<story><title>Any sufficiently advanced uninstaller is indistinguishable from malware</title><url>https://devblogs.microsoft.com/oldnewthing/20230911-00/?p=108749</url></story><parent_chain><item><author>blackpill0w</author><text>Why do Windows programs need special installers&amp;#x2F;uninstallers? Why isn&amp;#x27;t this handled by Windows itself?</text></item></parent_chain><comment><author>EvanAnderson</author><text>Windows has had an installer as an OS component since the late 90s (called Windows Installer). As a sysadmin I&amp;#x27;d prefer apps use it. Many application developers do not. It&amp;#x27;s maddening. (Doubly so when Microsoft themselves don&amp;#x27;t use it-- newer versions of Office, Teams, etc. Microsoft suffers from too much NIH.)&lt;p&gt;I get unattended installs and uninstalls &amp;quot;for free&amp;quot; when well-behaved applications use Windows Installer. Patching is included, too. Customizing installations is fairly straightforward.&lt;p&gt;On the developer side it has historically used a very quirky proprietary file format (MSI) with a fairly steep learning curve and a ton of &amp;quot;tribal knowledge&amp;quot; required to make it work for all but the most trivial cases. (Though, to be fair, most installs are the trivial case-- copy some files, throw some stuff into the registry, make some shortcuts.)&lt;p&gt;Worse, it allows for arbitrary code execution (&amp;quot;Custom Actions&amp;quot;), at which point all bets are off re: unattended installs, removal, etc. Some Windows Installer packages are just &amp;quot;wrapped&amp;quot; EXEs (Google Chrome, for example).&lt;p&gt;I&amp;#x27;ve packaged a ton of 3rd party software as Windows Installer packages. It&amp;#x27;s an ugly system with lots of warts and legacy crap, but if you need to load an application on a large number of Windows PCs reliably unattended it&amp;#x27;s decently fit for purpose.&lt;p&gt;There is reasonable free and libre tooling to generate MSI packages from plain text source (the WiX toolkit) and it can be used in a CI pipeline.</text></comment>
<story><title>Any sufficiently advanced uninstaller is indistinguishable from malware</title><url>https://devblogs.microsoft.com/oldnewthing/20230911-00/?p=108749</url></story><parent_chain><item><author>blackpill0w</author><text>Why do Windows programs need special installers&amp;#x2F;uninstallers? Why isn&amp;#x27;t this handled by Windows itself?</text></item></parent_chain><comment><author>BoppreH</author><text>How could Windows handle it by itself?&lt;p&gt;If it provides a framework for installers&amp;#x2F;uninstallers, it&amp;#x27;ll be fighting the inertia of decades of legacy software, programmer habits, and old tutorials.&lt;p&gt;If it tracks file ownership by program, it might accidentally delete user files. How would it differentiate between a VSCode extension that should be uninstalled, and a binary compiled with VSCode for a user project? A false positive could be catastrophic.&lt;p&gt;If it restricts what programs can do to accurately track file ownership, you end up with Android. Which is fantastic for security, but is a royal pain in the ass for all parties:&lt;p&gt;- The app developers have to jump through hoops for the simplest actions, and rewrite most of their code in the new style.&lt;p&gt;- The operating system has to implement a ton of scaffolding, like permissions-restricted file pickers and ways to hand off &amp;quot;intents&amp;quot; between applications.&lt;p&gt;- The user is faced with confusing dialogs, and software with seemingly arbitrary limitations.&lt;p&gt;In the age of shared runtimes, auto-updaters, extension marketplaces, and JIT compilers, managing installed applications is harder than ever.&lt;p&gt;Edit: the answer above applies only to Windows, because of its baggage. Linux&amp;#x27;es are in a much better position, for example, though their solution is still not perfect.</text></comment>