5 ms·
Microsoft Update Quietly Installs Firefox Extension
- deleted 17y ago[deleted]
- solutionyogi 17y agoPersonally, I would have been okie if Microsoft installed an extension in Firefox to support .NET related applications [ClickOnce for instance.]. But it is completely unacceptable that it disables the Uninstall button! Who is thinking of these ideas at Microsoft? Also, why does Firefox let an extension decide whether it is uninstallable or not?
- nanexcool 17y agoI just bought an Acer Aspire One and Firefox comes installed with the Google Toolbar. The uninstall button is also disabled so it's not just Microsoft doing it. Almighty, do-no-evil Google is at it too.
- ori_b 17y agoIf it's an Acer Aspire One, I'd say it's probably Acer doing it, most likely by installing the plugin globally (which means that a normal non-root user doesn't have the permissions to remove it).
- invisible 17y agoIt also seems like this extension has vulnerabilities INSIDE of it, so that raises some larger questions. From that post, someone states that Firefox may not have the access required to remove the registry key for application extensions (because that is all it is for extensions installed this way) and thus the Uninstall button is disabled. I think that given that circumstance, a reason should be explained to the end-user of WHY.
- stcredzero 17y agoreason should be explained to the end-user of WHY Marketdroids who hold their customers in contempt. People like this guy: http://www.imdb.com/title/tt0097531/ http://www.imdb.com/title/tt0097531/
- neilk 17y agoAlso, why does Firefox let an extension decide whether it is uninstallable or not? In the OP, commenter WladimirPalant says that's a side effect of a Firefox feature which allows plug-ins to be registered via the Windows Registry. But disabling will have the exact same effect: the plugin is not loaded.
- asmosoinio 17y agoQuoting a comment on the article by WladimirPalant: ---------- Unfortunately, this is only partially Microsoft's fault. Firefox makes it easy for applications to ship their own browser extensions - they only need to add a registry entry that points to the extension's directory. But Firefox cannot uninstall extensions that were installed like this (because it didn't install them in the first place, because it might require administrator rights and because doing that would affect other Firefox profiles as well). So while this feature is great for application developers, it is rather flawed from user's point of view. -----------
- RossM 17y agoIs there a way to trigger Firefox to install an update the traditional way (as in with a user dialogue)? If this is the only way possible to install an extension (without asking the user to visit addons.moz.org for example) then it's Mozilla's fault rather than the developers'.
- godDLL 17y agoWhat is wrong with referring your users to the download/install page? It's opt-in in the same way as clicking a dialog is. The way they did it is sneaky, disarming and opt-out.
- solutionyogi 17y agoYes, you are right. Here's the relevant documentation from Mozilla. "Extensions that are installed this way include the Java Quick Starter extension for Firefox (see above), the Microsoft .NET Framework Assistant [13] [14] the RealPlayer Browser Record Plugin extension, [15] and the Lenovo ThinkVantage Password Manager extension for Firefox [16] [17]. Although you can disable the extension in the Add-ons manager, the Uninstall option may not be functional (it will be "greyed out). In such cases, experienced users can uninstall the extension by removing the associated Registry entry and/or the contents of the folder containing the extension; otherwise, simply disable it." http://kb.mozillazine.org/Uninstalling_add-ons#Windows_Registry_extension http://kb.mozillazine.org/Uninstalling_add-ons#Windows_Regis... Microsoft has an article about how to remove this extension: http://support.microsoft.com/kb/963707/ http://support.microsoft.com/kb/963707/ From the same KB article, "In Windows 7 and in a forthcoming update for the .NET Framework 3.5 SP1, the .NET Framework Assistant will be installed on a per-user basis. As a result, the Uninstall button will be functional in the Firefox Add-ons menu." I am using Windows 7 right now and I can verify that I do see that Uninstall button is functional. http://imgur.com/gX5c8.png http://imgur.com/gX5c8.png BTW, this just goes to show the kind of reputation Microsoft has achieved in the marketplace. When the uninstall button was disabled, no one thought that it could be problem in the way Firefox works. Everyone (including me) just assumed that it was Microsoft who is deliberately doing this. I don't know how can they possibly fix their image.
- jd 17y agoThe uninstall and disable buttons work on my FF install, for the framework assistant 1.1
- ScottWhigham 17y agoThis started happening well over a year ago and has been covered extensively before. http://www.google.com/search?q=firefox+Microsoft+.NET+Framework+Assistant+1.0 http://www.google.com/search?q=firefox+Microsoft+.NET+Framew...
- socratees 17y agoThe people at Microsoft who are responsible for this should be questioned.
- wyday 17y agoRight, because nothing inspires risk taking in a corporation like a good old fashioned witch hunt. I agree with you in that this is a shitty thing for MS to do (hell, I was one of the first ones to write a blog post explaining how to undo it - http://wyday.com/blog/2008/how-to-uninstall-microsoft-net-framework-assistant-from-firefox/ http://wyday.com/blog/2008/how-to-uninstall-microsoft-net-fr... ). But, a witch hunt is idiotic.
- steveklabnik 17y agoMan, when this happened, it was the worst. See, at my college, it logs you in with a fresh copy of everything, every time you log in. And it automatically applies patches. This patch came out after the latest image was made, so when you log in, it grabs the patch and installs it. Every time. Then, you start Fx, and it has to install the patch, and restart itself. Every time. Takes almost 8 minutes to log in. It's the absolute worst.
- trezor 17y agoWhile I don't question how the login time causes frustration, I would address the real issue instead of blaming Microsoft: You have a broken login process.
- steveklabnik 17y agoYou won't find any disagreement here. It's totally dumb. I just hope they have a new image for those attending fall classes.
- 83457 17y agoSo the installation of the extension occurs on the next run of Firefox and takes 8 minutes? That does really suck regardless of the whole imaging thing.
- steveklabnik 17y agoFrom typing username/password to being able to type something into Firefox, 8 minutes is a loose guess. It's really, really bad. Part of the problem is also that the computers in the "social" CS lab are pretty old by now. Lots of the newer labs are better, but they just won't replace the computers in this one. So there's a lot of factors.
- trezor 17y agoBesides this being old news, yes let's all hate on Microsoft for them writing actual code and adding ClickOnce deployment support to Firefox. I agree the lack of an uninstall option is silly, but calling this a "rougue Firefox extension" just makes you look like an asshat.
- huhtenberg 17y agoWell, sure. Next time when they silently install, say, an MP3 blocker in your Firefox, let's also applaud all the troubles they went through coding it. Just in case if it's not clear - what makes it a rogue extension is the fact that it was installed silently.
- trezor 17y agoNext time when they silently install, say, an MP3 blocker in your Firefox Protip: If you want to be taken seriously, omit bullshit like this the next time you make a comment. Just in case if it's not clear - what makes it a rogue extension is the fact that it was installed silently. So basically just like any Adobe product ever. Gotcha.
- DougBTX 17y agoExactly. It even installs using a documented (by Mozilla) API, hardly rouge. Nor it is hidden or activley malicios. It also happens to be far more secure than IE's ancient ActiveX support.
- 83457 17y agoI don't understand how it matters if it is a documented API. If they are installing something to other software that could have consequences for the user then they should inform the user IMO.
- TweedHeads 17y ago"Secondly -- to Microsoft -- this is a great example of how not to convince people to trust your security updates."
- emilis_info 17y agoThis is very old news. Even Slashdot had the story in february: http://tech.slashdot.org/article.pl?sid=09/02/01/2143218 http://tech.slashdot.org/article.pl?sid=09/02/01/2143218 I feel sorry for voting this thing up, before investigating the links in the article.
- joe_the_user 17y agoOld news or not, I think that this kind of behavior deserves attention. Microsoft's behavior is a scary game of chicken. Even supposing MS's plugin didn't change Firefox for the worse this, does MS intend to modify the behavior of any and every application running on of windows with its routine updates? If so, this standard means they could subtly hamstring any app any time in the future. Makes competition is bit tough, you think?
- niels_olson 17y agoFirst I heard of it. Glad you voted it up.
- dinkumthinkum 17y agoI don't know what's scarier: this "update" from Microsoft or the Washington Post reporting on technology.
- blasdel 17y agoHe may still usually misrepresent stories due to ignorance, but at least these days Brian Krebs is less of an asshat tabloidist.