Slashdot Log In
Microsoft Update Slips In a Firefox Extension
Posted by
kdawson
on Sun Feb 01, 2009 10:45 PM
from the hitch-hiker dept.
from the hitch-hiker dept.
An anonymous reader writes "While doing a weekly scrub of my Windows systems, which includes checking for driver updates and running virus scans, I found Firefox notifying me of a new add-on. It's labelled 'Microsoft .NET Framework Assistant,' and it 'Adds ClickOnce support and the ability to report installed .NET versions to the web server.' The add-on could not be uninstalled in the usual way. A little Net searching turned up a number of sites offering advice on getting rid of the unrequested add-on." The unasked-for extension has been hitchhiking along with updates to Visual Studio, and perhaps other products that depend on .NET, since August. It appears to have gone wider recently, coming in with updates to XP SP3.
Related Stories
Submission: Latest Microsoft Update slips in Firefox Extension by Anonymous Coward
[+]
Your Rights Online: MS Issued a Fix For Its Unwanted FireFox Extension 266 comments
As we discussed last February, and again a few days ago after the Washington Post noticed, Microsoft installed without permission a hard-to-remove Firefox extension along with a service pack for .NET Framework 3.5. Reader Pigskin-Referee lets us know that, as it turns out, Microsoft issued a fix a month ago; details here.
[+]
Firefox Disables Microsoft<nobr> <wbr></nobr>.NET Addon 448 comments
ZosX writes "Around 11:45 PM Friday night, I was prompted by Firefox that it had disabled the addons that Microsoft has been including with .NET — specifically, the .NET Framework Assistant and the Windows Presentation Foundation. The popup announcing this said that the 'following addons have been known to cause stability or security issues with Firefox.' Thanks, Mozilla team, for hitting the kill switch and hopefully this will get Microsoft to release a patch sooner." Here's the Mozilla security blog entry announcing the block, which Mozilla implemented via its blocklisting mechanism.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
malware.... (Score:5, Insightful)
Re:malware.... (Score:5, Funny)
Remember Sony?
Yes. Trying not to.
Parent
sony (Score:5, Funny)
Never forget.
Forgetting is key to getting caught again. You can only catch a cat in the same trap once.
Parent
Re:sony (Score:5, Insightful)
Unless that cat is the American public and the time since the last time you caught them is greater than the time since the last episode of American Idol.
Parent
Re:malware.... (Score:5, Insightful)
The true question here is not how to uninstall it. The question everyone should be asking is: is it messing with other settings in firefox, reporting back to MS what other extensions I use, monitoring my web traffic, going to break my browser, new security holes? Maybe I don't want my f'ing browser to report what other software is installed on my computer.
How about this one: Ok Microsoft, you are making automatic changes to software written by other companies without permission or request of the user. I don't care if you say it's just an extension, you didn't ask me! My trust just went right down the toilet.
Note: I noticed this extension the other night on a system in VMWare but I haven't had a chance to look into it yet.
In all fairness I think Microsoft should be forced to open source things they want to add on to NON MS applications. That way people can go take a look... Especially when you don't ask the user permission.
Are there any legality issues with what they just did here?
Parent
Re:malware.... (Score:5, Funny)
Parent
Re:malware.... (Score:5, Funny)
Parent
Re:malware.... (Score:5, Insightful)
Having said that, I wonder if this update is stated anywhere in the ToA.
Parent
Re:malware.... (Score:5, Insightful)
Who's to say this thing isn't a security risk? Microsoft?
Of course, we don't *know* that this software is bad, but my policy with my own machine is that if I don't know what something does, it doesn't run on my computer, which is why my computer still runs smoothly even though I haven't reinstalled Windows for several years.
For those of you who are assuming it's probably safe (and admittedly, you're probably right), there's another good reason to get rid of it. Microsoft changing your browser string to indicate that this piece of software is installed in your browser. The purpose of this, most likely, is to increase the installed base for this software, and use that as an argument to ush whatever new web technology they're pushing. Now that non-IE browsers account for 30% of the total browsers on the internet, Microsoft is losing their stranglehold on web "standards", and they're pulling this crap to get it back.
Don't be a part of it. Remove this plugin, then go into about:config and change your browser string back so it doesn't falsely advertise that you have it installed.
Oh, and as far as Firefox goes... why is the uninstall button grayed out? This feels like a UI issue to me; principals of user-friendliness dictate that I ought to be in control of whether or not I can uninstall an add-on. Even having code in the browser that allows someone to take that freedom away from me is a bad thing. (Of course, is it really Firefox's fault? Is there a technical reason that Firefox *can't* uninstall the plugin?)
Parent
Re:malware.... (Score:5, Informative)
Parent
Re:malware.... (Score:5, Interesting)
Interesting... Would it be possible to change Firefox in such a way that it refuses to recognize those plugins that it can't install?
Parent
Re:malware.... (Score:5, Insightful)
You could, but that would basically mean the system administrator can't make extensions available system-wide. A tradeoff, of course, and assumes that you trust your system administrator somewhat...
Parent
Re:malware.... (Score:5, Insightful)
So why didn't MS enable removal through the "add or remove programs" mechanism?
Parent
Re:malware.... (Score:5, Informative)
If you install something (e.g. an extension) via apt or (I assume) rpm on Linux, Firefox can't uninstall it since it isn't running as root. In that scenario, the button is grayed out with no explanation. But, of course, you can always ask apt/rpm to remove the offending software, or not install it in the first place...
Parent
Mod up. 5 is not enough. (Score:5, Insightful)
Shame on MS. They have been through this before and should know better. Bad. Bad. Negative points. Sad, sad negative Karma.
Parent
Re:malware.... (Score:5, Insightful)
there's another good reason to get rid of it. Microsoft changing your browser string to indicate that this piece of software is installed in your browser. The purpose of this, most likely, is to increase the installed base for this software, and use that as an argument to ush whatever new web technology they're pushing. Now that non-IE browsers account for 30% of the total browsers on the internet, Microsoft is losing their stranglehold on web "standards", and they're pulling this crap to get it back.
This. It doesn't very often happen that a point is so important that I feel the need to quote it entirely and just add a "me too", but this is one of those very rare occasions.
They have just hijacked every Firefox install out there, and are using it to advertise their own product. The only appropriate response would be for Mozilla to automatically refuse it from Firefox with the next Firefox update.
Parent
Re:malware.... (Score:5, Funny)
Is there any difference between Microsoft doing that to Firefox, and Microsoft doing that popup blocker with Internet Explorer when someone does the SP2 update? Or how they force a firewall on you?
You see, Microsoft is akin to a proctologist. Sticking things where they don't belong.
Parent
Re:malware.... (Score:5, Insightful)
I would give up Microsoft Windows....but I like playing games.....
Parent
Re:malware.... (Score:5, Insightful)
Be honest. Have you read the source code of EVERY program you run, and of your operating system? Did you understand all of it? If you have read it all and understand it all, you're either running very few programs and a tiny, simple OS, or you have way too much free time. 'Knowing what someting does' is not a black-and-white thing. To get a good analogy: I can use a car and understand most of its parts without fully understanding the atoms it's made of, or how the car was made. Odds are GP is someone who knowns what all processes on his computer do, even if he doesn't know precisely how they do it. You create a false dichotomy by suggesting it is only possible to know what your programs do when you run an open source operating system.
Parent
Re:malware.... (Score:5, Funny)
Parent
Huh! (Score:5, Insightful)
Exactly! (Score:5, Insightful)
They think they have a right to re-configure the software you use, for their own convenience and profit. That they can install things and you should have no say in the matter.
I am serious. On the corporate level (not most individual employees, I am sure), they really think that way. The evidence is incontrovertible.
Which used to serve them well. But which, in today's environment, is suffering a greater and greater disconnect with reality. I am sure you have noticed this yourself... the most obvious explanation for Microsoft's accelerating loss of market share is simply that they have lost touch with the realities of the market: their users' wants and needs, and, not to make too small a point of it, their business ethics.
I am not surprised at all.
Parent
You have missed the point. (Score:5, Insightful)
(2) Microsoft has every opportunity to give that end user A CHOICE. Yet, typically of Microsoft, they chose not to do so. That was the WRONG decision. And that is how most people view their work machines today: it belongs to me, by damn, and you had better ask me before installing something. As a computer professional, who depends on controlling software versions and so on to guarantee compatibility, this is not an option for me. I insist upon it. Companies that violate that policy are not my friends. They do NOT make my life easier, they make it much more difficult.
(3)They have no right to assume that I want their goddamned "Clickonce" thing to work. Maybe I don't. And in fact, the OP was not about installing it via the web at all, it was about it being installed automatically in the background via SPs and SP updates. This isn't about clicking on a link at all. Please read first before you offer an opinion.
(4) This is NOT about adding a mime-type handler. It is about installing a mime-type handler that some users may not want, secretly, in the background, without asking for permission. And for a BROWSER that isn't even their own product. Not only is this unacceptable to me (because I must always be in control of what is installed on my work machines), it is also typical of Microsoft's arrogant attitude toward their users.
My high-horse is not strictly MS-specific, as you would know if you actually read what I wrote! If any other company did this, I would oppose it just as vehemently. It is just that Microsoft is famous for doing this kind of thing, and here is yet one more example.
Odds are, "ozphx", that I was using Microsoft products professionally before you were out of elementary school. If you don't have a direct counterargument to mine, then please go elsewhere.
Oh... by the way. I agree that including the Google toolbar in Java updates is unethical, too. But at least a choice *IS* offered, and that during a voluntary install. In the case under discussion, it was stated that this software is being added unannounced, as part of an update, without any such option being provided. So there is a bit of a difference.
Parent
Car Analogy For You (Score:5, Insightful)
This is like sending in your Microsoft car for servicing at Microsoft and having the Microsoft mechanic install an extension to your "Firefox" add-on car radio - which you installed yourself, because you wanted an alternative to the embedded Microsoft Car Radio (which cannot be removed without disabling a large part of the car).
An extension that allows you to listen to the New & Wonderful Microsoft Radio Stations, and all installed without asking your permission first.
Just because you chose to add that extension on your built-in Microsoft Car Radio, does not give them the right to install it on your non-Microsoft Car Radios, WITHOUT YOUR PERMISSION.
After all many of us have the Firefox Car Radio just so that we can avoid listening to the Microsoft Radio Stations by accident or mistake or "Just Because Microsoft thinks it's time for you to". When we want to listen to those stations we use the Microsoft Car Radio.
So far I have managed to install the Java crap on various computers without having the google tool bar installed without my permission - they made it optional and I usually deselect all such options.
MS deserves a bashing for this. They are trespassing and are arguably doing an "unauthorised modification" to your computer system, which is a Computer Crimes offense in many countries.
They'd probably get away by giving the various usual excuses. After all, the Sony bunch got away without being jailed even though they did something worse.
Unauthorized modification of one to a few hundred computers and it's "hacking/vandalism", and if caught you can go to jail.
Unauthorized modification of millions of computers and it's called "useful and allowing firefox adoption".
Parent
Allowed scope of updates (Score:5, Insightful)
Re:Allowed scope of updates (Score:5, Interesting)
It is totally unacceptable for Microsoft to interfere with any of the 3rd party software I have installed on my computer whether via their update mechanism or otherwise. If I ever find any of these shenanigans going on I will raise a formal complaint with the appropriate government competition bureau, I encourage others to do the same.
Parent
Re:Allowed scope of updates (Score:5, Insightful)
Which most people assume means things like MS Office and other MS components that are not part of a bare Windows install. I can't imagine anyone thinking this means 3rd party software.
Parent
Re:Allowed scope of updates (Score:5, Insightful)
that's because:
a) most apps in Ubuntu come from the ubuntu servers, not their native homes and are compiled by canonical to work nicely with ubuntu
b) Other apps are hosted in repositories. Some by the program writer, some by other people. But Apt/synamptic manages all the repositories in one place for you! And you can turn them on and off at will. What a concept!! This is what people have been requesting from Microsoft update for the better part of a decade.
Parent
Re:Allowed scope of updates (Score:5, Insightful)
Microsoft Update sure sounds like it will update Microsoft products. Given that Firefox is not a microsoft product, how the hell was I to know they would update it?
Parent
Re:Why get upset? Firefox users avoid proprietary (Score:5, Insightful)
Maybe because...
Just one of those is enough to make something bad.
Parent
Re:Why get upset? Firefox users avoid proprietary (Score:5, Insightful)
I'm seriously confused as to why this is upsetting considering that the average Firefox user installs plugins ...
The point isn't that MSFT is creating FF plugins.
The point is that MSFT is silently forcing plugins without telling us what they do.
This whole thing would have been a non-issue if they had
But MSFT is too arrogantly stupid to do that.
Parent
Amazing (Score:5, Insightful)
Re:Amazing (Score:5, Funny)
Classic move. People noticed. Two steps forward 10 steps back, eh? [emphasis added]
I can't tell if that's binary or decimal or what.
Parent
Intelligence gathering (Score:5, Funny)
Scumware, eh? (Score:5, Informative)
One hint that this "extension" is unwanted garbage is that when you Google (google: Microsoft Framework Assistant) for it and the top links are pages about how to remove it. Then the first link from your site (microsoft.com) is also a forum that mentions getting rid of it...
Anyway, here's how to remove it.
http://www.robertnyman.com/2009/01/26/microsoft-force-installs-firefox-extension/ [robertnyman.com]
Re:Scumware, eh? (Score:5, Insightful)
It does matter because the sites are different. The ones that come up for Microsoft Framework Assistant are forum postings, articles and blogs instead of autogenerated bull-honky.
Parent
Re:Scumware, eh? (Score:5, Funny)
You have a problem with autogenerated bull-honky? This site [simple-pc-help.com] may have the answer!
Parent
but... (Score:5, Insightful)
Re:but... (Score:5, Insightful)
Except in Apple's case, it's somewhat worse... after all, why the fuck would they install MobileMe or Bonjour on my system when I install iTunes?
Why the FUCK do they think I want their networking system along with their player?
Bonjour [wikipedia.org]
Grrrrrrrrrrrrrrrrrrrrrr. Weak. At least the .NET extension is within the realms of making sense.
Parent
Re:but... (Score:5, Interesting)
I don't understand the hatred for Bonjour. It's a discovery protocol, used by Macs for ages. All it does is to make it possible to find other computers.
The only reason I have iTunes installed is because I couldn't find a Quicktime download that didn't come with it. The only reason I have Quicktime installed is because of people who only make their content available as Quicktime files for whatever reason.
*Why* would I want Quicktime to be able to discover other devices on my network? Even if I did, why would I want a service running all of the time as opposed to once every few months when I go to play a Quicktime file?
I can only speak for myself, but that's why *I* hate Bonjour. I wanted Apple's poorly-coded (for Windows at least) proprietary video player. In order to get it, I had to get a bunch of extra software I most definitely didn't want.
I already tried Quicktime Alternative. It wasn't able to play the newest Quicktime variants.
Parent
updating third party software? (Score:5, Insightful)
So it's really nothing abnormal to install an extension in a third party browser. This leaves us with only one issue, the fact that it was distributed via updates to other applications. I refute this as being a major issue for the exact same reason - quite a few programs update/install Firefox extensions as part of their normal update procedure - I raise Foxit Reader as an example, which as of v3.0 automatically installs a Firefox plugin. No one's yelling about that.
A significant question here: If it wasn't Microsoft, would anyone be nearly as angry?
Re:updating third party software? (Score:5, Insightful)
Parent
Is this SO bad? (Score:5, Insightful)
A lot of you will hate me for this...
MS doing this is them trying to ensure that Firefox will work with their web apps (or, web apps built with their technology). Now, granted that they are taking liberties they should not. It would be better to just make the plugin easy to get and install. Consider however that they are doing this so their technology will work on a standards-compliant browser. That's not nothing. It IS dysfunctional in a passive-aggressive way (aggressive-passive?). On the other hand MS is trying to make the browsing experience BETTER for people who use .Net with Firefox. I'm not so sure this is a bad thing. maybe poorly executed...but...there's an argument for saying it's not.
Look, if you were running Ubuntu, installed Opera, and automatically got plugins from Synaptic for Opera that added new functionality would you complain?
Then again, the convoluted removal process should be reconsidered.
Security (Score:5, Insightful)
Given Microsoft's track record with security, I worry:
- Windows user installs Firefox to avoid IE's security flaws. .NET functionality allows websites to host .NET executables.
- Microsoft silently installs a plugin onto Firefox that reports the browser includes
- Hackers discover a way to exploit this.
- Thus, Firefox is now less secure thanks to Microsoft.
Quickly forgotten (Score:5, Insightful)
Anybody remember when Windows "Genuine Advantage" validation software was getting slipped in as part of "critical updates" for things like the Microsoft Flash Player patch? It wasn't really that long ago.
You don't seriously expect Microsoft to *not* do these sorts of things on what they consider to be *their* systems, do you?
Microsoft, huh? (Score:5, Informative)
Here's a look at all the plugins I didn't want and had to disable:
Extensions: .NET Framework Assistant 1.0
- Java Quick Starter 1.0
- Microsoft
Plugins: - Adobe Acrobat
- Java(TM) Platform SE 6 U10
- Java(TM) Platform SE 6 U11
- Java(TM) Platform SE 6 U11 (Yes, again)
- Microsoft(R) DRM
- Microsoft(R) DRM (Yes, again)
- QuickTime Plug-in 7.4.5 (I'll send it to the external player, please)
- RealPlayer Version Plugin (RealAlternative, please)
- RealPlayer(tm) G2 LiveConnet-Enabled Plug-IN (32-bit)
- Windows Media Player Plug-in Dynamic Link Library
So far, that's Sun, Apple, Real, Adobe, and Microsoft messing with my browser without telling me... and only because I'm quite strict with what I install on my system. This isn't Microsoft up to their old tricks, it's just them keeping up with the Joneses, and forcing me to keep up with everyone with an agenda. What else is new?
I do have Silverlight installed, too, but at least the installer for that told me it would work with multiple browsers. Thank goodness the Mozilla people had the fine sense to let people see plugins and extensions, unlike IE6 and friends. Quite a few time I've had to fix someone's compter by hacking out IE extensions from the system registry, and that's not pleasant at all.
YES Unsuspecting... (Score:5, Insightful)
Parent
Re:NOT Unsuspecting... (Score:5, Insightful)
Just because I installed the
Parent
Re:First (Score:5, Funny)
!First. Fail!
...not first, fail not? ugh, this is why I prefer using the bitwise oprtator (~) instead, although in /. lore this is instead in jokes used to mean "home", per the bash usage instead of the one's complement.
Or, I just need to get out more. After asking why all the guys were buying wings and beer on the same day in throngs at the grocery store, I found out the last super bowl was indeed not 32.
Parent
Re:Equal Opportunity Offender... (Score:5, Funny)
Don't worry. IE has so many holes they're no longer news-worthy.
Wait. You mean IE has non-hole parts?
Parent