Oh that's nothing.

When they introduced IE7, they broke ClickOnce launchers all around the globe due to the new download prompting. I raised a defect with my MS Partner support dude and normal MS support. All they managed was a registry fix shipped out to turn an old flag on that was removed from the UI but was still in the code inside IE. I did the diagnostic work to get that far.

After arguing for months with various support people at Microsoft I managed to get hold of people on both the IE and CLR teams and they both pointed at each other and refused to fix anything blaming the other team.

They called me every 6 months to ask me to close the ticket and I denied it because it wasn't fucking fixed. Eventually they stopped calling when Microsoft Connect was shut down. I wonder how many millions of issues they solved at that time!

Oh no wait, the issue still exists in IE11. They fixed it in old Edge.

This was a manual registry fix we had to deploy to 20,000 users at over 500 companies for 10 years.

Eventually we rewrote the software so it didn't use ClickOnce, instead passing context to the application via a shell protocol handler (much like Slack does).

Incidentally we're no longer an MS Gold partner and have no certified staff any more. This is not a coincidence. They did a shitty job and like hell we were paying any further. Amazon got our business in the end.

The issue?

You can't set window.location.href=""; to a clickonce activation link because of a race condition in the download bar in IE.

I guess I'm old enough to only ever know this side of MSFT. I see them getting positive reviews (for various different products) here on HN. But stories like yours is what I think of when I hear the word Microsoft thrown around at work. It's a company to be avoided at all costs.

Same here. Microsoft acts like an ex that wants you to believe they’ve changed but you always regret trusting them. Windows still has a lot of crap and actually gotten worse in a few ways (like the spyware and ads).

Windows is basically a glorified games console UI for me now but thanks to my actual consoles and VM-able games I don’t really miss Windows at all.

I had not used anything by Microsoft for 10 years ago until they bought GitHub. Fuck.

> Microsoft acts like an ex that wants you to believe they’ve changed but you always regret trusting them

This is the most apt analogy I've yet seen. I went "back" to Microsoft in the mid 2010s right around the time they started gaining a reputation for sucking less. Big mistake. But at least it gave me enough perspective to realize that the competing non-microsoft products and OSes (even the FOSS ones!) really aren't lacking as much as you'd expect.

Microsoft OSS stuff is generally good, VSCode, .NET Core and that ecosystem. The enterprise stuff (SFB, Sharepoint, AD, etc.) is a pile of garbage I wouldn't touch unless my life depended on it.

Sharepoint has tortured people 17 years and still it sucks. I had unfortunate privilege back in 2003 to be involved to many "intranet" projects to customize the Sharepoint to customers needs. That was horrible from the technical point of view.

By enough marketing power you can sell almost anything.

Oh, yes, Share point, the worst nightmare when I worked in a big corp years ago. I wonder if there are really some sort of experts that understand how does it supposed to work?

There is a reason it is called "Scarepoint," even internally.

I remember the first time I was shown a SharePoint

"This is what we use to keep track all purchase orders! It's GRRREEEAT!"

Neat, so it's a big Excel spreadsheet we all use at the same time? I can get into—hang on, some of this stuff doesn't have a da—should I worry about—are 'Michel' and 'Michell' the same—what about 'Msh', and why are her rows purple?

"Old, all old. If someone from lab needs something, they will tell you."

But I still gotta—

"Everything in the SharePoint."

^that If you told me that MSFT championing OSS space ten years ago, I would have assumed that you were trolling.

With the acquisition of Github and NPM, MSFT might just be the new ally of the open source movement.

Buying things up means monetising them aggressively (after all, that is what acquisition is for). This is the opposite of what an ally would do, it is an impending sign of corporate oppression. Give it a few years.

Acquiring everything doesn't make it an ally, merely an owner or dictator of policy.

Microsoft (and other large companies, surely) has a huge problem dealing with issues where multiple teams share responsibility. There's no supported way to use DirectX (or Direct 2D or DXGI or ...) from .NET. They know there's relatively large demand for it, but the .NET team says "I'll forward that to the DirectX team" and the DirectX team says "we just do C++ over here." The default response to cross-cutting concerns should be that both teams take responsibility but right now neither team will take responsibility. Another corollary to Conway's Law.

I've always heard the phrase, "if two people are responsible, no one is responsible".

> There's no supported way to use DirectX (or Direct 2D or DXGI or ...) from .NET

Wow, they’re still treating .NET as a second class citizen?? That’s one of the biggest reasons I jumped off the MS boat.

At least Apple is going all-in on Swift and actually using their latest tech in core parts of their OSes (unlike MS and things like WPF etc.)

Well you can’t expect Microsoft to rewrite all their software in the framework of the week, right?

That would be stupid. /s?

They could have an official .NET wrapper for DirectX, but then it's not "direct" :) anymore.

Of course then the next question is whether it works on Mac/Linux/... in dotnet.core

which is in conflict with their inner lockin tendency

Same experience with IE bug-reporting here. I reported a bug in May 2015, put up a little example page in order to show them the problem:

http://bjarneh.github.io/ie/index.html

Strange bug where input fields added to the DOM containing non-ASCII characters (whether you escape them or not) trigger 'input' events. So the example page loaded in IE will already have triggered 2 'input' events, since the last 2 input-elements contain the letter 'å' (escaping it as å makes no difference).

After getting through the trouble of submitting the bug, nothing happened. About 6 months later I got an email saying the ticket was closed; as they were not able to reproduce the bug. The bug is still here today 5 years later.

If that event appears as user interaction you might be able to make a minor vulnerability out of it, instance to create pop-ups without interaction.

Yes that should be possible. Unfortunately I was in the opposite position, i.e. I had to make this browser look normal by hiding all of its misbehaviors, not try to exploit them :-)

Yes but if you can find a way to exploit it you can file it as a security issue and get Microsoft to fix it or even pay you!

Ah, that's the loophole in Microsoft's bug-reporting. It's not just hard to file bug-reports, you have to find ways to exploit every bug in a way that make them security issues :-)

> and get Microsoft to fix it or even pay you!

That would be nice...

I feel for you. At least it’s good to know that IE11 is likely to die before we do at the moment :)

The sad news was that this browser was the recommended browser to use inside the company as it worked best with "Sharepoint".

Basically a total hack was required for every AJAX request that could return input fields with non-ASCII characters, as the page itself listened for input events on these elements. I.e. we basically have to wait for the AJAX-elements to be added to the DOM (removing any 'input' listener as they are), then add the same event-listeners again after every AJAX-call etc, not exactly an elegant solution...

> You can't set window.location.href=""; to a clickonce activation link because of a race condition in the download bar in IE.

I don't even... shakes head in dismay

It’s even worse when you realise I spent ten years convincing tens of large angry enterprises why they needed to deploy a registry fix to make our web based software work.

I put the cost of this bug for us just in the $100k range.

Were these deployed on prem on Windows servers?

No - web deployed click once applications. Straight to desktop from browser. Signed and whitelisted.

I had the same reaction to this when I was told by Microsoft, however this description seems intentionally misleading. Microsoft Support accepts calls for support and bug reports. There's a fee for the support. If it turns out that the issue is a defect, then you won't pay for the support call.

Unfortunately, this was the only way to report a bug at the time.

Yeah thats definitely possible, I may be misremembering the specifics. I think for us the end result was the same: it made us a lot less likely to help them improve their product.

We did the opposite. With premier support, you used to buy a bucket of hours. We had a few folks that learned the lingo and basically was able to attach a product defect to almost any call we made, billable to the product group.

We’d end up with a surplus of hours, and leverage the threat of slashing those hours to get the execs on the support side to push for concessions from the other parts of the business. Premier was basically a revenue generator for us :)

Something tells me they don't mind if the bucket's overflowing so long as you're paying for the water. "Make 'em feel like _they're_ workin' _you_" is a tried-and-true sales tactic

But sadly not enough to break their desktop monopoly.

I found a nasty XSL rendering bug for some version of IE many solar rounds ago. Took them 2 years to get back to me: "this bug is closed because that browser is not supported anymore" or something like that and "you are not eligible for a free copy of Windows X since there are no bugs". Or something like that, memory is fuzzy. But other people were getting free copy left and right for PEBKAC problems.

Microsoft vulnerabilties are now being disclosed on a Microsoft subsidiary website, Github, Inc.

I’m pretty sure their App Store has a 5-6 year old bug where kids are prompted to use their (child) PIN to authorize purchases instead of a parent’s PIN. I haven’t tested it in a long time though.

I tried to make a video demonstrating it a couple years ago, but VBox video recording mangled it due to a bug. I found it amusing that one bug preventing me from demonstrating another bug.

I tried figuring out how to report something like that to MS and gave up. It’s way too much hassle.

Last month they broke integration with PowerBI service with directquery, marked it “info” without estimated resolution time, posted a windows server specific solution, and ten days later silently fixed it for the rest of the platforms including Azure SQL.

That reminds me of all my efforts reporting bugs in a Certain browser today... Except there is no option to pay $100, you just get ignored and sent to WONTFIX.

I'm assuming that policy was designed for general bug reports, rather than specifically for security bugs? Especially if this was 20 years ago.

Thats ridiculous

I presume you declined to pay?

The company I worked for at the time decided to pay since it was affecting users and we had to do an annoying work around. If I remember correctly we got the $100 back a month or so later, with a one liner reply saying something to the effect of "this will be fixed in a service pack at some point, godspeed."

20 years ago you needed that kind of filter.

Haha. I couldn't even invent something that stupid. I guess they had a lot of cranks reporting bugs? The $100 would make sense if there was a large reward on the other end. Like, if it was deemed to be a real bug, you'd get $10K or $100K.

It sounds like the normal Microsoft support (aka PSS) when you don't have a support agreement. If the problem you are reporting is solved by a hotfix or update, then MS refunds the support fee.

They also refund it if it’s a demonstrable but in the product, even if it’s a WONTFIX bug.

The only downside is the fee is now $500, not $100