Slashdot Mirror


Microsoft Update Slips In a Firefox Extension

An anonymous reader writes "While doing a weekly scrub of my Windows systems, which includes checking for driver updates and running virus scans, I found Firefox notifying me of a new add-on. It's labelled 'Microsoft .NET Framework Assistant,' and it 'Adds ClickOnce support and the ability to report installed .NET versions to the web server.' The add-on could not be uninstalled in the usual way. A little Net searching turned up a number of sites offering advice on getting rid of the unrequested add-on." The unasked-for extension has been hitchhiking along with updates to Visual Studio, and perhaps other products that depend on .NET, since August. It appears to have gone wider recently, coming in with updates to XP SP3.

46 of 803 comments (clear)

  1. malware.... by gchesney0001 · · Score: 5, Insightful

    Remember Sony?

    --
    Bite me
    1. Re:malware.... by eebra82 · · Score: 4, Insightful

      I wouldn't class Sony's rootkit 'malware' as much as it was a security risk. This is not even remotely close to how stupid Sony's decision was.

      Having said that, I wonder if this update is stated anywhere in the ToA.

    2. Re:malware.... by Lendrick · · Score: 5, Insightful

      Who's to say this thing isn't a security risk? Microsoft?

      Of course, we don't *know* that this software is bad, but my policy with my own machine is that if I don't know what something does, it doesn't run on my computer, which is why my computer still runs smoothly even though I haven't reinstalled Windows for several years.

      For those of you who are assuming it's probably safe (and admittedly, you're probably right), there's another good reason to get rid of it. Microsoft changing your browser string to indicate that this piece of software is installed in your browser. The purpose of this, most likely, is to increase the installed base for this software, and use that as an argument to ush whatever new web technology they're pushing. Now that non-IE browsers account for 30% of the total browsers on the internet, Microsoft is losing their stranglehold on web "standards", and they're pulling this crap to get it back.

      Don't be a part of it. Remove this plugin, then go into about:config and change your browser string back so it doesn't falsely advertise that you have it installed.

      Oh, and as far as Firefox goes... why is the uninstall button grayed out? This feels like a UI issue to me; principals of user-friendliness dictate that I ought to be in control of whether or not I can uninstall an add-on. Even having code in the browser that allows someone to take that freedom away from me is a bad thing. (Of course, is it really Firefox's fault? Is there a technical reason that Firefox *can't* uninstall the plugin?)

    3. Re:malware.... by BZ · · Score: 5, Insightful

      You could, but that would basically mean the system administrator can't make extensions available system-wide. A tradeoff, of course, and assumes that you trust your system administrator somewhat...

    4. Re:malware.... by whoever57 · · Score: 4, Insightful

      Firefox cannot uninstall plugins that are installed to "sensitive" areas, like the actual Program Files folder.

      So why didn't MS enable removal through the "add or remove programs" mechanism?

      --
      The real "Libtards" are the Libertarians!
    5. Re:malware.... by johannesg · · Score: 4, Insightful

      there's another good reason to get rid of it. Microsoft changing your browser string to indicate that this piece of software is installed in your browser. The purpose of this, most likely, is to increase the installed base for this software, and use that as an argument to ush whatever new web technology they're pushing. Now that non-IE browsers account for 30% of the total browsers on the internet, Microsoft is losing their stranglehold on web "standards", and they're pulling this crap to get it back.

      This. It doesn't very often happen that a point is so important that I feel the need to quote it entirely and just add a "me too", but this is one of those very rare occasions.

      They have just hijacked every Firefox install out there, and are using it to advertise their own product. The only appropriate response would be for Mozilla to automatically refuse it from Firefox with the next Firefox update.

    6. Re:malware.... by Anonymous Coward · · Score: 5, Insightful

      The true question here is not how to uninstall it. The question everyone should be asking is: is it messing with other settings in firefox, reporting back to MS what other extensions I use, monitoring my web traffic, going to break my browser, new security holes? Maybe I don't want my f'ing browser to report what other software is installed on my computer.

      How about this one: Ok Microsoft, you are making automatic changes to software written by other companies without permission or request of the user. I don't care if you say it's just an extension, you didn't ask me! My trust just went right down the toilet.

      Note: I noticed this extension the other night on a system in VMWare but I haven't had a chance to look into it yet.

      In all fairness I think Microsoft should be forced to open source things they want to add on to NON MS applications. That way people can go take a look... Especially when you don't ask the user permission.

      Are there any legality issues with what they just did here?

    7. Re:malware.... by westyvw · · Score: 4, Insightful

      There is a lesson there somewhere.....

      I would give up Microsoft Windows....but I like playing games.....

    8. Re:malware.... by Thiez · · Score: 4, Insightful

      Be honest. Have you read the source code of EVERY program you run, and of your operating system? Did you understand all of it? If you have read it all and understand it all, you're either running very few programs and a tiny, simple OS, or you have way too much free time. 'Knowing what someting does' is not a black-and-white thing. To get a good analogy: I can use a car and understand most of its parts without fully understanding the atoms it's made of, or how the car was made. Odds are GP is someone who knowns what all processes on his computer do, even if he doesn't know precisely how they do it. You create a false dichotomy by suggesting it is only possible to know what your programs do when you run an open source operating system.

    9. Re:malware.... by Yvanhoe · · Score: 5, Insightful

      Because malware usually disable this feature.

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    10. Re:malware.... by Ed+Avis · · Score: 5, Insightful

      is it messing with other settings in firefox, reporting back to MS what other extensions I use, monitoring my web traffic, going to break my browser, new security holes?

      If they wanted to do that, they wouldn't be so stupid as to make it an extension that's clearly visible in the Firefox preferences. Since Microsoft control the operating system and can push out updates for it, any trojan they wanted to install would be much more stealthy.

      If you run Microsoft Windows then you accept that you run whatever software Microsoft chooses to put on your machine, and without source code you have little hope of finding out exactly what it's doing. If you do not trust Microsoft, I suggest you uninstall Windows from your computer right now.

      --
      -- Ed Avis ed@membled.com
    11. Re:malware.... by nazsco · · Score: 5, Insightful

      Mod parent up.

      That's the whole point. You install binary crap from a provider you don't trust. So, don't complain.

      It's not like at this day and age there's still a gun pointed to you to use Windows (in the past i may recognize there were, but not today)

    12. Re:malware.... by Ed+Avis · · Score: 5, Insightful

      I dunno, you could equally well say this shows that Microsoft is starting to accept a multi-browser world and distribute software that works with Firefox and not just IE. If there were no Firefox extension available and you had to use Internet Explorer instead to get this thing to work, there would equally be complaints on Slashdot...

      Remember that the whole point of an extension mechanism is to let third parties modify Firefox. Linux distributions routinely ship patches and modifications to Firefox (and many other applications). And it's not as if no third party software ever installs extensions to Windows...

      --
      -- Ed Avis ed@membled.com
    13. Re:malware.... by BZ · · Score: 4, Insightful

      They didn't "sabotage" anything. They simply installed a system-wide extension. If it's not installed in the Firefox profile, Firefox can't very well remove it (especially if the user it's running as is not privileged).

      Note that the "Disable" button works just fine, as it should. Had they really wanted to prevent this thing being disabled, they could have done that too, you know.

  2. Huh! by ScrewMaster · · Score: 5, Insightful

    This definitely goes into the "WTF?" category.

    --
    The higher the technology, the sharper that two-edged sword.
    1. Re:Huh! by obarthelemy · · Score: 4, Insightful

      This is probably actionnable under whatever covenant MS signed to get out of the antitrust lawsuits against them: they're using the OS (windows update) to modify a competitor's software (FF), in order to give an unfair advantage to one of their technologies/product.

      If that behaviour can be proven, someone stands to make a lot of money. Several someones: the states, the competitors...

      --
      The Cloud - because you don't care if your apps and data are up in the air.
  3. Allowed scope of updates by Statecraftsman · · Score: 5, Insightful

    Microsoft gives us updates all the time and we trust them to fix bugs and security holes. Firefox not coming with their extension is not in the scope of bugs and security holes they should fix. When they overstep their bounds like this ON TOP of an application(esp. a free software application) what might they be doing in their proprietary code under the application? Whatâ(TM)s next, an OpenOffice extension to make sure Microsoft never has an $ where their s is?

    1. Re:Allowed scope of updates by schon · · Score: 4, Insightful

      Microsoft gives us updates all the time and we trust them to fix bugs and security holes.

      What you mean "we", Kemosabe?

    2. Re:Allowed scope of updates by whoever57 · · Score: 5, Insightful

      There is an option that you have to check to allow updates to things other than Windows.

      Which most people assume means things like MS Office and other MS components that are not part of a bare Windows install. I can't imagine anyone thinking this means 3rd party software.

      --
      The real "Libtards" are the Libertarians!
    3. Re:Allowed scope of updates by mabhatter654 · · Score: 5, Insightful

      that's because:
      a) most apps in Ubuntu come from the ubuntu servers, not their native homes and are compiled by canonical to work nicely with ubuntu

      b) Other apps are hosted in repositories. Some by the program writer, some by other people. But Apt/synamptic manages all the repositories in one place for you! And you can turn them on and off at will. What a concept!! This is what people have been requesting from Microsoft update for the better part of a decade.

    4. Re:Allowed scope of updates by aussie_a · · Score: 5, Insightful

      Microsoft Update sure sounds like it will update Microsoft products. Given that Firefox is not a microsoft product, how the hell was I to know they would update it?

  4. Amazing by kcbanner · · Score: 5, Insightful

    Classic move. People noticed. Two steps forward 10 steps back, eh?

    --
    Obligatory blog plug: http://www.caseybanner.ca/
  5. YES Unsuspecting... by Anonymous Coward · · Score: 5, Insightful

    The .NET framework is not required for Firefox to run. Why would any sane person assume installing a totally unrelated framework would scribble all over Firefox?

  6. Re:NOT Unsuspecting... by flydpnkrtn · · Score: 5, Insightful

    It most definitely IS unexpected, because I was never notified anywhere that a MICROSOFT update would entail installing an addon to a completely NON-Microsoft product.

    Just because I installed the .NET framework, I'm subject to whatever else MS wants to do to my computer? Nay, sir, nay.

  7. A good sign! by dclozier · · Score: 4, Insightful

    Although it's not the best approach that could have been taken it is a good sign. If Microsoft can no longer ignore Firefox then all those sites that still require IE to function will begin to follow.

  8. but... by powerspike · · Score: 5, Insightful

    It's Funny, i have had the same issue with apple update, i find it requesting to install updates for programs that weren't installed in the first place, seems like the same thing but different company...

    1. Re:but... by spectecjr · · Score: 5, Insightful

      Except in Apple's case, it's somewhat worse... after all, why the fuck would they install MobileMe or Bonjour on my system when I install iTunes?

      Why the FUCK do they think I want their networking system along with their player?

      Bonjour

      Grrrrrrrrrrrrrrrrrrrrrr. Weak. At least the .NET extension is within the realms of making sense.

      --
      Coming soon - pyrogyra
  9. Re:sony by MrNaz · · Score: 5, Insightful

    Unless that cat is the American public and the time since the last time you caught them is greater than the time since the last episode of American Idol.

    --
    I hate printers.
  10. Re:Scumware, eh? by Kral_Blbec · · Score: 5, Insightful

    It does matter because the sites are different. The ones that come up for Microsoft Framework Assistant are forum postings, articles and blogs instead of autogenerated bull-honky.

  11. Normal for Microsoft by Anonymous Coward · · Score: 4, Insightful

    People think that Microsoft is a software company that is sometimes abusive. But it isn't, in my opinion. Microsoft is an abuse company that delivers abuse using software.

    1. Re:Normal for Microsoft by RobDude · · Score: 4, Insightful

      Oh dear god....

      Looks like someone took an Intro to Philosophy at their university and wants the world to know just how 'deep' they are.

      I bet you didn't even get an A in the class.

      You can sit around for *years* and debate whether or not Slashdot exits, or if it is simply a construct of your imagination. And you can go on and on, at great length; trying to determine whether you can determine *anything* because, everything, as you said, that you can perceive is from your own reference point. How can 'real' be defined.

      The same old, tired, arguments for and against these have been tossed around for, hundreds and hundreds of years. Probably longer.

      Pointing them out, in unrelated contexts...like a Slashdot discussion of Microsoft software patch makes you look like a fresh out of Phil101 college d-bag who plays hacky-sack in the quad after lunch and before BIO 102.

      Next you'll point out how maybe the colors you see are like...ya know...different from what other people and that perception is all relative. WHOA!

      But yeah, the whole 'Like, dude, it's really just a symbol! That's all it is, just a symbol' crap is really a stretch.

      Yes, of course, it's a symbol. Symbols are used extensively by people. It makes communication easier. Is it easier to define a large company like MSFT by saying, 'Microsoft' or 'the company responsible for the creation of Windows, Office, .Net, Visual Studio, etc, etc, etc...' or perhaps a complete list of employees start and end dates would make you happier?

      Of course it's a symbol. Duh.

      Pointing it out adds nothing to the conversation. Nothing. And feeling the need to point it out means that you think you are a LOT more clever than you really are.

  12. Re:Why get upset? Firefox users avoid proprietary by Mad+Merlin · · Score: 5, Insightful

    Maybe because...

    • nobody asked for this extension
    • the extension makes a point of not letting you remove or disable it
    • the extension doesn't help you in any way whatsoever
    • it's Microsoft

    Just one of those is enough to make something bad.

  13. Re:Why get upset? Firefox users avoid proprietary by Nutria · · Score: 5, Insightful

    I'm seriously confused as to why this is upsetting considering that the average Firefox user installs plugins ...

    The point isn't that MSFT is creating FF plugins.

    The point is that MSFT is silently forcing plugins without telling us what they do.

    This whole thing would have been a non-issue if they had

    • added a sentence on why this plugin is useful, and
    • enabled the Uninstall button.

    But MSFT is too arrogantly stupid to do that.

    --
    "I don't know, therefore Aliens" Wafflebox1
  14. updating third party software? by master_runner · · Score: 5, Insightful

    I find it interesting that people here are so outraged at MS installing an extension for third party software, particularly a web browser. Think about how many completely non-Mozilla related products install a Firefox extension - PDF readers, media players, etc. I'll take as an example Adobe Reader, which installs a plugin for in-browser viewing when you install the desktop app (I hate Adobe Reader too, but it's a high-profile example). Firefox is not an Adobe product at all! yet we aren't yelling at that. Additionally, MS already has components installed in FF. Silverlight and the Windows Presentation Foundation are both MS products that are commonly installed in Firefox as plugins, to enable apps that take advantage of Silverlight and .NET browser features to operate in Firefox and friends as well as Internet Explorer. This plugin seems to serve a similar purpose of allowing .NET-powered web apps (which MS wants to be common in the future) to operate in Firefox as well as Internet Explorer. It seems like we should appreciate this move towards interoperability on MS's part - the alternative is only supporting Internet Explorer for web apps.

    So it's really nothing abnormal to install an extension in a third party browser. This leaves us with only one issue, the fact that it was distributed via updates to other applications. I refute this as being a major issue for the exact same reason - quite a few programs update/install Firefox extensions as part of their normal update procedure - I raise Foxit Reader as an example, which as of v3.0 automatically installs a Firefox plugin. No one's yelling about that.

    A significant question here: If it wasn't Microsoft, would anyone be nearly as angry?

    --
    I might be stupid, but that's a risk we're going to have to take.
    1. Re:updating third party software? by Qantravon · · Score: 5, Insightful

      It's not the fact that they're installing an addon, it's the fact that they're not telling you they're doing it, and that they're not giving you an easy/obvious way of getting rid of it.

  15. Is this SO bad? by gorehog · · Score: 4, Insightful

    A lot of you will hate me for this...

    MS doing this is them trying to ensure that Firefox will work with their web apps (or, web apps built with their technology). Now, granted that they are taking liberties they should not. It would be better to just make the plugin easy to get and install. Consider however that they are doing this so their technology will work on a standards-compliant browser. That's not nothing. It IS dysfunctional in a passive-aggressive way (aggressive-passive?). On the other hand MS is trying to make the browsing experience BETTER for people who use .Net with Firefox. I'm not so sure this is a bad thing. maybe poorly executed...but...there's an argument for saying it's not.

    Look, if you were running Ubuntu, installed Opera, and automatically got plugins from Synaptic for Opera that added new functionality would you complain?

    Then again, the convoluted removal process should be reconsidered.

  16. Security by Adrian+Lopez · · Score: 5, Insightful

    Given Microsoft's track record with security, I worry:

    - Windows user installs Firefox to avoid IE's security flaws.
    - Microsoft silently installs a plugin onto Firefox that reports the browser includes .NET functionality allows websites to host .NET executables.
    - Hackers discover a way to exploit this.
    - Thus, Firefox is now less secure thanks to Microsoft.

    --
    "In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
  17. Mod up. 5 is not enough. by Jane+Q.+Public · · Score: 5, Insightful

    Installing software on my computer -- especially software that is designed to make YOUR software work better, at the possible expense of others -- without my knowledge or consent is UNETHICAL . Period. And deliberately making uninstall difficult? INEXCUSABLE!!!

    Shame on MS. They have been through this before and should know better. Bad. Bad. Negative points. Sad, sad negative Karma.

  18. Exactly! by Jane+Q.+Public · · Score: 5, Insightful

    This is where Microsoft shows its true colors. They believe that as long as you are running Windows, they actually have RIGHTS regarding your desktop and the software you run.

    They think they have a right to re-configure the software you use, for their own convenience and profit. That they can install things and you should have no say in the matter.

    I am serious. On the corporate level (not most individual employees, I am sure), they really think that way. The evidence is incontrovertible.

    Which used to serve them well. But which, in today's environment, is suffering a greater and greater disconnect with reality. I am sure you have noticed this yourself... the most obvious explanation for Microsoft's accelerating loss of market share is simply that they have lost touch with the realities of the market: their users' wants and needs, and, not to make too small a point of it, their business ethics.

    I am not surprised at all.

    1. Re:Exactly! by ais523 · · Score: 4, Insightful

      They think they have a right to re-configure the software you use, for their own convenience and profit. That they can install things and you should have no say in the matter.

      They do. Read the EULA.

      --
      (1)DOCOMEFROM!2~.2'~#1WHILE:1<-"'?.1$.2'~'"':1/.1$.2'~#0"$#65535'"$"'"'&.1$.2'~'#0$#65535'"$#0'~#32767$#1"
  19. Quickly forgotten by scdeimos · · Score: 4, Insightful

    Anybody remember when Windows "Genuine Advantage" validation software was getting slipped in as part of "critical updates" for things like the Microsoft Flash Player patch? It wasn't really that long ago.

    You don't seriously expect Microsoft to *not* do these sorts of things on what they consider to be *their* systems, do you?

  20. You have missed the point. by Jane+Q.+Public · · Score: 5, Insightful

    (1) Firefox is not a Microsoft application. It is installed at the will and whim of the end-user. And the end-user should have control over what is installed into their Firefox.

    (2) Microsoft has every opportunity to give that end user A CHOICE. Yet, typically of Microsoft, they chose not to do so. That was the WRONG decision. And that is how most people view their work machines today: it belongs to me, by damn, and you had better ask me before installing something. As a computer professional, who depends on controlling software versions and so on to guarantee compatibility, this is not an option for me. I insist upon it. Companies that violate that policy are not my friends. They do NOT make my life easier, they make it much more difficult.

    (3)They have no right to assume that I want their goddamned "Clickonce" thing to work. Maybe I don't. And in fact, the OP was not about installing it via the web at all, it was about it being installed automatically in the background via SPs and SP updates. This isn't about clicking on a link at all. Please read first before you offer an opinion.

    (4) This is NOT about adding a mime-type handler. It is about installing a mime-type handler that some users may not want, secretly, in the background, without asking for permission. And for a BROWSER that isn't even their own product. Not only is this unacceptable to me (because I must always be in control of what is installed on my work machines), it is also typical of Microsoft's arrogant attitude toward their users.

    My high-horse is not strictly MS-specific, as you would know if you actually read what I wrote! If any other company did this, I would oppose it just as vehemently. It is just that Microsoft is famous for doing this kind of thing, and here is yet one more example.

    Odds are, "ozphx", that I was using Microsoft products professionally before you were out of elementary school. If you don't have a direct counterargument to mine, then please go elsewhere.

    Oh... by the way. I agree that including the Google toolbar in Java updates is unethical, too. But at least a choice *IS* offered, and that during a voluntary install. In the case under discussion, it was stated that this software is being added unannounced, as part of an update, without any such option being provided. So there is a bit of a difference.

  21. Car Analogy For You by TheLink · · Score: 5, Insightful

    "You look like you need a car analogy"

    This is like sending in your Microsoft car for servicing at Microsoft and having the Microsoft mechanic install an extension to your "Firefox" add-on car radio - which you installed yourself, because you wanted an alternative to the embedded Microsoft Car Radio (which cannot be removed without disabling a large part of the car).

    An extension that allows you to listen to the New & Wonderful Microsoft Radio Stations, and all installed without asking your permission first.

    Just because you chose to add that extension on your built-in Microsoft Car Radio, does not give them the right to install it on your non-Microsoft Car Radios, WITHOUT YOUR PERMISSION.

    After all many of us have the Firefox Car Radio just so that we can avoid listening to the Microsoft Radio Stations by accident or mistake or "Just Because Microsoft thinks it's time for you to". When we want to listen to those stations we use the Microsoft Car Radio.

    So far I have managed to install the Java crap on various computers without having the google tool bar installed without my permission - they made it optional and I usually deselect all such options.

    MS deserves a bashing for this. They are trespassing and are arguably doing an "unauthorised modification" to your computer system, which is a Computer Crimes offense in many countries.

    They'd probably get away by giving the various usual excuses. After all, the Sony bunch got away without being jailed even though they did something worse.

    Unauthorized modification of one to a few hundred computers and it's "hacking/vandalism", and if caught you can go to jail.

    Unauthorized modification of millions of computers and it's called "useful and allowing firefox adoption".

    --
  22. Re:Firefox is a web broswer by Jaruzel · · Score: 5, Insightful

    I don't use .NET.

    I bet you do.

    Got Office 2003 ? Some of that is .NET code. Got Live Messenger ? Ditto. Nvidia or ATI graphics cards ? well, those DEFINITELY need .NET to work properly. Let's not forget all those extra bits of freeware you've also got, some of those will be .NET based as well.

    As I understand it, this add-on just alters the useragent to declare that the PC it's running on is .NET capable (i.e. you got at least one version of the .NET framework installed). This is a good thing - as it means MORE sites that have .net extensions or controls will work in FF, meaning you can finally ditch IE completely (in theory).

    Yes their installation methods were suspect - but remember MS's major user base is The Doe Family, who can just about turn their PC on and off. Do you really thing they know the answer to 'Do you really want to install the .NET Framework Assistant ?' - If course they wont know what that is, or whether they need it.

    Does your mechanic, dentist, doctor, explain to you each and every thing they do to you or your car in intimate detail ? No.

    The PC is becoming a closed box appliance. You can't fight this.

    An finally, if you distrust MS SO much - why did you have Windows Updates on anyway!?

    --
    Together, We Can Make Slashdot Better. I Do NOT Mod ACs. - Check Me Out
  23. Re:sony by hairyfeet · · Score: 4, Insightful

    Well allow me to add that it is NOT, I repeat NOT just Visual Studio. I don't have Visual Studio installed and this "extension" was installed along with the latest patch for DotNET V3.5. So pretty much anyone who has FF and has the latest version and patches for dotNET is affected.

    How are they allowed to get away with this? Isn't installing BHOs that are not asked for and cannot be uninstalled without hacking pretty much the definition of malware? If some company like Gator or WhenU pulled this crap they would be busted. So why is MSFT allowed to pull this crap? And how do we know that this "extension" wouldn't cause problems or add bugs to FF? Seems like a great way to hamstring your competition to me. I just hope they get called to the mat for pulling this crap, because as far as I'm concerned this is the definition of malware. After all I didn't ask for it or give them permission to install it, they disabled the common way to remove it, and the only way to get rid of it was to hack both the reg and my prefs.js file. Sounds exactly like the kind of crap I deal with removing malware BHOs for customers.

    --
    ACs don't waste your time replying, your posts are never seen by me.
  24. Re:sony by commodore64_love · · Score: 5, Insightful

    Not a big deal???

    Microsoft modified *another company's products*. What's next? MS is going to start adding updates to VLC player or Utorrent or OpenOffice or WordPerfect?!?!? They shouldn't be messing with non-microsoft products.

    --
    "I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall