Comment by qz2 | Hacker News Reader

Comment by qz2 | Hacker News Reader

Parent Full thread

Oh that's nothing.

When they introduced IE7, they broke ClickOnce launchers all around the globe due to the new download prompting. I raised a defect with my MS Partner support dude and normal MS support. All they managed was a registry fix shipped out to turn an old flag on that was removed from the UI but was still in the code inside IE. I did the diagnostic work to get that far.

After arguing for months with various support people at Microsoft I managed to get hold of people on both the IE and CLR teams and they both pointed at each other and refused to fix anything blaming the other team.

They called me every 6 months to ask me to close the ticket and I denied it because it wasn't fucking fixed. Eventually they stopped calling when Microsoft Connect was shut down. I wonder how many millions of issues they solved at that time!

Oh no wait, the issue still exists in IE11. They fixed it in old Edge.

This was a manual registry fix we had to deploy to 20,000 users at over 500 companies for 10 years.

Eventually we rewrote the software so it didn't use ClickOnce, instead passing context to the application via a shell protocol handler (much like Slack does).

Incidentally we're no longer an MS Gold partner and have no certified staff any more. This is not a coincidence. They did a shitty job and like hell we were paying any further. Amazon got our business in the end.

The issue?

You can't set window.location.href=""; to a clickonce activation link because of a race condition in the download bar in IE.

I guess I'm old enough to only ever know this side of MSFT. I see them getting positive reviews (for various different products) here on HN. But stories like yours is what I think of when I hear the word Microsoft thrown around at work. It's a company to be avoided at all costs.

Microsoft OSS stuff is generally good, VSCode, .NET Core and that ecosystem. The enterprise stuff (SFB, Sharepoint, AD, etc.) is a pile of garbage I wouldn't touch unless my life depended on it.

^that If you told me that MSFT championing OSS space ten years ago, I would have assumed that you were trolling.

With the acquisition of Github and NPM, MSFT might just be the new ally of the open source movement.

Acquiring everything doesn't make it an ally, merely an owner or dictator of policy.

Buying things up means monetising them aggressively (after all, that is what acquisition is for). This is the opposite of what an ally would do, it is an impending sign of corporate oppression. Give it a few years.

Oh, yes, Share point, the worst nightmare when I worked in a big corp years ago. I wonder if there are really some sort of experts that understand how does it supposed to work?

There is a reason it is called "Scarepoint," even internally.

I remember the first time I was shown a SharePoint

"This is what we use to keep track all purchase orders! It's GRRREEEAT!"

Neat, so it's a big Excel spreadsheet we all use at the same time? I can get into—hang on, some of this stuff doesn't have a da—should I worry about—are 'Michel' and 'Michell' the same—what about 'Msh', and why are her rows purple?

"Old, all old. If someone from lab needs something, they will tell you."

But I still gotta—

"Everything in the SharePoint."

Sharepoint has tortured people 17 years and still it sucks. I had unfortunate privilege back in 2003 to be involved to many "intranet" projects to customize the Sharepoint to customers needs. That was horrible from the technical point of view.

By enough marketing power you can sell almost anything.

Same here. Microsoft acts like an ex that wants you to believe they’ve changed but you always regret trusting them. Windows still has a lot of crap and actually gotten worse in a few ways (like the spyware and ads).

Windows is basically a glorified games console UI for me now but thanks to my actual consoles and VM-able games I don’t really miss Windows at all.

I had not used anything by Microsoft for 10 years ago until they bought GitHub. Fuck.

> Microsoft acts like an ex that wants you to believe they’ve changed but you always regret trusting them

This is the most apt analogy I've yet seen. I went "back" to Microsoft in the mid 2010s right around the time they started gaining a reputation for sucking less. Big mistake. But at least it gave me enough perspective to realize that the competing non-microsoft products and OSes (even the FOSS ones!) really aren't lacking as much as you'd expect.

Microsoft (and other large companies, surely) has a huge problem dealing with issues where multiple teams share responsibility. There's no supported way to use DirectX (or Direct 2D or DXGI or ...) from .NET. They know there's relatively large demand for it, but the .NET team says "I'll forward that to the DirectX team" and the DirectX team says "we just do C++ over here." The default response to cross-cutting concerns should be that both teams take responsibility but right now neither team will take responsibility. Another corollary to Conway's Law.

I've always heard the phrase, "if two people are responsible, no one is responsible".

> There's no supported way to use DirectX (or Direct 2D or DXGI or ...) from .NET

Wow, they’re still treating .NET as a second class citizen?? That’s one of the biggest reasons I jumped off the MS boat.

At least Apple is going all-in on Swift and actually using their latest tech in core parts of their OSes (unlike MS and things like WPF etc.)

Well you can’t expect Microsoft to rewrite all their software in the framework of the week, right?

That would be stupid. /s?

They could have an official .NET wrapper for DirectX, but then it's not "direct" :) anymore.

Of course then the next question is whether it works on Mac/Linux/... in dotnet.core

which is in conflict with their inner lockin tendency

Same experience with IE bug-reporting here. I reported a bug in May 2015, put up a little example page in order to show them the problem:

http://bjarneh.github.io/ie/index.html

Strange bug where input fields added to the DOM containing non-ASCII characters (whether you escape them or not) trigger 'input' events. So the example page loaded in IE will already have triggered 2 'input' events, since the last 2 input-elements contain the letter 'å' (escaping it as å makes no difference).

After getting through the trouble of submitting the bug, nothing happened. About 6 months later I got an email saying the ticket was closed; as they were not able to reproduce the bug. The bug is still here today 5 years later.

I feel for you. At least it’s good to know that IE11 is likely to die before we do at the moment :)

The sad news was that this browser was the recommended browser to use inside the company as it worked best with "Sharepoint".

Basically a total hack was required for every AJAX request that could return input fields with non-ASCII characters, as the page itself listened for input events on these elements. I.e. we basically have to wait for the AJAX-elements to be added to the DOM (removing any 'input' listener as they are), then add the same event-listeners again after every AJAX-call etc, not exactly an elegant solution...

If that event appears as user interaction you might be able to make a minor vulnerability out of it, instance to create pop-ups without interaction.

Yes that should be possible. Unfortunately I was in the opposite position, i.e. I had to make this browser look normal by hiding all of its misbehaviors, not try to exploit them :-)

Yes but if you can find a way to exploit it you can file it as a security issue and get Microsoft to fix it or even pay you!

Ah, that's the loophole in Microsoft's bug-reporting. It's not just hard to file bug-reports, you have to find ways to exploit every bug in a way that make them security issues :-)

> and get Microsoft to fix it or even pay you!

That would be nice...

> You can't set window.location.href=""; to a clickonce activation link because of a race condition in the download bar in IE.

I don't even... shakes head in dismay

It’s even worse when you realise I spent ten years convincing tens of large angry enterprises why they needed to deploy a registry fix to make our web based software work.

I put the cost of this bug for us just in the $100k range.

Were these deployed on prem on Windows servers?

No - web deployed click once applications. Straight to desktop from browser. Signed and whitelisted.

Reply on news.ycombinator.com