Re: I'm sticking with WinHelp (was Re: WinHelp on Vista - a

["Mike Starr" <mike -at- writestarr -dot- com>]

----- Original Message ----- 
Message: 22
Date: Fri, 22 Sep 2006 10:01:03 -0700
From: "Mike Hamilton" <mhamilton -at- madcapsoftware -dot- com>
Subject: RE: I'm sticking with WinHelp (was Re: WinHelp on Vista - a
usefullink)

*** Post by a Tool Vendor ***

<snip>
Just a point of order here, WinHelp on Vista is the mythical format as 
nobody has seen the new WinHelp engine that is supposed to be coming for 
this new OS. At the same time, demos of Vista Help have been up and running 
for the world to see for well over a year (and longer for those under NDA 
with Microsoft).

Mike Starr replies...
I'm considering the Vista Help a mythical format because the average 
technical writer doesn't have the ability to develop documentation in that 
format. From my perspective, that makes it vaporware.



The other problem that I see is that the WinHelp format, with its 
unrestricted macro support is a HUGE security risk and with Microsoft's 
focus on security for the Vista OS I wouldn't expect the new WinHelp engine 
to support everything that the older ones have. This is purely my 
speculation, but it may be severly crippled in capabilities to plug some 
security holes.

I am not the only one to see the problems with security in WinHelp, here is 
a post made by one of the Microsoft Help MVPs on one of the Microsoft blogs 
on the subject:
"As has been pointed out, WinHelp does pose a substantial security risk. 
Virtually anything can be run using its extensive macro capabilities."
And at the Writer's UA show this year there was a presentation that focused 
exclusivey on security issues as they apply to online help and the 
presentation was not kind to WinHelp.

Mike Starr responds:

And CHM help is better how?? Meanwhile, I'm not aware of any "in the wild" 
WinHelp exploits. Yes, I'm sure it's theoretically insecure but the script 
kiddies have had ample opportunities to attempt to exploit those 
vulnerabilities. If I'm distributing the help file as part of an application 
install, I already have more than enough capability of exploiting your 
system that I don't need to do it via WinHelp. In order for a script kiddie 
to exploit a system via WinHelp, they'd probably first have to get an 
unsuspecting innocent to download a .hlp file, then get them to access the 
proper topic in it.


<snip>
Now, for full disclosure I am in the business of selling help authoring 
tools so take my words with a grain of salt. Having read my points above you 
may still have a valid reasoning/case for using WinHelp with your 
environment and customers, however I would highly recomend having a strong 
back up plan just in case. My crystal ball isn't always perfect but I can 
see the day that the first virus is found that impacts the Vista OS through 
a security loophole caused by the WinHelp viewer and the very next day there 
could be a Windows Update that removes it from everyone's OS once and for 
all.

Mike Starr responds:

And to further disclose, MadCap Flare doesn't support WinHelp. If Microsoft 
allowed WinHelp in Vista, MadCap would have to do a hurry-up implementation 
of WinHelp in order to remain viable in the marketplace.


Mike Hamilton
V.P. Product Management
MadCap Software
--
Mike Starr                            WriteStarr Information Services
Technical Writer   -   Online Help Developer   -    Website developer
Graphic Designer    -    Desktop Publisher   -       MS Office Expert
Phone: (262) 694-1028 - Tollfree: (877) 892-1028 - Fax:(262) 697-6334
Email: mike -at- writestarr -dot- com      -      Web: http://www.writestarr.com 

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

WebWorks ePublisher Pro for Word features support for every major Help 
format plus PDF, HTML and more. Flexible, precise, and efficient content 
delivery. Try it today! http://www.webworks.com/techwr-l

Easily create HTML or Microsoft Word content and convert to any popular Help file format or printed documentation. Learn more at http://www.DocToHelp.com/TechwrlList

---
You are currently subscribed to TECHWR-L as archive -at- infoinfocus -dot- com -dot- 

To unsubscribe send a blank email to 
techwr-l-unsubscribe -at- lists -dot- techwr-l -dot- com
or visit http://lists.techwr-l.com/mailman/options/techwr-l/archive%40infoinfocus.com


To subscribe, send a blank email to techwr-l-join -at- lists -dot- techwr-l -dot- com

Send administrative questions to lisa -at- techwr-l -dot- com -dot-  Visit
http://www.techwr-l.com/techwhirl/ for more resources and info.