I found this article after searching on the subject of an extension that had
appeared in my Vista firefox install - one that I had not installed, nor been
asked permission to install. I checked my work PC (XP) and it, also, had the
extension. I'm surprised there's not more fireworks going off about this, as
it's precisely the sort of thing that makes IE so much of a trundling disaster
waiting for a place to happen.

  http://www.annoyances.org/exec/show/article08-600

Bonus: the extension installed by Microsoft has the 'uninstall' option disabled.

-- Chris

Post a reply to this message

I wondered where the heck that came from. Showed up a few weeks ago here.

This raises an interesting question - what if Mozilla were to issue a 
security "update" that removed the Microsoft .NET Framework Assistant from 
Firefox? Considering that the software is installed without a user's 
permission, I doubt MS would have any recourse.

Mike

"Chris Cason" <del### [at] deletethistoopovrayorg> wrote in 
message news:49b0af6c@news.povray.org...
>I found this article after searching on the subject of an extension that 
>had
> appeared in my Vista firefox install - one that I had not installed, nor 
> been
> asked permission to install. I checked my work PC (XP) and it, also, had 
> the
> extension. I'm surprised there's not more fireworks going off about this, 
> as
> it's precisely the sort of thing that makes IE so much of a trundling 
> disaster
> waiting for a place to happen.
>
>  http://www.annoyances.org/exec/show/article08-600
>
> Bonus: the extension installed by Microsoft has the 'uninstall' option 
> disabled.
>
> -- Chris
>

Post a reply to this message

> I found this article after searching on the subject of an extension that 
> had
> appeared in my Vista firefox install - one that I had not installed, nor 
> been
> asked permission to install.

Would it not be in the EULA when you installed .net framework 3.5 SP1?

What is the extension meant to actually do?

Post a reply to this message

Mike Hough wrote:
> This raises an interesting question - what if Mozilla were to issue a 
> security "update" that removed the Microsoft .NET Framework Assistant from 
> Firefox? Considering that the software is installed without a user's 
> permission, I doubt MS would have any recourse.

I expect that the Windows Update and WGA terms allow Microsoft to do more or
less whatever they like.

-- Chris

Post a reply to this message

scott wrote:
> Would it not be in the EULA when you installed .net framework 3.5 SP1?

Where did I say that *I* installed .NET 3.5 SP1?

> What is the extension meant to actually do?

It's designed to allow websites to more easily install software on your PC.

>From MSDN at http://msdn.microsoft.com/en-us/library/cc716877.aspx -

  "A XAML browser application (XBAP) is a deployment and application packaging
   technique whereby a WPF application can be deployed through a browser
   connection to a server, and then executed within the browser. When the user
   clicks the link that refers to the .xbap file, ClickOnce automatically
   handles the mechanics of downloading and launching the application. ClickOnce
   is a deployment technology for Windows-based applications that can update
   installations without uninstalling, and also facilitates self-contained
   application installations."

NB it's not unusual for software that requires .net to ship with the
redistributables, and to auto-install them if the target system has the older
version. Add that to the fact that Microsoft is pushing 3.5 SP1 through Windows
Update, sooner or later this will end up on a large percentage of PC's.

Post a reply to this message

>> Would it not be in the EULA when you installed .net framework 3.5 SP1?
> 
> Where did I say that *I* installed .NET 3.5 SP1?

Choose a stronger password? :-)

Post a reply to this message

Chris Cason wrote:
> I found this article after searching on the subject of an extension that had
> appeared in my Vista firefox install - one that I had not installed, nor been
> asked permission to install. I checked my work PC (XP) and it, also, had the
> extension. I'm surprised there's not more fireworks going off about this, as
> it's precisely the sort of thing that makes IE so much of a trundling disaster
> waiting for a place to happen.
> 
>   http://www.annoyances.org/exec/show/article08-600
> 
> Bonus: the extension installed by Microsoft has the 'uninstall' option disabled.
> 

On my machine, too.. What a PITA. Not only is it not removable by a 
simple button click, it's configured by default to install software w/o 
prompting the user.

I'm sure the malware creators are happy :/

-- 
~Mike

Post a reply to this message

> On my machine, too.. What a PITA. Not only is it not removable by a simple 
> button click, it's configured by default to install software w/o prompting 
> the user.

Really, where do you change that?  On mine if I click a link to try and 
install a ClickOnce app I first get the standard FF dialog box with 
Save/Cancel but with an extra "Run ClickOnce app".  If I click the Run 
button it then checks what version of .net I have (this is what the MS FF 
extension is for) and then I get *another* security warning that asks me if 
I'm sure I want to install the application.  Then it runs.

If I try the same without the MS FF extension installed, I just have to save 
the file somewhere (there is no "Run ClickOnce app" button) then run it 
(with a warning), then the ClickOnce app installs and runs.

TBH so long as the MS FF extension always asks you I think it makes things 
easier to run from the web.  The fact that yours defaults to running without 
any prompt though is a bit worrying.

Post a reply to this message

scott wrote:
>> On my machine, too.. What a PITA. Not only is it not removable by a 
>> simple button click, it's configured by default to install software 
>> w/o prompting the user.
> 
> Really, where do you change that?  On mine if I click a link to try and 
> install a ClickOnce app I first get the standard FF dialog box with 
> Save/Cancel but with an extra "Run ClickOnce app".  If I click the Run 
> button it then checks what version of .net I have (this is what the MS 
> FF extension is for) and then I get *another* security warning that asks 
> me if I'm sure I want to install the application.  Then it runs.
> 
> If I try the same without the MS FF extension installed, I just have to 
> save the file somewhere (there is no "Run ClickOnce app" button) then 
> run it (with a warning), then the ClickOnce app installs and runs.
> 
> TBH so long as the MS FF extension always asks you I think it makes 
> things easier to run from the web.  The fact that yours defaults to 
> running without any prompt though is a bit worrying.
> 
> 
I dunno, since I haven't knowingly downloaded any ClickOnce apps, but 
there was a checkbox marked "Prompt before installing software" in the 
configuration. it was unchecked. This may be an extra prompt.

I'd prefer to save the file, let my virus scanner check it out, then run 
it, though.

-- 
~Mike

Post a reply to this message

Chris Cason wrote:
>> What is the extension meant to actually do?
> It's designed to allow websites to more easily install software on your PC.

Basically, it does for native executables (at least .NET native executables) 
what Java applets do - download the code if it's new, then launch it. It's 
been around since early early .NET days.

Of course, if they didn't support it in Firefox, people would complain 
they're excluding firefox.

And you're told it's getting installed. People just click past that, because 
it's checked by default.  It's like complaining you didn't ask for Clippy. 
Or maybe I'm one of the small number of people who actually read the list of 
stuff I'm installing before I install it.  Maybe that's why my machine 
doesn't get the "windows slowness rot" everyone else's seem to.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Chris Cason <del### [at] deletethistoopovrayorg> wrote:
> I found this article after searching on the subject of an extension that had
> appeared in my Vista firefox install - one that I had not installed, nor been
> asked permission to install. I checked my work PC (XP) and it, also, had the
> extension. I'm surprised there's not more fireworks going off about this, as
> it's precisely the sort of thing that makes IE so much of a trundling disaster
> waiting for a place to happen.
>
>   http://www.annoyances.org/exec/show/article08-600
>
> Bonus: the extension installed by Microsoft has the 'uninstall' option disabled.
>
> -- Chris

Thanks for the warning! (I'm using Windows XP SP3 and Firefox 3.0.5--I don't
think I've yet downloaded the newest FF version.) I have Auto-Updates active
(but to 'show me first before installing'--I hope!)

I took a look at the website link, followed the instructions to find this
extension (looking at Tools/Add-Ons/Extensions in Firefox), and I didn't see
the extension there. In fact, there's nothing at all there. Looking under
Plugins, I didn't see it either, and all the plugins have an active 'disable'
button.

If I've followed the instructions correctly, I haven't yet been hit by this. But
I guess I can assume that this bizarre extension *will* be coming my way soon?

Ken W.

Post a reply to this message

On Fri, 06 Mar 2009 18:42:25 +1100, Chris Cason wrote:

> I expect that the Windows Update and WGA terms allow Microsoft to do
> more or less whatever they like.

I dunno, mucking about with other companies' software?  I would think 
that there are parts of the world (particularly the EU) where that 
wouldn't hold up.

Jim

Post a reply to this message

scott wrote:
> If I try the same without the MS FF extension installed, I just have to
> save the file somewhere (there is no "Run ClickOnce app" button) then run
> it (with a warning), then the ClickOnce app installs and runs.

Which is how Java WebStart apps work. You download a .jnlp file, which opens
with javaws.exe, and then downloads and runs the actual app. Firefox does
show "Open with Java WebStart" when you click the link (which it doesn't do
for .exe files).

Post a reply to this message

Jim Henderson wrote:
> I dunno, mucking about with other companies' software?  

Installing an extension in a documented way is "mucking about with other 
companie's software"?

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New <dne### [at] sanrrcom> wrote:
> Jim Henderson wrote:
> > I dunno, mucking about with other companies' software?  

> Installing an extension in a documented way is "mucking about with other 
> companie's software"?

  EU laws probably forbid the kind of action described here. "You
accepted our EULA" is not an excuse if the EULA in question is illegal.

-- 
                                                          - Warp

Post a reply to this message

On Fri, 06 Mar 2009 16:13:23 -0800, Darren New wrote:

> Jim Henderson wrote:
>> I dunno, mucking about with other companies' software?
> 
> Installing an extension in a documented way is "mucking about with other
> companie's software"?

I was commenting on Chris' comment about Windows Update and WGA Terms 
letting Microsoft do "more or less whatever they like".

Jim

Post a reply to this message

Warp wrote:
> Darren New <dne### [at] sanrrcom> wrote:
>> Jim Henderson wrote:
>>> I dunno, mucking about with other companies' software?  
> 
>> Installing an extension in a documented way is "mucking about with other 
>> companie's software"?
> 
>   EU laws probably forbid the kind of action described here. "You
> accepted our EULA" is not an excuse if the EULA in question is illegal.

Um, OK. So how does a virus cleaner work with the EU laws?

I don't know about you, but I got told when MS was adding the extension to 
firefox. Maybe I just didn't click thru the notices everyone else did, or 
maybe they changed it by the time I installed it, or something.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New <dne### [at] sanrrcom> wrote:
> >   EU laws probably forbid the kind of action described here. "You
> > accepted our EULA" is not an excuse if the EULA in question is illegal.

> Um, OK. So how does a virus cleaner work with the EU laws?

  You mean virus cleaners modify your system without asking?

-- 
                                                          - Warp

Post a reply to this message

Warp wrote:
>   You mean virus cleaners modify your system without asking?

As much as installing any other software does, yes?  Haven't you gotten 
"Whoop whoop! Virus detected!" and then cleaned it?

How is "I'd like to install this software, which includes yidda yadda and 
this firefox extension" now asking?

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New <dne### [at] sanrrcom> wrote:
> Warp wrote:
> >   You mean virus cleaners modify your system without asking?

> As much as installing any other software does, yes?  Haven't you gotten 
> "Whoop whoop! Virus detected!" and then cleaned it?

> How is "I'd like to install this software, which includes yidda yadda and 
> this firefox extension" now asking?

  So you are saying that the article at
http://www.annoyances.org/exec/show/article08-600 is lying when it says
"without asking your permission"?

-- 
                                                          - Warp

Post a reply to this message

Warp wrote:
>   So you are saying that the article at
> http://www.annoyances.org/exec/show/article08-600 is lying when it says
> "without asking your permission"?

Not necessarily. I'm saying *I* got asked permission. The EULA when I 
downloaded SP1 mentioned it. When firefox started up afterwards, it asked me 
if I wanted to install stuff without asking, with a default of "no". Firefox 
always pops up a window when you start it saying what new extensions it has 
installed, so it's not like you can miss it.

Now, maybe between this blog post being posted and my personally getting 
.NET SP1, Microsoft changed the EULA or something.  I wasn't surprised by 
it, nor was it ever in a state where I would randomly install clickonce 
software without being prompted. Maybe it's just because I was paying more 
attention and I knew what the technical terms meant.

Out of curiosity, would you be upset if a windows update upgraded IE or 
Office to work with the latest version of click-once software?

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New <dne### [at] sanrrcom> wrote:
> Out of curiosity, would you be upset if a windows update upgraded IE or 
> Office to work with the latest version of click-once software?

  No, because I don't use IE nor Office.

  Even if I did, I would be upset if the added feature is a potential
security risk.

-- 
                                                          - Warp

Post a reply to this message

Darren New wrote:
> And you're told it's getting installed. People just click past that, because 
> it's checked by default.  It's like complaining you didn't ask for Clippy. 
> Or maybe I'm one of the small number of people who actually read the list of 
> stuff I'm installing before I install it.  Maybe that's why my machine 
> doesn't get the "windows slowness rot" everyone else's seem to.

I don't see how you manage to misunderstand what I said.

I was NOT told it was being installed.

NOT. Do you understand NOT???

I was NOT ASKED and NOT TOLD.

Not on my home workstation, not on my office one.

It's clear you don't believe that and frankly I don't care. What I said is
true whether you choose to believe it or not.

-- Chris

Post a reply to this message

Warp wrote:
>   So you are saying that the article at
> http://www.annoyances.org/exec/show/article08-600 is lying when it says
> "without asking your permission"?

NB the vast majority of articles I have come across say the same thing
(that it's installed without explicit notification or permission).

It's also been reported if a user purchases a computer with this already
installed (e.g. a brand-new fully-updated Vista system could potentially
have KB951847), and *subsequently* installs firefox, the extension turns up
in FF immediately.

-- Chris

Post a reply to this message

Chris Cason wrote:
> NB the vast majority of articles I have come across say the same thing
> (that it's installed without explicit notification or permission).

OK. Maybe I'm mis-remembering because Firefox jumped up and down flashing 
the new thing in my face when I started it.

It's not like I didn't give permission to install software on my machine, 
knowing what software is being installed. So I'm not really sure what all 
the complaining is about. It's a plug-in for firefox, which supports a 
plug-in architecture for just such purposes. The plug in that came down was 
bundled with 20+ meg of other changes to your system software as well. It's 
not like it's a root kit or something - before the first time it runs, you 
get FF in your face telling you it has been installed, do you want to 
configure it or disable it? Hardly "stealth."

And if it asked explicit permission, you'd get the same complaints that 
people have about too many UAC prompts - "why are you asking me twice?"

I just don't understand the outrage. "How dare you add a new feature to my 
software?"

Note there are already several 3rd=party plug-ins for firefox making it do 
clickonce. Perhaps none of those worked with the new click-once stuff, so MS 
wants to override the assignment of the mime type to the plug-in that 
actually works, without the user saying "Oh, I don't need that, I already 
have that."

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Chris Cason wrote:
> It's also been reported if a user purchases a computer with this already
> installed (e.g. a brand-new fully-updated Vista system could potentially
> have KB951847), and *subsequently* installs firefox, the extension turns up
> in FF immediately.

Sounds like, then, that they don't actually have to modify firefox at all in 
order to make this functionality work. They're just installing the bundled 
software, and the fact that it affects *firefox* instead of your desktop or 
IE or your start menu or your Office installation is what has people up in arms?

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> not like it's a root kit or something - before the first time it runs, you 
> get FF in your face telling you it has been installed, do you want to 
> configure it or disable it? Hardly "stealth."

I've told you four times now. I was NOT asked or told. You are intentionally
ignoring this.

I will state one last time: I was NOT ASKED OR TOLD. on EITHER of my machines. I
am not the sort of user who clicks past warnings or ignores checkboxes. Network
security is one of my professional gigs.

I use Firefox because of Microsoft's abysmal security record with the internet
as a whole, and IE in particular. I am very choosy about what I permit to be
installed in Firefox and what pissed me off about this incident is that I got no
notification whatsoever that it was installed, and if I had been asked I would
under no circumstances have allowed it.

Given you have chosen to intentionally ignore my prior statements and basically
imply I am either stupid or a lair, I consider you have passed the point of fair
discussion and are simply a troll. As a troll, you are not welcome to continue
posting to this thread; if you wish to troll, go elsewhere.

-- Chris

Post a reply to this message

Mike Raiford wrote:
> On my machine, too.. What a PITA. Not only is it not removable by a 

Do you ever recall seeing firefox mention that the extension had been installed?
(As I mentioned, I did not).

-- Chris

Post a reply to this message

Chris Cason wrote:
> Darren New wrote:
>> not like it's a root kit or something - before the first time it runs, you 
>> get FF in your face telling you it has been installed, do you want to 
>> configure it or disable it? Hardly "stealth."
> 
> I've told you four times now. I was NOT asked or told. You are intentionally
> ignoring this.

I'm not ignoring *your* experience.  I'm telling you that *I* wasn't 
surprised it was installed when I installed it.  What can I say?

I already offered at least three reasons why this might be so that isn't 
calling you a liar.

In any case, did it bring up the "you installed new plug-ins" window when 
you started firefox the next time?  If not, this sounds like a bug in 
firefox as well.

I'm also trying to figure out why this is a problem at all. You install 
software, part of the software is a plug-in for firefox, firefox now has a 
plug-in. When I install software, part of it can be start menu shortcuts, 
system libraries, new menus in my word processor, etc. I just don't see what 
the problem is, really. It's not stealth, it's not something you can't 
disable, it's not apparently breaking anything else. I wouldn't be surprised 
if the exact same SP patched the click-once code that IE uses, but I don't 
see anyone complaining about that. So I'm kind of at a loss there.

I can understand it wasn't mentioned other than "click-once functionality 
improved" in the KB article, but the outrage seems way out of proportion.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> Chris Cason wrote:
>> I've told you four times now. I was NOT asked or told. You are intentionally
>> ignoring this.
> 
> I'm not ignoring *your* experience.  I'm telling you that *I* wasn't 
> surprised it was installed when I installed it.  What can I say?

Here's a direct quote from your post I made that reply to:

Darren New wrote:
> > not like it's a root kit or something - before the first time it runs, you
> > get FF in your face telling you it has been installed, do you want to
> > configure it or disable it? Hardly "stealth."

 "*YOU* get ff in in your face, telling *YOU* it has been installed, do *YOU*
  want to configure it ..."

Hardly "your" experience, and typical of your other replies, where you tend to
directly contradict the poster. Your extensive use of the third party makes it
clear you intend to refer to the OP, not yourself.

You have successfully hijacked this thread from a discussion of the topic to a
"you were told" "not I was'nt" "yes you were". I resent this; I took the time to
make the post because it's a subject I care about and it's descended into a
series of defences of Microsoft's actions primarily by yourself.

-- Chris

Post a reply to this message

Darren New wrote:
> In any case, did it bring up the "you installed new plug-ins" window when 
> you started firefox the next time?  If not, this sounds like a bug in 
> firefox as well.

No. But rather than a bug in FF, more likely Microsoft used a means that avoids
this (which might be designed into FF, for all I know).

> I'm also trying to figure out why this is a problem at all. You install 
> software,

*Microsoft* installs software. *I* did not install it. Whether it came via
windows update or bundled with another program I can't be sure. I can be sure I
was never asked about it. This is the majority of opinion in articles around the
www. I can think of several ways a KB can be installed without the end-user
being asked, including (I suspect) the "quiet" switch which is provided for
times such as a network roll-out or when it's invoked from another software
package that bundles it.

I can't say whether or not the end-user is asked about it when it's installed
via automatic updates (where they are set to "automatically download and
install" but I would be surprised if they were asked - the purpose of auto
download and install of windows update items is to do exactly that.

> plug-in. When I install software, part of it can be start menu shortcuts, 
> system libraries, new menus in my word processor, etc. I just don't see what 

As a general rule, Microsoft has avoided directly installing stuff into programs
they don't own in the past. And in any event, if I install software from
manufacturer "X", I don't expect them to fiddle with the software from
manufacturer "Y" unless they ask me first. I'd be annoyed at any company - not
just Microsoft - if they did this, and have been so in the past. But this goes
beyond just ordinary annoyance because of *what* they installed.

> the problem is, really. It's not stealth, 

If I'm not told it's being done, it's stealth, at least insofar as modifying
another company's product (*especially* when that product is considered by
Microsoft as a competitor to one of their own programs).

> I can understand it wasn't mentioned other than "click-once functionality 
> improved" in the KB article, but the outrage seems way out of proportion.

The outrage is because there are millions of firefox users who use it BECAUSE IT
IS SAFER THAN IE. IE has been repeatedly demonstrated to be a disaster waiting
for a place to happen. Microsoft has an atrocious record on security, and those
of us who were working in the industry when they first introduced activex (I
was) recall just what a bloody disaster that was.

Consider this from the point of view of someone who uses FF for this reason: why
wouldn't we be outraged when microsoft then rams a piece of potentially buggy
software into our browser, which we are using primarily to avoid using their
buggy browser code??? The majority of us (those who use FF for this reason)
*DO NOT WANT* any Microsoft internet-related code running in FF, it's that simple.

My home network needs to be secure as I work for (and in some cases network
admin for) several firms to whom I have VPN or SSH access. I don't even allow IE
to access the blasted internet! I have a proxy, firefox knows about it, but
Windows and IE do *not*. I occasionally open it up on a separate port to allow
windows update to run, but that's it. I never under any circumstances use IE on
the open internet because of the serious flaws that to this day still are being
discovered and which sometimes lead to drive-by-downloads, trojan and virus
infections, keyloggers, and what have you.

I do not want ANY Microsoft components running inside my browser since they have
proven time and time and time again over the past 14 years that they simply
cannot be trusted to produce secure, well-designed code.

THAT is why I and many are pissed off this appeared in FF without our
permission. Their security record speaks for itself. If you wish to defend
Microsoft irregardless of their record, please do so elsewhere: this is not the
forum for it.

Please: no more replies, no more posts from you on this topic. It gets nowhere
and distracts from the real purpose of the thread.

-- Chris

Post a reply to this message

Darren New wrote:
> In any case, did it bring up the "you installed new plug-ins" window when
> you started firefox the next time?  If not, this sounds like a bug in
> firefox as well.

Or Microsoft set the "notification already shown for this plugin" flag while
installing it.

Post a reply to this message

Chris Cason wrote:
> Darren New wrote:
>> Chris Cason wrote:
>>> I've told you four times now. I was NOT asked or told. You are intentionally
>>> ignoring this.
>> I'm not ignoring *your* experience.  I'm telling you that *I* wasn't 
>> surprised it was installed when I installed it.  What can I say?
> 
> Here's a direct quote from your post I made that reply to:
> 
> Darren New wrote:
>>> not like it's a root kit or something - before the first time it runs, you
>>> get FF in your face telling you it has been installed, do you want to
>>> configure it or disable it? Hardly "stealth."
> 
>  "*YOU* get ff in in your face, telling *YOU* it has been installed, do *YOU*
>   want to configure it ..."

Clearly I should have said "One gets that in one's face." Miscommunication 
there.

Right now, I'm building a new virtual machine, gonna put firefox on it, then 
install windows updates, and I'll see exactly what it does while I'm paying 
attention.

> Hardly "your" experience, 

It was my experience, as far as I recall from the two times I installed the 
stuff here. I assumed the security features in FF that showed me that worked 
for you too.

> and typical of your other replies, where you tend to
> directly contradict the poster. Your extensive use of the third party 

... second party ... ;-)

> makes it clear you intend to refer to the OP, not yourself.

Sure. But earlier I also said "maybe your experience was different."

> You have successfully hijacked this thread from a discussion of the topic to a
> "you were told" "not I was'nt" "yes you were".

Sorry. It looked like "I wasn't told" *was* the topic of the thread.


-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Chris Cason wrote:
> 
> Do you ever recall seeing firefox mention that the extension had been installed?
> (As I mentioned, I did not).
> 
> -- Chris

Not at all. It didn't ask me, FF didn't do it's usual "Hey! You have a 
new plugin" dialog. Nothing.

Had I not read your post, I wouldn't have known about it.
-- 
~Mike

Post a reply to this message

Chris Cason wrote:
> Darren New wrote:
>> In any case, did it bring up the "you installed new plug-ins" window when 
>> you started firefox the next time?  If not, this sounds like a bug in 
>> firefox as well.
> 
> No. But rather than a bug in FF, more likely Microsoft used a means that avoids
> this (which might be designed into FF, for all I know).

Hmmm... Here's what I did. I started a new VM, installed Vista, installed 
all suggested updates but .NET 3.5 SP1, then installed the latest firefox, 
and confirmed there was nothing in the tools menu about Microsoft.

Then I installed SP1.  Contrary to my memory, it did not make me agree to a 
new EULA, so if you told Windows to install updates without asking, it 
probably would do so "silently" as requested.

After rebooting, the first time I started firefox, it popped up the window 
saying "You have new extensions". The default option boxes were both turned 
off, so it doesn't report every version of .NET and doesn't prompt before 
running click-once programs. (Sounds like bad defaults to me.)

If you didn't get that, perhaps you have a different version of Windows of 
Firefox or .NET 3.5 SP1 installed. Perhaps MS got flamed and changed the 
code to be marginally less silent.

http://darren.s3.amazonaws.com/Junk.png because I'm sure at least some 
people will think I'm lying.  I'm sure at least some people will think I'm 
lying and even made up the screen shot, like I work for MS's legal 
department or something.

>> I'm also trying to figure out why this is a problem at all. You install 
>> software,
> 
> *Microsoft* installs software. *I* did not install it. Whether it came via
> windows update or bundled with another program I can't be sure. I can be sure I
> was never asked about it.

Since it was made available via Windows Update and did not require an EULA 
agreement, it's possible it installed itself if you tell Windows Update to 
install things automatically.

> I can't say whether or not the end-user is asked about it when it's installed
> via automatic updates (where they are set to "automatically download and
> install" but I would be surprised if they were asked - the purpose of auto
> download and install of windows update items is to do exactly that.

Usually big things ask, or at least anything where MS wants your agreement 
to a new EULA. For example, I don't think the "malicious software removal 
tool" runs without explicit permission. This update didn't.

> As a general rule, Microsoft has avoided directly installing stuff into programs
> they don't own in the past. And in any event, if I install software from
> manufacturer "X", I don't expect them to fiddle with the software from
> manufacturer "Y" unless they ask me first.

OK.  I guess they figure firefox is getting enough popularity they have to 
support it.  Maybe it comes from the number of people complaining you have 
to use IE to get to particular microsoft-centric web sites.

>> the problem is, really. It's not stealth, 
> 
> If I'm not told it's being done, it's stealth, at least insofar as modifying
> another company's product (*especially* when that product is considered by
> Microsoft as a competitor to one of their own programs).

OK. I guess that's just semantics there. They don't ask in advance, but 
before it runs you get told about it and get the opportunity to turn it off. 
It's modifying another company's product by installing extensions through a 
defined interface. Dunno.

> *DO NOT WANT* any Microsoft internet-related code running in FF, it's that simple.

Doesn't the "disable" button keep it from running? I mean, isn't that what 
that button *does*?  If not, sounds like FF is broken too.

> THAT is why I and many are pissed off this appeared in FF without our
> permission. Their security record speaks for itself. If you wish to defend
> Microsoft irregardless of their record, please do so elsewhere: this is not the
> forum for it.

Fair enough. Now I understand. :-)  I'm not sure why the conversation 
couldn't stay civil.

> Please: no more replies, no more posts from you on this topic. It gets nowhere
> and distracts from the real purpose of the thread.

I'm still curious about the "real purpose" of the thread. :-)

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

> The majority of us (those who use FF for this reason)
> *DO NOT WANT* any Microsoft internet-related code running in FF, it's that 
> simple.

That will be a bit tricky seeing as you have FF running on an OS written by 
MS, if you really do not want any MS code running then use a different OS 
for web browsing, it's the only way to be sure.

Post a reply to this message

scott <sco### [at] scottcom> wrote:
> > The majority of us (those who use FF for this reason)
> > *DO NOT WANT* any Microsoft internet-related code running in FF, it's that 
> > simple.

> That will be a bit tricky seeing as you have FF running on an OS written by 
> MS, if you really do not want any MS code running then use a different OS 
> for web browsing, it's the only way to be sure.

  So basically you are saying: If you use Windows, don't bother even trying
to browse securely. Just use IE and whatever. After all, it's futile to even
try to do anything securely.

  That's the kind of TheDailyWTF style mentality, in the same lines as
"we don't have any passwords in your database server because, after all,
it's impossible to secure it from all possible hacker attacks".

-- 
                                                          - Warp

Post a reply to this message

Warp wrote:
> scott <sco### [at] scottcom> wrote:
>>> The majority of us (those who use FF for this reason)
>>> *DO NOT WANT* any Microsoft internet-related code running in FF, it's that 
>>> simple.
> 
>> That will be a bit tricky seeing as you have FF running on an OS written by 
>> MS, if you really do not want any MS code running then use a different OS 
>> for web browsing, it's the only way to be sure.
> 
>   So basically you are saying: 

No. Basically he's saying FF is still using Windows graphics routines to 
draw, Windows font handlers to load fonts, Windows TCP stack to do TCP, 
Windows DNS clients to look up hosts, Windows image processing code to 
display images, and quite possibly (I haven't looked) Windows cryptographic 
services to deal with certificates.

If you "do not want *any* Microsoft internet-related code running in FF," 
then you're going to have an awful time connecting out the ethernet port 
that Windows is managing to share with all you other applications, as I'm 
pretty sure FF doesn't come with its own TCP stack and ethernet drivers. If 
MS's track record is so awful with shatter attacks, network hooking and 
redirecting, keystroke sniffing, etc, and your security needs are such that 
you can't afford to have a disabled extension in your firefox directories, 
you probably *shouldn't* be running Windows. Which is not to say running FF 
is a bad idea or less secure. It just means you can't run FF under windows 
without running any MS internet related code, which is *exactly* the bit 
Scott quoted.

But hey, a good hyperbole goes miles towards keeping a flame fest alive, so 
who am I to interfere?

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New <dne### [at] sanrrcom> wrote:
> >   So basically you are saying: 

> No. Basically he's saying FF is still using Windows graphics routines to 
> draw, Windows font handlers to load fonts, Windows TCP stack to do TCP, 
> Windows DNS clients to look up hosts, Windows image processing code to 
> display images, and quite possibly (I haven't looked) Windows cryptographic 
> services to deal with certificates.

> If you "do not want *any* Microsoft internet-related code running in FF," 
> then you're going to have an awful time connecting out the ethernet port 
> that Windows is managing to share with all you other applications, as I'm 
> pretty sure FF doesn't come with its own TCP stack and ethernet drivers. If 
> MS's track record is so awful with shatter attacks, network hooking and 
> redirecting, keystroke sniffing, etc, and your security needs are such that 
> you can't afford to have a disabled extension in your firefox directories, 
> you probably *shouldn't* be running Windows. Which is not to say running FF 
> is a bad idea or less secure. It just means you can't run FF under windows 
> without running any MS internet related code, which is *exactly* the bit 
> Scott quoted.

> But hey, a good hyperbole goes miles towards keeping a flame fest alive, so 
> who am I to interfere?

  Spoken language is not always unambiguous. The expression "you are saying"
can have two meanings with a subtle difference:

  1) The literal meaning: "This is exactly what you are saying".

  2) The figurative meaning: "You are writing this, but you seem to be
implying this."
  Or more shortly: "So basically you are implying:"

  I understand perfectly the *literal* meaning of what he wrote, even
without your useless lengthy explanation. However, that literal meaning
seemed to imply what I said, ie. "since you can't avoid using MS software
if you are running your web broser in Windows, then it doesn't really
matter what software you use, and trying to make your system more secure
is useless".

  Or if we put it in other words: He seemed to be implying that if the
attitude is that MS software is insecure, running Firefox on Windows to
get more security (for the reason that MS software is insecure) is useless
because it will be running on top of MS software. The second implication
from this is that running FF is useless and you could just as well use IE.

-- 
                                                          - Warp

Post a reply to this message

scott wrote:
>> The majority of us (those who use FF for this reason)
>> *DO NOT WANT* any Microsoft internet-related code running in FF, it's that 
>> simple.
> 
> That will be a bit tricky seeing as you have FF running on an OS written by 
> MS, if you really do not want any MS code running then use a different OS 

That's not what I said. I said "running *in* FF". I don't understand why you
turn one into the other.

There's a difference between FF running *on* Microsoft software, and FF having
Microsoft plugins introduced *into* it. While we have to at a minimum put up
with FF using the Windows IP stack, mostly the rest of the code that is directly
exposed to the internet in FF is not written by MS. It is precisely this type of
code that has caused so many previous security incidents.

-- Chris

Post a reply to this message

Mike Raiford wrote:
> Chris Cason wrote:
>> Do you ever recall seeing firefox mention that the extension had been installed?
>> (As I mentioned, I did not).
>>
>> -- Chris
> 
> Not at all. It didn't ask me, FF didn't do it's usual "Hey! You have a 
> new plugin" dialog. Nothing.
> 
> Had I not read your post, I wouldn't have known about it.

Thanks for confirming that. It appears that perhaps Microsoft has changed the
behaviour, or alternately the presence or absence of confirmation depends on
other factors unknown to us.

-- Chris

Post a reply to this message

Darren New wrote:
> you can't afford to have a disabled extension in your firefox directories, 

Just to clarify, as I presume you are implying (since clearly Warp made no
statement even slightly like this) that I made such claims:

  1. I have made statements that for security reasons I don't like risking
     having operational Microsoft extensions silently turn up in my FF install.

  2. I have at no time said I "cannot afford" to have a disabled extension.
     Any such implication is at most a distortion and possibly an outright lie.

  3. I have not stated that disabling the extension is insufficient.

  4. I have pointed out that it is not good that Microsoft disables the means
     of un-installing the extension.

  5. You have repeatedly claimed that it is my fault the plugin turned up
     because I ignored warnings, clicked through EULA's, or whatever.

  6. By your own admission you now agree the service pack doesn't present an
     EULA.

  7. At least one other poster in this thread has confirmed that no warning was
     given by FF that the plugin had been installed on his system. This is also
     the experience of the majority of the posts on this topic that I have read
     around the WWW, which while not in itself proof, certainly lends credence
     to my position.

Most of your time in this thread has been spent arguing that I was wrong in my
claims. Now it appears you are resorting to casting aspersions on the *reasons*
I don't like what Microsoft did.

-- Chris

Post a reply to this message

Chris Cason wrote:
>   1. I have made statements that for security reasons I don't like risking
>      having operational Microsoft extensions silently turn up in my FF install.

No, me neither.

>   2. I have at no time said I "cannot afford" to have a disabled extension.
>      Any such implication is at most a distortion and possibly an outright lie.

I neither said nor implied you did.

>   3. I have not stated that disabling the extension is insufficient.

I neither said nor implied you did.

>   4. I have pointed out that it is not good that Microsoft disables the means
>      of un-installing the extension.

I agree with you. I'm not sure why they do.

>   5. You have repeatedly claimed that it is my fault the plugin turned up
>      because I ignored warnings, clicked through EULA's, or whatever.

I admitted I misremembered that.

>   6. By your own admission you now agree the service pack doesn't present an
>      EULA.

Yep.  Odd, since there's a SP1-specific EULA.

Are you somehow trying to embarrass me by pointing out that I took time to 
do the experiments and posted the results indicating that I was mistaken? Or 
are you encouraging me to not, in the future, admit when I've made a 
mistake? I'm honestly unsure of your motivation for this summary.

>   7. At least one other poster in this thread has confirmed that no warning was
>      given by FF that the plugin had been installed on his system. This is also
>      the experience of the majority of the posts on this topic that I have read
>      around the WWW, which while not in itself proof, certainly lends credence
>      to my position.

I can't speak to that, except to say that when I reproduced the situation, I 
got a warning myself. I already admitted that others may be running 
different versions of something that cause different behavior, and even that 
Microsoft may have changed the behavior of the SP1 since the articles noted 
it's behavior.

> Most of your time in this thread has been spent arguing that I was wrong in my
> claims. Now it appears you are resorting to casting aspersions on the *reasons*
> I don't like what Microsoft did.

I wasn't speaking about you, or to you, at all. I was saying that Warp's 
hyperbole was extending the lovely flamefest we're having, as hyperbole 
tends to do.

Try not to read personal attacks into statements that aren't about you. 
Things go more smoothly.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Chris Cason wrote:
> Thanks for confirming that. It appears that perhaps Microsoft has changed the
> behaviour, or alternately the presence or absence of confirmation depends on
> other factors unknown to us.

I tried it a different way. If you install FF *after* SP1, you don't get the 
pop-up warning, but it does wind up being installed. At least in my tests. 
Just so's ya know.

Plus there's another WPF-related plug-in under the plug-ins list. Just so's 
ya can turn it off if it bothers you.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Warp wrote:
>   Or if we put it in other words: He seemed to be implying that if the
> attitude is that MS software is insecure, running Firefox on Windows to
> get more security (for the reason that MS software is insecure) is useless
> because it will be running on top of MS software. The second implication
> from this is that running FF is useless and you could just as well use IE.


That's funny, because that didn't seem to be to me what he was implying at 
all. I, personally, run firefox primarily because IE is such a poster child 
for insecure programming these last couple of years.

As a suggestion, if you're trying to figure out whether someone implied 
something by stating something less extreme, it's often better to say 
something like "are you suggesting that...?" instead of "so you're implying 
that: ..."  The former is a request for clarification, while the latter 
often comes across as ridicule or sarcasm in English, especially when the 
latter is hyperbole.

Of course, on this list, some folks seem to take every opportunity to take 
offense and read people in the worst possible way, regardless of intent. I 
believe you've commented on this yourself. I'm not sure what the solution is 
besides simply accepting that the first option should be to believe the 
writer isn't implying the reader is stupid or evil if there's an alternate 
interpretation.

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> As a suggestion, 

That said, I hope you're amused by the idea of *you* taking advice from *me* 
on how to avoid flame wars. :-)

-- 
   Darren New, San Diego CA, USA (PST)
   My fortune cookie said, "You will soon be
   unable to read this, even at arm's length."

Post a reply to this message

Darren New wrote:
> I tried it a different way. If you install FF *after* SP1, you don't get the 
> pop-up warning, but it does wind up being installed. At least in my tests. 
> Just so's ya know.

Yep. Also note that the extension physically is not installed in the plugins
dir; it's elsewhere in the system. I think Microsoft just sets up the registry
entries in advance.

> 
> Plus there's another WPF-related plug-in under the plug-ins list. Just so's 
> ya can turn it off if it bothers you.

Yah, already done :-)

Post a reply to this message

Chris Cason wrote:
 > I found this article after searching on the subject of an extension that
 > had appeared in my Vista firefox install - one that I had not installed,
 > nor been asked permission to install. I checked my work PC (XP) and it,
 > also, had the extension. I'm surprised there's not more fireworks going
 > off about this, as it's precisely the sort of thing that makes IE so
 > much of a trundling disaster waiting for a place to happen.
 >
 >   http://www.annoyances.org/exec/show/article08-600
 >
 > Bonus: the extension installed by Microsoft has the 'uninstall' option
 > disabled.
 >
 > -- Chris

Thanks for letting us know about this.

I've just watched the .NET Framework update install via Windows Update and 
I can confirm that it does indeed install the extension without asking you 
and with no indication that it's doing it (and it also installed a plug-in 
called Windows Presentation Foundation without asking or notification as 
well).

I had Firefox running while the Windows Update was running and at no time 
was I prompted that an extension or plug-in was being installed and I was 
never presented with the normal extension install warning dialog that 
allows you to allow/reject an install.

Upon restarting Firefox after the Windows Update had completely finished, 
Firefox popped up the Extensions window telling me 1 extension had been 
installed, but I never was asked whether I wanted to install it (so 
couldn't tell it not to install it) and the Uninstall button is disabled - 
not happy.  Additionally the plug-in installation was completely silent; 
even Firefox didn't note that a plug-in had been installed.

I'm extremely surprised that it does this without telling you it's going 
to or giving you the option not to, and I'm surprised that Firefox doesn't 
pop up the standard "do you want to install this extension" dialog asking 
for permission.

Even more alarming is that the extension's option of "Prompt before 
running ClickOnce applications" is not enabled by default!

I have three words for Microsoft:  DO NOT WANT.

I'm astounded that this invasive install practice hasn't been all over IT 
news websites by now.  I use Firefox precisely because I don't want 
websites to be able to do whatever they feel like doing, and in wanders 
Microsoft and force-installs an extension that has the potential to let 
them do just that.

Now I'm going to have to go through the process that the article outlines 
to try to get rid of all this stuff...

I'm amazed that Mozilla hasn't taken Microsoft to task over this; it's 
exactly these kinds of sneaky force-install issues that create attack vectors.

NOT HAPPY.

Lance.

thezone - thezone.firewave.com.au

Post a reply to this message

On a similar note, it appears that recent versions of the Java Runtime  
also silently install a Firefox add-on (called "Java quick starter"). Like  
the Microsoft one, this one also has the uninstall option disabled, though  
it can be removed through the Java control panel.

You also get a Windows service with the same name.


-- 
FE

Post a reply to this message

Bill Gates lost $18 Bill. ($40B remaining) last year I hope he lost 
another $18B on law suits so he and MS actually lear respect for the 
common man. The more time passes the less I like MS.

MS first got into war with Netscape Browser (Mozilla browser mod), years 
later they cried for help to Mozilla, IE7 is FireFox with "MS Vista 
skin", then they hack FireFox... Is this behavior jerky or is just me?

This makes me wonder, are the vulnerabilities of all versions of Windows 
a twisted, uncomfortable and intentional form of control by MS? Since 
they can twist and hack a foreign software why not their own?

Is 4:44 am, maybe I'm not making much sense now, but I despise MS that 
is for sure.

Cheers.

Post a reply to this message