8 ms·

Oh that's nothing. When they introduced IE7, they broke ClickOnce launchers all around the globe due to the new download prompting. I raised a defect with my M

by qz2 6y ago

Oh that's nothing. When they introduced IE7, they broke ClickOnce launchers all around the globe due to the new download prompting. I raised a defect with my MS Partner support dude and normal MS support. All they managed was a registry fix shipped out to turn an old flag on that was removed from the UI but was still in the code inside IE. I did the diagnostic work to get that far. After arguing for months with various support people at Microsoft I managed to get hold of people on both the IE and CLR teams and they both pointed at each other and refused to fix anything blaming the other team. They called me every 6 months to ask me to close the ticket and I denied it because it wasn't fucking fixed. Eventually they stopped calling when Microsoft Connect was shut down. I wonder how many millions of issues they solved at that time! Oh no wait, the issue still exists in IE11. They fixed it in old Edge. This was a manual registry fix we had to deploy to 20,000 users at over 500 companies for 10 years. Eventually we rewrote the software so it didn't use ClickOnce, instead passing context to the application via a shell protocol handler (much like Slack does). Incidentally we're no longer an MS Gold partner and have no certified staff any more. This is not a coincidence. They did a shitty job and like hell we were paying any further. Amazon got our business in the end. The issue? You can't set window.location.href=""; to a clickonce activation link because of a race condition in the download bar in IE.

arthurcolle 6y ago
> You can't set window.location.href=""; to a clickonce activation link because of a race condition in the download bar in IE. I don't even... shakes head in dismay
- qz2 6y ago
  It’s even worse when you realise I spent ten years convincing tens of large angry enterprises why they needed to deploy a registry fix to make our web based software work. I put the cost of this bug for us just in the $100k range.
  - arthurcolle 6y ago
    Were these deployed on prem on Windows servers?
    - qz2 6y ago
      No - web deployed click once applications. Straight to desktop from browser. Signed and whitelisted.
ryanSrich 6y ago
I guess I'm old enough to only ever know this side of MSFT. I see them getting positive reviews (for various different products) here on HN. But stories like yours is what I think of when I hear the word Microsoft thrown around at work. It's a company to be avoided at all costs.
- reader_mode 6y ago
  Microsoft OSS stuff is generally good, VSCode, .NET Core and that ecosystem. The enterprise stuff (SFB, Sharepoint, AD, etc.) is a pile of garbage I wouldn't touch unless my life depended on it.
  - PradeetPatel 6y ago
    ^that If you told me that MSFT championing OSS space ten years ago, I would have assumed that you were trolling. With the acquisition of Github and NPM, MSFT might just be the new ally of the open source movement.
    - qz2 6y ago
      Acquiring everything doesn't make it an ally, merely an owner or dictator of policy.
    - krageon 6y ago
      Buying things up means monetising them aggressively (after all, that is what acquisition is for). This is the opposite of what an ally would do, it is an impending sign of corporate oppression. Give it a few years.
  - walty8 6y ago
    Oh, yes, Share point, the worst nightmare when I worked in a big corp years ago. I wonder if there are really some sort of experts that understand how does it supposed to work?
    - Wistar 6y ago
mastax 6y ago
Microsoft (and other large companies, surely) has a huge problem dealing with issues where multiple teams share responsibility. There's no supported way to use DirectX (or Direct 2D or DXGI or ...) from .NET. They know there's relatively large demand for it, but the .NET team says "I'll forward that to the DirectX team" and the DirectX team says "we just do C++ over here." The default response to cross-cutting concerns should be that both teams take responsibility but right now neither team will take responsibility. Another corollary to Conway's Law.
- JamesBarney 6y ago
  I've always heard the phrase, "if two people are responsible, no one is responsible".
- Razengan 6y ago
  > There's no supported way to use DirectX (or Direct 2D or DXGI or ...) from .NET Wow, they’re still treating .NET as a second class citizen?? That’s one of the biggest reasons I jumped off the MS boat. At least Apple is going all-in on Swift and actually using their latest tech in core parts of their OSes (unlike MS and things like WPF etc.)
  - tinus_hn 6y ago
    Well you can’t expect Microsoft to rewrite all their software in the framework of the week, right?
    - silon42 6y ago
      That would be stupid. /s? They could have an official .NET wrapper for DirectX, but then it's not "direct" :) anymore. Of course then the next question is whether it works on Mac/Linux/... in dotnet.core which is in conflict with their inner lockin tendency
bjarneh 6y ago
Same experience with IE bug-reporting here. I reported a bug in May 2015, put up a little example page in order to show them the problem: http://bjarneh.github.io/ie/index.html http://bjarneh.github.io/ie/index.html Strange bug where input fields added to the DOM containing non-ASCII characters (whether you escape them or not) trigger 'input' events. So the example page loaded in IE will already have triggered 2 'input' events, since the last 2 input-elements contain the letter 'å' (escaping it as å makes no difference). After getting through the trouble of submitting the bug, nothing happened. About 6 months later I got an email saying the ticket was closed; as they were not able to reproduce the bug. The bug is still here today 5 years later.
- qz2 6y ago
  I feel for you. At least it’s good to know that IE11 is likely to die before we do at the moment :)
  - bjarneh 6y ago
    The sad news was that this browser was the recommended browser to use inside the company as it worked best with "Sharepoint". Basically a total hack was required for every AJAX request that could return input fields with non-ASCII characters, as the page itself listened for input events on these elements. I.e. we basically have to wait for the AJAX-elements to be added to the DOM (removing any 'input' listener as they are), then add the same event-listeners again after every AJAX-call etc, not exactly an elegant solution...
- tinus_hn 6y ago
  If that event appears as user interaction you might be able to make a minor vulnerability out of it, instance to create pop-ups without interaction.
  - bjarneh 6y ago
    Yes that should be possible. Unfortunately I was in the opposite position, i.e. I had to make this browser look normal by hiding all of its misbehaviors, not try to exploit them :-)

by qz2 6y ago

arthurcolle 6y ago

> You can't set window.location.href=""; to a clickonce activation link because of a race condition in the download bar in IE. I don't even... shakes head in dismay

qz2 6y ago
It’s even worse when you realise I spent ten years convincing tens of large angry enterprises why they needed to deploy a registry fix to make our web based software work. I put the cost of this bug for us just in the $100k range.
- arthurcolle 6y ago
  Were these deployed on prem on Windows servers?
  - qz2 6y ago
    No - web deployed click once applications. Straight to desktop from browser. Signed and whitelisted.

ryanSrich 6y ago

I guess I'm old enough to only ever know this side of MSFT. I see them getting positive reviews (for various different products) here on HN. But stories like yours is what I think of when I hear the word Microsoft thrown around at work. It's a company to be avoided at all costs.

reader_mode 6y ago
Microsoft OSS stuff is generally good, VSCode, .NET Core and that ecosystem. The enterprise stuff (SFB, Sharepoint, AD, etc.) is a pile of garbage I wouldn't touch unless my life depended on it.
- PradeetPatel 6y ago
  ^that If you told me that MSFT championing OSS space ten years ago, I would have assumed that you were trolling. With the acquisition of Github and NPM, MSFT might just be the new ally of the open source movement.
  - qz2 6y ago
    Acquiring everything doesn't make it an ally, merely an owner or dictator of policy.
  - krageon 6y ago
    Buying things up means monetising them aggressively (after all, that is what acquisition is for). This is the opposite of what an ally would do, it is an impending sign of corporate oppression. Give it a few years.
- walty8 6y ago
  Oh, yes, Share point, the worst nightmare when I worked in a big corp years ago. I wonder if there are really some sort of experts that understand how does it supposed to work?
  - Wistar 6y ago

mastax 6y ago

Microsoft (and other large companies, surely) has a huge problem dealing with issues where multiple teams share responsibility. There's no supported way to use DirectX (or Direct 2D or DXGI or ...) from .NET. They know there's relatively large demand for it, but the .NET team says "I'll forward that to the DirectX team" and the DirectX team says "we just do C++ over here." The default response to cross-cutting concerns should be that both teams take responsibility but right now neither team will take responsibility. Another corollary to Conway's Law.

JamesBarney 6y ago
I've always heard the phrase, "if two people are responsible, no one is responsible".
Razengan 6y ago
> There's no supported way to use DirectX (or Direct 2D or DXGI or ...) from .NET Wow, they’re still treating .NET as a second class citizen?? That’s one of the biggest reasons I jumped off the MS boat. At least Apple is going all-in on Swift and actually using their latest tech in core parts of their OSes (unlike MS and things like WPF etc.)
- tinus_hn 6y ago
  Well you can’t expect Microsoft to rewrite all their software in the framework of the week, right?
  - silon42 6y ago
    That would be stupid. /s? They could have an official .NET wrapper for DirectX, but then it's not "direct" :) anymore. Of course then the next question is whether it works on Mac/Linux/... in dotnet.core which is in conflict with their inner lockin tendency

bjarneh 6y ago

Same experience with IE bug-reporting here. I reported a bug in May 2015, put up a little example page in order to show them the problem: http://bjarneh.github.io/ie/index.html http://bjarneh.github.io/ie/index.html Strange bug where input fields added to the DOM containing non-ASCII characters (whether you escape them or not) trigger 'input' events. So the example page loaded in IE will already have triggered 2 'input' events, since the last 2 input-elements contain the letter 'å' (escaping it as å makes no difference). After getting through the trouble of submitting the bug, nothing happened. About 6 months later I got an email saying the ticket was closed; as they were not able to reproduce the bug. The bug is still here today 5 years later.

qz2 6y ago
I feel for you. At least it’s good to know that IE11 is likely to die before we do at the moment :)
- bjarneh 6y ago
  The sad news was that this browser was the recommended browser to use inside the company as it worked best with "Sharepoint". Basically a total hack was required for every AJAX request that could return input fields with non-ASCII characters, as the page itself listened for input events on these elements. I.e. we basically have to wait for the AJAX-elements to be added to the DOM (removing any 'input' listener as they are), then add the same event-listeners again after every AJAX-call etc, not exactly an elegant solution...
tinus_hn 6y ago
If that event appears as user interaction you might be able to make a minor vulnerability out of it, instance to create pop-ups without interaction.
- bjarneh 6y ago
  Yes that should be possible. Unfortunately I was in the opposite position, i.e. I had to make this browser look normal by hiding all of its misbehaviors, not try to exploit them :-)