Offline and the "CONFIG FILE" Issue

A reader posted this question to me:

"I developed an Outlook plugin...

I add the application manifest file in my setup project and deployed on client machine and published it on a deployment server. the problem is that when deployment server is online it works fine but when deployment server is offline, my outlook addin is not loaded."

Misha helped me figure this one out.  Misha's response to the reader was:

"Did you see this part of the documentation which says that .config file is required for offline mode to work?

'Your project must include a configuration file. When the user's system is in offline mode, the common language runtime (CLR) will load an assembly from the Internet Explorer cache only if the assembly has a configuration file. For information about adding a configuration file to your project, see How to: Set Up Configuration Information for an Office Solution. The configuration file does not have to include information specific to your solution; you can add a default configuration file to your project if you do not need other functionality'."

The detail that I can add to this question is answering the why.  Why do you need a config file for when you are offline?  Why does the Outlook add-in not load if the config file is not present and the machine is offline?

The answer is due to security concerns.  One use of the config file is to reconfigure a solution to use a different component--for example because there was a security issue in say version 1.0 of a component, you can reconfigure the solution to use a later version of that component that doesn't have the security issue. 

If the machine goes offline and the CLR can't find the config file in the cache, it has to, in the words of Eric Lippert "assume the worst: that there is in fact a new and important configuration file available that it cannot find."  Meaning, that the last time it loaded the solution when you were online the CLR assumes that the component was downloaded and cached and a config file was also downloaded and cached but then somehow the config file might have been scavenged out of the cache.  So to ensure that your solution will work offline, you have to put a local config file on the machine so that the CLR won't assume this worst case scenario.  Even if all you do is put an empty config file on the machine, this resolves the "config-file-less" conundrum for the CLR.

Eric Lippert talks about this in the VSTO C# book on page 815-816 and in the VSTO VB book on pages 803-805.