Mike Raiford wrote:
> Chris Cason wrote:
>> Do you ever recall seeing firefox mention that the extension had been installed?
>> (As I mentioned, I did not).
>>
>> -- Chris
> 
> Not at all. It didn't ask me, FF didn't do it's usual "Hey! You have a 
> new plugin" dialog. Nothing.
> 
> Had I not read your post, I wouldn't have known about it.

Thanks for confirming that. It appears that perhaps Microsoft has changed the
behaviour, or alternately the presence or absence of confirmation depends on
other factors unknown to us.

-- Chris

Post a reply to this message

Darren New wrote:
> you can't afford to have a disabled extension in your firefox directories, 

Just to clarify, as I presume you are implying (since clearly Warp made no
statement even slightly like this) that I made such claims:

  1. I have made statements that for security reasons I don't like risking
     having operational Microsoft extensions silently turn up in my FF install.

  2. I have at no time said I "cannot afford" to have a disabled extension.
     Any such implication is at most a distortion and possibly an outright lie.

  3. I have not stated that disabling the extension is insufficient.

  4. I have pointed out that it is not good that Microsoft disables the means
     of un-installing the extension.

  5. You have repeatedly claimed that it is my fault the plugin turned up
     because I ignored warnings, clicked through EULA's, or whatever.

  6. By your own admission you now agree the service pack doesn't present an
     EULA.

  7. At least one other poster in this thread has confirmed that no warning was
     given by FF that the plugin had been installed on his system. This is also
     the experience of the majority of the posts on this topic that I have read
     around the WWW, which while not in itself proof, certainly lends credence
     to my position.

Most of your time in this thread has been spent arguing that I was wrong in my
claims. Now it appears you are resorting to casting aspersions on the *reasons*
I don't like what Microsoft did.

-- Chris

Post a reply to this message

Chris Cason wrote:
>   1. I have made statements that for security reasons I don't like risking
>      having operational Microsoft extensions silently turn up in my FF install.

No, me neither.

>   2. I have at no time said I "cannot afford" to have a disabled extension.
>      Any such implication is at most a distortion and possibly an outright lie.

I neither said nor implied you did.

>   3. I have not stated that disabling the extension is insufficient.

I neither said nor implied you did.

>   4. I have pointed out that it is not good that Microsoft disables the means
>      of un-installing the extension.

I agree with you. I'm not sure why they do.

>   5. You have repeatedly claimed that it is my fault the plugin turned up
>      because I ignored warnings, clicked through EULA's, or whatever.

I admitted I misremembered that.

>   6. By your own admission you now agree the service pack doesn't present an
>      EULA.

Yep.  Odd, since there's a SP1-specific EULA.

Are you somehow trying to embarrass me by pointing out that I took time to 
do the experiments and posted the results indicating that I was mistaken? Or 
are you encouraging me to not, in the future, admit when I've made a 
mistake? I'm honestly unsure of your motivation for this summary.

>   7. At least one other poster in this thread has confirmed that no warning was
>      given by FF that the plugin had been installed on his system. This is also
>      the experience of the majority of the posts on this topic that I have read
>      around the WWW, which while not in itself proof, certainly lends credence
>      to my position.

I can't speak to that, except to say that when I reproduced the situation, I 
got a warning myself. I already admitted that others may be running 
different versions of something that cause different behavior, and even that 
Microsoft may have changed the behavior of the SP1 since the articles noted 
it's behavior.

> Most of your time in this thread has been spent arguing that I was wrong in my
> claims. Now it appears you are resorting to casting aspersions on the *reasons*
> I don't like what Microsoft did.

I wasn't speaking about you, or to you, at all. I was saying that Warp's 
hyperbole was extending the lovely flamefest we're having, as hyperbole 
tends to do.

Try not to read personal attacks into statements that aren't about you. 
Things go more smoothly.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Chris Cason wrote:
> Thanks for confirming that. It appears that perhaps Microsoft has changed the
> behaviour, or alternately the presence or absence of confirmation depends on
> other factors unknown to us.

I tried it a different way. If you install FF *after* SP1, you don't get the 
pop-up warning, but it does wind up being installed. At least in my tests. 
Just so's ya know.

Plus there's another WPF-related plug-in under the plug-ins list. Just so's 
ya can turn it off if it bothers you.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Warp wrote:
>   Or if we put it in other words: He seemed to be implying that if the
> attitude is that MS software is insecure, running Firefox on Windows to
> get more security (for the reason that MS software is insecure) is useless
> because it will be running on top of MS software. The second implication
> from this is that running FF is useless and you could just as well use IE.


That's funny, because that didn't seem to be to me what he was implying at 
all. I, personally, run firefox primarily because IE is such a poster child 
for insecure programming these last couple of years.

As a suggestion, if you're trying to figure out whether someone implied 
something by stating something less extreme, it's often better to say 
something like "are you suggesting that...?" instead of "so you're implying 
that: ..."  The former is a request for clarification, while the latter 
often comes across as ridicule or sarcasm in English, especially when the 
latter is hyperbole.

Of course, on this list, some folks seem to take every opportunity to take 
offense and read people in the worst possible way, regardless of intent. I 
believe you've commented on this yourself. I'm not sure what the solution is 
besides simply accepting that the first option should be to believe the 
writer isn't implying the reader is stupid or evil if there's an alternate 
interpretation.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> As a suggestion, 

That said, I hope you're amused by the idea of *you* taking advice from *me* 
on how to avoid flame wars. :-)

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> I tried it a different way. If you install FF *after* SP1, you don't get the 
> pop-up warning, but it does wind up being installed. At least in my tests. 
> Just so's ya know.

Yep. Also note that the extension physically is not installed in the plugins
dir; it's elsewhere in the system. I think Microsoft just sets up the registry
entries in advance.

> 
> Plus there's another WPF-related plug-in under the plug-ins list. Just so's 
> ya can turn it off if it bothers you.

Yah, already done :-)

Post a reply to this message

Chris Cason wrote:
 > I found this article after searching on the subject of an extension that
 > had appeared in my Vista firefox install - one that I had not installed,
 > nor been asked permission to install. I checked my work PC (XP) and it,
 > also, had the extension. I'm surprised there's not more fireworks going
 > off about this, as it's precisely the sort of thing that makes IE so
 > much of a trundling disaster waiting for a place to happen.
 >
 >   http://www.annoyances.org/exec/show/article08-600
 >
 > Bonus: the extension installed by Microsoft has the 'uninstall' option
 > disabled.
 >
 > -- Chris

Thanks for letting us know about this.

I've just watched the .NET Framework update install via Windows Update and 
I can confirm that it does indeed install the extension without asking you 
and with no indication that it's doing it (and it also installed a plug-in 
called Windows Presentation Foundation without asking or notification as 
well).

I had Firefox running while the Windows Update was running and at no time 
was I prompted that an extension or plug-in was being installed and I was 
never presented with the normal extension install warning dialog that 
allows you to allow/reject an install.

Upon restarting Firefox after the Windows Update had completely finished, 
Firefox popped up the Extensions window telling me 1 extension had been 
installed, but I never was asked whether I wanted to install it (so 
couldn't tell it not to install it) and the Uninstall button is disabled - 
not happy.  Additionally the plug-in installation was completely silent; 
even Firefox didn't note that a plug-in had been installed.

I'm extremely surprised that it does this without telling you it's going 
to or giving you the option not to, and I'm surprised that Firefox doesn't 
pop up the standard "do you want to install this extension" dialog asking 
for permission.

Even more alarming is that the extension's option of "Prompt before 
running ClickOnce applications" is not enabled by default!

I have three words for Microsoft:  DO NOT WANT.

I'm astounded that this invasive install practice hasn't been all over IT 
news websites by now.  I use Firefox precisely because I don't want 
websites to be able to do whatever they feel like doing, and in wanders 
Microsoft and force-installs an extension that has the potential to let 
them do just that.

Now I'm going to have to go through the process that the article outlines 
to try to get rid of all this stuff...

I'm amazed that Mozilla hasn't taken Microsoft to task over this; it's 
exactly these kinds of sneaky force-install issues that create attack vectors.

NOT HAPPY.

Lance.

thezone - thezone.firewave.com.au

Post a reply to this message

On a similar note, it appears that recent versions of the Java Runtime  
also silently install a Firefox add-on (called "Java quick starter"). Like  
the Microsoft one, this one also has the uninstall option disabled, though  
it can be removed through the Java control panel.

You also get a Windows service with the same name.


-- 
FE

Post a reply to this message

Bill Gates lost $18 Bill. ($40B remaining) last year I hope he lost 
another $18B on law suits so he and MS actually lear respect for the 
common man. The more time passes the less I like MS.

MS first got into war with Netscape Browser (Mozilla browser mod), years 
later they cried for help to Mozilla, IE7 is FireFox with "MS Vista 
skin", then they hack FireFox... Is this behavior jerky or is just me?

This makes me wonder, are the vulnerabilities of all versions of Windows 
a twisted, uncomfortable and intentional form of control by MS? Since 
they can twist and hack a foreign software why not their own?

Is 4:44 am, maybe I'm not making much sense now, but I despise MS that 
is for sure.

Cheers.

Post a reply to this message