Microsoft Update Quietly Installs Firefox Extension(voices.washingtonpost.com)
voices.washingtonpost.com
Microsoft Update Quietly Installs Firefox Extension
http://voices.washingtonpost.com/securityfix/2009/05/microsoft_update_quietly_insta.html
38 comments
Quoting a comment on the article by WladimirPalant:
---------- Unfortunately, this is only partially Microsoft's fault. Firefox makes it easy for applications to ship their own browser extensions - they only need to add a registry entry that points to the extension's directory. But Firefox cannot uninstall extensions that were installed like this (because it didn't install them in the first place, because it might require administrator rights and because doing that would affect other Firefox profiles as well). So while this feature is great for application developers, it is rather flawed from user's point of view. -----------
---------- Unfortunately, this is only partially Microsoft's fault. Firefox makes it easy for applications to ship their own browser extensions - they only need to add a registry entry that points to the extension's directory. But Firefox cannot uninstall extensions that were installed like this (because it didn't install them in the first place, because it might require administrator rights and because doing that would affect other Firefox profiles as well). So while this feature is great for application developers, it is rather flawed from user's point of view. -----------
Yes, you are right. Here's the relevant documentation from Mozilla.
"Extensions that are installed this way include the Java Quick Starter extension for Firefox (see above), the Microsoft .NET Framework Assistant [13] [14] the RealPlayer Browser Record Plugin extension, [15] and the Lenovo ThinkVantage Password Manager extension for Firefox [16] [17]. Although you can disable the extension in the Add-ons manager, the Uninstall option may not be functional (it will be "greyed out). In such cases, experienced users can uninstall the extension by removing the associated Registry entry and/or the contents of the folder containing the extension; otherwise, simply disable it."
http://kb.mozillazine.org/Uninstalling_add-ons#Windows_Regis...
Microsoft has an article about how to remove this extension:
http://support.microsoft.com/kb/963707/
From the same KB article,
"In Windows 7 and in a forthcoming update for the .NET Framework 3.5 SP1, the .NET Framework Assistant will be installed on a per-user basis. As a result, the Uninstall button will be functional in the Firefox Add-ons menu."
I am using Windows 7 right now and I can verify that I do see that Uninstall button is functional.
http://imgur.com/gX5c8.png
BTW, this just goes to show the kind of reputation Microsoft has achieved in the marketplace. When the uninstall button was disabled, no one thought that it could be problem in the way Firefox works. Everyone (including me) just assumed that it was Microsoft who is deliberately doing this. I don't know how can they possibly fix their image.
"Extensions that are installed this way include the Java Quick Starter extension for Firefox (see above), the Microsoft .NET Framework Assistant [13] [14] the RealPlayer Browser Record Plugin extension, [15] and the Lenovo ThinkVantage Password Manager extension for Firefox [16] [17]. Although you can disable the extension in the Add-ons manager, the Uninstall option may not be functional (it will be "greyed out). In such cases, experienced users can uninstall the extension by removing the associated Registry entry and/or the contents of the folder containing the extension; otherwise, simply disable it."
http://kb.mozillazine.org/Uninstalling_add-ons#Windows_Regis...
Microsoft has an article about how to remove this extension:
http://support.microsoft.com/kb/963707/
From the same KB article,
"In Windows 7 and in a forthcoming update for the .NET Framework 3.5 SP1, the .NET Framework Assistant will be installed on a per-user basis. As a result, the Uninstall button will be functional in the Firefox Add-ons menu."
I am using Windows 7 right now and I can verify that I do see that Uninstall button is functional.
http://imgur.com/gX5c8.png
BTW, this just goes to show the kind of reputation Microsoft has achieved in the marketplace. When the uninstall button was disabled, no one thought that it could be problem in the way Firefox works. Everyone (including me) just assumed that it was Microsoft who is deliberately doing this. I don't know how can they possibly fix their image.
If you install an update & this annoying extension shows up, you say the update caused the annoyance. That's how it works. It's their fault for pushing the bug/feature & they still haven't taken it out.
Regarding your other point, I think 1 high profile FOSS project (eg webkit, hadoop, V8 ) or would do a lot for microsoft's image among techies.
Regarding your other point, I think 1 high profile FOSS project (eg webkit, hadoop, V8 ) or would do a lot for microsoft's image among techies.
Even that option has limited PR value; Microsoft either uses their "shared source" licenses (and comes under fire for not using a more recognized license like GPL or BSD) or they use such a license and feed ammo to the "shared source is trap" crowd.
Well either way they'll come under fire from that crowd. (And i'd agree it sort of is a trap.)
While not as high profile as any of the above they have committed to jQuery http://weblogs.asp.net/scottgu/archive/2008/09/28/jquery-and...
Is there a way to trigger Firefox to install an update the traditional way (as in with a user dialogue)? If this is the only way possible to install an extension (without asking the user to visit addons.moz.org for example) then it's Mozilla's fault rather than the developers'.
What is wrong with referring your users to the download/install page? It's opt-in in the same way as clicking a dialog is.
The way they did it is sneaky, disarming and opt-out.
The way they did it is sneaky, disarming and opt-out.
First, it is entirely Microsoft's fault. They did it. As the article says, they should have created an ordinary extension and put it on the Firefox extension site.
Saying that it isn't MS' fault if they followed an easy but wrong to do something is like saying it's not my fault if I rob a liquor store since "it's easier than earning money".
Firefox should provide more control over extensions but that's a different point.
Saying that it isn't MS' fault if they followed an easy but wrong to do something is like saying it's not my fault if I rob a liquor store since "it's easier than earning money".
Firefox should provide more control over extensions but that's a different point.
I just bought an Acer Aspire One and Firefox comes installed with the Google Toolbar. The uninstall button is also disabled so it's not just Microsoft doing it. Almighty, do-no-evil Google is at it too.
If it's an Acer Aspire One, I'd say it's probably Acer doing it, most likely by installing the plugin globally (which means that a normal non-root user doesn't have the permissions to remove it).
It also seems like this extension has vulnerabilities INSIDE of it, so that raises some larger questions.
From that post, someone states that Firefox may not have the access required to remove the registry key for application extensions (because that is all it is for extensions installed this way) and thus the Uninstall button is disabled. I think that given that circumstance, a reason should be explained to the end-user of WHY.
From that post, someone states that Firefox may not have the access required to remove the registry key for application extensions (because that is all it is for extensions installed this way) and thus the Uninstall button is disabled. I think that given that circumstance, a reason should be explained to the end-user of WHY.
reason should be explained to the end-user of WHY
Marketdroids who hold their customers in contempt. People like this guy:
http://www.imdb.com/title/tt0097531/
Marketdroids who hold their customers in contempt. People like this guy:
http://www.imdb.com/title/tt0097531/
Also, why does Firefox let an extension decide whether it is uninstallable or not?
In the OP, commenter WladimirPalant says that's a side effect of a Firefox feature which allows plug-ins to be registered via the Windows Registry. But disabling will have the exact same effect: the plugin is not loaded.
In the OP, commenter WladimirPalant says that's a side effect of a Firefox feature which allows plug-ins to be registered via the Windows Registry. But disabling will have the exact same effect: the plugin is not loaded.
The uninstall and disable buttons work on my FF install, for the framework assistant 1.1
This is very old news. Even Slashdot had the story in february: http://tech.slashdot.org/article.pl?sid=09/02/01/2143218
I feel sorry for voting this thing up, before investigating the links in the article.
I feel sorry for voting this thing up, before investigating the links in the article.
First I heard of it. Glad you voted it up.
Old news or not, I think that this kind of behavior deserves attention.
Microsoft's behavior is a scary game of chicken. Even supposing MS's plugin didn't change Firefox for the worse this, does MS intend to modify the behavior of any and every application running on of windows with its routine updates? If so, this standard means they could subtly hamstring any app any time in the future. Makes competition is bit tough, you think?
Microsoft's behavior is a scary game of chicken. Even supposing MS's plugin didn't change Firefox for the worse this, does MS intend to modify the behavior of any and every application running on of windows with its routine updates? If so, this standard means they could subtly hamstring any app any time in the future. Makes competition is bit tough, you think?
This started happening well over a year ago and has been covered extensively before.
http://www.google.com/search?q=firefox+Microsoft+.NET+Framew...
http://www.google.com/search?q=firefox+Microsoft+.NET+Framew...
[deleted]
The people at Microsoft who are responsible for this should be questioned.
Right, because nothing inspires risk taking in a corporation like a good old fashioned witch hunt.
I agree with you in that this is a shitty thing for MS to do (hell, I was one of the first ones to write a blog post explaining how to undo it - http://wyday.com/blog/2008/how-to-uninstall-microsoft-net-fr... ).
But, a witch hunt is idiotic.
I agree with you in that this is a shitty thing for MS to do (hell, I was one of the first ones to write a blog post explaining how to undo it - http://wyday.com/blog/2008/how-to-uninstall-microsoft-net-fr... ).
But, a witch hunt is idiotic.
I don't know what's scarier: this "update" from Microsoft or the Washington Post reporting on technology.
He may still usually misrepresent stories due to ignorance, but at least these days Brian Krebs is less of an asshat tabloidist.
Man, when this happened, it was the worst. See, at my college, it logs you in with a fresh copy of everything, every time you log in. And it automatically applies patches. This patch came out after the latest image was made, so when you log in, it grabs the patch and installs it. Every time. Then, you start Fx, and it has to install the patch, and restart itself. Every time.
Takes almost 8 minutes to log in. It's the absolute worst.
Takes almost 8 minutes to log in. It's the absolute worst.
So the installation of the extension occurs on the next run of Firefox and takes 8 minutes? That does really suck regardless of the whole imaging thing.
From typing username/password to being able to type something into Firefox, 8 minutes is a loose guess. It's really, really bad.
Part of the problem is also that the computers in the "social" CS lab are pretty old by now. Lots of the newer labs are better, but they just won't replace the computers in this one. So there's a lot of factors.
Part of the problem is also that the computers in the "social" CS lab are pretty old by now. Lots of the newer labs are better, but they just won't replace the computers in this one. So there's a lot of factors.
While I don't question how the login time causes frustration, I would address the real issue instead of blaming Microsoft: You have a broken login process.
You won't find any disagreement here. It's totally dumb. I just hope they have a new image for those attending fall classes.
"Secondly -- to Microsoft -- this is a great example of how not to convince people to trust your security updates."
Besides this being old news, yes let's all hate on Microsoft for them writing actual code and adding ClickOnce deployment support to Firefox.
I agree the lack of an uninstall option is silly, but calling this a "rougue Firefox extension" just makes you look like an asshat.
I agree the lack of an uninstall option is silly, but calling this a "rougue Firefox extension" just makes you look like an asshat.
Well, sure. Next time when they silently install, say, an MP3 blocker in your Firefox, let's also applaud all the troubles they went through coding it.
Just in case if it's not clear - what makes it a rogue extension is the fact that it was installed silently.
Just in case if it's not clear - what makes it a rogue extension is the fact that it was installed silently.
Next time when they silently install, say, an MP3 blocker in your Firefox
Protip: If you want to be taken seriously, omit bullshit like this the next time you make a comment.
Just in case if it's not clear - what makes it a rogue extension is the fact that it was installed silently.
So basically just like any Adobe product ever. Gotcha.
Protip: If you want to be taken seriously, omit bullshit like this the next time you make a comment.
Just in case if it's not clear - what makes it a rogue extension is the fact that it was installed silently.
So basically just like any Adobe product ever. Gotcha.
Exactly. It even installs using a documented (by Mozilla) API, hardly rouge. Nor it is hidden or activley malicios. It also happens to be far more secure than IE's ancient ActiveX support.
I don't understand how it matters if it is a documented API. If they are installing something to other software that could have consequences for the user then they should inform the user IMO.
But it is completely unacceptable that it disables the Uninstall button! Who is thinking of these ideas at Microsoft? Also, why does Firefox let an extension decide whether it is uninstallable or not?