InstallSite Blog

A potential "Y2K7 problem"

A member of the Visual Studio team at Microsoft blogged about a "Y2K7" (year 2007) problem they were facing with the build numbers they were using. They used a file versioning scheme like Major.Minor.Build.QFE where the Build number representend the build date in YMMDD format. For example 50325 means the file was built on March 25, 2005. The problem is that this number would become 70101 on January 1st, 2007, but this version number field is only a 16 bit integer which can hold a maximum value of 65535. Therefore Microsoft changed their build numbering scheme earlier this year. If you are using a similar scheme you only have few days left to change it.

http://blogs.msdn.com/quanto/archive/2006/12/19/y2k7-crisis-coming-up.aspx

 Happy Y2K7 everyone!

Launching a program when setup is completed may be a security issue

An article in the InnoSetup knowledge base points out that launching your application or displaying a readme file (using notepad for instance) at the end of your installation may cause a security issue on Windows Vista. The problem arises if the installation runs with elevated privileges because the child process (your application or notepad) inherits these privileges. This means that now your application runs with full administrator rights, which defeats the purpose of UAC.

This is a problem for all setups that don't use Windows Installer technology, like InnoSetup or InstallScript projects in InstallShield. But MSI based setups can also be affected.

If you launch an .msi file (by double clicking or via msiexec.exe) on Windows Vista, only custom actions that are scheduled for deferred execution in system contect (i.e. with the NoImpersonate flag set) will run with elevated privileges. Ususally you wouldn't launch your application with such an action, but instead use a DoAction event on the Finish button on the "setup complete" dialog. In this case you're fine.

However if you launch your MSI install using a setup.exe which is not explicitly manifested to indicate that it doesn't need elevated rights, the UAC prompt will be displayed right at the start, and your whole user interface sequence will run with elevated permissions. In this case the launched application will inherit these permissions.

In general it may be best not to launch the application at the end of the installation. Note that similar security problems can also happen on Windows versions before Vista, for instance if the setup was launched using RunAs with administrator privilges. And if a reboot is required to complete the installation, your application may not run properly when launched from the Finish dialog anyway.

MSDN Magazine article about UAC (in multiple languages)

An MSDN Magazine article that talks about User Account Control (UAC) on Windows Vista and also covers setup topics is available online.

There are several localized versions of this article. If your language isn't detected automatically you can select a language from the drop down box in the upper right corner.

Teach Your Apps To Play Nicely With Windows Vista User Account Control
http://msdn.microsoft.com/msdnmag/issues/07/01/UAC/default.aspx

Adventures in Vista Logo certification

I found an interesting blog article from a software developer who prepared his application and setup for Windows Vista Logo certification. He describes useful resources and tips, and also some pitfalls.

How to: Getting Certified for Windows Vista logo
http://www.metalinkltd.com/?p=74

Oops, they did it again: InstallAware "inspired" by competitor's web site

Usually I write about setup technology, not ethics. So I was unsure whether I should write this article or not. Also because InstallAware Software Corp. may have a policy of: "All publicity is good publicity because after a few months people forget what you did wrong and only remember your name." At least that's what Rob Mensching, chief of the WiX project, wrote in his Blog after InstallAware representatives visited him in his office at Microsoft. But I finally decided to blog about this, so here the story goes:

For their new Windows Installer authoring product, WiXAware, InstallAware Software Corp. also launched a new web site www.wixaware.com. For reasons unknown to me they didn’t use the same design as in their main www.installaware.com site but instead created a completely different looking web site.

I noticed that the new WiXAware site resembles the layout and design of www.advancedinstaller.com. AdvancedInstaller is also a Windows Installer authoring tool, from Caphyon Ltd, a competitor of InstallAware. Click the images to see the live web site.

www.advancedinstaller.com	www.wixaware.com

While InstallAware uses a slightly different CD-ROM picture, the sites share the same layout, like the "Clients & Partners" box etc. They even have the fine print in the upper right corner and a similar color scheme for the "Download" and "Buy Now" buttons.

The same is true for the "Features" resp. "Benefits" page, where they even use similar wording:

 Note that the last paragraph heading is in red or organge on both web sites.

They did it before

This is not the first time InstallAware copied a competitor's web site layout: In January 2006 Macrovision Corp. sent a legal letter to InstallAware Corp. requesting that they stop using the layout and text from the zerog.com web site. That was some time after Macrovision had acquired Zero G. The letter is available at InstallAware’s web site at www.installaware.com/threat/ .

[Edit (Dec 12): InstallAware today changed the link. It now points to an open letter to me (same as in the comment below), but here's a copy of the legal letter from Macrovision to InstallAware.]

Unfortunately by the time they sent the letter, Macrovision had already redesigned the zerog.com web site to integrate it with the macrovision.com site. Therefore InstallAware took the chance to make Macrovision look bad: "Macrovision Corporation Uses Legal Scare Tactics Against Emerging Competitor InstallAware Software Corporation". Later, InstallAware also changed their web site so there's no more similarity today.

But with the help of archive.org you can go back in time and look at the web sites:

www.zerog.com as of September 10, 2005	www.installaware.com as of December 15, 2005

Sinan Karaca, founder of InstallAware Softwware Corp., did not yet reply to my request for a comment.

If you are more interested in a review of the WiXAware product, please visit:

• Rob Mensching's Blog
• Christopher Painter's Blog

Microsoft Office Version Detector

C++ code to programmatically detect the presence, and version of Microsoft Office applications. It can detect Word, Excel, Outlook, Access, and PowerPoint, versions 95-2007. Could be useful in a custom action DLL.

http://www.codeproject.com/useritems/OfficeVersion.asp