Hi, I'm a Microsoft employee and own the certification for apps. Electron is allowed. I checked with my team it. The failure is related to browsing capabilities which have to comply with 10.2.1.

No vested interest in this whatsoever - just wanted to let you know that it's cool you picked this up on HN, followed it up internally and responded publicly to clarify the situation.

That kind of transparency really helps build confidence in Microsoft Store as a platform. It's important to show that the team is accessible (and, frankly, human). It also helps to correct misleading narratives (e.g. "MS Store doesn't Electron apps").

Definitely thanks for following up.

We were eventually approved!!! so if you had any impact here I really really appreciate it!

This strikes me as a very deceptive post - I hope not intentionally.

They aren't rejecting your code because you use Electron. They are rejecting your code because you use Electron to browse the web.

To see why this is a bad idea, one only has to look so far as the third post currently on the from page of HN: https://news.ycombinator.com/item?id=19321775 Do you think that microsoft can reasonably rely on this patch being promptly applied to all the electron apps in it's store?

Electron may primarily be developed by GitHub, a recent acquisition, but it is not well suited for this purpose.

You can see that this post is tricking other people in the replies to it, e.g. the one discussing slack, the first reaction of the microsoft employee that kindly replied, and the person who replied saying "I have a electron app in the microsoft store".

In fact, while I may be mistaken, it looks to me like you are currently serving binaries vulnerable to the exploit linked, which is known to be being attacked in the wild.

Your package-lock.json references electron 3.1.3, which was released at the end of January, while that vulnerability was only patched Feb 27. I think (but you should check) that 3.1.5 includes the patch. Edit: It doesn't. The only way to get this patch seems to be to update to Electron 5.x.

Yes.. I disclose this in the post that I linked to...

It's not even a disclosure. I don't claim it's because they're blocking electron apps as a blanket.

Heh. This reminds me of something else with using Microsoft. My employer uses Office365 with a smart card authentication for email. In order to use the encryption features, you have to enable an activeX plugin from Microsoft. Microsoft Edge does not trust the Microsoft published plugin and disables it every time I boot up Edge (EDIT: I should note even when I attempt to enable it, it shows up as "disabled" on the extension tabs, and I have never gotten encryption/signing working on Edge). It only works on Internet Explorer (which Microsoft is actively trying to get people off).

I get the impression they don't do extensive Q&A with their products.

Eh, half the problem is that there are far too many options to maintain, many of them legacy. Smart card authentication has worked great in Edge on Office 365 for years without any plugins at Microsoft, so I imagine your employer has got the wrong box checked somewhere triggering a fall back to ActiveX.

   Eh, half the problem is that there are far too many options to maintain

In microsofts case, this is partially self-inflicted, and cultural.

Enterprises want options. How else are they going to disable solitaire and make work as miserable as possible?

So the smart card authentication works (I can log in), it's using the smart card to encrypt/sign emails.

Oh, I could certainly see that. I don't recall encryption/signing working very well in the best of cases. If you haven't yet, I'd suggest submitting a bug report (I think there's a button somewhere in the O365 web interface). ActiveX is very deprecated and likely will be removed from Edge as part of the move to Chromium (just my personal speculation - I don't know if that's the official plan).

Seems like there might be more to it than that, since Slack is written in Electron and is in the Windows Store.

There is something more to it: Slack is really popular and MS really wanted it on the store so they let them ignore the rule.

Slack isn't the only Electron app in the MS Store. There's an entire guide on building Electron apps for the Store:

https://electronjs.org/docs/tutorial/windows-store-guide

Microsoft devs have even contributed to the tool mentioned in that article (and Microsoft is listed in the MIT license copyright statement):

https://github.com/felixrieseberg/electron-windows-store

The "more to it" is covered in the article.

They don't want things 'browsing the web' without you being forced to use MS Edge.

Does your application allow arbitrary web browsing, or just display its own content in a web view?

You preview content on the web, then capture it locally.

It's not really 'browsing' as you give it one URL and if that URL works you 'capture' it for offline storage.

Call it whatever you want, you're running untrusted third party code in electron, which is exactly what they should be worried about and preventing.

You weren't even blocking code from common malware providers such as ad networks last I checked... Glancing at the code it looks like you still aren't.

I do have an electron app on the Windows Store which is not particularly popular. I don't think Electron is just the reason why you were rejected. They might reject you once but keep trying might work. Do provide reason why your electron app is using something native that a normal website cannot achieve.