third-party installer for choice and security

third-party installer for choice and security

• Vinod Sa

  I am sure you believe you have acted in our best interests; but, taking choice away from developers is not what I would call engaging the development community. Yes, in the past, MS was very supportive of the community. However, in recent years, the attitude is more of a do it our way or move on. While polite, your reply sends that sort of message. I, for one, do not like my choice being taken away.
  
  Whether the intention was to hide or not, the end result is a program that is hidden from the user. Even the developer doesn't know where the program was installed (although the location can be discovered by a little creative coding). Hiding software installation is not my idea of good security. That the shortcut on the Start menu also hides the program's location and its properties is also disturbing. It seems more like a breeding ground for malware.
  
  With regard to your experience on the road: As a computer security consultant, I am not at all surprised that users would love to have a way to install programs without having to worry about the admintrator's approval. Perhaps I'm misunderstanding the concept. 
  
  I have been developing a com class in vb express. I successfully ran regasm on it; but the program that is supposed to access it cannot find it. Is that because it is so well hidden At this point the only choice I have is to rewrite the program in another IDE. That may be VS2003 or in a competitor's language. My career has been built on MS products so it is not a decision I can take lightly, but MS is giving me no choice ;).
  
  UPDATE: I ran sn.exe on the installed program's exe (that's one more reason why its good to know where a program is installed) to create a strong name key pair. Then I ran gacutil.exe on the program's exe. Now the com class is recognized by the other program. Unfortunately, it's properties and methods are not. Any ideas
  
  The other program is called Wealth-Lab (a trading program); it uses a pascal like script. Here's the code:
  
  var zcLib: ComVariant;
  zcLib := CreateOleObject('zc.CheckResult');
  showmessage(inttostr(zcLib.NumMinutes(IWealthLabAddOn3)));
  

  
  

• Klause

  I have been trying to get a response in the Language forum but with no success so far. I've actually made several requests because as I learn more and try out different ideas, the problem that needs to be fixed keeps changing. But thanks anyway.
  

• Barry Neilsen

  Hi, rwbogosian,
  
  I’m sorry that this aspect of the click-once deployment process is frustrating. Please accept my assurances that engaging the development community is very much on our minds, and much of our daily routine revolves around that guiding principle. When we first started the Whidbey cycle, we recognized that we needed to get more involved with the community and better understand what our customers need, and to that end we’ve been visiting customers, inviting customers in, getting customer feedback on the prototypes very early in the product cycles, blogging, enhanced newsgroup and forum participation, expanded beta coverage, and so on. I know that my team has personally have benefited from this interaction, and we’ve made a great deal of changes in the code based on customer feedback. I will be the first to admit that we can certainly take it even farther, and in the coming product cycle (which we are defining now) we will continue to focus heavily on customer feedback in all aspects of the development cycle.
  
  
  
  For the particular feature in question: I’m not on the deployment team, and they could certainly explain it better than me, but I’ve demo’d the feature with customers on trips and so have some familiarity with it. I can definitely state that the intention was not to hide the installation location; far from it. The rationale behind the current scheme (which is not limited to Express versions, but the other versions as well) is around security – maximizing the ability for end-users to download the application without forcing them to have administrator privileges. The application gets downloaded to a location which is end-user specific, rather than general locations which might require the end user to have administration privileges (depending on how the customer has defined directory access). We’ve gotten the feedback from our customers that requiring such privileges is not a good thing, because it creates all sorts of security headaches, and the click once mechanism avoids this by essentially treating the application as bits owned by the specific user. It’s also designed to make (for example) rolling back to previous versions easy even if the network is not available, thanks to caching. If you need to get to the actual EXE, for whatever reason, you still can, since it’s in your own documents area (albeit cached in such a way as to make sure that it is “unique” on the filesystem). That is not to say that it is perfect, and as we go forward, we will continue to incorporate customer feedback into improvements.
  
  
  
  As far as Express goes: hmm, I dunno, I kinda like them, but that’s just me. I do most of my “for fun” app building & deployment using VB Express. Still, there are some things with Express that we’d really like to expand upon. I think we can do (and did) a reasonably job of determining which features would go into the release (I’m happy to hear opinions regarding this, incidentally :-)), but (just for example) maybe we could do better on the actual designer experience – it’s not clear to me that the VS Pro shell is necessarily the best fit for Express scenarios, and there’s a whole host of hobbyist scenarios that we haven’t even begun to address. There is a *lot* of thought around this subject here in Redmond right now; I personally enjoy thinking and planning around it.
  
  
  
  I hope this helps or clarifies things a bit. We really do value your feedback and appreciate all suggestions you might have.
  
  
  
  --Matt Gertz--*
  
  VB Compiler Dev Lead
  
  

• hackfinn

  That's one of the problems of this hidden installation concept that some dimwit at MS thought up. If they don't trust the programmer to make the choice of where to install his/her own program they should atleast put it in accessible location such as Program Files or a new VS Express exclusive location (e.g., C:\VSE Programs). That would resolve both their lack of faith in programmers and rest of the world's desire to have programs installed in an accessible location.
  
  For me, the key issue is trust. MS doesn't trust the programmer; nobody who knows anything about computer security would trust a program that hides it's installation; not even a new programmer should trust a development platform that insults his/her intelligence.
  
  IMHO, even a preteen just learning programming would outgrow the Express version within a few months. I thought it was MS's intention to draw new programmers to Visual Studio products. The limitations of the Express versions (I've tried all but J#) are driving me away. Although I've used earlier Pro and Enterprise versions (both at home & work), my Express experience has me thinking I should wait until the next upgrade before purchasing VS; 2005 just doesn't work well enough. Sure there are neat IDE improvements but that doesn't make up for MS's apparent belief that programmers cannot be trusted to make their own choices.
  
  I am a long time MS advocate (I programmed with VB since the preWindows version) but I feel like they are caring less and less about the development community. My particular concern is that new programmers are likely to turn away from MS products because other companies are making greater efforts to include developers in the process. These days, MS's attitude seems to be that we must do exactly what MS wants whether we like it or not. Sorry, MS but developers know a thing or two about programming; you would do better if you were considerate our needs and desires.

  
  

• JEsraelo

  McWhirter wrote:

  Thats good to know I was just whining to myself yesterday that the product comparison listed clickonce for the Basic Edition. I didn't wanna have to fork out the money for Pro. Now i might be happy :)

  
  
  Yes, I was pleasently suprised to find that out too. If you noticed (and unless it has been changed, haven't checked lately) the product comparison page, shows that the Express Editions don't have a deployment method. ClickOnce Deployment is not mentioned for the Express Editions and yet, it is there.
  To me that is a pretty good deal for a freebie!
  james
  aka:Trucker
  
  

• tjerk

  There are dozens of reasons why developers and users prefer to choose where an app gets installed. That's why that option exists in the real world. I am amazed that MS decided to hide the install location (I assume there was some sort of brain freeze in Redmond that day). Even the shortcut in the Start menu intentionly hides the location of the installed program. The only way I found my app's location was by adding Application.StartupPath in a messagebox in my code.
  
  When so many people today are concerned about computer security, it makes absolutely no sense to hide software installations. Malware writers hide their installations not legitimate programmers. I imagine at least a few malware writers are looking into ways of taking advantage of this feature.
  
  I, for one, would not trust software that intentionally tries to hide itself from me.  Any reasonably security-minded person would want to know what is being installed and to where it being is installed.
  

• poum

  I agree
  
  I just discovered that a batch file my vb2005express program runs will NOT run from the default installation folder. If this is the case I'll have to deploy the completed app on my machine, then manually create folders and shortcuts on other machines using the correct files.
  
  Clickonce is great for updating, but it gets a general thumbs down from me for being pretty much totally useless otherwise.
  

• UweM

  Hi, Rwbogosian,
  
  I want to make it clear what I mean when I said “engage the developer community,” since I probably wasn’t very clear at all (I tend to rather too much verbosity :-)) – very specifically, I mean that we got feedback on the feature using VB customers who need to do this sort of work day to day, at various points in the product cycle – at the point when we designed it, or the first prototypes (made available via TS sessions into our own machines), alphas, betas, and customer releases, online chats, and some onsite meetings as well. Granted, it has to be a limited set of customers in many cases in order to stay manageable (much larger for betas, obviously, but smaller for terminal sessions), but nevertheless it’s important to us, almost a “signoff” on the features, really, and we do change the features based on that feedback – I certainly don’t want to ship features nobody likes or can’t use – that’s just no fun (or use) for anyone.
  
  
  
  Hope that clarifies, and sorry for any confusion…
  
  
  
  --Matt--*
  
  

• Erdw

  Visual Basic Express only supports ClickOnce publishing, which doesn't allow control over the installation location, however it does have many benefits such as the ability to automatically update the application. Is there a particular reason why you need to control where the app is installed If not, take a look at CllickOnce; is so, then a third-party installer (or the full version of Visual Studio, which includes Setup and Deployment projects) will be necessary.
  
  Steve Hoag
  
  

• Justin Burtch

  Just thought I would add my .02 to this post.  As I understand it, the Express Editions are mainly targeted at people wanting to learn programming and not at
  PRO Developers.  The fact that Microsoft included ClickOnce Deployment with a
  free product , is, in my opinion, pretty neat. It is not the solution for someone
  wanting more creative control over the installation of their application(s).
  For that you can, as I recently learned, move up to Visual Studio 2005 Standard Edition.  The product comparison page does not show it, but, you can do a real
  Setup Project with the Standard Edition just like in the PRO edition.
  At least, that is what I have on my system and it works quite well.  I went to a
  Launch Event recently and received Visual Studio 2005 Standard Edition along with
  SQL Server 2005 Standard Edition and a voucher for BizTalk Server 2006. (all attendees received the same set of software)
  I installed Visual Studio 2005 Standard Edition along with the MSDN DVD and that is when I found out that the Standard Edition includes templates for Setup Projects. I have only tested a portion of it, but, so far, the Setup Templates and the test project I created with it, created a working Setup.
   I was planning to purchase the PRO edition for this feature alone. But, having seen that the Standard Edition has it, I may hold off until I have had the chance to find other differences between the Editions that I may or may not need.
  If you have a previous version of Visual Studio on your system, you can find the upgrade version of Visual Studio 2005 Standard Edition online for less than $200.00.  That is cheaper than some of the 3rd party installers(Wise etc.) and gives you the options you want.
  james
  aka:Trucker
   
  

• Lenka

  Thank you for that clarification but there is something I still don't understand. I manually ran regasm, sn and gacutil on both an exe and a dll created in an Express edition. Each of the three utilities reported success. However, neither my exe nor the dll show's up in the Add Reference dialog box under COM. I can add them using Browse. Oddly, while the class itself is recognized the properties and methods (functions and subs) are not. They show up in the Object Browser but not as an Intellisense selection. When trying to use the class from another program that normally can access COM objects (from Excel for example) the same thing happens. The class is recognized but properties and methods are not. Is this a limitation of the Express version
  
  Frankly, I would have given up long ago but quitting isn't in my nature. Also, I was hoping to use the Express version for a volunter class I give from time to time. That is my primary reason for the extensive evaluation.
  
  

• Guitz

  I don't believe there is any limitation of the Express edition as far as referencing COM components. I'm no expert, but I do vaguely remember seeing a post somewhere about problems with referencing COM objects that are part of the same solution, and using project-to-project references instead.
  
  Perhaps you could ask this question in a separate post, since this is quite a ways off the original thread. I'm sure someone knows the answer.
  
  

• leedt

  Hi rwbogosian,
  
  Please note that the limitations you speak of only apply to the Express edition, which only supports ClickOnce deployment. The full version of Visual Studio also supports Windows Installer deployment, which does allow you to choose your installation location, register your COM component, and many other things that ClickOnce can't do. So in fact, with Visual Studio 2005, we aren't taking choice away from the developer, we are actually adding a new choice.
  
  ClickOnce deployment was never intended to be used in all situations; there are numerous scenarios where Windows Installer deployment is a more appropriate approach - and in fact, there are a number of scenarios where ClickOnce simply won't work. Your scenario is one of those case - ClickOnce does not support installation to the Global Assembly Cache.
  
  The following Help topic contains a table comparing the two deployment technologies: http://msdn2.microsoft.com/library/142dbbz4.aspx
  
  ClickOnce deployment does provide a way to install applications without Admin privileges, but it also runs those applications in a "sandbox" to prevent security issues. This approach comes with certain limitations, but for many line-of-business applications that don't require Full Trust permissions it is an appropriate solution.
  
  In your case, ClickOnce deployment isn't the answer - you will need to deploy your app using either a third-party installer, or using a Setup and Deployment project in the full version of Visual Studio.
  
  Steve Hoag
  Visual Basic Express
  
  

• DuvallBuck

  Thats good to know
  
  I was just whining to myself yesterday that the product comparison listed clickonce for the Basic Edition. I didn't wanna have to fork out the money for Pro.
  
  Now i might be happy :)
  
• third-party installer for choice and security