Microsoft to kill off VBScript in Windows to block malware delivery
Open link in next tab
https://www.bleepingcomputer.com/news/security/microsoft-to-kill-off-vbscript-in-windows-to-block-malware-delivery/
https://www.bleepingcomputer.com/news/security/microsoft-to-kill-off-vbscript-in-windows-to-block-malware-delivery/
Man I hate VBA as much as the next guy, but when the IT department has your network so locked down you cant install anything. Having that hidden tab in Excel to write a script to automate some mundane task was really useful. I like python, but there's no fuckin way my ex employer would just allow me to run random python code like they did for VBA. It was a gov job btw.
Python is soon to be integrated into excel, I might not be a python fan but if it's gonna replace vba I'm all for it.
Afaik the python is ran on Microsoft servers, so not exactly a perfect solution. I doubt it will run offline at all
Wouldn't it face the exact same security issues as VBA, with drive-by installs of obfuscated malware and executions of arbitrary code?
You don't understand. "Security" is always the goto reason for either changing or leaving stuff as is, if companies don't want to state the real reason.
People are used to ccept "Security" as a reason for almost anything.
I remember once where a MS guy (someone higher up, don't remeber who, is many years ago...) was asked why the Windows filesystems are case-insensitive and stated the reason was security, so that one file cannot be named the same with just different upper/lowercasing letters. Classic deflection.
The article is not about VBA, it's about VBS. The languages are similar but not the same (why exactly MS did it this way I'll never know).
VBA is for embedded macros in MS Office documents.
VBS is a standalone language you write into .vbs files that get executed by wscript.exe. It's a default windows feature that has been around a long time (IIRC the ILOVEYOU worm used it).
It is their own Adobe Flash and it’s good that it is faded out. Too obscure in modern times, too many security flaws. Only warm nostalgic memories will remain in 10 years.
While true it was their actual flash, based on install basis and history, silverlight was a blimp on MS history. While flash died slowly off after 2008 as html5 gained ground and plugins fell out of favor (anyone remember java applets?), MS decided to launch their own Plugin into a world that already turned away from this technologies. Classic MS.
The comparison that VBS is like MS JS is a bit wonky, as JS is breathing and alive, while VBS is not. You also never encounter VBS on a website.
I hope they kill off VBA too. I still see some teams in banks implementing Monte Carlo simulators or PDE solvers in straight VBA 🤢
I have seen critical enterprise applications run in VBA in excel. Removing VBA would cause global economic ruin. I'm pretty sure that's the unspoken backstory for the Fallout series.
Another Sys Admin confirming that yes, the finance department runs nearly entirely on VBA. They would be lost without it.
Another confirmation here. At my previous job, I was they guy who built Access databases and wrote VBA code. While not ideal, it was a very small business (less than 10 employees) and it was fit for purpose.
When I got a new job at a company with almost 3,000 employees, I was like, "Finally, I'll be working somewhere that has proper IT resources." Ha! I soon find out that my department runs critical business infrastructure with Excel macros. And we have a proper IT department.
As everyone has already said, if IT resources are in short supply (or the wait is too long, or building projects with IT support is a PITA), then people will build systems with the tools they have at hand. And that's often MS Office.
Also remember, strictly speaking, IT is not software development. IT is networking and hardware management.
Software development (and scoff all you want, but VBS/VBA are programming languages/frameworks used to develop software applications) is its own separate beast.
They MAY report to the CIO. They could also report to the COO. Fuck, software development/process automation/business intelligence can have a director reporting directly to the CEO.
In general, software development and information technology are not the same and don't reside in the same chain of command.
Strictly speaking, information technology encompasses software dev as a subfield. Practically, a large software development at a company has very different needs and strategic goals than what people usually understand as the "IT guys" so what you mentioned. So they are set up accordingly in an organisation.
With some of my smaller clients, the CIO is the same as the CTO and the same as the IT Director. There, IT is developers, too.
IT isn't developers. What is really needed is a developer on your team, or somebody who at least knows how to lead the effort. I've been that guy.
We do have developers on our team. They write Excel macros :). I work in data integration, so it isn't as simple as building a more robust tool. We still need infrastructure support or our tool doesn't do anything.
Please at least tell me that the Macros are just a front end for ODBC connections to actual SQL servers for ETL functions, and it ALL isn't stored only in excel...?
It's not that bad, the macros are just front end apps. Our data is housed in a real, enterprise class database.
My job is literally to keep a NASDAQ company afloat on process automation written mostly in VBA to make up for the sweeping layoffs that were made to keep the CEOs bonuses fat...
WTF, seriously? VBA feels more like a scripting addon (which I suppose it is), not something to build wholesale CRITICAL programs with.
They didn't start out building an enterprise critical application, they normally started as some little script someone built to make their work faster. Then they shared it with the team, built more features, and 20 years later hundreds of staff are using it and if it dissappeared they would be screwed.
Plus the data in them is often the only record of critical data (in their defense, the spreadsheets are typically stored somewhere where the backup process will back them up).
they normally started as some little script someone built to make their work faster.
It's me, I'm that guy lmfao, although by the time I left it was considerably more complex. I have "real" languages under my belt, but it was a banking environment and VBA was all I had (Which even that kinda surprised me lol).
I was hooked into the windows API and doing all sorts of stuff and yea before leaving I did distribute stand alone parts of it (The full system was a beast, 90% of my job was automated towards the end lololol)
Honestly, VBA is more powerful than people give it credit for, just a PITA to implement some things
At my old job, we had a VBA script that would:
Thirty page custom reports per client within 2 minutes (when nothing broke). It allows you to interact and automate across the Microsoft Suite. That is one of the reasons why it is indispensable to many companies
This is definitely giving me flashbacks during my time in the corporate world. There was one report that was replete with copy and pasting, the poor lady who used to do it apparently had to pull all-nighters doing it. I rebuilt everything in Access using some SQL and the new process only took 15 minutes to run.
The things done in excel might not be critical per-se, but macros are used and abused a lot and many companies can be affected by their dependence on workflows refined over the years.
Haha, don't I know it. I've had to work with some of them in a past life. Messy and also very scary at how they underpin million dollar decisions.
This is true for software in general.
The same description can be given to workshops (and you know they already exist) that do the same stuff with ChatGPT.
It's a scripting language.
A solid, verbose, diverse scripting language that gives you impressive control over Windows environments.
If some people are delivering malware or phishing, that sucks, but it doesn't negate the languages merit.
It would be the same as ceasing production of spray paint because of taggers.
The ends don't justify the means.
They have an alternative called Powershell that can do what VBS does and more. Its a modern and actively developed scripting language that Microsoft undoubtedly expect you to port your code into, that is if you cant use a cloud product first wink wink
It will be a shit show of course, at least for those orgs that dont block this depreciation outright via whatever method comes out. Still, there is putty to patch the holes.
I suppose Microsoft Access has better options now you can define the steps in macros, but I think it's still needed for many of the more fiddly bits.
Yup, I was the guy who wrote vba script to calculate performance of network mobile and export chart to ppt files.
Many critcal engineering and financial calculations rely on vba scripts
I have seen critical enterprise applications run in VBA in excel.
I wrote one of them. It replaced periodically writing down application outputs on paper and sounding the alarm if something went pear-shaped. It wasn't my job to develop software but I didn't want hand cramps to be my job, either. I had vague ideas about how to do what I wanted to do with Excel so I poked at it and googled until it worked. More than a decade later, I'm no longer there but that freakin spreadsheet is still running 24/7, being proudly showed off during tours of the facility.
I will cackle if MS ever pulls the plug on VBA.
Your story is pretty typical in my experience. No one hires a dev team to build a VBA tool (except the occasional MS Access tool). It's normally someone doing the work who works out how to do a basic macro to make it quicker, and it grows from there.
Indeed. In my case, I fought through managerial malaise and turned the entire process on its ear. But even after the approach proved its worth, they refused to put a dev resource on it. It became my problem 24/7.
Remember kids, being good at something outside of your job description means it's now your job. If the boss refuses to compensate you for it, slap it on your resume and find someone who will.
And then MS will issue a limited extension.
An business still won't be ready.
Modern auth on email is still causing problems for a lot of places.
I've worked for a major international company and I was for a while the only maintainer of a shitty request form in an excel file, sent worldwide to hundreds of people. As they wanted more and more specific functions the stuff grew to thousands of unholy VBA code lines and a huge hidden sheet of data.
That thing even had a fully custom language switch function for all dozens of field labels and their possible values.
I kinda hope they're still using it (that wouldn't surprise me) and that their whole workflow will crash and burn when Microsoft finally kills VBA.
Enterprise will cause a boom in hiring VBA devs to migrate legacy apps to other programming languages, then hear Microsoft will extend support for a few more years, then fire all those VBA devs again. If Microsoft had some wits, they'd create easy tools to migrate VBA to C#.
otherwise we end up with another version of COBOL.
We're already there, I don't see VBA being phased out of accounting or finance for at least a decade and I'm not even sure then.
Or how about this... we use what works and stop throwing the world into chaos every 4 years so Microsoft can sell their next 50k/year enterprise application.
I'm migrating some VBAs to python/pandas and reducing some process times from half an hour to 3 minutes.
Yup that's normal because VBA is single-threaded, doesn't take advantage of vector instructions and even its interpreter is slow. So when someone writes numerical code in VBA working in single precision, and assuming they have an 8 core CPU with AVX2, they're using only 1/64-th of their CPU's processing power. On the other hand with Python, while it's still interpreted, the interpreter is much faster on its own, and you have modules like numpy that use precompiled routines that take advantage of vector instructions (and possibly multiple cores).
Yes. Python is a LOT more powerful. Requires a LOT technical knowledge to operate.
Are you making north of 150k to make your strife worth it?
Or are you raising the technical bar while also lowering the compensation bar?
Myself, I make 60k and my VBA gets the job done. Zero incentive to get into the minutia you just explained. My shit works. And I'm not set on fucking up the bell curve for everyone.
bruv Python is so simple you barely need to know English to use it. Haven't used VBA but I'll just blindly guess it's more difficult because honestly I have not seen a language that is easier to pick up than Python.
I learned some VB.net in college and it probably depends on what you are trying to do with it, but it's simpler than Python, I would say. It is an event driven language, and you handle everything at a very high level. It was the first language taught in my CS studies in the mid to late 2000s for that reason. I remember enjoying working with it, the performance just sucks and there are just better languages for most of the things it does, like C#.
That being said, Python is very nice and intuitive to learn and work with as well. It's just a much deeper rabbithole than VB.
Well, if VBA disappears, Python is what I'll need to learn.
If I don't need to learn a new language tho, I'd prefer that.
Honestly, 95% of my vba is just nested do until loops.
The remaining 5% is ODBC connections and BCP shell commands.
If I don’t need to learn a new language tho, I’d prefer that.
Not trying to hate on you but this sort of take is really bad. I understand if you dislike programming and are forced to do it for your job but otherwise learning a new thing occasionally is a good thing. In case programming is a key part of your job it's like a carpenter saying "I prefer hand sawing everything but if they discontinue them I'll be forced to use a table saw". But again, if you are forced to program at work despite not liking it that changes things.
I challenge your read.
I love programming. I'd love to expand my knowledge.
I am 5 years deep on "you hired an analyst and then demanded a developer/architect/salesman, and the payrate didn't follow. I am still making creative ramen dishes from my rental when I should have a house, and I should get a yearly vacation."
My CEO gets 30% gains yearly... and he is the only person at my company that enjoys that.
Basically I am striking. Like the rest of the world.
Cool you are making a fair wage and aren't scabbing on your peers. Because a love for leaving behind what works to make something in a different language that also works fills your soul with joy?
I don't know what your seniority is, but it's cool if it works for you. However, to remain employable in case you someday get laid off (of course not wishing you that), it would be beneficial to have experience in a more modern language. To remain fixated on one single language/tech just because it works for you for now is going to cause you lots of pain in case you need to hit the job market again someday and it would be too late to learn new languages because, depending on your seniority again, recruiters won't want someone who just began learning the language.
Excel will kinda support it soon, unfortunately it will only be available to run in the cloud and not locally.
The first hack I ever did was to remove the security add-on my middle school put on our macs so we couldn’t play games. The attack vector was the file APIs in VBScript executed via a word doc. Fun times!
I don’t think there were any computers designed for K-12 schools at the time. They were PowerMacs, and later, iMacs. They weren’t even set up for multi-user; they were just unlocked all the time.
Now would be a great time for everybody to dust off their VBScript skills and start offering contracting hours to the tens of thousands of companies that rely heavily on it for daily operations. Make yourself a mint porting scripts from 1996 into a modern language, or even PowerShell if you must.