top | item 37076523

MS Teams channels cannot contain MS-DOS device names

444 points| tapoxi | 2 years ago |learn.microsoft.com

350 comments

order
[+] kentonv|2 years ago|reply
Circa 1998 I was a teenage Linux zealot who would attend LAN parties carrying a Linux box. It actually worked -- at the time, WINE practically existed to support Starcraft, Quake 2 could run natively, and that covered like 95% of what people were playing.

One time I thought it would be funny to run a shell script that looped through every Windows share on the network and tried to open `CON/CON` on it, resulting in a prompt Blue Screen of Death for each machine.

For some reason my friends did not think it was funny.

[+] madrox|2 years ago|reply
This brings back memories. Every LAN group had that one friend like you. I'm sure you made up for it if, like my BSD friend, you were handy with network troubleshooting and always brought spare CAT-5.
[+] Phrodo_00|2 years ago|reply
Was that over IPX? I don't think I ever configured IPX on Linux. By the time I was using enough Linux to run Starcraft on Wine, it already supported IP.
[+] code_runner|2 years ago|reply
love this story very much. I had no idea WINE had been around for that long and was able to play starcraft etc. I have really great memories of playing starcraft with friends back in the day.... that game had enough staying power that we could all get into and out of in middle school and then again in college!
[+] AndrewKemendo|2 years ago|reply
Classic! My favorite “anyone can do it hack” was ping flooding people during a lan-party

Good old memories

[+] 4m1rk|2 years ago|reply
Golden era. We were different or the world around us?
[+] EspressoGPT|2 years ago|reply
> Circa 1998 I was a teenage Linux zealot who would attend LAN parties carrying a Linux box.

Arch, I suppose.

[+] conscion|2 years ago|reply
This is most likely due to those names not being allowed for files or folders in the Windows file system. MS Teams channels create a matching folder in SharePoint where file attachments are stored.
[+] Zelphyr|2 years ago|reply
Microsoft, when confronted with a problem, think "I know, I'll build it on top of SharePoint."
[+] gadders|2 years ago|reply
I worked at a bank that had a windows-based trading system and for some reason created folders to hold the details of each book. There were issues when a trader decided to call a book "LPT1".
[+] yellow_lead|2 years ago|reply
I bet there is another vulnerability here, although they also seem to blacklist % and ..
[+] andix|2 years ago|reply
And matching Active Directory groups. It's kind of cool to use them, because it's a really easy way to let the users administrate access to resources without opening a support ticket.
[+] whalesalad|2 years ago|reply
sharepoint has its claws in msft and it will forever be their achilles heel.
[+] nullindividual|2 years ago|reply
SharePoint stores files as binaries in a SQL database (or a reference to an Azure Blob Store). The filesystem doesn’t come into play.
[+] Brian_K_White|2 years ago|reply
I was about to say "Which is essentially leaking the existence of something terrible inside. They should be embarrassed to say something like this in public. Like saying you can't have %s or $PS1. Why the hell not? What are you doing with this user-supplied input?"

But maybe it's more about what everyone else might do with a channel name. Ie they might cut & paste it anywhere, and I guess windows users aren't expected to escape their own strings when pasted into cmd or powershell or wsl.

The teams code itself can probably handle it just fine, but maybe not all the unknown janky random things out there that might handle channel names.

Other people have pointed out the SharePoint folders associated with the channels. Not sure I would excuse that myself since it's easy enough to just escape or modify or encode to create a safe version for the directory, but maybe it's important elsewhere for the channel name and the directory name to be identical. Within one app you could simply encode and decode both the channel name and directory name the same way and totally hide the encoding from the user, but if the directory is used outside of the app, then it would look bad with URL encoding or something that everything else will just display as it is, not decoded.

So the directory has to be safe for everything else, and so the channel name has to be the same.

Essentially choosing to have these limits rather than have directory names that look ugly sometimes. It's ultimately not even a safety or breakage thing, just a cosmetic thing. All directories will always look natural and good, because they don't allow anything that would have needed to be encoded.

[+] m3047|2 years ago|reply
> leaking the existence of something terrible inside

If you should get the opportunity to look at a raw (DNS) NXDOMAIN passive DNS (PDNS) feed there's a lot of plain brokenness, but the nuggets can be truly alarming. This is what happens when translating between naming services: naming services typically have application domains, and names in one context are interpreted differently in another. Bobby Tables is well known, but how about that special file "-rf"? Was a time when the happy path for Active Directory essentially trusted DNS domain names implicitly for things like file shares. Sounds ok until you realize executable files might be on those "drives".

(Honestly I don't find the string "MS-DOS" anywhere in that document.) (Edit: Did find the reference to e.g. CON, LPT1...)

[+] thefz|2 years ago|reply
> essentially leaking the existence of something terrible inside

It's just a restriction imposed on SharePoint folder names bubbling up. Nothing fancy.

[+] marcosdumay|2 years ago|reply
> I guess windows users aren't expected to escape their own strings

Eh... When did the users of any kind of system start to fit that expectation? And what is that utopia system?

[+] paulddraper|2 years ago|reply
AWS has character restrictions on virtually everything.

The message bodies of SQS messages has restrictions on which whitespace characters can be used.

[+] naikrovek|2 years ago|reply
they're SharePoint limits, man. Teams is backed by SharePoint and it's not a secret, nor is it embarrassing.
[+] wizofaus|2 years ago|reply
Try creating a value in a SharePoint choice column that has ;# in it, and you might not be so certain this isn't being done because MS don't trust their own code.
[+] Roark66|2 years ago|reply
Why is it that most "chat/conference" apps become horrible sooner or later? I still remember when teams used to be an OK app. It even had a Linux desktop client. I remember when slack was actually fast, I remember Skype out being more reliable to make phone calls than my mobile/cell service. Today slack is extremely slow if you add few organisations to it (but at least you can add more than one). Teams has deprecated their Linux desktop client and the only way to use it on Linux is via chrome, but wait, if you use it as part of office365/sharepoint you need to use Firefox for "some" sharepoint links. So essentially you need 2 browsers at all times. Chrome for teams (screen sharing and video), Firefox for some sharepoint links.
[+] eddythompson80|2 years ago|reply
Because believe it or not, a chat/conference is the most easy gateway to an "everything app" just like with WeChat. Afterall, a chat/conference app is a microcosm of the "internet".

Your chat app is great but imagine if we can send/share audio clips too.

Your chat app is great but imagine if we can send/share video clips too.

Your chat app is great but imagine if we can send/share live video too.

Your chat app is great but imagine if we can send/share money too.

Your chat app is great but imagine if we can send/share conference meetings too.

Your chat app is great but imagine if we can send/share calendar invites too.

Your chat app is great but imagine if we can send/share food delivery requests too.

Your chat app is great but imagine if we can send/share gaming sessions too.

Your chat app is great but imagine if we can send/share X too.

There is no limit on X. The internet is about sharing X. a chat app is about sharing X. There is no bound to how much it can grow really.

[+] prepend|2 years ago|reply
The key is to be terrible and simple from the beginning. IRC works just as poorly today as 30 years ago.
[+] nxobject|2 years ago|reply
I think part of it is the constant drive to add features – sure, we can do chat and video! But, what if we put background blurring in there? Crap, Zoom has polls, we'll have to add polls now... well, shoot, if we're cranking out features like this and iterating quickly, we might as well use Electron.
[+] graphviz|2 years ago|reply
The market rewards features and integration, not performance, as long as an app is usable. Developers devel... I mean features features features.
[+] evouga|2 years ago|reply
Because after your lean, highly-productive startup team creates the app that everyone loves, you get a bunch of funding and hire thousands of extraneous software developers and then have to find something for them to do.
[+] zelphirkalt|2 years ago|reply
Wait, the MS Teams desktop app is deprecated? Never got any message about that ... Guess I might soon be forced to use double the evil, in Chrome and Teams in Chrome? Wow, the world becomes more dystopian by the day. Perhaps I should quit my job when I am forced to use Chrome. Well gonna use the desktop app for as long as I can. They will probably never fix their broken shit app, so that one can use it from any browser.
[+] cwkoss|2 years ago|reply
> Why is it that most "chat/conference" apps become horrible sooner or later?

To 'become' horrible there has to have been a period where it wasn't. AFAIK that doesn't apply to teams, lol

[+] duxup|2 years ago|reply
The app that does everything always seems to stink.

It's no coincidence that my favorite note taking app is ... Apple's Notes App. I've used other apps but I've found that all that heft from all the extra features makes it more of a hassle for me in the end.

I get how it happens, even my current employer / small team are looking into internal documentation routes and ... oh man the list of things people want just goes on and I fear leads to some beastly solution.

[+] HPsquared|2 years ago|reply
It's easier to add things than fix annoyances.
[+] ikekkdcjkfke|2 years ago|reply
Entreprise wishes i guess? Just look at all the group policies for windows update..
[+] keepamovin|2 years ago|reply
Ahahaha, I love this! I love how this new fandango thing harkens back to the earliest days of MS-DOS when it ran on a 086 or 286, back in the early (very early) 90s.

Have to respect MS' backwards compatibility fanaticism. Impossibly as if a native port of MS Teams would be created for MS-DOS 3.1 (hahahaha). When more plausibly the MS Teams servers run on an ancient crazy proprietary MS-DOS 3.1 mainframe (still implausible, but hey).

I know that this device name restriction also applies to Windows file names, so it's not that surprising (if you are inclined to be less fun than possible), but if you like fun, you can pretend the former.

Relevant frag link: https://learn.microsoft.com/en-us/microsoftteams/limits-spec...

[+] red_hare|2 years ago|reply
Reminds me of the rumor that the reason it went "Windows 7", "8", "10" and skipped "9" is because the fear of a codebase that went:

  if(version.StartsWith(“Windows 9”)) {
    /* 95 and 98 */
    ...
  }
[+] owlninja|2 years ago|reply
Words: forms, CON, CONIN$, CONOUT$, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, desktop.ini, _vti_
[+] maerF0x0|2 years ago|reply
General tip for structuring user data. Try to treat it as obscure blobs, whenever possible.. Imagine it's encrypted so it's not even printable/human readable.

> forms, CON, CONIN$, CONOUT$, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, desktop.ini, _vti_

If they have to restrict those because some user input is going straight into their FS, then they mucked up. Probably should have been given a safe ID (perhaps uuid4, perhaps something more like a digest of the channel name instead of using the user input directly.

For me it's a smell when someone says "You cannot use these characters". I automatically think "Why not? You're not using this unencoded or plaintext, right?" eg passwords, or usernames, or content that will show up on a webpage like a comment or such.

This all being said, perhaps it's just an easter egg gone sideways... Perhaps they were just trying to have a bit of fun :)

[+] TacticalCoder|2 years ago|reply
It's bad, ok... But honestly what's the goal? To let people name anything, including the name of a channel, anything they like, like, say:

    "rm -rf /*"
Wait, I've got better: that rm -rf, but written "fr- mr" with RLO left/right overrides.

Surely that is something to aim for because nothing shall ever go wrong?

Thankfully having a file named https://example.org is illegal in Linux (and Windows too right?).

Seriously: is this a problem of you? And if it's a problem, where do you draw the line?

What about codepoint 0? What about Hangul fillers and RLO characters: do you think applications who refuse these do suck?

There are, thankfully, limitation on what filenames can contain. And I think the restrictions aren't anywhere near restrictive enough. Same for usernames, same for channels, same for oh-so-many things.

Does anyone really find it problematic that, say, Twitter only allows visible alphanumeric characters and underscore? (and 15 chars max)

This seems very smart to me. I take that any day over longing for people being able to use poop emojis in their usernames and channels names.

[+] graypegg|2 years ago|reply
If this IS a case where the title of a channel is used as a SharePoint folder, I’m surprised there isn’t some standard way to escape specifically these strings? I know it would break compatibility for applications that rely on these magic device files, but SharePoint should NEVER actually want to speak to COM1. Weird to me it isn’t handled already in SharePoint!
[+] lol768|2 years ago|reply
Does this imply it's writing a file to the fs for its internal storage, with the name matching the channel's name instead of a channel ID?
[+] prepend|2 years ago|reply
Teams is so weird, “ Number of org-wide teams allowed in a tenant” is limited to 25.

So my company can only have 25 “general” teams.

I think it would be neat to learn the rationale behind some of these settings.

[+] Mister_Snuggles|2 years ago|reply
I sort of get most of these - they're internal to various bits of Microsoft technology. 'CON' plus the ones ending in $ are internal device names dating back to MS-DOS, 'desktop.ini' is a magic file that Explorer uses, '_vti_' is something I've seen but can't remember what it was from.

But 'forms'? Why is 'forms' a bad word?

[+] glonq|2 years ago|reply
I'm old[school], so if I'm at the windows command prompt and need to bust out a quick batch file or script I will do "copy con foo.bat" instead of using notepad or vscode. Old habits die hard!
[+] air7|2 years ago|reply
This backwards compatibility chain reminds me of the age old tale of how rockets are the width of two horses... (1)

(1) http://astrodigital.org/space/stshorse.html

[+] failuser|2 years ago|reply
This is a classic joke, but settling on a common gauge was really difficult, it was not just copying some old Roman standard. There were even riots when different railways started to standardize because common rail gauge meant you can move through the town without engaging with the local economy, see Erie gauge war. Russia still has a wider gauge than Europe and Australia has 3 different ones.
[+] whalesalad|2 years ago|reply
Microsoft is going for the Guinness World Record for oldest tech debt. They are winning.
[+] lokar|2 years ago|reply
Just imagine the deep commitment to tech debt that results in this
[+] acheron|2 years ago|reply
I actually laughed out loud at that headline. Fantastic.

AFAIK those still can’t be used as file system names, so I’m assuming it’s related to that.

Tim Paterson’s Revenge.

[+] m00dy|2 years ago|reply
I can't be the only one thinking that generally MS Team is offering probably worst experience in the messaging market.
[+] alkonaut|2 years ago|reply
If I ever do anything where I let people name things it's rarely a good idea to NOT lock it down with some restrictions. "Minimum length", "Maximum lenght" at least, but anyone who has programmed windows machines for any length of time might also have the scars to remember to do "is a valid file name" too.

Having to escape everything or replace names with stable guids is not a good relpacement for storing \whatever\logs\channelname or whatever the need may be. Especially for systems that are hard bound to windows filesystems or Sharepoint to begin with.

I bet there are apps on other OS:es where you CAN name things a "\0" sequence or "/" and for each such app I imagine there are people who regret making that possible.