Warp wrote:
>   So you are saying that the article at
> http://www.annoyances.org/exec/show/article08-600 is lying when it says
> "without asking your permission"?

NB the vast majority of articles I have come across say the same thing
(that it's installed without explicit notification or permission).

It's also been reported if a user purchases a computer with this already
installed (e.g. a brand-new fully-updated Vista system could potentially
have KB951847), and *subsequently* installs firefox, the extension turns up
in FF immediately.

-- Chris

Post a reply to this message

Chris Cason wrote:
> NB the vast majority of articles I have come across say the same thing
> (that it's installed without explicit notification or permission).

OK. Maybe I'm mis-remembering because Firefox jumped up and down flashing 
the new thing in my face when I started it.

It's not like I didn't give permission to install software on my machine, 
knowing what software is being installed. So I'm not really sure what all 
the complaining is about. It's a plug-in for firefox, which supports a 
plug-in architecture for just such purposes. The plug in that came down was 
bundled with 20+ meg of other changes to your system software as well. It's 
not like it's a root kit or something - before the first time it runs, you 
get FF in your face telling you it has been installed, do you want to 
configure it or disable it? Hardly "stealth."

And if it asked explicit permission, you'd get the same complaints that 
people have about too many UAC prompts - "why are you asking me twice?"

I just don't understand the outrage. "How dare you add a new feature to my 
software?"

Note there are already several 3rd=party plug-ins for firefox making it do 
clickonce. Perhaps none of those worked with the new click-once stuff, so MS 
wants to override the assignment of the mime type to the plug-in that 
actually works, without the user saying "Oh, I don't need that, I already 
have that."

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Chris Cason wrote:
> It's also been reported if a user purchases a computer with this already
> installed (e.g. a brand-new fully-updated Vista system could potentially
> have KB951847), and *subsequently* installs firefox, the extension turns up
> in FF immediately.

Sounds like, then, that they don't actually have to modify firefox at all in 
order to make this functionality work. They're just installing the bundled 
software, and the fact that it affects *firefox* instead of your desktop or 
IE or your start menu or your Office installation is what has people up in arms?

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> not like it's a root kit or something - before the first time it runs, you 
> get FF in your face telling you it has been installed, do you want to 
> configure it or disable it? Hardly "stealth."

I've told you four times now. I was NOT asked or told. You are intentionally
ignoring this.

I will state one last time: I was NOT ASKED OR TOLD. on EITHER of my machines. I
am not the sort of user who clicks past warnings or ignores checkboxes. Network
security is one of my professional gigs.

I use Firefox because of Microsoft's abysmal security record with the internet
as a whole, and IE in particular. I am very choosy about what I permit to be
installed in Firefox and what pissed me off about this incident is that I got no
notification whatsoever that it was installed, and if I had been asked I would
under no circumstances have allowed it.

Given you have chosen to intentionally ignore my prior statements and basically
imply I am either stupid or a lair, I consider you have passed the point of fair
discussion and are simply a troll. As a troll, you are not welcome to continue
posting to this thread; if you wish to troll, go elsewhere.

-- Chris

Post a reply to this message

Mike Raiford wrote:
> On my machine, too.. What a PITA. Not only is it not removable by a 

Do you ever recall seeing firefox mention that the extension had been installed?
(As I mentioned, I did not).

-- Chris

Post a reply to this message

Chris Cason wrote:
> Darren New wrote:
>> not like it's a root kit or something - before the first time it runs, you 
>> get FF in your face telling you it has been installed, do you want to 
>> configure it or disable it? Hardly "stealth."
> 
> I've told you four times now. I was NOT asked or told. You are intentionally
> ignoring this.

I'm not ignoring *your* experience.  I'm telling you that *I* wasn't 
surprised it was installed when I installed it.  What can I say?

I already offered at least three reasons why this might be so that isn't 
calling you a liar.

In any case, did it bring up the "you installed new plug-ins" window when 
you started firefox the next time?  If not, this sounds like a bug in 
firefox as well.

I'm also trying to figure out why this is a problem at all. You install 
software, part of the software is a plug-in for firefox, firefox now has a 
plug-in. When I install software, part of it can be start menu shortcuts, 
system libraries, new menus in my word processor, etc. I just don't see what 
the problem is, really. It's not stealth, it's not something you can't 
disable, it's not apparently breaking anything else. I wouldn't be surprised 
if the exact same SP patched the click-once code that IE uses, but I don't 
see anyone complaining about that. So I'm kind of at a loss there.

I can understand it wasn't mentioned other than "click-once functionality 
improved" in the KB article, but the outrage seems way out of proportion.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> Chris Cason wrote:
>> I've told you four times now. I was NOT asked or told. You are intentionally
>> ignoring this.
> 
> I'm not ignoring *your* experience.  I'm telling you that *I* wasn't 
> surprised it was installed when I installed it.  What can I say?

Here's a direct quote from your post I made that reply to:

Darren New wrote:
> > not like it's a root kit or something - before the first time it runs, you
> > get FF in your face telling you it has been installed, do you want to
> > configure it or disable it? Hardly "stealth."

 "*YOU* get ff in in your face, telling *YOU* it has been installed, do *YOU*
  want to configure it ..."

Hardly "your" experience, and typical of your other replies, where you tend to
directly contradict the poster. Your extensive use of the third party makes it
clear you intend to refer to the OP, not yourself.

You have successfully hijacked this thread from a discussion of the topic to a
"you were told" "not I was'nt" "yes you were". I resent this; I took the time to
make the post because it's a subject I care about and it's descended into a
series of defences of Microsoft's actions primarily by yourself.

-- Chris

Post a reply to this message

Darren New wrote:
> In any case, did it bring up the "you installed new plug-ins" window when 
> you started firefox the next time?  If not, this sounds like a bug in 
> firefox as well.

No. But rather than a bug in FF, more likely Microsoft used a means that avoids
this (which might be designed into FF, for all I know).

> I'm also trying to figure out why this is a problem at all. You install 
> software,

*Microsoft* installs software. *I* did not install it. Whether it came via
windows update or bundled with another program I can't be sure. I can be sure I
was never asked about it. This is the majority of opinion in articles around the
www. I can think of several ways a KB can be installed without the end-user
being asked, including (I suspect) the "quiet" switch which is provided for
times such as a network roll-out or when it's invoked from another software
package that bundles it.

I can't say whether or not the end-user is asked about it when it's installed
via automatic updates (where they are set to "automatically download and
install" but I would be surprised if they were asked - the purpose of auto
download and install of windows update items is to do exactly that.

> plug-in. When I install software, part of it can be start menu shortcuts, 
> system libraries, new menus in my word processor, etc. I just don't see what 

As a general rule, Microsoft has avoided directly installing stuff into programs
they don't own in the past. And in any event, if I install software from
manufacturer "X", I don't expect them to fiddle with the software from
manufacturer "Y" unless they ask me first. I'd be annoyed at any company - not
just Microsoft - if they did this, and have been so in the past. But this goes
beyond just ordinary annoyance because of *what* they installed.

> the problem is, really. It's not stealth, 

If I'm not told it's being done, it's stealth, at least insofar as modifying
another company's product (*especially* when that product is considered by
Microsoft as a competitor to one of their own programs).

> I can understand it wasn't mentioned other than "click-once functionality 
> improved" in the KB article, but the outrage seems way out of proportion.

The outrage is because there are millions of firefox users who use it BECAUSE IT
IS SAFER THAN IE. IE has been repeatedly demonstrated to be a disaster waiting
for a place to happen. Microsoft has an atrocious record on security, and those
of us who were working in the industry when they first introduced activex (I
was) recall just what a bloody disaster that was.

Consider this from the point of view of someone who uses FF for this reason: why
wouldn't we be outraged when microsoft then rams a piece of potentially buggy
software into our browser, which we are using primarily to avoid using their
buggy browser code??? The majority of us (those who use FF for this reason)
*DO NOT WANT* any Microsoft internet-related code running in FF, it's that simple.

My home network needs to be secure as I work for (and in some cases network
admin for) several firms to whom I have VPN or SSH access. I don't even allow IE
to access the blasted internet! I have a proxy, firefox knows about it, but
Windows and IE do *not*. I occasionally open it up on a separate port to allow
windows update to run, but that's it. I never under any circumstances use IE on
the open internet because of the serious flaws that to this day still are being
discovered and which sometimes lead to drive-by-downloads, trojan and virus
infections, keyloggers, and what have you.

I do not want ANY Microsoft components running inside my browser since they have
proven time and time and time again over the past 14 years that they simply
cannot be trusted to produce secure, well-designed code.

THAT is why I and many are pissed off this appeared in FF without our
permission. Their security record speaks for itself. If you wish to defend
Microsoft irregardless of their record, please do so elsewhere: this is not the
forum for it.

Please: no more replies, no more posts from you on this topic. It gets nowhere
and distracts from the real purpose of the thread.

-- Chris

Post a reply to this message

Darren New wrote:
> In any case, did it bring up the "you installed new plug-ins" window when
> you started firefox the next time?  If not, this sounds like a bug in
> firefox as well.

Or Microsoft set the "notification already shown for this plugin" flag while
installing it.

Post a reply to this message

Chris Cason wrote:
> Darren New wrote:
>> Chris Cason wrote:
>>> I've told you four times now. I was NOT asked or told. You are intentionally
>>> ignoring this.
>> I'm not ignoring *your* experience.  I'm telling you that *I* wasn't 
>> surprised it was installed when I installed it.  What can I say?
> 
> Here's a direct quote from your post I made that reply to:
> 
> Darren New wrote:
>>> not like it's a root kit or something - before the first time it runs, you
>>> get FF in your face telling you it has been installed, do you want to
>>> configure it or disable it? Hardly "stealth."
> 
>  "*YOU* get ff in in your face, telling *YOU* it has been installed, do *YOU*
>   want to configure it ..."

Clearly I should have said "One gets that in one's face." Miscommunication 
there.

Right now, I'm building a new virtual machine, gonna put firefox on it, then 
install windows updates, and I'll see exactly what it does while I'm paying 
attention.

> Hardly "your" experience, 

It was my experience, as far as I recall from the two times I installed the 
stuff here. I assumed the security features in FF that showed me that worked 
for you too.

> and typical of your other replies, where you tend to
> directly contradict the poster. Your extensive use of the third party 

... second party ... ;-)

> makes it clear you intend to refer to the OP, not yourself.

Sure. But earlier I also said "maybe your experience was different."

> You have successfully hijacked this thread from a discussion of the topic to a
> "you were told" "not I was'nt" "yes you were".

Sorry. It looked like "I wasn't told" *was* the topic of the thread.


-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message