Some things just leave me puzzled ... My last "wonder" is Silverlight. I'll close an eye about not supporting proxy authentication (which, well, is used in pretty much every fucking enterprise in the world), because blah blah accessing the LSASS pipe is a PITA from an IE extension, blah blah.. But Jeebus did they really have to ignore proxy.pac settings as well?!? The proxy.pac hack was my only "clean" (HA!) solution to get the video working (just redirect the silverlight site to a squid which requires no auth and which lets that traffic through), without NAT-ing the client and opening some rules on the FW cluster. I mean, thanks a lot for disallowing cross-domain access and hence simplifying the life of us networking monkeys, but pretty please with cherries on top, fix the damn auth+proxy.pac problem.