Slashdot Mirror
Microsoft Adds Support For JavaScript Functions in Excel (bleepingcomputer.com)
An anonymous reader shares a report: At the Build 2018 developer conference that's taking place these days in Seattle, USA, Microsoft announced support for custom JavaScript functions in Excel. What this means is that Excel users will be able to use JavaScript code to create a custom Excel formula that will appear in Excel's default formula database. Users will then be able to insert and call these formulas from within Excel spreadsheets, but have a JavaScript interpreter compute the spreadsheet data instead of Excel's native engine. "Office developers have been wanting to write JavaScript custom functions for many reasons," Microsoft says, "such as: (1) Calculate math operations, like whether a number is prime. (2) Bring information from the web, like a bank account balance. (3) Stream live data, like a stock price."
....
This could be good, if they handle errors well. If they use the same default "fail silently" practice as they do with VBA functions, then it will be just as dangerous as those are.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
The only thing better than VB in a spreadsheet is JavaScript. This is awesome.
One of the first “apps” for this will be yet another cryptocurrency miner that will be spread around an organization’s spreadsheets.
It's my understanding that VB macros do not require source code to be distributed if it has already been compiled into byte code.
Presumably, one can vet the source code themselves if they are wary of third party code.
Theoretically, at least, javascript has a potential of being safer than VB in this regard.
File under 'M' for 'Manic ranting'
Personally, I think this capability could be extremely useful and should be pursued.
But, my first thought was to type handling - both environments largely handle data typing automagically and I would like to see how incompatible types are recognized and handled. I would worry about JavaScript's tendency to ignore failures and carry on as best it can without notifying the user as being a significant concern. For this reason, I would consider Python to be a better choice.
I wish in the TFA, when they reference getting web information using JavaScript, they didn't jump to getting a "bank account balance". That should strike terror in just about everyone - I'd be a bit more amenable if they used an example like getting the temperature in Tampa. It's not like Microsoft or JavaScript have been shown to be paragons of protecting user information and security.
Mimetics Inc. Twitter
The issue is Microsoft, not the language. VBA macros still exist, it's the managed environment running them that becomes the issue without regard to the language.
Folks, I will have to say that this development is very welcome though what really saddens me is this: -
There's no Open Source Excel alternative that comes even close to what Excel can do.
To make matters worse, there's no [serious] effort to create anything capable.
Good God, of all languages, why JavaScript? JavaScript is a terrible programming language! And its floating point math is bonkers, have you ever tried doing 0.1 * 0.2 in JavaScript, the answer is 0.020000000000000004! Can you imagine how main spreadsheet errors this will cause?
And JavaScript doesn't even have type safety! If Microsoft were smart, they would use a compiled programming language, like C, that you'd have to compile using a command-line compiler with a GPG-Key that you could inspect to avoid government MITM attacks! Now the government can get your tax spreadsheet information!
And, JavaScript is terrible because a lot of popular JavaScript frameworks have their own package managers! Can you imagine developers BLINDLY TRUSTING whatever package and whatever dependencies it has? Every developer should be forced to only use the OS package manager to install JavaScript libraries!
And, JavaScript is terrible because hundreds of programmers release hundreds of new packages every day, and they grow old and stale and now the JavaScript package ecosystem is older and staler and more crowded than the iOS app store ecosystem!
And, JavaScript is terrible because anyone can just pick it up and start playing with it, and they can write a web server in 15 minutes without even knowing about tail recursion or Monte Carlo cyclomatic complexity reduction! Script kiddies will start taking our jobs, and they don't even have to know how to covert an AST optimization into a stack heap implementation!
I hope that Microsoft realizes the error of their ways, and instead implement something like LISP as the programming language.
For at least ten years, StarOffice, OpenOffice.org, LibreOffice, and derivatives supported JavaScript and Python in the Calc spreadsheet.
That's all fine. But all I really want is for it to be faster than molasses in January. It take forever to load, and forever to save. If I want bunch of fancy features, I would switch to a more powerful program.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
"Microsoft Adds Support For JavaScript Functions in Excel"
But could you please do it before the first batch of Excel-based javascript-empowered cryptominer and other malware arrives in our company?
Who the FUCK thought it would be a great idea to marry the one file format every idiot opens when it arrives in his mailbox because that's what he does all day with the one scripting language that can the easiest be obfuscated to escape the current antivirus signatures?
So far I was willing to say that MS simply can't fight malware, but this makes me wonder whether they get a cut of the profits.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Microsoft has added various scripting languages to their Office products over the years... and each and every one has been abused by bad actors at some point, forcing Microsoft to cripple and/or remove the capability. What on earth could possibly make Microsoft think that adding JavaScript to Office documents will be any different? Particularly since it has already been abused in a myriad of ways within web browsers??
As the old saying goes, "The definition of insanity is doing the same thing over and over again, and expecting different results."
I didn't suggest that this would make the system as a whole any safer, I said that JS, in this respect, is less likely to be successfully used as an attack vector than VB because the end user can vet javascript source code themselves if they are so inclined, and possibly spot any dangerous code, while VB has the option of being distributed as pre-compiled byte code.
But of course, if they are keeping VB (and I expect that they are), then obviously the system isn't any safer at all, because attacks can still be obscured from that angle anyways,
File under 'M' for 'Manic ranting'
all at once.
Does this mean VBA gets yanked? Is the roadmap to replace macros with Java? GAWD!
I am so tired of other java systems failing after an automated java update, now the CFO's spreadsheet fails... spectacular idea.
"Office developers have been wanting to write JavaScript custom functions for many reasons"
Mainly because they're assholes who will throw IT under the bus the second a routine they blithely copy-paste from some random site steals sensitive data.
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
I can already manipulate any of Excel's data with C++, C#, VB.NET, VBScript, yes, JavaScript, and any other language that can handle scriptable COM objects. I wouldn't necessarily call this a game changer.
It's not a game changer to a programmer. It's potentially a game changer to some desk jockey in a low tech job that can copy and paste formulas from the internet and can follow it well enough to make a few simple changes.
Although... they have VBA for that already.
"That's the way to do it" - Punch
Cause they didn't have enough gaping wide vulnerabilities with VBA?
Here's hoping they carried over all the lessons learned.
I'm in an organization that INSISTS on using Microsoft Excel as an administrative end for an entire ecommerce platform. They want to use it for all of their inventory management. The last major iteration, I finally said "FUCK THIS SHIT", and wrote a quick VBA script that simply copied the current sheet to a new document, saved as XLSX (for those unaware, this format is just a small collection of XML files ZIPed up, with a custom file extension), and then the VBA script uploads this new single-sheet document to an internal web application. Now instead of having to deploy the fuckall bullshit VBA scripts across the entire organization every time a new feature or bug fix is needed, the entire codebase is handled on a centralized server. Hopefully with Microsoft's current Azure focus, they can do something like this close to natively with their new JavaScript implementation. I'm not a fan of MS Office at all, in fact, I'm absolutely sick and tired of having to support it... but if they can at least make something easier, I'm all for it.
This is clearly a Good Thing, and could never cause any kind of security concerns.
After all, the one thing I always wanted in my company's proprietary and highly confidential corporate budgeting spreadsheets was the ability to stream random data from the Internet.
Also, I have a bridge in Brooklyn to sell, the biggest and most amazing bridge ever. Call today!
"The only good windmill is a tilted windmill."
Remove custom functions, scripting and macros from Excel.
At the very least, it will stop people building business critical applications as a spread sheet.
On second thought, bring on the JavaScript functions. I make a lot of money replacing spread sheet applications with real ones.
At least this kludge will make it easier for office anarchists to skim a fraction of a penny off every transaction and deposit into a bank account... JS precision is so bad nobody would ever notice!
News Flash From The Future
Financial melt-down due to developer pulling NPM packages for some arbitrary reason; economists inconsolable!
Well, count down to viruses.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
No, it does not use the Excel Object Model.
The Excel Object model is actually very good. Sensible and clean (ignoring recent horrors like the ribbon). COM is a mess, but the object model is excellent.
Moving to JavaScript does not merely men replacing End If with {}. The JavaScript model runs in a client server style, with futures etc. Much, much more complex. That is the essence of the change, Not the actual language.
10 lines of VBA becomes 100 lines of the new Java API. And is impossible for non-programmers to write. And that is what VBA supports, non programmers.
In VBA you can even record a macro, see the object handling, and then tidy it up afterwards. Excellent.
What actual users of Excel want is the VBA to be properly supported. It was abandoned for .Net, which was unusable by non programmers and very difficult to deploy. And now the fashion is Javascript. But since when to developers listen to uses? Wot's hot and wot's not. That is what counts.
Perish the thought, unless you want to end up in Federal pound-me-in the-ass prison!
WARNING: Smartphones have side effects--most of them undocumented.
So they went with this, at least Excel will be more in the news in the near future. They should also throw in jQuery and React, for good measure. If youâ(TM)re supporting JS go all the way!
There are two rules for success:
1. Never tell everything you know.
While they're at it, will they at least update that broze-age era IDE that lurks inside MS Office like a horror in a dark cellar?