http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspxImagine a blog entry where I dissect the Google Toolbar Beta for Enterprise and not only find that it is built by WiX but hides another nasty surprise...en-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#521865Wed, 01 Feb 2006 16:30:03 GMT91d46819-8472-40ad-a661-2c78acb4018c:521865社本＠ワック Blog企業向け Google Toolbar のMSIパッケージは、トロイの木馬！？ - WiX/Windows Installerhttp://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#522012Wed, 01 Feb 2006 18:44:41 GMT91d46819-8472-40ad-a661-2c78acb4018c:522012Netweb » Google Toolbar Enterprise Trojan HorsePingBack from <a rel="nofollow" target="_new" href="http://netweb.wordpress.com/2006/02/02/google-toolbar-enterprise-trojan-horse/">http://netweb.wordpress.com/2006/02/02/google-toolbar-enterprise-trojan-horse/</a>http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#522304Wed, 01 Feb 2006 21:50:12 GMT91d46819-8472-40ad-a661-2c78acb4018c:522304CalebThe title of this blogpost is a bit misleading (how ironic?). Mozilla was making a few MSIs during a period of time, and those were also just wrappers around their "silent" installation program. Sometimes it just too much time to create anoter installer, and then to beta test it. Note that Mozilla has stopped using those MSIs because they sucked. Probably sometime in the future they'll have real ones ;-)http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#522350Wed, 01 Feb 2006 22:30:32 GMT91d46819-8472-40ad-a661-2c78acb4018c:522350robmenCaleb, the title maybe be a bit sensationalist (okay, maybe a bit more than a little &lt;grin/&gt;) but it says exactly what I meant it to say. The MSI package for the Google Toolbar Beta for Enterprise is a wrapper to make the custom installation executable (whatever it may do) appealing to administrators to deploy. The Greeks did the same thing. They wrapped themselves in a wooden horse to be more palatable to the Romans. <br/> <br/>When I put &quot;Trojan horse&quot; in quotes, I was trying to indicate I meant the more literary meaning of the term Trojan horse not the popular computer security meaning. Maybe I should have called out my meaning explicitly in the blog entry. I guess the comment here will have to suffice. <br/> <br/>By the way, I've never installed Firefox (just haven't made time to do so) but I would have said the same thing about their MSI package if I ever looked at it. I also appreciate the time and effort that goes into creating installers (I've spent a bit of time creating them myself &lt;smile/&gt;), but my understanding is that the Google Toolbar Beta for Enterprise only needs one installer for one platform. They could have made it a proper MSI package.http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#522804Thu, 02 Feb 2006 07:38:54 GMT91d46819-8472-40ad-a661-2c78acb4018c:522804AJI have successfully repackaged the Google Toolbar installer for deployment. It's a pretty simple install. A lot of vendors take the easy way out with their installers. Sun's Java Runtime Environment is another example of this faux pas.http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#523091Thu, 02 Feb 2006 16:05:53 GMT91d46819-8472-40ad-a661-2c78acb4018c:523091twaltariHow to detect the MSI package was created with WiX?http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#523137Thu, 02 Feb 2006 17:24:06 GMT91d46819-8472-40ad-a661-2c78acb4018c:523137Adam BellThey've done the same thing with the Google Desktop Search for the Enterprise. We looked at this about 6 months ago and also noticed that it was just a wrapper MSI. Of course the fun here is that it dumps a shortcut on the Desktop. Very un-corporate and something that most entprise environment's frown on. There was no easily documentated method of stopping this behaviour without seemingly needed to create an MSI install for yourself. With this in mind we binned deploying it in our environment. In their favour it's one of the rare applications I've seen that works nicely with GPO and comes with it's own ADM's. http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#523158Thu, 02 Feb 2006 17:44:10 GMT91d46819-8472-40ad-a661-2c78acb4018c:523158runItWell... there is a learning curve involved with using MSI (properly). Quite a few people still see installation as glorified xcopy and have trouble understanding the MSI way. Most likely they did this as a way to distribute something that they already knew worked and at the same time get their feet wet with MSI. I think you will see a proper Windows installer package with the next iteration of the product. http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#523481Thu, 02 Feb 2006 23:31:24 GMT91d46819-8472-40ad-a661-2c78acb4018c:523481Christopher PainterRob- I'm usually nodding my head with you, but come on, Microsoft did the EXACT same thing with the Windows Media Player 9 Administratios Deployment kit that we talked about a couple blogs ago. Perhaps if AD GPO wasn't so restrictive in only understanding MSI people wouldn't feel the need to wrap legacy installer in a pseudo-msi package. http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#523778Fri, 03 Feb 2006 06:39:24 GMT91d46819-8472-40ad-a661-2c78acb4018c:523778Christopher PainterSorry for the back to back posts but I want to drive my point home a little more. InstallShield has done the exact same thing also. Take a look at the MDAC 27 ENU merge module that InstallShield distributes. All it does is sequence a custom action that shells out to a legacy installer to install the MDAC redistributables. And you want to know where they got that idea from? MICROSOFT! Read this one in case you've never seen it: http://support.microsoft.com/?kbid=320788 In the above link there is a download of a white paper that ( SUPRISE ) teaches how to create a merge module with a custom action to call out to the MDAC setup. http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#524760Sat, 04 Feb 2006 15:10:23 GMT91d46819-8472-40ad-a661-2c78acb4018c:524760Leon ZandmanChristopher is absolutely right. I was amazed at Microsoft's MDAC merge module solution when I first encountered it. I still find it very weird that Microsoft doesn't provide nice merge modules for MDAC (and some other technologies). And the merge modules that they do provide often contain errors, that cause my installers to fail ICE validation. <br/> <br/>BTW Rob, how did you know it was created using WiX? Did they use the GUI library? Or did they use a WiX custom action?http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#526124Tue, 07 Feb 2006 02:43:20 GMT91d46819-8472-40ad-a661-2c78acb4018c:526124Christopher PainterI haven't looked at the inner workings of the structured storage, but if you look at the MSI with a hex editor or even notepad/strings command you can see it branded: <br /> <br />Windows Installer XML v2.0.3309.0 (candle/light) <br />http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#526134Tue, 07 Feb 2006 02:57:01 GMT91d46819-8472-40ad-a661-2c78acb4018c:526134Christopher PainterI just looked at the WiX source. &nbsp;Take a look at the UpdateSummaryInfor() in binder.cs. &nbsp;It's being stored in Property 18 ( PID_APPNAME for those of us who like to use constants ). &nbsp; <br /> <br />BTW, too bad ORCA doesn't display this property... :) <br /> http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#526138Tue, 07 Feb 2006 03:02:04 GMT91d46819-8472-40ad-a661-2c78acb4018c:526138robmenLeon, Christopher Painter is correct. &nbsp;The Application Summary Property in the Summary Information stream is updated by the WiX toolset as per the MSI SDK: <br /> <br />Creating Application Summary Property <br /> <br />The Creating Application Summary property conveys which application created the installer database. In general the value for this summary property is the name of the software used to author this database.http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#526855Tue, 07 Feb 2006 22:24:15 GMT91d46819-8472-40ad-a661-2c78acb4018c:526855Leon ZandmanAh, thanks for your explanation.http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#528223Thu, 09 Feb 2006 06:37:44 GMT91d46819-8472-40ad-a661-2c78acb4018c:528223Christopher PainterI didn't mean to put Rob on the spot with my comments. &nbsp;But I was hoping to get his opinion on the points that I raised.http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#528323Thu, 09 Feb 2006 09:00:50 GMT91d46819-8472-40ad-a661-2c78acb4018c:528323robmenOh, Christopher, I wasn't trying to avoid commenting. &nbsp;You're comments are actually a great segue into my next couple *big* posts. &nbsp;Also, remember I'm trying to answer more comments and blogs with my own blog posts: <a rel="nofollow" target="_new" href="http://blogs.msdn.com/robmen/archive/2006/01/07/510425.aspx">http://blogs.msdn.com/robmen/archive/2006/01/07/510425.aspx</a>. &nbsp;I haven't forgotten, I'm just lazy. &nbsp;&lt;wink/&gt;http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#529496Fri, 10 Feb 2006 17:12:32 GMT91d46819-8472-40ad-a661-2c78acb4018c:529496Christopher PainterI've read that thread, and I took it to mean instead of making comments on other peoples blogs make posts on your own. &nbsp;I didn't take it to mean don't make comments on your own posts on your own blog. &nbsp; &nbsp;To me comments on a blog helps keep topics together. <br> <br>I personally don't mind making comments on other proples blogs, it shows respect for that person. &nbsp;It says I was here and I deemed the post good enough to contribute. <br> <br>For me to only make comments by making posts on my own blog seems like a selfish way of saying I'm too important &nbsp;to make a comment on Robmen's blog and I'd rather draw everyone to my blog instead. <br> <br>I don't make posts on my blog to satisfy some sense of self-grandure. &nbsp;I do it to share my thoughts in the hope that it will help someone else with their problems.http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#529648Fri, 10 Feb 2006 20:02:07 GMT91d46819-8472-40ad-a661-2c78acb4018c:529648robmenChristopher, I feel that trackbacks remove the selfishness/self-grandure angle of your argument. &nbsp;If I just have a quick comment, then I'll leave a comment on someone elses blog. &nbsp;However, if I have a intricate counter-point or I want to expand on their point with more than a paragraph, I think posting a blog entry and leaving a trackback to the appropriate blog entry (on my own blog or others) is very reasonable. &nbsp;And honestly, after seeing Scoble do so on their blogs for a while, I think I prefer it... because he points out interesting comments that I might have otherwise missed. <br> <br>To respond to some of your comments above, I have been thinking about a particular blog entry (or 3!) for about a month trying to get the points all organized in my head. &nbsp;It isn't something I'm just going to whip up and drop in a comment somewhere. &nbsp;It is going to take a me more than a couple hours to write and I'm going to want it spell checked and I'm going to want to make sure I save drafts in case the browser refreshes or whatever. <br> <br>See, already, this comment here probably should have been posted as a blog entry. &nbsp;It demonstrates a lot about what I believe and now it is hidden under the title &quot;Googal Toolbar Beta for Enterprise a 'Trojan Horse' MSI package.&quot; &nbsp; <br> <br>How many people do you think are going to find this great discussion between us (and I do mean that sincerely, not sarcastically) here?http://blogs.msdn.com/robmen/archive/2006/02/01/521809.aspx#530004Sat, 11 Feb 2006 05:51:32 GMT91d46819-8472-40ad-a661-2c78acb4018c:530004Christopher PainterSincerly, I read everyone of your posts and everyone of the comments on them. &nbsp;The same goes for several other setup bloggers. &nbsp; It's a small community and I never want to miss a chance to learn something new. <br> <br>In my blog ( now mostly defunct since blogging is verbotten in my new job ) I'm not worried about reaching lots of people but just the ones that find it interesting. &nbsp;In fact I barely get any traffic now, sad, but understandable considering the circumstances. &nbsp;Still maybe one day I'll be able to publish again. <br> <br>And for the selfishness/grandeur comment, I wasn't talking about anyone other then myself. &nbsp; &nbsp;The only other argument is when I post a comment on your site I'm giving you the respect to be able to choose to moderate or remove it if you like. &nbsp;I'm afraid too many people could get tempted to go blog some nasty comments on their own site where you don't get the same respect shown to you. <br> <br> <br>But eitherway you are right. &nbsp;This hole topic is thoroughly hijacked now! &nbsp; &nbsp;In fact feel free to delete all of these comments if you like!! :) <br>