One of these days I’ll actually pay attention to stuff like this by default – it turns out that you can run unsigned .NET code from the internet by default. under medium security settings in IE. I need to test this out as it makes for interesting possibilities.