5 ms·

That's cool... assuming you can get in: https://getpolarized.io/2019/02/28/dear-app-stores-dont-block-apps-lead-with-the-carrot.html https://getpolarized.io/20

That's cool... assuming you can get in: https://getpolarized.io/2019/02/28/dear-app-stores-dont-block-apps-lead-with-the-carrot.html https://getpolarized.io/2019/02/28/dear-app-stores-dont-bloc... I found out that our app was crushed after 2 weeks of development. Basically, they won't let us in because we use Electron. Electron is developed in part (primarily) due to Github which they now own. TWO WEEKS I spent porting to the MS App Store only to have them just crush us ... It's great that I can make 95% of zero... But seriously. If anyone from Microsoft is listening - please unblock us ;) I'm considering submitting this as a PWA but it's missing a lot of features as a PWA.

deleted 8y ago
[deleted]
jpobst 8y ago
Seems like there might be more to it than that, since Slack is written in Electron and is in the Windows Store.
- opencl 8y ago
  There is something more to it: Slack is really popular and MS really wanted it on the store so they let them ignore the rule.
  - WorldMaker 8y ago
    Slack isn't the only Electron app in the MS Store. There's an entire guide on building Electron apps for the Store: https://electronjs.org/docs/tutorial/windows-store-guide https://electronjs.org/docs/tutorial/windows-store-guide Microsoft devs have even contributed to the tool mentioned in that article (and Microsoft is listed in the MIT license copyright statement): https://github.com/felixrieseberg/electron-windows-store https://github.com/felixrieseberg/electron-windows-store
  - burtonator 8y ago
    The "more to it" is covered in the article. They don't want things 'browsing the web' without you being forced to use MS Edge.
kop316 8y ago
Heh. This reminds me of something else with using Microsoft. My employer uses Office365 with a smart card authentication for email. In order to use the encryption features, you have to enable an activeX plugin from Microsoft. Microsoft Edge does not trust the Microsoft published plugin and disables it every time I boot up Edge (EDIT: I should note even when I attempt to enable it, it shows up as "disabled" on the extension tabs, and I have never gotten encryption/signing working on Edge). It only works on Internet Explorer (which Microsoft is actively trying to get people off). I get the impression they don't do extensive Q&A with their products.
- JoshuaJB 8y ago
  Eh, half the problem is that there are far too many options to maintain, many of them legacy. Smart card authentication has worked great in Edge on Office 365 for years without any plugins at Microsoft, so I imagine your employer has got the wrong box checked somewhere triggering a fall back to ActiveX.
  - kop316 8y ago
    So the smart card authentication works (I can log in), it's using the smart card to encrypt/sign emails.
    - JoshuaJB 8y ago
      Oh, I could certainly see that. I don't recall encryption/signing working very well in the best of cases. If you haven't yet, I'd suggest submitting a bug report (I think there's a button somewhere in the O365 web interface). ActiveX is very deprecated and likely will be removed from Edge as part of the move to Chromium (just my personal speculation - I don't know if that's the official plan).
  - ska 8y ago
    Eh, half the problem is that there are far too many options to maintain In microsofts case, this is partially self-inflicted, and cultural.
deleted 8y ago
[deleted]
JeremyBanks 8y ago
Does your application allow arbitrary web browsing, or just display its own content in a web view?
- burtonator 8y ago
  You preview content on the web, then capture it locally. It's not really 'browsing' as you give it one URL and if that URL works you 'capture' it for offline storage.
  - gpm 8y ago
    Call it whatever you want, you're running untrusted third party code in electron, which is exactly what they should be worried about and preventing. You weren't even blocking code from common malware providers such as ad networks last I checked... Glancing at the code it looks like you still aren't.
giorgioz 8y ago
I do have an electron app on the Windows Store which is not particularly popular. I don't think Electron is just the reason why you were rejected. They might reject you once but keep trying might work. Do provide reason why your electron app is using something native that a normal website cannot achieve.
MSJo 8y ago
Hi, I'm a Microsoft employee and own the certification for apps. Electron is allowed. I checked with my team it. The failure is related to browsing capabilities which have to comply with 10.2.1.
- avinium 8y ago
  No vested interest in this whatsoever - just wanted to let you know that it's cool you picked this up on HN, followed it up internally and responded publicly to clarify the situation. That kind of transparency really helps build confidence in Microsoft Store as a platform. It's important to show that the team is accessible (and, frankly, human). It also helps to correct misleading narratives (e.g. "MS Store doesn't Electron apps").
- deleted 8y ago
  [deleted]
- datastreamer 8y ago
  Definitely thanks for following up. We were eventually approved!!! so if you had any impact here I really really appreciate it!
gpm 8y ago
This strikes me as a very deceptive post - I hope not intentionally. They aren't rejecting your code because you use Electron. They are rejecting your code because you use Electron to browse the web. To see why this is a bad idea, one only has to look so far as the third post currently on the from page of HN: https://news.ycombinator.com/item?id=19321775 https://news.ycombinator.com/item?id=19321775 Do you think that microsoft can reasonably rely on this patch being promptly applied to all the electron apps in it's store? Electron may primarily be developed by GitHub, a recent acquisition, but it is not well suited for this purpose. You can see that this post is tricking other people in the replies to it, e.g. the one discussing slack, the first reaction of the microsoft employee that kindly replied, and the person who replied saying "I have a electron app in the microsoft store".
- gpm 8y ago
  In fact, while I may be mistaken, it looks to me like you are currently serving binaries vulnerable to the exploit linked, which is known to be being attacked in the wild. Your package-lock.json references electron 3.1.3, which was released at the end of January, while that vulnerability was only patched Feb 27. I think (but you should check) that 3.1.5 includes the patch. Edit: It doesn't. The only way to get this patch seems to be to update to Electron 5.x.
- datastreamer 8y ago
  Yes.. I disclose this in the post that I linked to... It's not even a disclosure. I don't claim it's because they're blocking electron apps as a blanket.

deleted 8y ago

[deleted]

jpobst 8y ago

Seems like there might be more to it than that, since Slack is written in Electron and is in the Windows Store.

opencl 8y ago
There is something more to it: Slack is really popular and MS really wanted it on the store so they let them ignore the rule.
- WorldMaker 8y ago
  Slack isn't the only Electron app in the MS Store. There's an entire guide on building Electron apps for the Store: https://electronjs.org/docs/tutorial/windows-store-guide https://electronjs.org/docs/tutorial/windows-store-guide Microsoft devs have even contributed to the tool mentioned in that article (and Microsoft is listed in the MIT license copyright statement): https://github.com/felixrieseberg/electron-windows-store https://github.com/felixrieseberg/electron-windows-store
- burtonator 8y ago
  The "more to it" is covered in the article. They don't want things 'browsing the web' without you being forced to use MS Edge.

kop316 8y ago

Heh. This reminds me of something else with using Microsoft. My employer uses Office365 with a smart card authentication for email. In order to use the encryption features, you have to enable an activeX plugin from Microsoft. Microsoft Edge does not trust the Microsoft published plugin and disables it every time I boot up Edge (EDIT: I should note even when I attempt to enable it, it shows up as "disabled" on the extension tabs, and I have never gotten encryption/signing working on Edge). It only works on Internet Explorer (which Microsoft is actively trying to get people off). I get the impression they don't do extensive Q&A with their products.

JoshuaJB 8y ago
Eh, half the problem is that there are far too many options to maintain, many of them legacy. Smart card authentication has worked great in Edge on Office 365 for years without any plugins at Microsoft, so I imagine your employer has got the wrong box checked somewhere triggering a fall back to ActiveX.
- kop316 8y ago
  So the smart card authentication works (I can log in), it's using the smart card to encrypt/sign emails.
  - JoshuaJB 8y ago
    Oh, I could certainly see that. I don't recall encryption/signing working very well in the best of cases. If you haven't yet, I'd suggest submitting a bug report (I think there's a button somewhere in the O365 web interface). ActiveX is very deprecated and likely will be removed from Edge as part of the move to Chromium (just my personal speculation - I don't know if that's the official plan).
- ska 8y ago
  Eh, half the problem is that there are far too many options to maintain In microsofts case, this is partially self-inflicted, and cultural.

deleted 8y ago

[deleted]

JeremyBanks 8y ago

Does your application allow arbitrary web browsing, or just display its own content in a web view?

burtonator 8y ago
You preview content on the web, then capture it locally. It's not really 'browsing' as you give it one URL and if that URL works you 'capture' it for offline storage.
- gpm 8y ago
  Call it whatever you want, you're running untrusted third party code in electron, which is exactly what they should be worried about and preventing. You weren't even blocking code from common malware providers such as ad networks last I checked... Glancing at the code it looks like you still aren't.

giorgioz 8y ago

I do have an electron app on the Windows Store which is not particularly popular. I don't think Electron is just the reason why you were rejected. They might reject you once but keep trying might work. Do provide reason why your electron app is using something native that a normal website cannot achieve.

MSJo 8y ago

Hi, I'm a Microsoft employee and own the certification for apps. Electron is allowed. I checked with my team it. The failure is related to browsing capabilities which have to comply with 10.2.1.

avinium 8y ago
No vested interest in this whatsoever - just wanted to let you know that it's cool you picked this up on HN, followed it up internally and responded publicly to clarify the situation. That kind of transparency really helps build confidence in Microsoft Store as a platform. It's important to show that the team is accessible (and, frankly, human). It also helps to correct misleading narratives (e.g. "MS Store doesn't Electron apps").
deleted 8y ago
[deleted]
datastreamer 8y ago
Definitely thanks for following up. We were eventually approved!!! so if you had any impact here I really really appreciate it!

gpm 8y ago

This strikes me as a very deceptive post - I hope not intentionally. They aren't rejecting your code because you use Electron. They are rejecting your code because you use Electron to browse the web. To see why this is a bad idea, one only has to look so far as the third post currently on the from page of HN: https://news.ycombinator.com/item?id=19321775 https://news.ycombinator.com/item?id=19321775 Do you think that microsoft can reasonably rely on this patch being promptly applied to all the electron apps in it's store? Electron may primarily be developed by GitHub, a recent acquisition, but it is not well suited for this purpose. You can see that this post is tricking other people in the replies to it, e.g. the one discussing slack, the first reaction of the microsoft employee that kindly replied, and the person who replied saying "I have a electron app in the microsoft store".

gpm 8y ago
In fact, while I may be mistaken, it looks to me like you are currently serving binaries vulnerable to the exploit linked, which is known to be being attacked in the wild. Your package-lock.json references electron 3.1.3, which was released at the end of January, while that vulnerability was only patched Feb 27. I think (but you should check) that 3.1.5 includes the patch. Edit: It doesn't. The only way to get this patch seems to be to update to Electron 5.x.
datastreamer 8y ago
Yes.. I disclose this in the post that I linked to... It's not even a disclosure. I don't claim it's because they're blocking electron apps as a blanket.