Microsoft has a new app store coming to both Windows 10 and 11, but some applications will use their own update mechanisms, raising security and user experience concerns.

When Microsoft introduced Windows 11, the company confirmed there would be a [1]new Microsoft Store , backported also to Windows 10, in which all the content is "tested for security, family safety and device compatibility."

At the time it was the support for [2]Amazon-flavoured Android applications that drew the headlines, but Microsoft also said that "starting today, Windows developers can publish any kind of app, regardless of app framework and packaging technology – such as Win32, .NET, UWP, Xamarin, React Native, Java and even Progressive Web Apps."

[3]

In a [4]related video , Microsoft principal program manager Pete Brown explained that the new store means you can "publish those traditional desktop applications using your own install packages." Brown showed how developers can submit a classic setup application in .exe or .msi format, located on the vendor's own infrastructure, but with a promise that "once submitted, the binary at the provided URL must not change." It must also be a complete installer, not a downloader for another install package. The installer also has to run in silent mode.

[5]

Submitting a Win32 package for the new Microsoft Store

The [6]detailed terms for the new store have revealed an important limitation. For those apps "packaged as a Win32 App," the terms state that "end users will not be able to receive updates from the Store. Apps can be updated directly by you via your app that is installed on a Windows Device after download from the Store."

[7]You, too, can be a Windows domain controller and do whatever you like, with this one weird WONTFIX trick

[8]Windows 11 comes bearing THAAS, Trojan Horse as a service

[9]Latest Windows 11 Preview a well-rounded update – literally

[10]Securing the cloud while Windows burns: Microsoft pops CloudKnox in trolley

There is provision for the developer to replace the installer in the Store with a newer one, but the user will not be prompted to reinstall it.

There are a couple of problems with this approach. One is that the user experience for applications that handle their own updates is variable. Some applications update frequently and have annoying pop-ups, or install background services solely for this purpose.

[11]

[12]

Another issue is that if a user installs an application from the store, which then updates itself, the updated version has in effect bypassed any checks which Microsoft made on the submission. How can the company still state that the content is "tested for security, family safety and device compatibility?" This model is unlike that of Apple's stores on Mac or iOS, or Google's Play Store, where all updates come through the Store after automated vetting for security and quality.

Microsoft developer advocate Scott Hanselman [13]said that recent publicity around this issue is "misleading… apps can use MSIX and update. It says on each app page if it updates itself or if the store does. It's pretty clear."

[14]

The word here with a special meaning is packaging. A Win32 application can be packaged as [15]MSIX , Microsoft's modern packaging format, in which case it will get auto-update. Apps packaged using the older MSI format, or a .exe installer, will not.

The issue is that users cannot be expected to understand the difference between MSI and MSIX, and may put unwarranted trust into apps downloaded from the Store by this mechanism. A Twitter user responded to Hanselman, [16]saying : "Also misleading. You're acting as if any Win32 could use MSIX while the majority does not… even your in-house VS Code still doesn't use it."

This is another example of Microsoft's weaving as it tries to satisfy the demands of security and a modern mobile-like experience – which was at its tightest in the Metro environment of Windows 8 or the locked-down Windows RT – and keeping faith with the expectation that a Windows PC will run any Windows application. ®

Get our [17]Tech Resources



[1] https://blogs.windows.com/windowsexperience/2021/06/24/building-a-new-open-microsoft-store-on-windows-11/

[2] https://www.theregister.com/2021/07/19/microsoft_windows_11_hands_on/

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQCCFZ-g3mp08uefu7AjJAAAAIc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://developer.microsoft.com/en-us/microsoft-store/desktop-apps/

[5] https://regmedia.co.uk/2021/07/27/package.jpg

[6] https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4OG2b

[7] https://www.theregister.com/2021/07/26/petitpotam_microsoft_windows/

[8] https://www.theregister.com/2021/07/26/windows_11_comes_bearing_thaas/

[9] https://www.theregister.com/2021/07/23/windows_11_preview/

[10] https://www.theregister.com/2021/07/22/microsoft_cloudknox/

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQCCFZ-g3mp08uefu7AjJAAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQCCFZ-g3mp08uefu7AjJAAAAIc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://twitter.com/shanselman/status/1419737569747603470

[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/applications&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQCCFZ-g3mp08uefu7AjJAAAAIc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[15] https://docs.microsoft.com/en-us/windows/msix/overview

[16] https://twitter.com/L0nghanks/status/1419749326834835458

[17] https://whitepapers.theregister.com/