Is security to blame for Windows 8 gadget removal?

Earlier this month, it was reported that current but unreleased builds of Windows 8 had taken away support for desktop gadgets, We emailed Microsoft for comment on this report but the company declined to do so.

Now Microsoft has issued a security warning this week that offers a way to disable desktop gadgets in Windows 7 and Windows Vista via a "Fixit" downloadable program. The warning states:

Disabling the Windows Sidebar and Gadgets can help protect customers from vulnerabilities that involve the execution of arbitrary code by the Windows Sidebar when running insecure Gadgets. In addition, Gadgets installed from untrusted sources can harm your computer and can access your computer's files, show you objectionable content, or change their behavior at any time.

Computerworld.com also reports that two software security researchers are scheduled to offer a presentation at the Black Hat conference later this month that could show a number of issues with gadgets in Windows operating systems. The description of the presentation says, "We will be talking about our research into creating malicious gadgets, misappropriating legitimate gadgets and the sorts of flaws we have found in published gadgets."

It definitely sounds like Microsoft is backing away from its current desktop gadget support and may eliminate it when Windows 8 is launched later this year.

Source: Computerworld.com

Report a problem with article
Previous Story

Borderlands 2 trailer features lots of guns, "wimowehs"

Next Story

Chinese website starts accepting iPhone 5 pre-orders

49 Comments

Commenting is disabled on this article.

Hello,

I was under the impression that Windows Gadgets posed a security vulnerability because they ran under the context of the user without any kind of isolation or sandboxing, and thought this was demonstrated many years ago at DEF-CON: DEF-CON 16 in 2008 on Google Gadgets (https://www.defcon.org/html/li...archives/dc-16-archive.html) and DEF-CON 15 in 2007 on "The Inherent Insecurity of Widgets and Gadgets" (https://www.defcon.org/html/li...archives/dc-15-archive.html) come to mind. There may be others, but those are the ones I attended.

While it is somewhat opaque, I do suspect the Metro model of live tiles may offer superior security, and thus it makes sense for Microsoft to deprecate Windows Gadgets, even if the threat from them was mostly theoretical given the low market penetration of this feature.

Regards,

Aryeh Goretsky

Windows gadgets are not the only ones with possible security issues ...

I've seen warnings on Deviantart about downloading certain widgets, skins or whatever you want to call them for Rainmeter so it'd be good to know exactly what the problems are with the Windows gadgets to see if the same security issues which appear to have killed windows gadgets might end up affecting other gadget platforms like Xwidget, rainmeter etc ...

I used to use a GMail gadget I was asked to test by its dev in like 2006 , but the Metro mail app basically does that now. I used to use a few others - the CPU/Mem one was always good for noticing when something was chewing your system - but I weened myself down to just the one in Windows 7. I was sort of confused when I first ran Win 8 and saw that gadgets were still available to be honest, I don't miss them.

I've only been using orbmu2k's (NVIDIA Inspector coder) gadgets: IntelCoreSeries, GPU Observer and Network Traffic. Also the Microsoft Weather gadget. I guess I've no reason to give up on gadgets then. Or do I?

The gadgets were not a joke. Yes many of them are bad, but there are some that are very good. Such as the multi-cpu core usage monitor gadget.

The only thing that was a joke was how few of them that were made for it. And if this is a security issue, then so will be the Metro Apps...

The Metro apps will never make up for missing gadgets, due to the fact the Metro apps are stuck on their own stupid screen. Whoever designed the interface between the Metro interface and the desktop interface, is an idiot. Its a HUGE pain to use the two together.

Security is one of the main reasons we disabled them at work, next to the platform not being supported by Microsoft anymore or the author not supporting it anymore either.

In our company open source software has to go through a legal review to confirm it is "free" for a company to use and those resources were not going to be spent on reviewing gadgets. Neither were we going to trust that everyone would be running safe gadgets that did not open a security risk or put the stability of the system at risk.

At home I use a number of them, but that's my call and my risk that I accept.

But tiles are "at a glance", are they?

This is part of why Windows 8 is likely to suffer a backlash in the tech world. It's taking functionality away in from the legacy platform in the name of "newness". It smacks of desperation and a lack of innovation.

I can't think of another product line (from any industry) where an iterative update has all new bells and the whistles removed...

Mugwump00 said,
But tiles are "at a glance", are they?

This is part of why Windows 8 is likely to suffer a backlash in the tech world. It's taking functionality away in from the legacy platform in the name of "newness". It smacks of desperation and a lack of innovation.

I can't think of another product line (from any industry) where an iterative update has all new bells and the whistles removed...


what functionality? the stuff noone uses?
desktop gadgets will be replaced by the windows start screen. dont argument that u barely use the windows start screen, noone is just gazing at their desktop wallpaper either. both are rarely seen and both actually do the same.
or you talk about the missing start menu? which is still there, just split up into multiple parts. i.e. the 'super taskbar' and the start screen.
What other core functionality is missing? You can upgrade from Windows 1.0 all the way to Windows 8 without doing a full install, just an upgrade. And even on Win7 (32bit in all fairness or WinXP mode) you can run applications created for windows 1-3 without a problem.

Whats there more thats missing? Aero? still there, pretty much everything Win7 has, Win8 has already.

Ah well, i'd love to get some actual examples of what Win7 has and Win8 doesnt. take your time, use google if you need to.

Shadowzz said,

what functionality? the stuff noone uses?

If no-one used Gadgets, an extensive gallery and developer community would never have existed. And this conversation wouldn't exist. And I wouldn't care.

Shadowzz said,

desktop gadgets will be replaced by the windows start screen. dont argument that u barely use the windows start screen, noone is just gazing at their desktop wallpaper either. both are rarely seen and both actually do the same.


My Gadgets are visible always, and are of the type that mandate them being visible for at-a-glance information. What I do with the StartScreen is not for you to predict. So far I've found it interesting on a laptop platform, but the current low number of tile-supporting apps make it hard to see the long-term benefit. I doubt many of the gadgets will find their equivalent through tiles and the density of information will never be there.


Shadowzz said,
or you talk about the missing start menu? which is still there, just split up into multiple parts. i.e. the 'super taskbar' and the start screen.

And broken - jump lists, MRU-apps, cohesive all-media search results. Intrusive and incomplete is what it is.


Shadowzz said,
What other core functionality is missing? You can upgrade from Windows 1.0 all the way to Windows 8 without doing a full install, just an upgrade. And even on Win7 (32bit in all fairness or WinXP mode) you can run applications created for windows 1-3 without a problem.

Sorry you are layering on an argument that I haven't made. Backwards compatibility remains impressive.

Shadowzz said,
Whats there more thats missing? Aero? still there, pretty much everything Win7 has, Win8 has already.

Removing the Start Menu, (no Aero just looks odd now) are what perplexes me. Windows has a massive presence in corporates, who want new products with enhanced performance and security, longer support life etc. But few are going to welcome an entirely new application platform to manage, missing core UI items (hot-corners ?!), full-screen apps and transitions (how does that work with VDI?) etc. Windows 8 represents a cult-of-mobility that seems to have dislodged MS's inherent need to provide enterprise tools. For now.


Shadowzz said,
Ah well, i'd love to get some actual examples of what Win7 has and Win8 doesnt. take your time, use google if you need to.

Can't be bothered to make up clever clever retort. ****.

I think that Microsoft is just trying to get people to stop using Desktop Gadgets as they go forward with Windows 8 - they've had several years to address "security issues" related to Gadgets and since they've discontinued hosting a Gadget gallery on their site it's easier to throw EVERYONE under a bus regarding these items. I haven't had issues with "renegade" gadgets and think that they're trying to scare people into turning them off...

I still use a number of meter gadgets on my desktop (most of them from AddGadget.com and BuildAGadget.com which I've used for years) but it's obvious that Microsoft is pushing there new Metro scheme instead. I've been a longtime user of Windows (every version since 1.0) and really like Windows 7 - I've been running Windows 8 on my laptop using VirtualBox and think it will be a MAJOR adjustment for most users. While I will probably "upgrade" to it as my regular OS, it won't be right away. I had Vista sitting on a shelf for over a year before I finally settled on it (but quickly installed the Windows 7 beta and then the full version after it came out) and waited several months to move to Windows XP from Windows 98 SE (which I moved back to after using Windows Me).

It's likely that Windows 8 will be like Me and Vista - products that were followed up with more stable (and useful) versions...

Yea. I never used it so I just shut it off. If you follow the directions in the advisory though they are a little wrong in regards to the group policy method (registry method is fine)

On step 2 it is labelled Desktop Gadgets not Windows Sidebar
On step 3 it is labelled as Turn off Desktop Gadgets rather than Turn off Windows Sidebar

I've reported the typos but also noted that the text in the document may be intentional and planned to be changed on the system in a later patch.

Good riddance. The only good gadget was notes. I don't really need my desktop covered with network and resource meters. Gadgets were a joke.

I guess if you've never used them then you are the authority on why they suck - Neowinian logic and all that...

Anyway, I make use of a select collection for FB, Twitter, system monitoring, Radio etc. I will really really miss them. Or not, if I never upgrade.

I suspect MS of deliberately deprecating Gadgets due to the conceptual overlap with Metro, but to be fair, irregardless of security, I've found too many gadget are horrific resource-hogs, especially the Page Fault rate they consume.

Am I missing something - is there a pool of Metro apps other than the Store, because even for a pre-release product, the selection of system tools etc. is cack.

Mugwump00 said,
I guess if you've never used them then you are the authority on why they suck - Neowinian logic and all that...

Anyway, I make use of a select collection for FB, Twitter, system monitoring, Radio etc. I will really really miss them. Or not, if I never upgrade.

I suspect MS of deliberately deprecating Gadgets due to the conceptual overlap with Metro, but to be fair, irregardless of security, I've found too many gadget are horrific resource-hogs, especially the Page Fault rate they consume.

Am I missing something - is there a pool of Metro apps other than the Store, because even for a pre-release product, the selection of system tools etc. is cack.

Well, right now only free apps are allowed on the store and developers like to get paid for their work so... most see no reason to release right now.

Gadgets basically died out when it was no longer the "cool" thing to do after Yahool bought out Konfabulator... then everyone had to have their own gadget system and no one cared anymore...

Windows gadgets were a kind of joke. I've used them, especially clock and calendar. But I've noticed that in Vista they used more than 200 Mb of my memory and also some CPU for nothing. So, I've stop use them. Now I use the HTC Home on my desktopt as a "gadget". It's teh best, pitty no longer developped.

eiffel_g said,
Windows gadgets were a kind of joke. I've used them, especially clock and calendar. But I've noticed that in Vista they used more than 200 Mb of my memory and also some CPU for nothing. So, I've stop use them. Now I use the HTC Home on my desktopt as a "gadget". It's teh best, pitty no longer developped.

You realize that Vista cached commonly used data in memory while XP did nothing with it right? Unused memory is useless.

dagamer34 said,

You realize that Vista cached commonly used data in memory while XP did nothing with it right? Unused memory is useless.

Don't confuse people, they are happy hating Vista for stuff they still don't understand.

thenetavenger said,

Don't confuse people, they are happy hating Vista for stuff they still don't understand.

Confused ? No. I;m afraid I know more about Windows Systems than any other who comments here. But complete removal of Vista Sidebar and gadgets, and one or two more tweaks, make it run similar with Windows 7 ( also without sidebar ). Sidebar takes to many resources from the system, and is useless. it was nice when it appears, but that was all.

eiffel_g said,

Confused ? No. I;m afraid I know more about Windows Systems than any other who comments here. But complete removal of Vista Sidebar and gadgets, and one or two more tweaks, make it run similar with Windows 7 ( also without sidebar ). Sidebar takes to many resources from the system, and is useless. it was nice when it appears, but that was all.


you do realise that every performance monitor takes resources? I tried others, also on linux, its always using a few % of my CPU. Similar to the gadgets in windows vista/7
and the fact its using ram, oh noes. If you know so much about windows, you know most RAM usage is just basically a cache that can be used for actual purpose usage just as fast as empty RAM? so it really doesnt matter how much RAM it shows its using, most of it can be freed up instantaniously

I liked having the CPU/GPU meters in the sidebar. I can part with them but I really need a metro alarm app to replace the one in my sidebar, one that let's me select my own music as an alarm tone.

Sadelwo said,
I liked having the CPU/GPU meters in the sidebar. I can part with them but I really need a metro alarm app to replace the one in my sidebar, one that let's me select my own music as an alarm tone.

Even if you aren't a developer, you are looking at maybe 1/2 hr of development time for a Metro App.

PS You can use the scheduler technology as well, and fire a 'song'.

Could have been security, but I think it's mostly lack of use. I thought widgets were cool when Konfabulator was around but it was only for Mac. I think then it was bought by Yahoo! and by then I had lost interest.

Also, live tiles can do what widgets/gadget did.

A340600 said,
Could have been security, but I think it's mostly lack of use. I thought widgets were cool when Konfabulator was around but it was only for Mac. I think then it was bought by Yahoo! and by then I had lost interest.

Also, live tiles can do what widgets/gadget did.

Konfabulator was for Windows, too. It still exists as Yahoo! Widgets.

GreyWolf said,

Konfabulator was for Windows, too. It still exists as Yahoo! Widgets.

Yeah? I remember being bummed out that I couldn't use Konfabulator 'cause it was only Mac, until it was bought by Yahoo! and renamed Yahoo! Widgets. I did try Yahoo! Widgets back when I was still on XP but never really got into them. Same thing with Google Desktop, I tried it but got over it quickly.

A340600 said,

Yeah? I remember being bummed out that I couldn't use Konfabulator 'cause it was only Mac, until it was bought by Yahoo! and renamed Yahoo! Widgets. I did try Yahoo! Widgets back when I was still on XP but never really got into them. Same thing with Google Desktop, I tried it but got over it quickly.

If ya want to timeline all this stuff, do a bit more homework.

Both products have 'parent' products, which come from Active Desktop in Win95 w/IE4.

And there is probably a really ancient product that predates that; however, Active Desktop was the first to have live content on the desktop that was not limited to localized Apps, since they could be portions of web sites that were always updated.

I imagine that the percentage of users that run gadgets is pretty low, which means that for most systems such functionality is just a security risk. If it really is insecure it should be disabled by default but with an option to easily enable it for those that so choose.

That said, I haven't heard of widespread abuse.

theyarecomingforyou said,
I imagine that the percentage of users that run gadgets is pretty low, which means that for most systems such functionality is just a security risk. If it really is insecure it should be disabled by default but with an option to easily enable it for those that so choose.

That said, I haven't heard of widespread abuse.

That's a good point, Gadgets could be bumped down to an optional windows component.

I remember widgets being a huge deal back in 2004-2006 on OS X, but after that both developers and people largely lost their interest. The same happened on Windows sometime after that. Except for the weather, calculator, unit converter and world clock I don't really use or care about Dashboard.

.Neo said,
I remember widgets being a huge deal back in 2004-2006 on OS X, but after that both developers and people largely lost their interest. The same happened on Windows sometime after that. Except for the weather, calculator, unit converter and world clock I don't really use or care about Dashboard.

Microsoft never really pushed Gadgets. Their own gallery had mostly crappy ones that noone in their right mind would have used. To some extend it's a shame that gadgets never took of, 'cause the idea itself was not bad [there seem to be some pretty handy ones available] - just (once again) poorly executed...

MFH said,

Microsoft never really pushed Gadgets. Their own gallery had mostly crappy ones that noone in their right mind would have used. To some extend it's a shame that gadgets never took of, 'cause the idea itself was not bad [there seem to be some pretty handy ones available] - just (once again) poorly executed...

Do you know if the tiles in the start screen can act like gadgets? I know clicking the tiles open up full screen apps, but could tiles have click-able content right on them without having to open them? Like currency converter or something.

Izlude said,

Do you know if the tiles in the start screen can act like gadgets? I know clicking the tiles open up full screen apps, but could tiles have click-able content right on them without having to open them? Like currency converter or something.

They show live content, not 'interactive' content.

Being critical that they would open to full screen is a silly argument if you get the UI concept, especially when a full App can take up less RAM and load to full screen faster than a gadget could respond without the full time CPU drain.

Izlude said,

Do you know if the tiles in the start screen can act like gadgets?

Except that they don't sit in the background on the desktop. The truth is that the new Start Screen would be MUCH more useful/effective for power/large screen/multi-monitor users as a semitransparent overlay on one screen's desktop background/wallpaper.

One can already do this with some of the better Rainmeter skins and those don't suffer from the problem that the "always on" realtime information aspect of Windows 8 Start Menu tiles are utterly useless as information providers unless you stay on the Start Screen all the time...

An example of this done right is http://omnimo.info/

MFH said,

Microsoft never really pushed Gadgets. Their own gallery had mostly crappy ones that noone in their right mind would have used. To some extend it's a shame that gadgets never took of, 'cause the idea itself was not bad [there seem to be some pretty handy ones available] - just (once again) poorly executed...

They were slopped together to replace Active Desktop and give it some 'structure'. They were to be fully XAML based in Windows 7, but with the turn in HTML5 progression, Microsoft was already spinning towards MVVM and merging framework technologies and it would have been wasted work, so they expanded functionality a bit with a bit more HTML and left it at that.

It wasn't promoted, but again 50% of the features in Windows 7 were not promoted, nor encouraged by users or developers.

The lack of understanding between NT development and upper layer software development and sales/management and then marketing has become increasingly insane as Windows added functionality. Do people realize they can use offline files in Pro or snapshot backups and previous versions (aka Time Machine but more features) - Nope.

.Neo said,
I remember widgets being a huge deal back in 2004-2006 on OS X, but after that both developers and people largely lost their interest. The same happened on Windows sometime after that. Except for the weather, calculator, unit converter and world clock I don't really use or care about Dashboard.

It happened a couple of times with Windows, with IE4 and Win98 with Active Desktop pulling content live from the web and the fanfare of HTML being capable of displaying 'folder' content that very few people used.

Active Desktop had some following with stock tickers and weather maps on the desktop, and all part of the feeds background web content sync with the live screen saver of sites and site content.

This was popular for a while, but the only thing that persisted was the background sync and update of web content that eventually died off as users moved away from dial up where having your favorite sites cached when you woke up was a good idea.

(However, the Web page sync technologies of IE3 and IE4 must have been popular at Apple, as it was one of their members that took the concept to create RSS after leaving Apple. However since it was during the Microsoft dump money into Apple timeframe, Microsoft didn't seem to care.)

thenetavenger said,
It happened a couple of times with Windows, with IE4 and Win98 with Active Desktop pulling content live from the web and the fanfare of HTML being capable of displaying 'folder' content that very few people used.

The original Mac OS had widgets too (or widget-like), but then they disappeared for a while.

MFH said,

Microsoft never really pushed Gadgets. Their own gallery had mostly crappy ones that noone in their right mind would have used. To some extend it's a shame that gadgets never took of, 'cause the idea itself was not bad [there seem to be some pretty handy ones available] - just (once again) poorly executed...
That is true, but their gadget system is still really pretty good (and it's native), and I found some on deviantart that I really like and haven't been able to live without for a year. Now the ****ing ****ers are going to make me go back to something that is more of a pain in the ass like rainmeter.

thenetavenger said,

It happened a couple of times with Windows, with IE4 and Win98 with Active Desktop pulling content live from the web and the fanfare of HTML being capable of displaying 'folder' content that very few people used.

Active Desktop had some following with stock tickers and weather maps on the desktop, and all part of the feeds background web content sync with the live screen saver of sites and site content.

This was popular for a while, but the only thing that persisted was the background sync and update of web content that eventually died off as users moved away from dial up where having your favorite sites cached when you woke up was a good idea.

(However, the Web page sync technologies of IE3 and IE4 must have been popular at Apple, as it was one of their members that took the concept to create RSS after leaving Apple. However since it was during the Microsoft dump money into Apple timeframe, Microsoft didn't seem to care.)


I sure do miss active desktop gadgets arent close enough, i always had a few sites pinned to the background, nicely interactive aswell.
Didnt they remove it because of instability issues next to the security risks it posed?