Windows Sidebar / Desktop Gadgets

~ the goodbye ~

windows sidebar was on every vista and windows 7 desktop i touched between 2007 and 2012. it was the docked panel on the right edge of the screen in vista, then a floating set of widgets you could pin anywhere on the desktop once windows 7 dropped the docked layout. the default install came with about a dozen small gadgets, mostly clock and weather utilities plus a cpu meter that everyone obsessed over. it lived as the small heads-up display nobody actively used but nobody removed either.

microsoft built sidebar as the successor to active desktop, which had been the late-90s attempt to put live html panels on the windows wallpaper. sidebar was supposed to be that idea done right: small html-and-javascript applets running in a sandboxed-ish runtime that microsoft itself controlled. windows live gallery hosted thousands of third-party gadgets, and the ecosystem of "windows 7 gadget pack" download sites stayed alive for years afterward.

the model died in 2012 because the sandbox was not really a sandbox. on july 10, 2012 microsoft issued security advisory 2719662 telling users to disable sidebar and desktop gadgets entirely, because the gadget runtime could host content that executed code with the user's full permissions. microsoft did not patch the runtime. it released a one-click fix-it that turned the whole feature off and treated that as the end of the conversation. windows live gallery had already been shuttered the previous october, and windows 8 shipped a few months later with no sidebar in the build at all.

~ the chronicle ~

~ how it landed ~

sidebar was one of the more visible pieces of vista's "wow" launch story, alongside aero glass and the new start menu. on a fresh install you got the docked panel with the clock and weather gadgets running on the right edge, plus a feed reader hooked into ie7's rss support. the vista marketing materials leaned hard on the picture-puzzle gadget because it was the only one that looked like a feature for normal people instead of for sysadmins. in turkish ttnet-era reviews of vista the sidebar took up a paragraph of its own, usually positive on the idea and negative on the ram footprint.

~ the decline ~

the security model was the problem. gadgets were html plus javascript, running inside a host process that had access to the local file system plus com automation, with no real boundary between the gadget and the user account it ran under. researchers mickey shkatov and toby kohlenberg presented the full attack class at black hat usa in 2012, showing how a malicious gadget could escalate to full code execution. microsoft's response was to disable the feature rather than fix the runtime, which told you everything about how much internal investment was still going into it.

~ what it became ~

windows 8 replaced sidebar with live tiles on the start screen. live tiles ran in a tighter sandbox and could not call out to local com objects, which solved the security model and broke most of what made gadgets useful in the first place. third-party clones like 8gadgetpack kept the original feature alive for users who reinstalled it on windows 10. by 2020 those clones were still being downloaded by people running new windows installs and missing the small cpu meter in the corner of the screen.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »