> Gizmodo was able to replicate the problem. In fact, we were able to circumvent the issue just by changing the name of the Chrome app on a Windows desktop. It seems that Microsoft threw up the roadblock specifically for Chrome, the main competitor to its Edge browser.
> Mozilla’s Firefox has its own one-click default button, which worked just fine throughout the ordeal.
so no, this doesn't appear to be about an app using a backdoor API, it's specifically targeted at Chrome.
https://chromium.googlesource.com/chromium/src/+/refs/heads/...
Yes, installing Candy Crush and a version of solitaire filled with IAP or filling the start menu with MSN news cruft is really looking out for its users. The only entities that Microsoft gives half a shit about is their shareholders.
A little dive in the original feature would reveal a bunch of unfortunate time-bombs of behaviors taking dependencies on _write time to the registry_, adding arbitrary retry loops to overcome time resolution, and circumventing the standard path in the platform.
https://chromium-review.googlesource.com/c/chromium/src/+/37...
The conspiracy theory is wild, and seems to be based largely on the changing of the name, but if you read the patch, it's dependent on the file.
The comments on the review that were rejected by the author could easily be the conditions that changed and a plausible cause.
The whole thing smells like sensationalist FUD, particularly given the content of this patch.
For what it's worth, around this time Microsoft's own API (which will only set Edge as default) messed this up occasionally if you ran it on the edge of a minute. When I implemented the equivalent feature for Firefox I checked the time, only one retry instead of Chrome's 5 and it's still not perfect, though my approach doesn't write the potentially out of date values first. That was already sufficiently stable that I couldn't make it fail.
The only reason Edge or whatever Microsoft is pushing these days didn't trigger the issue is because their browser didn't make the API call on every new window event and not because of some sinister plan to increase their market share.
Back in the day trying to do things as silently as possible was reserved for malware.