oreilly.comSafari Books Online.Conferences.


Moonlight: Silverlight Goes Mono
Pages: 1, 2

The solution turned out to be Cecil, a library for operating on compiled CIL bytecode. A linker based on Cecil is able to create multiple profiles of the same libraries, creating appropriate Moonlight libraries after all the compilation has been done. This tuning process not only removes unneeded parts of libraries, but also adds in required attributes, avoiding large amounts of intrusive #ifdef macros in the original source. The current estimate is that Moonlight will be about eight or nine megabytes to download, about a third of the size of Mono.

In addition to the reduced API size, hosting Moonlight in the browser offers another, significant challenge: security. Applications delivered over the network and running in the browser must be subject to security that is both tight and easily understood. For Silverlight itself, Microsoft deprecated their previous .NET security mechanism, Code Access Security (CAS), using instead something called the CoreCLR security model (the CoreCLR being the reduced-footprint runtime powering Silverlight).

As with removing the obligation to implement all of WPF, not having to implement CAS in its entirety is a huge boon to the Moonlight project, although a subset of CAS functionality is available. At its most simple, Moonlight security comes down to three levels of access for code:

  • Transparent code

  • Safe critical APIs

  • Critical APIs

Transparent code is what all Silverlight applications are composed of; it is verifiable, meaning that the runtime is able to inspect the bytecode and ensure it doesn't attempt unsafe actions. The safe critical APIs provide a bridge between the Silverlight application code and critical APIs. For instance, accessing the filesystem would be considered a critical operation, as it requires native system calls. The safe critical API enforces the sandbox rules for filesystem access, wrapping the critical API, and only permits operations if the rules are satisfied.

Interestingly, once this model is implemented, it has advantages beyond embedding Mono in the desktop browser. As Miguel de Icaza observes, the CoreCLR security model is very similar to that required for the embedding of Mono in Second Life.

What Interesting Things Can I Do with Moonlight?

The obvious use of Moonlight is to run Silverlight applications in the browser, of course. Given the current state of play, it will likely be some time in the next year before you can do that securely. However, there's a really interesting application you can put Moonlight to right away: desklets.

Desklets, also known as widgets, are small applications with a dedicated purpose. If you've not seen any before, check out Mac OS X Dashboard, Yahoo! Widgets, or gDesklets. They're attractive, easy to use, and lightweight.

Following the hack-a-thon theme, the Moonlight desklets work was started as part of Novell's hack week, an exercise inspired by Nat Friedman where Novell employees got a week to work on a new project of their choice.

Desklets screenshot
Figure 2. Example Moonlight desklets in action

Desklets are implemented simply as a directory containing a XAML file and the logic to drive it. To see desklets in action, view this YouTube video and read more about how they work in Miguel's blog.

Also thanks to Novell's hack week, Mono's IDE (Monodevelop) is also getting some support for developing Moonlight applications. Jackson Harper's hack week work was focused on allowing Monodevelop to import Silverlight projects and to create new ones.

How Can I Get My Hands on Moonlight?

First, remember that Moonlight is an experimental implementation of an unreleased technology. The real fun with Silverlight itself will start when version 1.1 is finalized. So, you should limit expectations of what you can do to experiments for now. If you're not comfortable with compiling, patching, or begging for help on IRC, waiting a while is the best policy. That said, the Getting Started notes on the Moonlight home page give you instructions on how to start working with Moonlight now.

According to the Moonlight team, the Moonlight development tools will ship with Mono by the end of the year, or early 2008. They hope to soon publish a more formal roadmap of deliverables.

Moonlight Factfile


XML for UI, JavaScript, Python, Ruby, C# or Visual Basic.NET for code.


Optimized for the Web: built in Ajax functionality.


Through a web page in Firefox or via a desktop runner.


Linux, Mac, Windows. Theoretically, anywhere Mono runs.


Mono's Moonlight tools, Monodevelop IDE.


Mono, Mozilla, Cairo, GTK+, FFmpeg, ALSA

Microsoft worry factor

Microsoft seems to be actively helping Miguel's team in building Moonlight. After all, its ubiquity is to their advantage, and it's hardly the same as a full .NET 3.0 implementation.

Further Reading

Edd Dumbill is co-chair of the O'Reilly Open Source Convention. He is also chair of the XTech web technology conference. Edd conceived and developed Expectnation, a hosted service for organizing and producing conferences. Edd has also been Managing Editor for, a Debian developer, and GNOME contributor. He writes a blog called Behind the Times.

Return to ONLamp.

Sponsored by: