Chris Cason wrote:
> Thanks for confirming that. It appears that perhaps Microsoft has changed the
> behaviour, or alternately the presence or absence of confirmation depends on
> other factors unknown to us.

I tried it a different way. If you install FF *after* SP1, you don't get the 
pop-up warning, but it does wind up being installed. At least in my tests. 
Just so's ya know.

Plus there's another WPF-related plug-in under the plug-ins list. Just so's 
ya can turn it off if it bothers you.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Warp wrote:
>   Or if we put it in other words: He seemed to be implying that if the
> attitude is that MS software is insecure, running Firefox on Windows to
> get more security (for the reason that MS software is insecure) is useless
> because it will be running on top of MS software. The second implication
> from this is that running FF is useless and you could just as well use IE.


That's funny, because that didn't seem to be to me what he was implying at 
all. I, personally, run firefox primarily because IE is such a poster child 
for insecure programming these last couple of years.

As a suggestion, if you're trying to figure out whether someone implied 
something by stating something less extreme, it's often better to say 
something like "are you suggesting that...?" instead of "so you're implying 
that: ..."  The former is a request for clarification, while the latter 
often comes across as ridicule or sarcasm in English, especially when the 
latter is hyperbole.

Of course, on this list, some folks seem to take every opportunity to take 
offense and read people in the worst possible way, regardless of intent. I 
believe you've commented on this yourself. I'm not sure what the solution is 
besides simply accepting that the first option should be to believe the 
writer isn't implying the reader is stupid or evil if there's an alternate 
interpretation.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> As a suggestion, 

That said, I hope you're amused by the idea of *you* taking advice from *me* 
on how to avoid flame wars. :-)

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> I tried it a different way. If you install FF *after* SP1, you don't get the 
> pop-up warning, but it does wind up being installed. At least in my tests. 
> Just so's ya know.

Yep. Also note that the extension physically is not installed in the plugins
dir; it's elsewhere in the system. I think Microsoft just sets up the registry
entries in advance.

> 
> Plus there's another WPF-related plug-in under the plug-ins list. Just so's 
> ya can turn it off if it bothers you.

Yah, already done :-)

Post a reply to this message

Chris Cason wrote:
 > I found this article after searching on the subject of an extension that
 > had appeared in my Vista firefox install - one that I had not installed,
 > nor been asked permission to install. I checked my work PC (XP) and it,
 > also, had the extension. I'm surprised there's not more fireworks going
 > off about this, as it's precisely the sort of thing that makes IE so
 > much of a trundling disaster waiting for a place to happen.
 >
 >   http://www.annoyances.org/exec/show/article08-600
 >
 > Bonus: the extension installed by Microsoft has the 'uninstall' option
 > disabled.
 >
 > -- Chris

Thanks for letting us know about this.

I've just watched the .NET Framework update install via Windows Update and 
I can confirm that it does indeed install the extension without asking you 
and with no indication that it's doing it (and it also installed a plug-in 
called Windows Presentation Foundation without asking or notification as 
well).

I had Firefox running while the Windows Update was running and at no time 
was I prompted that an extension or plug-in was being installed and I was 
never presented with the normal extension install warning dialog that 
allows you to allow/reject an install.

Upon restarting Firefox after the Windows Update had completely finished, 
Firefox popped up the Extensions window telling me 1 extension had been 
installed, but I never was asked whether I wanted to install it (so 
couldn't tell it not to install it) and the Uninstall button is disabled - 
not happy.  Additionally the plug-in installation was completely silent; 
even Firefox didn't note that a plug-in had been installed.

I'm extremely surprised that it does this without telling you it's going 
to or giving you the option not to, and I'm surprised that Firefox doesn't 
pop up the standard "do you want to install this extension" dialog asking 
for permission.

Even more alarming is that the extension's option of "Prompt before 
running ClickOnce applications" is not enabled by default!

I have three words for Microsoft:  DO NOT WANT.

I'm astounded that this invasive install practice hasn't been all over IT 
news websites by now.  I use Firefox precisely because I don't want 
websites to be able to do whatever they feel like doing, and in wanders 
Microsoft and force-installs an extension that has the potential to let 
them do just that.

Now I'm going to have to go through the process that the article outlines 
to try to get rid of all this stuff...

I'm amazed that Mozilla hasn't taken Microsoft to task over this; it's 
exactly these kinds of sneaky force-install issues that create attack vectors.

NOT HAPPY.

Lance.

thezone - thezone.firewave.com.au

Post a reply to this message

On a similar note, it appears that recent versions of the Java Runtime  
also silently install a Firefox add-on (called "Java quick starter"). Like  
the Microsoft one, this one also has the uninstall option disabled, though  
it can be removed through the Java control panel.

You also get a Windows service with the same name.


-- 
FE

Post a reply to this message

Bill Gates lost $18 Bill. ($40B remaining) last year I hope he lost 
another $18B on law suits so he and MS actually lear respect for the 
common man. The more time passes the less I like MS.

MS first got into war with Netscape Browser (Mozilla browser mod), years 
later they cried for help to Mozilla, IE7 is FireFox with "MS Vista 
skin", then they hack FireFox... Is this behavior jerky or is just me?

This makes me wonder, are the vulnerabilities of all versions of Windows 
a twisted, uncomfortable and intentional form of control by MS? Since 
they can twist and hack a foreign software why not their own?

Is 4:44 am, maybe I'm not making much sense now, but I despise MS that 
is for sure.

Cheers.

Post a reply to this message

>> > The majority of us (those who use FF for this reason)
>> > *DO NOT WANT* any Microsoft internet-related code running in FF, it's 
>> > that
>> > simple.
>
>> That will be a bit tricky seeing as you have FF running on an OS written 
>> by
>> MS, if you really do not want any MS code running then use a different OS
>> for web browsing, it's the only way to be sure.
>
>  So basically you are saying: If you use Windows, don't bother even trying
> to browse securely.

If you really don't consider the MS code that FF uses (eg to draw JPEGs, 
create the windows, interact with the network etc) to be secure, then no, 
don't even bother, get another OS that you think is more secure.

>  That's the kind of TheDailyWTF style mentality, in the same lines as
> "we don't have any passwords in your database server because, after all,
> it's impossible to secure it from all possible hacker attacks".

Exactly, which is why most people (myself included) are happy with the 
compromise of using FF on an MS OS, of course there are still likely to be 
security holes, but it's worth the risk if you need the MS OS for other 
reasons and aren't uber paranoid about security.

Post a reply to this message

Dunno what you're all on about, I just did the recent update in FF and no 
secret MS extension has been installed.

  <shrug>

  ~Steve~

Post a reply to this message

St. <dot### [at] dotcom> wrote:
> Dunno what you're all on about, I just did the recent update in FF and no 
> secret MS extension has been installed.

  It's not a question of updating Firefox.

-- 
                                                          - Warp

Post a reply to this message