Wednesday, April 11, 2018

Big enough is big enough

Visual Studio has a macro capability, but you might never have used it. You might not even know that it exists.

You see, you cannot use it as Visual Studio comes "out of the box". The feature is disabled. You have to take action before you can use it.

First, there is a setting inside of Visual Studio to enable macros.

Second, there is a setting inside of Windows to allow Visual Studio macros. Only system administrators can enable it.

Yes, you read that right. There are two settings to enable macros in Visual Studio, and both must be enabled to run macros.

Why? I'm not sure, but my guess is that the Visual Studio setting was there all along, allowing macros if users wanted them. The second setting (inside Windows) was added later, as a security feature.

The second setting was needed because the macro language inside of Visual Studio is powerful. It can call Windows API functions, instantiate COM objects, and talk to .NET classes. All of this in addition to the expected "insert some text" and "move the insertion point" we expect of a text editor macro.

Visual Studio's macro language is the equivalent of an industrial-strength cleaning solvent: So powerful that it can be used only with great care. And one is always at risk of a malevolent macro, sent from a co-worker or stranger.

But macros don't have to be this way.

The Notepad++ program (the editor for Windows) is a text editor -- not an IDE -- and it has macro capabilities. Its macro capability is much simpler than that of Visual Studio: it records keystrokes and plays them back. It can do anything you, the user, can do in the program, and no more.

Which means, of course, that NotePad++'s macro capabilities are safe. They can do only the "normal" operations of a text editor.

And it also means that macros in Notepad++ are safe. It's not possible to create a malevolent macro -- or send or receive one. (I guess the most malicious macro could be a "select all, delete, save-file" macro. It would be a nuisance but little else.)

The lesson? Macros that are "powerful enough" are, well, powerful enough. Macros that are "powerful enough to do anything" are, um, powerful enough to do anything, including things that are dangerous.

Notepad++ has macros that are powerful enough to do meaningful work. Visual Studio has macros that can do all sorts of things, much more that Notepad++, and apparently so powerful that they must be locked away from the "normal" user.

So Notepad++, with its relatively small macro capabilities is usable, and Visual Studio, with its impressive and all-powerful capabilities (okay, that's a bit strong, but you get the idea) is *not* usable. Visual Studio's macros are too powerful for the average user, so you can't use them.

Something to think about when designing your next product.

No comments: