I found this article after searching on the subject of an extension that had
appeared in my Vista firefox install - one that I had not installed, nor been
asked permission to install. I checked my work PC (XP) and it, also, had the
extension. I'm surprised there's not more fireworks going off about this, as
it's precisely the sort of thing that makes IE so much of a trundling disaster
waiting for a place to happen.

  http://www.annoyances.org/exec/show/article08-600

Bonus: the extension installed by Microsoft has the 'uninstall' option disabled.

-- Chris

Post a reply to this message

I wondered where the heck that came from. Showed up a few weeks ago here.

This raises an interesting question - what if Mozilla were to issue a 
security "update" that removed the Microsoft .NET Framework Assistant from 
Firefox? Considering that the software is installed without a user's 
permission, I doubt MS would have any recourse.

Mike

"Chris Cason" <del### [at] deletethistoopovrayorg> wrote in 
message news:49b0af6c@news.povray.org...
>I found this article after searching on the subject of an extension that 
>had
> appeared in my Vista firefox install - one that I had not installed, nor 
> been
> asked permission to install. I checked my work PC (XP) and it, also, had 
> the
> extension. I'm surprised there's not more fireworks going off about this, 
> as
> it's precisely the sort of thing that makes IE so much of a trundling 
> disaster
> waiting for a place to happen.
>
>  http://www.annoyances.org/exec/show/article08-600
>
> Bonus: the extension installed by Microsoft has the 'uninstall' option 
> disabled.
>
> -- Chris
>

Post a reply to this message

> I found this article after searching on the subject of an extension that 
> had
> appeared in my Vista firefox install - one that I had not installed, nor 
> been
> asked permission to install.

Would it not be in the EULA when you installed .net framework 3.5 SP1?

What is the extension meant to actually do?

Post a reply to this message

Mike Hough wrote:
> This raises an interesting question - what if Mozilla were to issue a 
> security "update" that removed the Microsoft .NET Framework Assistant from 
> Firefox? Considering that the software is installed without a user's 
> permission, I doubt MS would have any recourse.

I expect that the Windows Update and WGA terms allow Microsoft to do more or
less whatever they like.

-- Chris

Post a reply to this message

scott wrote:
> Would it not be in the EULA when you installed .net framework 3.5 SP1?

Where did I say that *I* installed .NET 3.5 SP1?

> What is the extension meant to actually do?

It's designed to allow websites to more easily install software on your PC.

>From MSDN at http://msdn.microsoft.com/en-us/library/cc716877.aspx -

  "A XAML browser application (XBAP) is a deployment and application packaging
   technique whereby a WPF application can be deployed through a browser
   connection to a server, and then executed within the browser. When the user
   clicks the link that refers to the .xbap file, ClickOnce automatically
   handles the mechanics of downloading and launching the application. ClickOnce
   is a deployment technology for Windows-based applications that can update
   installations without uninstalling, and also facilitates self-contained
   application installations."

NB it's not unusual for software that requires .net to ship with the
redistributables, and to auto-install them if the target system has the older
version. Add that to the fact that Microsoft is pushing 3.5 SP1 through Windows
Update, sooner or later this will end up on a large percentage of PC's.

Post a reply to this message

>> Would it not be in the EULA when you installed .net framework 3.5 SP1?
> 
> Where did I say that *I* installed .NET 3.5 SP1?

Choose a stronger password? :-)

Post a reply to this message

Chris Cason wrote:
> I found this article after searching on the subject of an extension that had
> appeared in my Vista firefox install - one that I had not installed, nor been
> asked permission to install. I checked my work PC (XP) and it, also, had the
> extension. I'm surprised there's not more fireworks going off about this, as
> it's precisely the sort of thing that makes IE so much of a trundling disaster
> waiting for a place to happen.
> 
>   http://www.annoyances.org/exec/show/article08-600
> 
> Bonus: the extension installed by Microsoft has the 'uninstall' option disabled.
> 

On my machine, too.. What a PITA. Not only is it not removable by a 
simple button click, it's configured by default to install software w/o 
prompting the user.

I'm sure the malware creators are happy :/

-- 
~Mike

Post a reply to this message

> On my machine, too.. What a PITA. Not only is it not removable by a simple 
> button click, it's configured by default to install software w/o prompting 
> the user.

Really, where do you change that?  On mine if I click a link to try and 
install a ClickOnce app I first get the standard FF dialog box with 
Save/Cancel but with an extra "Run ClickOnce app".  If I click the Run 
button it then checks what version of .net I have (this is what the MS FF 
extension is for) and then I get *another* security warning that asks me if 
I'm sure I want to install the application.  Then it runs.

If I try the same without the MS FF extension installed, I just have to save 
the file somewhere (there is no "Run ClickOnce app" button) then run it 
(with a warning), then the ClickOnce app installs and runs.

TBH so long as the MS FF extension always asks you I think it makes things 
easier to run from the web.  The fact that yours defaults to running without 
any prompt though is a bit worrying.

Post a reply to this message

scott wrote:
>> On my machine, too.. What a PITA. Not only is it not removable by a 
>> simple button click, it's configured by default to install software 
>> w/o prompting the user.
> 
> Really, where do you change that?  On mine if I click a link to try and 
> install a ClickOnce app I first get the standard FF dialog box with 
> Save/Cancel but with an extra "Run ClickOnce app".  If I click the Run 
> button it then checks what version of .net I have (this is what the MS 
> FF extension is for) and then I get *another* security warning that asks 
> me if I'm sure I want to install the application.  Then it runs.
> 
> If I try the same without the MS FF extension installed, I just have to 
> save the file somewhere (there is no "Run ClickOnce app" button) then 
> run it (with a warning), then the ClickOnce app installs and runs.
> 
> TBH so long as the MS FF extension always asks you I think it makes 
> things easier to run from the web.  The fact that yours defaults to 
> running without any prompt though is a bit worrying.
> 
> 
I dunno, since I haven't knowingly downloaded any ClickOnce apps, but 
there was a checkbox marked "Prompt before installing software" in the 
configuration. it was unchecked. This may be an extra prompt.

I'd prefer to save the file, let my virus scanner check it out, then run 
it, though.

-- 
~Mike

Post a reply to this message

Chris Cason wrote:
>> What is the extension meant to actually do?
> It's designed to allow websites to more easily install software on your PC.

Basically, it does for native executables (at least .NET native executables) 
what Java applets do - download the code if it's new, then launch it. It's 
been around since early early .NET days.

Of course, if they didn't support it in Firefox, people would complain 
they're excluding firefox.

And you're told it's getting installed. People just click past that, because 
it's checked by default.  It's like complaining you didn't ask for Clippy. 
Or maybe I'm one of the small number of people who actually read the list of 
stuff I'm installing before I install it.  Maybe that's why my machine 
doesn't get the "windows slowness rot" everyone else's seem to.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message