Gadget Corner

Gadget security guide

sbblog@microsoft.com — Wed, 01 Aug 2007 08:52:00 GMT

Check out Michael Howard's and Dave Ross' nice article on how to write a more secure gadget at http://msdn2.microsoft.com/en-us/library/bb498012.aspx.

Swiss gadget development competition

sbblog@microsoft.com — Wed, 18 Apr 2007 18:37:00 GMT

Our friends in Switzerland are hosting a gadget development competition. Here are some highlights:

What is the Swiss Gadget Competition about?

Contestants develop their own Windows Live or Vista Sidebar Gadget to become the Swiss Gadget Champion 2007. They will not only compete with Swiss developers, but their gadget will also be presented to the rest of the world.

How is it set up?

The competition is set up in two phases:

Phase 1

From now till 31 May 2007: Developers design their gadgets to take part in the competition.

Phase 2

1 June till 15 June: Public voting. Any Swiss user may vote for their favorite gadget.

How does public voting work?

Criteria

Number of votes, weighing 30% of total score
Average gadget score based on customer’s votes, weighing 70% of total score

Examples

Number of votes: The gadget with the highest number of total votes gets 5 points. All other gadgets are valued in relation to the highest number of votes (5000 votes = 5 points, 3’000 votes = 3 points, 100 votes = 0,1 points)
Average gadget score: User give scores between 1 to 5 (5 = excellent, 1 = poor). Only full points can be given. The total number of points divided by the number of votes = average score.

Final score

Both results are added, based on their weighing. Should the total score be equal

The contestant with the higher average gadget score wins
Should both criteria be equal, the winner will be elected by a lucky draw

Prizes for developers

1st prize: Fly to the Professional Developers Conference 2007. The prize includes admission, flight in Economy Class and hotel accommodation during PDC. Value: approx 3‘500 US Dollars.
2nd prize: One Toshiba Flat Screen TV (82 cm, HD-ready, HDMI Digital Input und Active Vision III Plus). Value: 1’300 US Dollars
3rd prize: One Windows Vista Ultimate Edition (Full version)

URL

All information is available in German and French on www.gadgetcompetition.ch

Pre-configuration of Sidebar Gadgets using unattend.xml

sbblog@microsoft.com — Fri, 09 Mar 2007 00:28:00 GMT

We’ve heard from several OEMs who are having trouble pre-configuring Sidebar gadgets using the Sidebar unattend settings. We will explain in more detail how these settings work.

First, the Sidebar unattend settings are overrides for the default gadget settings. To determine what the default Sidebar gadget settings are, you can examine the “%programfiles%\Windows Sidebar\settings.ini” file. The default settings.ini file that shipped with Vista contains the following information (note that this can change between versions of Windows):

As you can see, the default settings indicate that Sidebar should be on by default and that the Clock, SlideShow and RSSFeeds gadgets are loaded.

The unattend.xml file can be used by OEMs and Corporations to override certain default properties of Windows components, including Sidebar, during Windows setup. Using the unattend.xml file, OEMs and Corporations my override the following Sidebar default settings:

Whether Sidebar is on by default when Windows boots
Whether Sidebar is visible by default when it is running
Control up to five default gadgets

Whether Sidebar starts when Windows boots is controlled by the “SidebarOnByDefault” unattend value. Whether Sidebar is visible by default when it runs is controlled by the “SidebarVisible” unattent setting. To have Sidebar not start by default when Windows load, you would add the following to your unattend.xml:

To have Sidebar start when Windows is booted but not be visible by default, you would add the following to your unattend.xml file:

To use the Gadget settings, you need the information from the default settings.ini file. It’s also best to think of the Gadget settings as slots to hold up to five gadgets. Each slot (Gadget1,…, Gadget5) contains two pieces of information; the path of a preinstalled gadget and whether that gadget is enabled (true) or disabled (false). These five gadget slots override the settings in the default settings.ini file (which controls which gadgets start by default). Let’s consider a few examples.

Example 1. Suppose you want to have Clock, SlideShow, RSSFreeds and your own custom preinstalled Foo gadget to load in that order. Since Clock, SlideShow, and RSSFeeds are already the default gadgets that load (and in that order) for Vista, you could just add the following to unattend.xml:

However, it’s best to avoid dependencies on the default values in settings.ini as much as possible since those could change in later versions of the operating system. You could accomplish the same thing in a safer way by adding the following to unattend.xml:

Example 2: Now suppose you wanted only your Foo gadget to load. In this case, if you just add a Gadget4 setting for Foo.Gadget, you will still have SlideShow, Clock and RSS starting since the unattend settings are just overrides (nothing has overridden the first three slots). There is no way to explicitly remove a gadget entry using the unattend.xml file, but you can disable a default gadget. So, to have only Foo load by default, you could add the following to unattend.xml:

In the above case, we just disabled the three existing gadgets and added a new entry for Foo. Another way to accomplish that could be to replace the slot 1 gadget with Foo and disable the other two slots, like so:

Example 3: Finally, let’s say you want to have three instances of Clock start up and then two instance of SlideShow.

Note that configuration of a gadget (beyond whether it’s enabled or disabled) is not supported via the unattend.xml file at this time.

Windows Live gadgets for Sidebar

sbblog@microsoft.com — Wed, 07 Mar 2007 23:07:00 GMT

Windows Live released two gadgets that really showcase some Windows Live services, as well as being terrific examples of how to give users quick access to lots of data in a Sidebar gadget.

Live Search Gadget - download

Live Search Traffic Gadget - download

Definitely head over to the Windows Live Gallery and check them out!

Tips for writing Sidebar gadgets with SideShow functionality

sbblog@microsoft.com — Fri, 02 Mar 2007 23:29:00 GMT

Here's a few tips for developers writing Sidebar gadgets that interact with Sideshow (the Windows Vista support for auxiliary displays):

Early versions of the Sidebar/Sideshow documentation incorrectly refers to the enabled method as a property. The following code snippet demonstrates how to determine in your gadget whether Sideshow is available using the enabled method:

Also note that the enabled method reports whether Sideshow is supported on that operating system, not whether a Sideshow device is currently available. Thus, it always reports “true” on Windows Vista.

The applicationEvent feature is not fully supported on the currently shipping version of Sidebar and should generally not be used.

You can update content using repeated calls to addText/addImage with the same id value. We recommend that you call remove before updating the content for a given id, otherwise the script may suffer from a memory leak.

Instead of this:

Do this:

Thanks,
Paula Tomlinson

Embedded ActiveX objects and x64

sbblog@microsoft.com — Fri, 26 Jan 2007 22:00:00 GMT

Really, this post is about Flash. But it will probably apply to quite a few other ActiveX objects out there, too, so use it liberally!

Unfortunately, Adobe Flash does not support the x64 processor architecture. The basic upshot of this is that you can't view Flash content in a Sidebar Gadget if your machine has an x64 processor. Sorry about that.

If you're developing a gadget, you can attempt to provide an user error experience for this by using our own System APIs. The System.Machine.processorArchiture returns "x86" and "x64" for those types, so if you're using a control you suspect isn't supported, then you can write out a helpful user message instead of the HTML for the object!

Thanks,
Brian

“WPF/E” and Sidebar gadgets

sbblog@microsoft.com — Wed, 06 Dec 2006 04:04:00 GMT

One of my favorite new web technologies is now available for preview. I’d urge to you go check out the developer center and team blog.

Of course, since “WPF/E” is a technology designed to work in web pages, many of you are going to try it out inside gadgets. Very cool. Unfortunately, you’ll probably hit some roadblocks when attempting to render “WPF/E” content inside a Sidebar gadget.

External Files

Samples that access external files will not be able to access those files. This includes images referenced in the XAML and XAML files, even inside the gadget package.

This is not a security issue, but rather a problem with the way the “WPF/E” control resolves file paths and URLs. Unfortunately, there is no known workaround, such as placing the files on a remote server. Only XAML content embedded in the HTML files will load.

Making samples into gadgets

It is minor in comparison to the above issue, but most examples won’t have height and width set on the body. This is required for Sidebar gadgets, so be sure to add it.

Brian

Using the slideshow gadget with Search folders

sbblog@microsoft.com — Tue, 28 Nov 2006 01:29:00 GMT

Ben Betz has a pretty cool post about building some advanced queries in the UI (http://shellrevealed.com/blogs/shellblog/archive/2006/10/31/Query-Composition_3A00_-Building-a-search-upon-another-search.aspx).

Did you know that you can direct the slideshow Sidebar gadget to cycle through images in those same dynamic search folders?

David Washington submitted this tip.

The Short Story:

You can point the Slideshow gadget at a Search Folder. You can do this by simply putting a search folder inside of an actual folder and pointing the gadget at the actual folder.

Here are the steps:

1) Create an actual folder

2) Perform a search of pictures

3) Save search to created folder

4) Point the Slideshow gadget at the created folder

5) Make sure “Include subfolders” is checked

The Long Story:

I have a ton of photos that I have tagged and rated, so I was a little disappointed when I saw that the Slideshow sidebar gadget doesn’t support search folders. I have search folders for “Top Rated Pictures” and “Pictures of Family” and I wished that I could just point the gadget at these instead of an actual folder.

Due to the awesome-ness of search folders, they behave just like a regular ShellFolder so the sidebar gadget should support it but the version of SHBrowseForFolder that is being called is only showing File System folders. Determined to hack my around this limitation, I was up to my elbows in javascript when I found that a neat feature in the gadget code that will allow this functionality. If “Include Sub-Folders” is checked the code that adds pictures to the slideshow checks each enumerated file if it is a folder and recursively adds its contents as well. Due to the aforementioned awesome-ness this includes Search Folders! To have a little more control over what pictures are displayed, I created a couple (file system) folders that contain search folders. I just point the Slideshow gadget at one of these and I have exactly what I wanted. I have multiple instances of the Slideshow Gadget running pointing to different saved searches.

Building the Feed headlines gadget using the Windows Feeds Platform

sbblog@microsoft.com — Thu, 16 Nov 2006 21:22:00 GMT

The final RSS gadget, “Feed Headlines” is done and available with Windows Vista! This gadget is featured on the Vista Sidebar by default and allows users to see new headlines peripherally. We built the gadget using the Windows Feeds Platform, which greatly reduced the complexity of getting and storing of feed data so that we could focus more on the user experience.

Initially, the gadget was prototyped using an http request to handle the xml files from each feed, similar to other AJAX development. Designing and developing the prototype quickly revealed that managing feeds was going to be very consuming to develop due to how much code would need to be written for feed download, storage, and user management not to mention the bugs introduced due to the extra code.

We started prototyping a gadget to be a full-fledged feed aggregator for all types of syndicated formats. As part of this development process we took a look at the Internet Explorer 7 feed reading experience and realized that our experience with a Sidebar gadget had to interact with Vista’s new feed platform. We ended up building a gadget that essentially became a face to the feed platform. Because we chose to build the gadget on top of the feed platform the job became a lot less complex, and a more usable gadget emerged. It was more usable in that the user doesn’t need to maintain another RSS list specific to the “feed headlines” gadget and read/unread data is synchronized.

In hindsight, it becomes quite clear that managing feeds in one location accessible to all applications is “how feed management on the OS should work”. Sure you can be savy and have your opml list and import it to all your RSS apps, but I personally am just not that organized, and isn’t that a lot of the reason we use computers - to do our mundane tasks for us?

By choosing to build our gadget on top of the feed platform, we introduced a dependency on the feed platform. If it breaks we break. This is not a bad thing, because if it does break we know where things went wrong and can be fixed from one point instead of several.

In conclusion, I don’t believe this would be a viable gadget without the feed platform. As an independent feed aggregator, there is just too much set-up to ask of the user. Gadgets are quick glance mini-applications. I don’t believe users will want to spend a great deal of time interacting with them, and API’s like the feed platform will make gadgets extremely robust.

Notes on the gadget’s usage of the Feed Platform APIs:

The RSS gadget uses a number of the APIs from the feed platform in ways that may not be obvious on the surface. Helpfully, the feed platform exposes its APIs through a scriptable ActiveX object, so it was simple to access these APIs in a Sidebar gadget using JavaScript.

By default, the RSS gadget displays all feeds in the feed platform, including subfolders. Because the feeds can be organized into folders, it’s possible through the settings dialog to select an individual feed or a folder of feeds.

The gadget also displays only the unread items from the selected feeds, making it more relevant to the user as a gadget. Further, if the user opens a feed item from the gadget’s flyout that particular item will be marked as read.

-John Moscarillo, Sidebar Gadget Developer

Roaming gadgets on a USB key

sbblog@microsoft.com — Fri, 10 Nov 2006 02:57:00 GMT

DISCLAIMER: This post is relevant for the Vista v1 version of Sidebar, but isn’t guaranteed to work on future versions. Hopefully we’ll be able to devise a more streamlined method of roaming gadgets and settings in the future.

Sidebar by default will use settings and gadgets that have been installed to your user profile. Many folks use multiple computers and don’t have easy methods of duplicating their user profiles between computers. Even on domain joined computers and accounts with roaming profiles, gadgets don’t roam. Additionally, some folks use shared computers with profiles that get wiped out every night. For most of these scenarios, Sidebar users typically only have access to the standard Vista gadgets and any shared gadgets the system administrator has installed. Fear not, roaming users, Sidebar does have support for carrying your gadgets and settings with you!

USB storage keys are pretty cheap these days, and they have plenty of room for storing gadgets. We can copy our gadgets and settings to this USB key, edit the settings file to make it drive-letter independent, and use a simple batch file to execute Sidebar in such a way that our gadgets and settings are loaded from the USB key instead of from the user profile.

Step 1: Copy the installed gadgets to the usb key

On Vista your settings and user-installed gadgets are found in “%userprofile%\appdata\local\microsoft\windows sidebar”. Gadgets which were installed by your system administrator are installed in “%programfiles%\windows sidebar\shared gadgets”.

a. On your USB volume (let’s assume it is on E: for these instructions), create a folder called sblocal

b. Copy the entire folder tree from “%userprofile%\appdata\local\microsoft\windows sidebar” to e:\sblocal.

c. You should now have settings.ini file under e:\sblocal, and all your user gadgets are under e:\sblocal\gadgets.

d. If you want to roam your admin-installed shared gadgets too, copy the entire folder tree from “%programfiles%\windows sidebar\shared gadgets” to e:\sblocal\gadgets

Step 2: Edit settings.ini to make it drive-letter independent

Sidebar supports environment variable expansion when figuring out where gadget files live. We can replace the drive-letter-based paths in our local settings.ini file to redirect Sidebar to look where we want for a given gadget.

a. Open settings.ini in your favorite text editor. <shameless plug>Note that the Find/Replace All functionality in Notepad on Vista is hundreds of times faster than it was in XP so Notepad is a good choice for this. </shameless plug>

b. Each section in the settings.ini file will have an entry called “PrivateSetting_GadgetName” whose value is set to the folder where the gadget files are found. EG, my calculator.gadget entry looks like this:

PrivateSetting_GadgetName="C:%5CUsers%5Cdavidshi%5CAppData%5CLocal%5CMicrosoft%5CWindows%20Sidebar%5CGadgets%5Ccalculator%5B1%5D.gadget"

c. I need to change every occurrence of my user profile-based path to use an environment variable called GADGETS_USER. GADGETS_USER is the variable that sidebar uses as the default location for finding user-installed gadgets to show in the gallery, so it’s a good variable to use here for consistency.

d. To do this, I will replace every occurrence of “C:%5CUsers%5Cdavidshi%5CAppData%5CLocal%5CMicrosoft%5CWindows%20Sidebar%5CGadgets%5C” with “%GADGET_USER%”, so my new entry for calculator will look like this:

PrivateSetting_GadgetName="%GADGETS_USER%\calculator%5B1%5D.gadget"

e. Similarly, for any system-provided gadget I want to use, I need to replace the string “C:%5CProgram%20Files” with “%PROGRAMFILES%”

f. Finally, for any of the Shared Gadgets I want to use, I need to replace the string “C:%5CProgram%20Files%5CWindows%20Sidebar%5CShared%20Gadgets” with “%GADGETS_USER%” so they will be mapped to the copies on my usb key

Step 3: Create a batch file for running sidebar with the right settings and gadgets

Now we can take advantage of Sidebar’s use of some environment variables to redirect it to use our local copies. GADGETS_SETTINGS tells sidebar where to find settings.ini, and GADGETS_USER tells sidebar where to look for gadgets to display in the gallery.

a. Under e:\sblocal, create a new text file called sb.cmd

b. Add these lines to the file and save it:

pushd %~dp0

set GADGETS_SETTINGS=%~dp0

set GADGETS_USER=%~dp0\gadgets

start sidebar

popd

Now you can plug your USB key into any Vista computer, exit the default Sidebar process that runs on logon, and run the sblocal\sb.cmd script to launch sidebar with your custom gadgets and settings. Note that if you add any new gadget instances to sidebar while roaming, you may have to repeat step 2.

Enjoy!

Localized Date Strings

sbblog@microsoft.com — Sun, 01 Oct 2006 20:29:04 GMT

I just saw this interesting exchange on an internal discussion list, and thought I'd pass it on:

From: A Microsoft Guy
Subject: Formatting date/time strings

Is there a good way to format a date/time string using the current system local? The javascript function toLocaleString() only outputs the long date + time format. I’m looking for a way to do short date, short time, and other formats. Any tips/suggestions, other than just providing a format string that gets localized for a particular language (not the best solution, but better than nothing).

From: A Sidebar Guy
Subject: RE: Formatting date/time strings

Shawn Steele graciously provided us with some information on this and added it to his blog here:

http://blogs.msdn.com/shawnste/archive/2006/09/05/741871.aspx

Powering Your Gadgets With ActiveX

sbblog@microsoft.com — Thu, 28 Sep 2006 21:19:00 GMT

A while ago, I wrote a tutorial explaining how to create an ActiveX control and use it inside a sidebar gadget. If you are finding yourself limited by the capabilities of DHTML and script in your gadget development, you will find this a useful way to add additional power and capabilities to your gadget. (At the cost of some additional deployment complexity.)

I've attached a Word document with the whole tutorial; or if you prefer to view it online, you can check out the original posts on my personal blog:

Powering Your Gadgets With ActiveX (part 1)

Powering Your Gadgets With ActiveX (part 2)

Powering Your Gadgets With ActiveX (part 3)

Persistent Settings Update

sbblog@microsoft.com — Tue, 26 Sep 2006 04:53:11 GMT

Soon after I posted my persistent settings library, I received my first bug on it. I'll discuss the bug a bit, but first things first - the bug is fixed, and the links updated; if you previously downloaded the library, please go ahead and get the updated version.

Details:

The symptom of the bug was that the following two consecutive calls:

getPersistentSetting( "setting", firstCallback );
getPersistentSetting( "setting", secondCallback );

Would result in two calls on the 'secondCallback' function. The failure itself made it clear to me where the error was; and the location of the error suggested the fix. I'm afraid I don't know enough about the intricacies of the javascript language to know exactly why it failed in the first place, though; perhaps one of my more knowledgable readers will chime in.

Here is the failing code:

window.setTimeout(function ()
{
    try
    {
        workItem.callback(returnValue);
    }
    catch (e)
    {
        persistentSettingLog("exception from callback: " + e.name + ": " + e.message);
    }
}, 0);

And here is the fixed version:

persistentSettingScheduleCallback(workItem.callback, returnValue);
function persistentSettingScheduleCallback(callback, returnValue)
{
    window.setTimeout(function ()
    {
        try
        {
            callback(returnValue);
        }
        catch (e)
        {
            persistentSettingLog("exception from callback: " + e.name + ": " + e.message);
        }
    }, 0);
}

Persistent Gadget Settings

sbblog@microsoft.com — Fri, 22 Sep 2006 07:14:07 GMT

Here is a question that seems to pop up with some regularity on the sidebar newsgroup: "Why doesn't the weather gadget remember where I live, if I close it and then add it again to my sidebar?"

The answer is that every time you add the weather gadget to the sidebar, you are creating a new 'instance' of the gadget; and every instance has its own associated location. So the newly-added weather gadget has settings that are completely distinct from the settings on the one you closed. This makes sense when you start to think about having three or five weather gadgets running at the same time - they should each be able to show the weather at a different location.

Having said that, you may choose to make a different design choice in your gadgets. Unfortunately, the sidebar does not offer a built-in mechanism for sharing settings between gadget instances. When asked how to do this by other gadget developers, my first response was: "you can use a shared file to share settings between gadget instances."

To make life easier for everyone, I decided to write a javascript library that encapsulated that work, and exposed a simple API for reading and writing shared settings. In the process of writing the library, I discovered that just saying "use a shared file" vastly oversimplifies the effort involved. *grin*

I've uploaded the results to the 'Sandbox' section of the Channel 9 site:

Persistent Settings ZIP Archive

The ZIP archive contains a JS file that implements the APIs, and a README.TXT file describing the APIs. You can include the file in your gadget HTML as follows:

I'm including the contents of the README.TXT file below, for ease of reference:

PersistentSettings.js - A Persistent Setting API For Sidebar Gadgets

These APIs allow multiple instances of the same gadget type to share a set of common settings. It will also maintain those settings even when all instances of the gadget are shut down. It will not maintain the settings if the gadget is uninstalled from the gadget gallery window, and then reinstalled.

There are two functions:

setPersistentSetting( name, value [, callback ] )

getPersistentSetting( name, callback )

If you have any questions, suggestions or bugs related to these APIs,please contact Bruce.Williams@microsoft.com. I hope you find this useful!

-Bruce

RC1 Changes to the Sidebar APIs

sbblog@microsoft.com — Fri, 08 Sep 2006 23:34:00 GMT

In the RC1 release of Windows Vista, the Sidebar received a number of changes in the APIs that make up our object model. These APIs make building rich gadgets that interact with other Windows components, and the Sidebar itself, easy and familiar to HTML developers.

Some gadgets written for the Beta 2 release of Windows Vista may fail to function correctly on this newer build, but most gadgets that we have seen are not affected.

The changes we made can be summarized as follows:

Small additions for Gadget user experience
Better integration with Windows components
Simplification and removal of several APIs

The following guide will help you as you examine the documentation for the Windows Vista Sidebar in RC1. For more information, please visit MSDN.

Gadget User Experience

System.Gadget.Settings.readString, writeString

We added these two methods in order to give developers more control over the way settings are stored. For instance, our note gadget uses these methods because a user that types in a long string of numbers, say, “2065551212”, probably doesn’t want to see “2.0 E9” returned because our type system believed it to be a long integer.

System.Gadget.document

To expose better communication between a gadget and its flyout we now expose the HTML document objects for both to the other. Two way communication was difficult prior to this change.

System.Gadget.visible, visibilityChanged

This property and event allow a gadget to suspend operations when a gadget goes off the screen. This assists gadgets in consuming as few system resources as possible.

Sidebar Graphics Library

Background element/object
Image object
Text object

The new graphics library, exposed in HTML markup and to script, allows greater flexibility in designing gadgets with alpha transparency, manipulating images and placing text and images over transparent regions of the gadget.

Windows Component APIs

System.Contacts
A set of APIs allows a gadget to access the information from the Windows Contact data store.

System.Machine.CPUs
An improved set of APIs allows a gadget to access information and utilization data about the different CPUs on the computer.

System.Machine.PowerStatus
An improved set of APIs allows a gadget to detect information about the power supply, and to alter the behavior to use fewer resources if the machine is operating from battery power. Several APIs were removed or modified as part of this change.

System.MessageStore
A new set of APIs allows a gadget to inspect mail and other messages present in Windows Mail.

System.Network.Wireless
A simplified set of APIs allows a gadget to detect information about the wireless connection state. Several more generic Networking APIs were removed as part of this change.

System.Time
A new set of APIs allows a gadget to display information formatted for the current, or other, time zones.

Removals and Simplifications

We made a number of changes to simplify the APIs and make the information more reliable. The following removed APIs typically are exposed in other places, such as WMI (Windows Management Instrumentation) or through the Shell and FileSystemObjects for scripting

System.Net.NetworkInterface
System.RecycleBin.percentFull
System.Sound

- Brian Teutsch