With users now able to get their hands on Microsoft’s latest document format – rolled out under the umbrella of the Fluid Framework – the company is hoping it can deliver on its promises of better productivity and collaboration online.
The Fluid Framework was announced at Microsoft’s Build developer conference in 2019, and at Build 2020 – a virtual-only event this year – the company made the format available for user preview for Microsoft 365 Enterprise and education subscribers enrolled in Targeted Release. It’s also available as open source software; Microsoft said the code and SDK will be available on GitHub soon.
The goal behind Fluid is an ambitious one: users can create discreet pieces of content – such as text, tables, graphs or lists – that live on the web instead of the desktop or a SharePoint drive and are blower agnostic. These artifacts can then be collaborated on or snapped together with other elements in near-to-real-time across a variety of environments.
Nick McQuire, vice president for enterprise research at CCS Insight, believes Microsoft is on its way to making Office “a development environment,” where organizations can start to “embed [Fluid] in business processes and deeper collaboration environments across your company.
“Microsoft does feel a bit of pressure to break down the silos within various, different applications out there, as well,” he said. “Whether it is Google or other flavors of collaboration software, there are others that are pushing the boundaries of what it is to collaborate.”
How it works
The basic Fluid experience involves a clean user experience reminiscent of Google Docs or Dropbox Paper. It is essentially a blank slate, with the option to create a document or Fluid artifact that can then be shared with your network.
“Discovering the full potential of the Fluid Framework can only be accomplished through creating a diverse, open, and vibrant developer community,” Jared Spataro, corporate vice president for Microsoft 365, said in an announcement this week.
Where Fluid differs from the likes of Google Docs is how it enables people to work together on an item – wherever it resides. Instead of opening a proposed agenda from an email and editing it in Word, a users can just edit it in place in the email, with all changes staying up to date. In practice, it looks like a typical Google Docs experience, with colleagues’ avatars appearing next to the line on which they’re working in real time.
If that sounds potentially chaotic, that’s because it is. Microsoft is looking to achieve true real-time collaboration, where changes are relayed immediately and multiple users can work on items simultaneously, even if they aren’t “in” the same document. That could lead to conflicts with co-workers, and concerns about version control.
Use cases will be fluid (sorry), but early examples include: tracking action items, building a crowd-sourced meeting agenda with minutes or sharing the results of a recent project with a team in a virtual meeting.
“It is becoming clear you cannot single handedly live in one application, so the ability for companies to make that workflow more adaptive and easier for people to do tasks across different applications, while retaining an experience that they prefer to work in, is becoming really important,” McQuire said.
Further in the future, Microsoft envisions a model where software bots – like its Cortana virtual assistant – can work alongside users to translate text, suggest edits and perform checks directly within Fluid components.
McQuire believes the success of Fluid depends on the developer community. “They have to be the starting point to take Fluid in a direction that will bring some innovation into Office and 365 overall,” he said.
With Windows 7’s retirement from support now behind everyone, the next major marker for a Microsoft expiration arrives in a little less than 10 months, when Office 2010 falls off the servicing list.
Big yawn, right?
Not really. According to an admittedly past-sale-date survey of nearly 1,200 IT professionals in the U.S., the U.K. and Canada in September 2017, 68% of the respondents said that their companies were still running Office 2007.
Office 2007’s end of support was Oct. 10, 2017, or less than a month after these IT people were polled.
There’s little reason to think that the percentage of companies now running Office 2010 would be much less. (Nor, according to Spiceworks, will everyone ditch Office 2010 by the deadline; in the fall of 2017, 46% of those surveyed said their workplaces still had Office 2003 running; that version dead-ended in April 2014.)
Remember the warning about watching how sausage is made? This is an electronic sausage-making story with lots of dirty little bits.
First, the chronology. On February’s Patch Tuesday, Microsoft released a bizarre standalone security patch, KB 4524244, which was then called “Security update for Windows 10, version 1607, 1703, 1709, 1803, 1809, and 1903: Feb. 11, 2020.” The name has changed, but bear with me.
It’s a standalone security patch. We don’t get standalone security patches anymore. They’re almost invariably rolled into cumulative updates.
It appeared to be directed at one wayward UEFI boot manager. From the KB article:
Addresses an issue in which a third-party Unified Extensible Firmware Interface (UEFI) boot manager might expose UEFI-enabled computers to a security vulnerability.
The Knowledge Base article title was clearly wrong. Win10 version 1909 wasn’t mentioned in the KB article, but the 1909 patch appeared in the Microsoft Catalog.
That buggy patch was accompanied by a parallel patch for older versions of Windows, KB 4502496, called “Security update for Windows 10, version 1507, Windows 8.1, RT 8.1, Server 2012 R2, and Server 2012: February 11, 2020.” This time the name was correct. But the Win8.1/1507 patch had the same bugs and met the same fate as its more illustrious co-conspirator, KB 4524244.
Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to your desktop and receive the error “There was a problem resetting your PC”.
The patch was first created in September 2019, so it was in testing for almost 5 months, and that still was not enough to get it right.
Microsoft has known about the UEFI loader security problem since April 2019, if not earlier. It took ten months to push a fix — and a buggy fix at that.
So what, really, was being patched in KB 4524244? The official description then, and even now, has very little substance.
It didn’t take long for the Twitterverse to point the finger at Kaspersky as the source of the faulty UEFI boot manager, but why would Microsoft issue a separate Windows patch (actually, two patches) specifically to block Kaspersky’s product? And what had Kaspersky done to deserve such treatment?
That brings us to the sausage-making part of the story.
Kaspersky, like other antivirus companies, includes the ability to create a boot disk — in this case, the “Kaspersky Rescue Disk” — that’ll let you boot your computer even if your PC’s internals have been compromised. In order to use the Kaspersky Rescue Disk, like other recovery boot disks, you have to have physical access to the PC.
The problem is that an older version of the Kaspersky Rescue Disk allowed attackers with physical access to your machine to boot the PC into a potentially harmful operating system, even if you have Secure Boot enabled. Secure Boot is supposed to make it impossible to use a recovery disk to boot into any operating system that hasn’t been pre-approved, but this older version of the Kaspersky Rescue Disk didn’t follow the Secure Boot rules.
Kaspersky learned of the security hole in April 2019, plugged it on systems running Kaspersky endpoint protection, but didn’t release an update to the Kaspersky Rescue Disk until August 2019.
Compounding the problem is the fact that Microsoft signed the old Kaspersky Rescue Disk program, so Secure Boot continued to recognize old Kaspersky Rescue Disks as valid up until earlier this month. You can mince terminology, and argue that every antivirus manufacturer does it, but any way you slice it the Kaspersky Rescue Disk program is a rootkit or, more exactly, a bootkit.
Modern PC motherboards’ firmware follow UEFI specification since 2010. In 2013, a new technology called Secure Boot appeared, intended to prevent bootkits from being installed and run. Secure Boot prevents the execution of unsigned or untrusted program code (.efi programs and operating system boot loaders, additional hardware firmware like video card and network adapter OPROMs).
Secure Boot can be disabled on any retail motherboard, but a mandatory requirement for changing its state is physical presence of the user at the computer. It is necessary to enter UEFI settings when the computer boots, and only then it’s possible to change Secure Boot settings.
Most motherboards include only Microsoft keys as trusted, which forces bootable software vendors to ask Microsoft to sign their bootloaders. This process include code audit procedure and justification for the need to sign their file with globally trusted key if they want the disk or USB flash to work in Secure Boot mode without adding their key on each computer manually.
So Microsoft did, and does, quite intentionally, sign rootkits. Er, bootkits. That way, emergency restore disks can work.
Revoking the UEFI signature
Microsoft can change its mind about the security clearance of its Microsoft-approved UEFI bypass programs any time, but to do so it has to add the no-longer-trusted app to something called a UEFI Revocation List File, which in turn updates the Secure Boot Forbidden Signature Database.
Still with me?
Here’s the problem. KB 4524244 and KB 4502496 add the old Kaspersky Rescue Disk routine to your PC’s Secure Boot Forbidden Signature Database, so it won’t be recognized as a Microsoft-approved app. But, for reasons that aren’t at all clear, monkeying around with the UEFI Secure Boot restrictions broke other programs — most notably the boot routine for HP PCs with Ryzen processors. There may be other collateral damage.
Somebody at Microsoft may know what went belly-up, but they certainly aren’t telling anybody.
What did Kaspersky do wrong?
Nothing. Other than distributing a Kaspersky Rescue Disk program, prior to August 2019, that could be used for nefarious purposes.
Kaspersky has a detailed — and, as far as I can tell, accurate — accounting of the debacle in a newly released FAQ.
The key conclusion, “Kaspersky products have not been a cause of this issue,” referring to the bugs in KB 4524244, rings true. The problem lies in some other conflict, which went unfixed in five months of testing.
It appears as if Microsoft had just tested its patch on an HP machine with a Ryzen processor we wouldn’t be in this mess. But … Microsoft.
Microsoft has yanked the patch. It won’t be pushed onto your machine. You can’t even download it from the Update Catalog.
If you installed KB 4524244 or KB 4502496 on your PC (Start > Settings > Update & Security, click View update history) and your machine still works, you’re fine. The old Kaspersky Rescue Disk signature is in your Secure Boot Forbidden Signature Database, and you’re no longer at risk from someone slipping a malicious disk into your machine.
If you installed the update and your machine won’t boot (yet another good reason to avoid installing patches right away, eh?), Microsoft has details for restoring your PC to health in the KB article (which now mentions Win10 version 1909) and on the Windows Release Information Status page. The instructions tell you how to uninstall the patch. For machines with the “Reset this PC” bug, Microsoft also recommends that you follow the uninstall with a run of Reset this PC. I have no idea why uninstalling the patch and running Reset restores machines to a working state, but apparently it does.
If you haven’t yet installed the patch, be of good cheer. Microsoft will come up with a suitable fix at some point in the future. As both the KB article and the Release Information Page promise:
We are working on an improved version of this update in coordination with our partners and will release it in a future update.
Let’s hope the “improved version” works better than the old one — and that it takes less than ten months to respond to the problem. Meanwhile, ValdikSS warns in a tweet:
At least 2 other vuln bootloaders exist, not revoked.
As best I can tell, Microsoft hasn’t published any details about this fiasco, other than yanking the patch, identifying the bugs and promising a fix. Security, meet obscurity.
Every year ’round this time, we start thinking about what Google’s got in store for Android in the months ahead. And broad trends aside, the biggest questions tend to revolve around the year’s upcoming Android release.
Some Android versions are mostly about under-the-hood improvements, while others focus on bits of subtle but significant polish. And sometimes, we see massive foundational changes to what the operating system represents — the switch to on-screen navigation buttons in 2011’s Honeycomb and Ice Cream Sandwich; the introduction of the modern, card-centric Material Design interface in 2014’s Lollipop; and then the advent of gesture-driven navigation in 2018’s Pie (and, uh, again in last year’s Android 10 update).
It’s still too soon to know for sure what themes we’ll see come up with this year’s Android 11 offering, but I have a sneaking suspicion the most interesting and potentially transformative advancements for Android this year won’t actually be connected to that software at all — or to any of Google’s own efforts, for that matter.
Stay with me here, ’cause I swear I haven’t lost my mind: The most consequential changes to the way we use and think about Android in 2020 might come from…Microsoft.
Yes, Microsoft. What a weird, upside-down world we live in, I know. But when you stop and think about it, it actually makes an awful lot of sense.
The company essentially created a Windows Phone 2.0, in other words, only this time doing it in a way that piggybacked off the world’s most widely used operating system instead of trying to go up against it. Just like Google, amusingly enough, Microsoft is now taking a post-OS era approach and focusing on ecosystem over operating system.
So when we heard last year that Microsoft was building its first self-made Android device, the dual-screened Microsoft Surface Duo, it was clear this wasn’t gonna be Yet Another Unremarkable Android Phone. Microsoft was up to something grander here — something intriguingly unusual and decidedly different.
To be sure, there’s still plenty we don’t know about the Duo and ample cause for skepticism. But with the release of a Duo-specific software development kit and loads of associated documentation this month, we’re getting some fresh clues about Microsoft’s true ambitions for the device — and its ultimate plan for pushing Android into some wild new territory Google itself has yet to explore. And if you ask me, this has the potential to be one of the most significant advancements Android’s seen in a good long while — the sort of thing that could have huge implications not only for the future of the platform but also for mobile technology in general.
Specifically, there are two main reasons I’m cautiously optimistic about what Microsoft’s about to do with Android — my two key takeaways from the company’s mountains of Duo-related materials.
While lots of companies are coming out with foldables, Microsoft is coming out with a smarter twist on the concept — and coming up with a genuine reason for it to exist.
When we talk about foldable phones right now, two common themes come up: First, by and large, they’re innovation for the sake of innovation — a solution in search of a problem that doesn’t quite exist. Cool as they may seem, they just don’t add much of meaningful value into the day-to-day phone-using experience. And even in the rare situations where they may have some practical benefit in terms of portability, they’re laden with compromises that make them inadvisable for practically everyone.
Instead of following mindlessly onto that foldable bandwagon, as most manufacturers seem eager to do these days, Microsoft came up with a smarter setup: a phone that folds in half, with two separate screens that sit side by side. And sure, there’s a thin hinge between ’em — but when you see how the Duo’s designed to work, you realize that doesn’t really matter all that much. (And also, call me crazy, but that thin hinge seems way less distracting than the clunky seam on the screen of a foldable phone and the host of durability issues that come with it.)
The most interesting advantage the Duo provides, y’see, isn’t being able to treat its dual displays as a single large screen (though you certainly can do that, in certain scenarios). It’s being able to treat them as separate but complementary parts of a phone-using experience — something that really seems like it could change the very nature of how we think about Android and mobile computing.
To wit: Microsoft’s software development kit details five core ways apps can tap into the Duo’s dual screens and take advantage of their potential. There’s technically a sixth — the basic “extended canvas,” where an app stretches across the two displays — but it’s the more advanced patterns that show off how Microsoft’s managing to evolve Android in a way that Google has not.
Take, for instance, the “master-detail” arrangement. There, apps split their content between a master pane, which contains some sort of list-like view, and a details pane, where extra information resides. Think of it like Outlook’s preview pane, transformed into a standard operating system element — and think of all the ways apps ranging from email clients to calendars, photo galleries, and even music players could take advantage of it.
Then there’s the “two page” view, in which apps can provide an open-book-like experience, complete with page turning. It’d evolve the way we experience reading-related apps, for sure, and it could also create some interesting possibilities for document- or note-oriented scenarios.
The “dual view” setup lets an app show similar sorts of content side by side — two documents, two lists, two images, or even two products on shopping sites — so you can easily compare and work across the two items without having to do any cramped screen splits or awkward back-and-forth switching.
And finally, the “companion pane” view is designed to show complementary interface elements — tools, menus, or control panels that’d typically be hidden behind a button in a standard single-screen environment — right alongside your main work area.
Beyond those possibilities, there’s also the plain and simple option of having two different apps exist on their own screens, side by side. And in that arrangement, if the apps support it, you can drag and drop content between the two programs — text, links, images, or even “rich objects” — instead of cutting and pasting.
See what’s happening here? Microsoft actually took a thoughtful approach to how an extended-screen setup should work and precisely what sort of real-world, instantly relatable value it should provide. Instead of taking a cool-looking new kind of technology and then trying to find a reason for it to exist, Microsoft came up with the reason — and then came up with the device to support it. With all the wild phone forms flying around right now, that’s something no other company has yet managed to do.
There’s another side to this story, though — one that’s critical to a phone like the Duo, or any other device with an unusual approach, to succeed. And based on this early look at Microsoft’s strategy, it sure looks like the company is setting itself up to nail it.
Microsoft is building in a smart fail-safe and making sure that apps without specific dual-screen support will still work well in its setup.
Regardless of how intriguing the Duo’s advanced use-cases are, this part is key. I mean, think about it: The Achilles’ heel of Microsoft’s entire strategy here is the fact that it requires Android app developers to actively optimize their apps in order for them to function in any of those aforementioned arrangements. You aren’t just gonna open up the Duo, pop open any ol’ app, and have it be magically ready to handle those sorts of next-level screen-spanning arrangements. And we all know how poky some Android developers can be at adopting new standards.
But here’s the saving grace: According to Microsoft’s development documentation, Android apps on the Duo will always default to opening on a single one of the device’s displays — thereby looking and acting just like they would on any regular Android device.
There is no compatibility question, in other words, because the default setup is exactly the same as what you’d get on any other Android phone. So at the worst, you have a device that lets you focus on one app on a standalone 5.6″ screen while then having the ability to pull up any other app or process on a second 5.6″ screen. That could still be interesting, particularly if the hardware is compelling. And at the best, well, you’d have apps that can do all those other advanced possibilities we were just mulling over.
Now, let’s not get ahead of ourselves: This is still just a concept. There are still tons of unanswered questions about the Duo, including its cost, the limitations surrounding its single-camera (only on the inside!) setup, and how exactly Microsoft will handle software updates.
But based on the concept, at least, it sure looks like this device has all the practical productivity benefits foldable phones are lacking — and without all the hardware-driven drawbacks those devices possess. With Android 10, Google created the basic framework for how apps could exist across multiple panels. Microsoft, meanwhile, seems to be the one taking that ball and running with it — coming up with a clever new concept and one-upping Google on its own terrain.
This is the sort of stuff that makes you sit up and say: “Oh! Right. Now I see why this could be useful instead of just novel” — and maybe, just maybe, the sort of stuff that ushers in a new era for the types of experiences Android can enable.
Sign up for my weekly newsletter to get more practical tips, personal recommendations, and plain-English perspective on the news that matters.
Resistance has mounted over the last several days to Microsoft’s decision to change the default search engine of Google’s Chrome to Bing on personal computers running Office 365 ProPlus.
Microsoft quietly announced the move Jan. 21 on its Microsoft 365 Roadmap page, then on Jan. 22 published support documents with additional information and a blog post that stated the company’s rationale.
Commentary on Microsoft’s blog, the support document and elsewhere — including an Office 365 website dedicated to user requests — was almost universally negative.
“I can’t believe you think this is an acceptable business practice,” asserted Rickey Roach in a comment appended to the Office 365 team’s blog post.
“This is … overreach,” opined Tom Arbuthnot on that same blog. Arbuthnot was identified as an MVP, a Microsoft Most Valuable Professional. “Microsoft might be doing this because they think it will give the user a better experience, but doing it by default without even asking the user or the organization is too much. I’m pretty sure Google won’t be too pleased with this either.” (Arbuthnot expanded on his criticism on his personal blog.)
It’s all about Microsoft Search
Microsoft’s scheme to switch Chrome from its designated search choice to Bing was part of the firm’s Microsoft Search strategy.
“By making Bing the default search engine, users in your organization with Google Chrome will be able to take advantage of Microsoft Search, including being able to access relevant workplace information directly from the browser address bar,” Microsoft contended in a Jan. 23 support document.
Microsoft Search, which the company unveiled in May 2019, was designed to make search in the enterprise — in Microsoft-made and third-party applications — more productive. Rather than return just website links, Microsoft Search would find information from files and those applications’ content, bringing to the forefront not only matches and near matches but also what the algorithms believed the user really was after. In Edge, the service is dubbed “Microsoft Search in Bing.”
Microsoft Search is a key component of Microsoft 365, the über subscription that bundles Office 365, Windows 10 and management tools, and appears to be a major initiative. (One way to gauge the latter: the comprehensive Microsoft Search in Bing adoption kit, a cache of email, poster and evaluation templates companies can use to educate workers on the service and convince them to try it.)
Apparently, Microsoft was so set on spreading the new search service that it decided to force it on those enterprise users — the ones running Office 365, anyway — who have Chrome as their default browser. Microsoft made this decision even though it had to know that the plot would receive serious pushback and could easily guess the forms of that criticism.
Not surprisingly, much of the blowback equated the unsolicited search change to the practices of malware makers and scammers.
“Force-changing the settings on a user for arbitrary reasons circles the drain of ‘unlawful,’ and is effectively browser hijacking,” said someone labeled only as camxct on GitHub, where comments attached to support documents appeared.
“Browser hijacking like in the 90s. Are you nuts?” asked kgbvax, perhaps not rhetorically.
The phrase “browser hijacking” — and others, including PUP, for “potentially unwanted program” — harked back years to a time when that practice was common. Malicious actors would infect a system with malware that changed a browser’s settings — typically its default search engine and/or home page — to drive traffic to specific sites where they could collect advertising revenue.
Google spent significant time and effort in blocking hijackers from taking over Chrome and in barring unofficial add-ons — those not hosted in the Chrome Web Store, more or less — from installing, all part of a years-long process to lock down the browser.
Now, Microsoft is attempting to do to Chrome just what Google has tried to stop.
“Chrome is not your browser, leave it alone!” said someone identified only as Andrew on the User Voice site Microsoft runs to solicit feedback and requests for Office. “This is adware at best! I am absolutely flabbergasted by this stunt!”
(As of 2 p.m. ET Jan. 28, that item on User Voice had been upvoted more than 900 times and had collected more than 180 comments.)
Others swore revenge. “This really makes me regret pushing Office 365 so hard where I work. You guys are putting egg on my face,” wrote Daniel Prince on the User Voice site. “I’m in charge of 90,000 Windows and Mac devices. Next week, we are blocking Bing.com at the firewall level. Hope this little stunt you pulled was worth it.”
Software should obtain your consent, says Microsoft
A pair of users objected to the extension in the Store, too. “Unwanted plugin, should not be allowed to install without consent,” argued Michael Studte. “Mess with Chrome Edge all you want, but don’t touch non-Microsoft browsers!”
The thing is, Microsoft’s own policies have — or still do; it’s unclear — forbid changing a browser’s default search engine without authorization.
“All extensions for Microsoft Edge must be deployed from the Microsoft Store,” stated the Microsoft browser extension policy for the old-school Edge. “The installation must be initiated and completed by the user, using only the user experience provided by Microsoft Edge and the Microsoft Store” (emphasis added).
Elsewhere, Microsoft’s own definition of unwanted software included phrasing that may match how it plans to distribute the Chrome extension. In the support document “How Microsoft identifies malware and potentially unwanted applications,” under “Unwanted software,” Microsoft said, “Software should obtain your consent before installing.” Microsoft has said nothing thus far about user consent when it rolls out the next update to Office 365 ProPlus.
Neither Google or Mozilla replied to requests for comment on Microsoft’s plan to issue add-ons for Chrome and Firefox in new installations of Office 365 ProPlus and the next update to ProPlus.