Office

From CyberTech Rambler (and Slashdot) comes the news that the Office 2003 Service Pack #3 disables (blocks) access to a number of legacy document formats. Details are in this MS support article. Formats so blocked include legacy Lotus 1-2-3 and Corel Quattro Pro formats. Why? According to the Microsoft support article, “By default, these file formats are blocked because they are less secure. They may pose a risk to you.”.

Interesting. Well, let’s look at the record. If we query the CERT vulnerability database for “WK1”, “WK3”, “WK4”, etc., how many reported vulnerabilities do we see? Zero. Nothing.

But search the same database for “XLS” and what do we see? Eleven reported vulnerabilities:

Hmm… I’m so glad they disabled access to the risky formats.

And what about the Data Interchange Format (DIF), the text based format for exchanging data between spreadsheets. As well as being text-based and easy to parse, DIF doesn’t allow any active code (scripts, macros) at all. Where is the security risk there, real or perceived? By what stretch of the imagination can Microsoft say, “…these file formats are blocked because they are less secure. They may pose a risk to you.”

Now it may be entirely possible that these old import filters in Excel are poorly written and poorly maintained and that Microsoft may be trying to reduce the overall security exposure of MS Office by ditching old code that is not strategic for them. But call it that. The MS Office code has the problem. Don’t malign the formats. Don’t make up some untenable story that DIF format is “less secure” and “may pose a risk for you”.

Some interesting news, via Bob Sutor.

Let’s take a closer look at the what is being offered as part of this “royalty free” deal from Microsoft.

At first it appears like an early Christmas present from Microsoft, a royalty-free license to the Office UI for “software vendors who wish to incorporate the 2007 Microsoft Office User Interface into their own products.” Woo hoo!

Now to be totally honest, I must admit that I’m not a big fan of the new Office ribbon UI. It smacks a bit too much of the kind of New, Improved Packaging! campaign that snack food companies engage in periodically. It is the same junk food in the end, with a new wrapper. But the domination of Microsoft is so great on the client, that their UI whim is practically the law for everyone else. So we must pay attention. Their market presence defines the norms, and these norms define user expectations and therefore intuitiveness. User interface guru Jakob Nielsen said it well:

If anybody else introduced a new user interface paradigm, it would probably remain a curiosity for years, but Microsoft Office has a special status as the world’s most-used interaction design. We know from user testing that users often demand that other user interfaces work like Office. When you’re used to one style most of the day, you want it in other applications and screens as well.

So, any genuine attempt to encourage the free and open use of new UI paradigms is to be applauded. The current Windows UI is certainly the result of an industry-wide evolution, with contributions from Xerox, Apple, IBM, NeXt and many others. Although Microsoft is the main beneficiary of this UI consolidation, they were not the sole contributors. So it is good to share the love and continue this evolution.

But then we read the fine print in what Microsoft is offering:

The program does not involve code or technical specifications and there are no protocols or file formats either.

OK. So what exactly are they offering? Answer:

pending utility and design patent claims, copyrights, trade dress and trademark rights.

OK. Another one of those, “We got stuff; you’ll need to deal with us” FUD messages. Odd that they aren’t offering any code or technical specifications, but they are still claiming copyright? Anyone remember Lotus v. Borland? “Method of operation” ring a bell?

We read further:

Your Licensed UI must comply with the Design Guidelines. If Microsoft notifies you that the Design Guidelines have been updated or that you are not complying with the Design Guidelines, you will make the necessary changes to comply as soon as you reasonably can, but no later than your next product release that is 6 months or more from the date you receive notice.

So once you accept this license, Microsoft can pretty much jerk you around whenever they want. I’ve seen terms like this before when licensing redistributable code modules. But has anyone seen this for merely following someone’s UI guidelines?

It gets still stranger:

This license contains no sub-license rights. If you allow others to use, copy, modify or distribute your Licensed UI in their products, your contract with them must state that they receive no Microsoft rights in the Licensed UI from you.

Not very open source friendly, is this? You can marry into the family and get protection from the Godfather, but you can’t transfer this to anyone. They need to make their own accommodation with Microsoft.

This makes me wonder about the Microsoft-funded ODF Add-in for Word that Clever Age and others are working on. This add-in does UI-level manipulations of the Office 2007 ribbon. Are they covered under Microsoft’s license program? Are their user’s covered? What about anyone who takes the source code and modifies it and redistributes it?

And then the nail in the coffin:

“Excluded Products” software products or components, or web-based or hosted services that perform primarily the same general functions as the Microsoft Office Word, Excel, PowerPoint, Outlook and Access software applications, and that are created or marketed as a replacement for any or all of those Microsoft applications.

So here the mask of openness falls off and we see this for what it is. This is very reminiscent of the original license on the Microsoft binary file formats, back in the days when the specifications were published on MSDN CD’s:

[Y]ou may use documentation identified in the MSDN Library portion of the SOFTWARE PRODUCT as the file format specification for Microsoft Word, Microsoft Excel, Microsoft Access, and/or Microsoft PowerPoint (“File Format Documentation”) solely in connection with your development of software product(s) that operate in conjunction with Windows or Windows NT that are not general purpose word processing, spreadsheet, or database management software products or an integrated work or product suite whose components include one or more general purpose word processing, spreadsheet, or database management software products.

Interestingly in that case, once they achieved their goal of total market domination, Microsoft removed the file format documentation from MSDN and it was only available under a special license. They started open, in order to gain market domination, but once their goals were achieved, the openness ended. What prevents this from happening again?

Caveat emptor, even when it appears to be free. The first one always is.