite.

[Nick Rhodes]

-{ Quote: "A simple question,
Can .NET 3.0 (or the recently released 3.5) replace 2.0 entirely?
I usually install .NET 1.1 (plus SP, hotfix and language pack) and .NET 2.0 (plus hotfixes and language pack)
I use the offline installers." }-

Depends on the CLR versions.

.net framework 3.5 shares the same clr as 2.0 sp1
3 same clr as 2.0
1.1 same clr as 1.

[lucas1985]

My head is spinning :wacko:
So, the best way would be installing 1.1 (support for 1.0), 3.0 (support for 2.0) and 3.5?

[Nick Rhodes]

Lucas, I would only install what you need, as if you need 2.0 support install 2.0, dont bother with 3.0. If you need 3.0 later, the installer is smart enough to only add the extra 3.0 features, same with 3.5 as well.
Just more stuff to manage (windows updates, backups etc).

[lucas1985]

-{ Quote: "Lucas, I would only install what you need, as if you need 2.0 support install 2.0, dont bother with 3.0. If you need 3.0 later, the installer is smart enough to only add the extra 3.0 features, same with 3.5 as well." }-
So, I'll stick to installing 1.1 and 2.0 and I'll try RyanVM's installers (SPs and hotfixes already integrated) (http://www.ryanvm.net/msfn/)
Thanks.
-{ Quote: "Just more stuff to manage (windows updates, backups etc)." }-
Agreed :( The Java runtime, .NET, C++ Redistributable, DirectX Bimonthly updates, WMP, IE, etc