Windows Package Manager Preview

293 points by zeusly 5 years ago | 161 comments
  • phiresky 5 years ago
    ... this thing literally just downloads .exe files and then executes them. There's no dependency management.

    Look at the firefox "package": https://github.com/microsoft/winget-pkgs/blob/master/manifes...

    There isn't even any uninstall functionality.

    This is a package manager as much as a piece of cardboard is a swiss army knife.

    Even if you say "but it's a preview", there's just no where to go when your starting point is "execute some arbitrary binary". The point of packages is to be declarative as much as possible.

    • alkonaut 5 years ago
      Would dependency management really make much sense on Windows?

      Under normal circumstances you share as little as possible. There isn’t a situation where an app needs “library X version Y or greater”.

      Some runtimes etc is usually all that’s shared.

      • eggsnbacon1 5 years ago
        their "store" failed because nobody wanted to go through all their BS.

        Now they're making it so anyone with a keyboard can add to their package manager. Probably with the end goal of a walled garden ala Android and Apple.

        The next stage is probably to "sandbox" whatever code runs in these installers into a virtual restricted environment. I would bet money on it.

        • mavhc 5 years ago
          Sounds like a good idea, hey, that's exactly what Windows 10X does.

          Do you really want every app to have access to pretty much every piece of user data on the system, and every other app?

        • r00fus 5 years ago
          Has this changed from the 90s/2000s? I've been on Lin/Mac for the past decade, but back then many libraries (DLLs) required (msxml4.dll, msvbvm50.dll) - note specific versions.
          • plorkyeran 5 years ago
            Windows has supported installing multiple versions of the same system library ever since Windows XP via WinSxS. It's been a non-issue for a long time.
            • alkonaut 5 years ago
              Typically that's not a problem any more, no.
            • cm2187 5 years ago
              Agree, very little shared libraries but there may still be dependencies. ffmpeg, correct .net framework version, etc.
            • bproven 5 years ago
              Uninstall, Deps and other items are on the roadmap here: https://github.com/microsoft/winget-cli/blob/master/doc/wind...
              • flohofwoe 5 years ago
                Scoop on Windows and Homebrew on Mac are quite similar and they work just fine.

                I wouldn't call such tools "package managers" but "installation and update managers", they have some functionality overlap with tools like apt or pacman, but in the end they serve a different purpose, installing tools and application on the command line and keeping track of what has been installed.

                • Sangeppato 5 years ago
                  I'm not 100% sure about Homebrew, but Scoop uses the "portable" installers every time it's possible, trying to put all the files in a well defined position, controlled by Scoop itself. I think that Homebrew (not Cask) does a very similar thing. What this Windows package manager does is running classical installers and there's absolutely no way to know exactly what the installer is going to do. Homebrew Cask follows a similar approach, but thanks to how .app and .pkg work it's actually possible to manage the uninstallation quite well
                • nojito 5 years ago
                  >There isn't even any uninstall functionality.

                  Control Panel --> uninstall apps

                  The issue is with how windows setup exes are designed. Most allow you to uninstall after running the exe again...others do not and leave traces of themselves everywhere.

                  This is a great first step and leads to some automation possibilities when setting up new installs.

                  • olyjohn 5 years ago
                    As a former SCCM admin, I can tell you that packaging things like this will be a nightmare. Microsoft really needs to revamp the way software is installed on Windows, and make it all work the same way. Putting a wrapper around an MSI or EXE can be a nightmare. I mean, /SILENT is not good enough for many apps to make installers silent, so the switch /VERYSILENT came out. And even then, it's still not standardized, and many programs will still pop up dialogs and kill your automation. And then you'll find that the same package won't run the same depending on what version of Windows, what edition, 32 or 64 bit, etc and the installer will fail.

                    Then when the MSIs aren't built correctly, they will leave you with a detection method that gets hosed when the software auto-updates. So you run your package manager, and it'll detect that your software is no longer installed, because the MSI product code changed for the newer version.

                    I mean we have so many ways to do software on Windows. Let's count them:

                    * MSI * EXE * MSU * AppX * Windows Features * dism * Windows Update * SCCM Deployments

                    Even just open up the "Uninstall Apps" control panel, or the old "Add / Remove Programs" and look how long it takes to load the list. It's pulling from like 20 different places in the registry and various places in the WMI database just to build that list. So when you want to use that as a detection method, good luck...

                    • GordonS 5 years ago
                      I haven't had the misfortune to have to repackage other apps for SCCM, but I have had the misfortune to create MSI installers for several apps.

                      It's horrible. MSI is so complex, and there are constraints, limitations and oddities at every twist and turn.

                      I love Windows for desktops, but my all time favourite item on my wishlist is for Microsoft to completely revamp how software is installed, from scratch, to improve things. I really mean from scratch - I know Microsoft like every new thing they do to be compatible all the way back to Windows 3.1, but no, really, from scratch!

                      • naikrovek 5 years ago
                        > Microsoft really needs to revamp the way software is installed on Windows, and make it all work the same way.

                        They did, it's called MSIX and there are apparently few HN commenters aware of it, especially among those that complain about installing things on Windows. I'm not referring to the comment I replied to.

                    • nlawalker 5 years ago
                      This is how Chocolatey works too for most stuff. Most Chocolatey “packages” are config and/or script files that point to the URL of an MSI installer.
                      • blacksmith_tb 5 years ago
                        Though at least it does let you update everything you've installed with it by running a single command, which is one of the nice things about 'proper' package management like apt etc.
                      • wronex 5 years ago
                        I think their approach is a very nice start. This way it can be immediately useful. It would risk not getting any use if it was too involved to create new packages. With this approach anyone can create a package.

                        There is nothing stopping them from adding more traditional packages in the future.

                        • neves 5 years ago
                          This isn't useless. Just the fact that Microsoft decided to make its own package manager is great!

                          With it I can:

                          - rebuild my machine from scratch. I've bought a new machine 2 months ago and still need to install something that I don't have. - know that the packages I'll install have less chance of being malware. - maybe I can install authorized packages myself in my business computer. - automatic updates

                          • cm2187 5 years ago
                            Please give chocolatey a try.

                            That combined with batch files that sets all my environment right, plus all my data backed up with synology cloudstation means setting up a new machine is a 15 min job.

                            And even if you installed softwares manually, try uninstalling them and re-installing them through chocolatey (usually you don't lose the settings). The ability to update all of your softwares with just one command line is something you quickly get addicted to.

                            I wouldn't wait for this Microsoft version. Until it has thousands of 3rd party packages it will be pretty much useless.

                            • GordonS 5 years ago
                              > Please give chocolatey a try

                              Please don't (see my other comment for a range of reasons why).

                              I find scoop far more reliable than chocolately.

                              • neves 5 years ago
                                I use chocolatey, but an official pm would be better. Just the ability to install tools in a drive other than my small ssd would be nice.
                              • stinos 5 years ago
                                I've been using OneGet + ChocolateyGet provider for that for a couple of years now. So on Powershell that's basically sudo { Install-Package A B C }. After Install-Package Sudo, that is.
                              • runjake 5 years ago
                                • contextfree 5 years ago
                                  The declarative package format on Windows is MSIX
                                  • kbumsik 5 years ago
                                    > ... this thing literally just downloads .exe files and then executes them. There's no dependency management.

                                    But do snap and flatpak do the same thing?

                                  • open-paren 5 years ago
                                    This[1] is the repository from which it pulls. It sounds like third-party repos are a planned feature. Basically, every package is a yaml file like this:

                                      Id: string # publisher.package format
                                      Publisher: string # the name of the publisher
                                      Name: string # the name of the application
                                      Version: string # version numbering format
                                      License: string # the open source license or copyright
                                      InstallerType: string # enumeration of supported installer types (exe, msi, msix)
                                      Installers:
                                        - Arch: string # enumeration of supported architectures
                                          URL: string # path to download installation file
                                          Sha256: string # SHA256 calculated from installer
                                      # ManifestVersion: 0.1.0
                                    
                                    
                                    Doesn't look like there is field for dependencies of a package, but this is also a 0.1.0 release.

                                    [1]: https://github.com/microsoft/winget-pkgs

                                    • DaiPlusPlus 5 years ago
                                      YAML? That’s very surprising to me (I grew up in the XML-for-everything days). Would this be the first-ever first-party Microsoft project to use YAML?
                                    • Xelbair 5 years ago
                                      using anything white-space delimited, or as verbose as XML for configuration should be forbidden.

                                      Preferably use something as simple as TOML, or even just plain JSON.

                                      Indentation is pain in the ass to work with in huge files and with editors that do not support autoindent(which occasionally you have to use) - especially if the comments do not follow the indentation.

                                      • yNeolh 5 years ago
                                        As far as I know, YAML 1.2 I think, is a superset of JSON so you could still use both. But maybe they use an older version or a custom parser...
                                      • techntoke 5 years ago
                                        Similar to a PKGBUILD file for Arch. It is 2020 and like WSL, it will probably take at least 2 iterations and 3 more years before this half-works and honestly as much as I want this to be successful they will have to create an entirely different package format for it to. Like EXE installers are so unpredictable already and Chocolatey does okay but packages frequently get broken and many of them are unmaintained.
                                        • open-paren 5 years ago
                                          At least having the package repo in a git repo removes the biggest problem (IMO) with Chocolatey, that a package owner would abandon it then never update it. Now, a package can be updated by anyone through a PR. However, whoever maintains the git repo (Kevin Larkin and some others) is likely to be overwhelmed quickly.
                                          • techntoke 5 years ago
                                            That is sort of how Chocolatey works already. You can modify any of their abandoned packages and submit a request to become owner. They still need to have admins or package authors maintaining packages though in order to ensure the hashes are correct. Otherwise if anyone can make a change then it will become ripe with viruses and malware.
                                      • ocdtrekkie 5 years ago
                                        I found the issue I think Microsoft is going to actually foul up poorly here, which I... went ahead and filed an issue on: https://github.com/microsoft/winget-pkgs/issues/288

                                        In short, a Microsoft employee added AdoptOpenJDK 8 to the repo. ...Java 8? ...In 2020? Another user has opened a PR to add what looks like the FSF's OpenJDK 14 to the repo. So are we supporting 8 or 14? Are users who want to "winget install openjdk" going to get 8 or 14, Adopt or FSF?

                                        I doubt Microsoft is willing to pick winners or losers or opinionate on the authority of third party package sources, and hence, the dream of "winget install powertoys" will probably only reliably do what it should for Microsoft tools.

                                        • karianna 5 years ago
                                          This was a bug of sorts, we’ve engaged the Java team at Microsoft to get this sorted. Disclaimer - I run the Java team at Microsoft
                                          • ocdtrekkie 5 years ago
                                            Good to hear. While I noticed Java as the example here, I feel this does speak to a general issue about how to handle multiple releases and some of the decision-making the Package Manager team is going to need to have in place before this leaves preview. For winget to be not just useful, but trusted, it needs to make decisions, not just be an open dumping ground for package installers.

                                            The decisions the team chooses will end up informing the community on the reliability of it as a platform. And I'm definitely excited to see what happens here!

                                          • vips7L 5 years ago
                                            It also installs OpenJ9 instead of HotSpot which is what most people are expecting when they install the JDK. For now I'd recommend using the Scoop Java Bucket [0] if you want to install the jdk.

                                            https://github.com/scoopinstaller/Java

                                            • vbezhenar 5 years ago
                                              What's wrong with Java 8? It's probably the most widely used Java.
                                              • rleigh 5 years ago
                                                Java 8 is six years old. It's not remotely current. Java 14 is the current release. Java 11 is the current LTS release. Depending upon your priorities, either of them would make sense to pick as a default.

                                                Most package managers provide multiple JDK versions, but default to the newest stable version for the default metapackage.

                                              • SamuelAdams 5 years ago
                                                I worked at a consulting firm in 2019 and one client had us upgrading some legacy, but still essential, applications from Java 6 to Java 8. So yeah it’s still relevant. Enterprise systems for a slow, painful, terribly drawn out death.
                                                • rbanffy 5 years ago
                                                  You can have multiple versions of Java on your machine. Packages in other OSs usually have lists of packages they depend upon, packages they conflict with, and "virtual" packages they provide. Therefore, an app that prefers OpenJDK 14 can require it directly while one that doesn't care can require a virtual package called 'java' that's provided by both 8 and 14.
                                                  • ocdtrekkie 5 years ago
                                                    Sure, but it doesn't really look like Microsoft has a plan or implementation for this yet, and currently serves a version of Java from 2014.
                                                    • Operyl 5 years ago
                                                      Java 8 is still widely used, it seems. For example, Mojang (owned by Microsoft) still ship Java8 with Minecraft. Pretty sure 8 still gets updates in 2020 too.
                                                • eclipsetheworld 5 years ago
                                                  I'd recommend to take a look at the project's roadmap to get an idea where Microsoft is going with this:

                                                  https://github.com/microsoft/winget-cli/blob/master/doc/wind...

                                                  • Congeec 5 years ago
                                                    I'm pretty satisfied with the package manager scoop. Scoop for now works best when you just install binary software. It is not a replacement for package managers like vcpkg yet with which you can pull dev dependencies for a project.

                                                    How does winget compare to scoop? Does it replace vcpkg/nuget/conan/...?

                                                  • lrpublic 5 years ago
                                                    I like scoop, and this is a show stopper for me.

                                                    "This project collects usage data and sends it to Microsoft to help improve our products and services. See the privacy statement for more details." from https://github.com/microsoft/winget-cli

                                                    • nojito 5 years ago
                                                      Why is that a showstopper?

                                                      People do not give feedback so it's impossible to tell how their programs are being used.

                                                      The other choice is to listen to the vocal minority that offers feedback than you get into issues of implementing features that no one wants/uses.

                                                      • lrpublic 5 years ago
                                                        It's not opt-in, so quite likely a breach of GDPR.

                                                        The telemetry in question seems to be logging what is installed, not just how the application is used.

                                                        Regardless of consumers willingness to provide feedback it's not a reasonable choice for a large software vendor to collect data from customers computers about competitors products.

                                                        • nojito 5 years ago
                                                          It’s logging what’s used so that the app can be improved to fit the use cases of its users.

                                                          Of course it’s reasonable. The other choice is developing blindly or listening to the vocal minority. Both of which hurt ALL users in the end.

                                                          • Analemma_ 5 years ago
                                                            > It's not opt-in, so quite likely a breach of GDPR.

                                                            This doesn't make any sense. You don't think that every single installation via the iPhone or Android App Store isn't logged and telemetrized?

                                                            • TheCoelacanth 5 years ago
                                                              I don't think that the fact that an anonymous person installed a particular piece of software is considered personal data under GDPR.
                                                              • tozeur 5 years ago
                                                                Microsoft is incredibly anal about GDPR. I doubt they’re committing a violation here.
                                                            • GordonS 5 years ago
                                                              I don't personally mind telemetry, as long as it's opt-in, or I can at least opt-out, and the data that is collected is clear.

                                                              The docs don't make any mention of how to opt out, or what data is collected. Which is incredibly annoying, as I really want an official package manager for Windows :/

                                                              • lrpublic 5 years ago
                                                                A bigger showstopper is no support for removing packages yet.
                                                              • milkthefat 5 years ago
                                                                Most of the responses here do a really great job at pointing out the flaws of this project. My biggest gripe is it currently has no plans to be integrated by default. So just like all the other package management tools for windows the tool itself is a prereq requiring another hoop. If I have to deal with more configuration management to install this from the app store I’d rather use chocolaty at least that can be installed reliably.
                                                                • charlesdaniels 5 years ago
                                                                  I'm not a Windows user... but didn't they already do this with OneGet? Did that get deprecated? Is this just a re-branding?
                                                                • 6c696e7578 5 years ago
                                                                  So in 199{7,8,9}? I was using yast and/or apt-get to get packages. That was >20 years ago. Now MS have offered something like tar.gz of binaries without dependencies.

                                                                  But I guess this is an answer to the "where's package management" question. Still not there.

                                                                  • recursive 5 years ago
                                                                    All the dependencies are just in the original thing. I have very limited experience with Linux but chasing down problems with dependencies of dependencies feels like a special circle of hell to me.
                                                                    • 6c696e7578 5 years ago
                                                                      > chasing down problems with dependencies of dependencies feels like a special circle of hell to me.

                                                                      Were you getting source from author sites or using the package manager?

                                                                      I've never had problems with apt or yum. In the days before yum it was a different story in Red Hat. Debian have always had it right with apt IMO. You could attribute the success of Ubuntu to it I feel.

                                                                      • recursive 5 years ago
                                                                        I don't remember. I tried to do some rails development in linux like 10 years ago. I know I was using apt, or at least started there. I don't think I ever even got the environment running. I'm sure I was doing something wrong, so no need to blame me, I already know.
                                                                    • totony 5 years ago
                                                                      Still better than the status-quo where you have different launchers auto-updating programs and programs self-updating randomly (and some just not updating causing security issues)
                                                                    • nailer 5 years ago
                                                                      How does this relate to `install-package`, the Microsoft-official 'package manager for package managers' released a few years ago?
                                                                      • techntoke 5 years ago
                                                                        Microsoft would be much better off if they had a YAML format for creating Windows installations, as opposed to their current unattended installs.
                                                                      • alexeiz 5 years ago
                                                                        Frankly, this is a very lame attempt at the package manager. All it does is download installer executables and run them. There is no ability to list installed packages, neither is the ability to uninstall. Where's the actual package management functionality?

                                                                        Both Scoop and Choco are way better than this.

                                                                        • mavhc 5 years ago
                                                                          It mentions oneget, isn't that nuget now? and also by Microsoft?
                                                                          • ruffrey 5 years ago
                                                                            It talks about installing apps. But what about DLLs? .NET framework versions?
                                                                            • pjmlp 5 years ago
                                                                              It has been ages that the best practices are to install them alongside the applications instead of polluting C:\Windows.

                                                                              Also .NET Core is supposed to be bundled with the application.

                                                                              • rbanffy 5 years ago
                                                                                Unfortunately, this causes file duplication (which is not that bad these days of endless storage) and unnecessary vulnerabilities when outdated vendored libraries are used by applications.

                                                                                Linux distributions tend to keep shared libraries in their own packages and applications depend on them so that when you install an app, the packages with the libraries also get installed. And all packages in the distribution tend to use the same versions of those shared libraries.

                                                                                • pjmlp 5 years ago
                                                                                  Which is why nowadays Linux suffers more from .so hell and ABI breakages than Windows does.
                                                                                  • contextfree 5 years ago
                                                                                    fwiw, on Windows MSIX deduplicates identical files across all package installs.
                                                                              • eigenvalue 5 years ago
                                                                                I’m sure the developers of Chocolatey have been dreading this day for years.
                                                                                • Sevaris 5 years ago
                                                                                  Depends on how good the Microsoft implementation is. Afaict, mainly power users use Chocolatey, and they're going to be particularly critical of a solution that is half-baked and doesn't solve the problem as well as an existing, third-party solution that they're already using and they're already used to.

                                                                                  I'm certainly not going to switch over just because it's MS. It's going to have to prove it's at least as good as, if not better than, Choco.

                                                                                  There are also benefits to Chocolatey that probably can't be replicated by MS, such as the package repo being a community effort and it being a relatively open platform for anybody to add whatever package they need.

                                                                                  • GordonS 5 years ago
                                                                                    I think most power users switched to scoop, because chocolately is... not great. Scoop is much better, but has a much smaller list of apps.

                                                                                    I don't want to hate on chocolately too much, because it has filled a very obvious gap in the Windows landscape for so long, but I really don't like it.

                                                                                    The biggest problem is that there are invariably 5 different packages for anything you want to install, with no reliable way of deciding which is the real/main one.

                                                                                    Another problem is packages constantly breaking. This can happen because packages actually pull files from remote, primary sources, and those files disappear or the site goes down, but also for a myriad of other reasons.

                                                                                    Yet another problem is the reliability of the chocolately site - it seems to go down or be slow as hell quite frequently.

                                                                                    Another gripe is that AFAIK, chocolately doesn't support 3rd party repos.

                                                                                    And finally (and this one is totally subjective) the website is ugly.

                                                                                    So as glad as I am that chocolately filled a void, I'll also be glad for Microsoft to provide an official, reliable replacement that also supports 3rd party repos.

                                                                                    • jedieaston 5 years ago
                                                                                      scoop and scoop extras (https://github.com/lukesampson/scoop-extras) covers pretty much everything I use on Windows. I didn't realize the other repos existed for a while, but once I did, I got rid of choco entirely.
                                                                                      • lostmsu 5 years ago
                                                                                        > The biggest problem is that there are invariably 5 different packages for anything you want to install, with no reliable way of deciding which is the real/main one.

                                                                                        > Another problem is packages constantly breaking. This can happen because packages actually pull files from remote, primary sources, and those files disappear or the site goes down, but also for a myriad of other reasons.

                                                                                        How are these different on Scoop? The first one seems to only be related to the actual amount of packages. E.g. if Scoop ever grows to the same size, it will get it too.

                                                                                        The second one is also unclear. Does Scoop test all the packages it provides? Somehow I think it is unlikely.

                                                                                        • mavhc 5 years ago
                                                                                          Not tried scoop, but not had many problems with choco, installing stuff on 100 machines at work, made a smb share to store the package files, wrote a script to grab xml files based on machine names of lists of things to install.

                                                                                          The search does seem to break sometimes, but not had much problem with the packages themselves, a few end up installing in a user context, which isn't helpful when the user is SYSTEM.

                                                                                          Easier than constantly repackaging things as MSI/writing install scripts

                                                                                          • neves 5 years ago
                                                                                            My gripe with Chocolatey is just that I can't set a non default dir. Everything is installed in my small SSD.
                                                                                        • STRML 5 years ago
                                                                                          Dreading? I doubt it. It's a relief when the problem your library solves no longer needs solving!
                                                                                          • nindalf 5 years ago
                                                                                            No, can't you see? Microsoft is going to Embrace, Extend, Extinguish Chocolatey!!! /s
                                                                                            • _-david-_ 5 years ago
                                                                                              If it was just a free library that would be one thing but they have a company with multiple employees.
                                                                                              • saxonww 5 years ago
                                                                                                I won't say it was silly to ever make Chocolatey, but it was living on borrowed time from day one.

                                                                                                What's interesting to me about this announcement is that it seems to replace something they already had; Microsoft released OneGet several years ago and was positioning it (I thought) the same way they are positioning this. It's in maintenance mode now. So I would say Chocolatey is doomed only if this actually sticks.

                                                                                            • cm2187 5 years ago
                                                                                              Still lame that Microsoft has been waiting that long to deliver such a basic functionality.

                                                                                              Kind of like the .net framework celebrating its first json serialization library in the CLR a couple of years ago. Welcome to 2010!

                                                                                              • ocdtrekkie 5 years ago
                                                                                                I suspect third parties will continue to do this way better than Microsoft, to be honest. Microsoft can't pick winners and losers, they can't offer an opinionated system, which package repos generally are, without being monopolist.
                                                                                              • rkagerer 5 years ago
                                                                                                Software management on Windows is such a mess.

                                                                                                After decades of opportunity for improvement, it's largely gotten worse. Uninstall is too often a myth, and the majority of programs out there leave bits and pieces behind. These add up over time to bloat your registry, disk, kernel drivers, etc, degrading the performance and reliability of your computer. Multiple conventions for where things go makes it difficult to track down the bits. (Program Files? (x86)? AppData\[Local|LocalLow|Roaming]? SteamApps\common? ProgramData? System32/SysWOW64? Dozens of registry locations?)

                                                                                                So many installers require unfettered, administrative access to my computer with little indication of exactly what they intend to do (Litter my desktop with new shortcuts? Add shell hooks? Install a rootkit?) and no opportunity from the OS to consent your partial permission or retroactively examine the changes. (Don't miss that popup balloon about a new driver! Have fun parsing through all the noise in your event logs).

                                                                                                Even simple chores like managing file type associations became more painful somewhere along the way.

                                                                                                There's a reason professionals so often fall back to advising a reformat. Makes me miss the days when your program went someplace like C:\PHOTOSHOP and most everything for it was contained within.

                                                                                                It's easy to point fingers at individual software publishers (I've called out some incompetent ones) but mostly I blame Microsoft for failing to evangelize rigorously thought-through best practices and provide better tooling to make it dead easy for developers to get it right. I might be wrong about this, but the preview looks like a gimmick for finding and running installers. I would have liked to see improved methodologies, packaging tools, and end-user empowerment announced alongside it.

                                                                                                Hats off to folks like Nir Sofer and Mark Russinovich who've shown the world just how much you can pack into a small, single-file, zero-installation EXE that just runs when you click it.

                                                                                                I've been using the same computer for 10 years now (with upgrades to components like video, RAID controller, SSD's) and have over 700 programs installed on it. I use third party monitoring software [1] to capture a disk and registry snapshot before and after any installation (and often on updates). The machine is still nearly as snappy as the day it was built (yes, I benchmark!), but it's taken a LOT of ongoing work to keep it that way. I use other tricks, like locking down certain registry keys and folder locations which programs like to pollute (or where that causes breakage, using startup scripts to clean them out after the fact in a cat and mouse game). One big win was completely giving up on My Documents. I treat it like just another AppData, and organize the content I really care about elsewhere.

                                                                                                All that said, I really like that my Windows software still comes directly from the vendors. I'm not sure how I feel about distribution becoming more centralized under Microsoft's control. Part of me hopes to see a vibrant ecosystem of third-party repos emerge, while another part dreads the confusion about where to get a package that may entail.

                                                                                                I do have to give Microsoft credit for enabling third party tools to take care of some of the shortfalls they haven't. On more locked down platforms that's been more difficult.

                                                                                                [1] https://www.martau.com/

                                                                                                • contextfree 5 years ago
                                                                                                  UWP and MSIX are/were intended to address the problems you mention
                                                                                                • tjoff 5 years ago
                                                                                                  Do you need a microsoft/whatever account for this? I can't see anything about it but wouldn't be surprised if they forgot to mention it...
                                                                                                  • jamieweb 5 years ago
                                                                                                    I'm interested to know whether the SHA256 hashes are just done on a TOFU basis, or whether they actually verify the Authenticode/GPG signatures of the EXE files to get an 'authoritative' or 'trusted' hash.
                                                                                                    • sigsergv 5 years ago
                                                                                                      What about uninstalling apps?
                                                                                                      • Ari_Ugwu 5 years ago
                                                                                                        Maybe the most exciting thing I've heard so far from Build 2020.

                                                                                                        Getting Closer to my dream install:

                                                                                                        * WSL 2

                                                                                                        * VS Code

                                                                                                        * .NET 5

                                                                                                        * Windows Terminal

                                                                                                        * Package Manager

                                                                                                        * Edge

                                                                                                        All that's missing is Edge on Linux and letting me write cross platform apps that use edge as a (headless) common runtime.

                                                                                                        • eat_veggies 5 years ago
                                                                                                          Given that edge is just chromium now, I'm curious as to how an edge headless runtime would differ from node or electron
                                                                                                        • akandiah 5 years ago
                                                                                                          Is this an msi hiding in a wrapper? Anyone who has dealt with the innards of an msi file knows it's a dog's breakfast!
                                                                                                          • 5 years ago
                                                                                                            • wronex 5 years ago
                                                                                                              Are they doing any form of caching (think CDN) to battle link rot?