Sun Slips Firefox Extension Into Java Update

pcardno writes "It seems it's not just Microsoft that have spotted a good opportunity to distribute their software through Firefox Addons. On installing the latest annoying, sysbar bubble based Java update, my Firefox informed me that I had a wonderful new Java addon automatically. Here's the addon screenshot. Yes, I could opt out of it, but why are Sun installing Addons to my Firefox without me making specific choices in the application itself? To be clear — I have never chosen to install this Addon, yet it has been installed without my permission with the latest Java Update."

Comments

You get what you pay for.

[Divebus]

You get what you pay for... and then some.

Re:You get what you pay for.

[TheKidWho]

The less you pay, the more you get!!!

And you'll like it too.

Re:You get what you pay for.

[jetsci]

...the last time 'Sun' slipped me something I woke up groggy and sore...

Re:You get what you pay for.

[Anonymous Coward]

or mozilla can fix the fucking bug.

https://bugzilla.mozilla.org/show_bug.cgi?id=446139

Re:You get what you pay for.

[telchine]

The less you pay, the more you get!!!

And you'll like it too.

You make an interesting point in that it's free as in beer. However, isn't Java GPL'd nowadays?

Has anyone created a JRE installer that you know, just installs the Java runtime without any of this Sun crap?

Maybe it'd be a good project. After all, there are less intrusive versions of closed software like Quicktime and Real Player (in the form of Quicktime Alternative and RealAlternative).

Re:You get what you pay for.

[Anonymous Coward]

This makes me hear a little voice say, "That is not a bug, but a feature to protect users from themselves." Grrr, that can be so evil!

Re:You get what you pay for.

[Anonymous Coward]

Send a bill to Sun. $5 per kilobyte or part thereof, per month. CC the Attorney general of their HQ location state, CA I believe? About the 20th one arrives in the mail (of a stream of 2 or 3 million), and both the AG and Sun will sit up and pay a LOT of attention! Come on guys -bill away!

Re:You get what you pay for.

[theshowmecanuck]

Sure, use Mozilla Firefox so that you can avoid proprietary browsers that may exploit their users by forcing them to install or use services that we don't want. Or even install plugins and such without telling you! [look of utmost shock and horror] Those horrible proprietary browser makers!! [/look of utmost shock and horror] Imagine... oh those horrible vendors. Just imagine them installing plugins to your browser that could compromise your security... impact your system's performance... possibly open up your personal information to being 'borrowed' etc. etc. etc. And they don't even tell you or give you a way to uninstall them! Sheesh, or just the nerve installing something without telling you... the nerve! That would be like malware! BUT... if you use our super slick browser, Firefox, you can avoid all that. WE won't do that!

Yes folks, use Firefox since we aren't some big proprietary company and we won't do that. We won't install addons or plugins without your knowledge and especially without you being able to uninstall them. We are Mozilla: open source and secure and all for your rights online! But what the heck, we won't stop the big proprietary companies from installing stuff on your machine without you knowing or being able to uninstall it. That just wouldn't be right! It would be like stepping on THEIR rights. And heck, it's only YOUR machine, what the hell do we care?

It's not like we got our market share with your help by advertising ourselves as the browser that is more secure and better able to prevent malware from installing on your system. Next time don't install any Sun Java updates and stop bugging us about your problems... we have better things to do than making it easy to uninstall unwanted addons snuck in with seemingly benign updates... like coming up with cooler Mozilla home pages telling everyone how cool we are.

It was only a matter of time after Mozilla was incorporated that this type of thinking was bound to take root there.

Re:You get what you pay for.

[thePowerOfGrayskull]

Erm.... this had nothing to do with Mozilla. Sun's java updater installed a firefox plugin. Mozilla didn't install it. Mozilla didn't endorse it. In fact, all mozilla did was build a browser.

But hey, don't let the facts get in your way...

Re:You get what you pay for.

[BikeHelmet]

I don't see why people are upset about this.

1) The addon/plugin is tied to your computer - not your profile. It's similar to installing quicktime. It registers plugins with your browser. But for some reason it shows up as an addon rather than as a plugin - perhaps because of the featureset it requires? It looks like they split prefetching functionality from the main plugin, so that it can be disabled if desired.

2) It's easy to turn off. Just go to the java control panel and disable it. If you can't figure it out, here. (first result on google)

3) Prior to Firefox 3, nobody even knew this stuff was running. Now you do, and you actually have the option to disable it, or totally remove it. Isn't this a good thing? Why are you screaming now that you know it's there?

4) This happened something like 6 months ago.

5) This feature was not "slipped in". Sun wrote about it in April 2008. Maybe if you were going to throw a fit, you should've done it when they first announced it.

6) Technically you did choose to install the addon. It's part of Java. A checkbox when installing would be nice, but really, isn't required - especially since this is easy to disable, and the functionality is known, and has been disclosed for almost a full year.

If you want something ludicrously invasive, go look at OpenOffice. It silently steals file associations, has no way to manually register extensions, etc.; half the changes they make are so poorly documented that deploying a new version in a production environment can leave things totally FUBAR.

(not that I'm dissing them - just pointing out that this isn't a big issue to me, because Sun did just about everything right, and people are still screaming about it - typical)

Re:You get what you pay for.

[theshowmecanuck]

Hey fan boy... sorry to burst your bubble, but opt out types of transactions especially when they don't let you opt out... e.g. you can't uninstall them. Java and MS .net installed unadvertised software... that is the Mozilla add on. Mozilla allows them to use a feature of Mozilla to prevent people from uninstalling an add on, even if it was not installed with the users knowledge. I know that is a fine point for you to grasp, but Mozilla is complicit in this due to their negligence... negligence since they obviously know this situation exists. And instead of helping users of their product, they blow them off by saying "talk to the people who installed stuff on your machine that was not advertised as part of their update". Something like a cop telling saying to you, "what do you expect me to do, go ask the thief to give back your money." People want Mozilla to modify the add on mechanism to allow any add on to be removed so this situation doesn't happen again. But if you don't think this is an issue, lend me your PC for a few hours, I promise I'll only install useful stuff... I'll even tell you what I'm installing... and I promise I won't install anything else with enough hooks to make it difficult to uninstall, and impossible to uninstall if you are an average user. Give me break.

Re:You get what you pay for.

[binford2k]

You're an idiot. Filesystem permissions are not a Mozilla feature. Stop talking. Now.

Re:You get what you pay for.

[atraintocry]

I know that is a fine point for you to grasp

Ironic, since you don't have a clue. The actual reason is that if you don't use Firefox to install the add-on, Firefox doesn't know where the files are located. In addition, if they are in the application directory, a privilege elevation is required.

The worst you could say is that it's shortsighted. It is certainly not malice. These are the type of devs that deny huge memory leaks over and over again with a straight face, remember?

In any case, you can always disable any add-on. And if you think Java is malware then I wouldn't have my PC in the same state as you, let alone lend it out.

Re:You get what you pay for.

[contrapunctus]

You realize OpenOffice is Sun?
So you are comparing Sun with Sun.
I think most of the angst comes from that it doesn't ask, you just find out after the fact (I know great setup for a joke!).

Re:You get what you pay for.

[The Snowman]

You make an interesting point in that it's free as in beer. However, isn't Java GPL'd nowadays?

Java 6 SE License. In a word, "no." Sun have talked about open sourcing Java, and I heard it was, but I just read the license and it does not look open-source to me. Regardless, I know for a fact they were not going to use the GPL, but another OSI-approved license, perhaps the Sun Public License?

Re:You get what you pay for.

[AmiMoJo]

The reason it upsets people is because some of us believe that we should have total control over our computers, including what software is installed on them and how.

A lot of people seem to think that Windows just gets slower and slower, until eventually you throw your PC away and buy a new one. Of course, that isn't really the case, but to prevent it you have to be very careful about what you install.

Java is actually a pretty good example of "crapware" which silently installs startup items, browser plug-ins and cache directories in places other than where you told it to install to. In fact, the "Java Quick Starter" is one of the worst offenders, along with Adobe Acrobat and Quicktime, because even though it makes Java start a bit faster it makes your PC start slower and wastes resources. It's a bit like the old days of DLL hell, where every vendor would just overwrite all the DLLs their software needed because if it broke someone else's software it wouldn't be them getting the support calls.

Re:You get what you pay for.

[thePowerOfGrayskull]

Well said. Not that GP will get it, he seemed to be having too much fun tossing insults about ;)

Re:You get what you pay for.

[Anonymous Coward]

But hey, don't let the facts get in your way...
I think you missed an important point. If a browser allows some 3rd party to install a plugin without user knowledge or permision, um, that's a huge security risk. Unless there was a EULA from Sun or a "click here for x browser plugin", yes, Mozilla is every bit to blame. Have a nice day.

Re:You get what you pay for.

[moonbender]

Um I think that's the point. He says that if you're going to criticize them, do it for OpenOffice.

Re:You get what you pay for.

[Anonymous Coward]

5) This feature was not "slipped in". Sun wrote about it in April 2008 [sun.com]. Maybe if you were going to throw a fit, you should've done it when they first announced it.

Something about a notification posted in a basement for a Vogon construction project... beware of leopard?

Re:You get what you pay for.

[iwan-nl]

The open source java implementation (OpenJDK) is a separate project. http://www.sun.com/software/opensource/java/

Re:You get what you pay for.

[leenks]

Java has been released under the GPL (pretty much all of it, bar a few small parts that are unable to be released due to patent / licencing issues). The Java you download from Sun is under their licence because it contains those patent uncumbered pieces still.

For linux you can download IcedTea which is essentially a build of the open sourced Java7 code from openjdk.org.

Re:You get what you pay for.

[tyrione]

Exactly! Oh but I can't live without my Twitter!! It just makes me all a flutter!

Re:You get what you pay for.

[CommanderIsm]

i would never have quicktime anywhere near my network and as for the bug-ridden, virus carrying java - go stuff yourself with common-sense - unless of course your are american - which explains everything, microshaft is the most popular os only because it is pre-installed on pc's, and people don't know enough to get rid of it (and get a refund) - and not because of choice. Apple has been lifting ideas from Linux (and everyone else) for years and yet people have been marveling at it's wonderful inventiveness. i bet you are so clueless as to think o' bummer as president is equally wonderful. your comments demonstrate you clearly do not know how to use software, let alone write about it as if you do. you don't get what you pay for.

You're right--convenience sucks

[perspectival]

Yes, now you have Java working in Firefox. Turn it off if you don't like it. Simple.

Re:You're right--convenience sucks

[Jeff DeMaagd]

The problem is that this should be an opt-in system, not opt-out later by going in.

You talk about convenience, but they certainly don't offer as convenient of an opt-out as they should have.

Re:You're right--convenience sucks

[Anonymous Coward]

Yeah, just like bonzi-buddy or gator or any number of other crap add-ons that installers feel you need.

And resident "quick starters" are just so fucking arrogant (pardon my french), whether it is in the browser or the sys tray.

Re:You're right--convenience sucks

[SatanicPuppy]

In order to have this happen to you, you have to install a completely optional automatic update package from Java, so you are opting in.

That it doesn't ask you again later doesn't mean much.

Re:You're right--convenience sucks

[davester666]

Same with Acrobat Reader (at least on Mac OS X, probably also on Windows), where Adobe installs, both without warning OR notification that they install Adobe AIR. And they don't use Apple's installer, so you can't even find out what files they've spammed to you system.

Acrobat Reader 8-109 Mb
Acrobat Reader 9-190 Mb

Re:You're right--convenience sucks

[techno-vampire]

so you are opting in.

You are opting in to the update, not the Firefox extension. That's installed silently as part of the update. The only reason it was detected was that Firefox told him that it had been installed, after the fact. If it were, as you claim, opt-in, he would have been asked if he wanted it before it was installed. See the difference?

Re:You're right--convenience sucks

[Anonymous Coward]

You're right, you have to turn it off - because you sure as hell can't uninstall it.

It's unwanted, it's unneeded (Java works fine without it) and it's useless (all it does is waste memory and make Firefox take even longer to start).

So why does Sun force it onto us without even asking? Damned if I know.

Fortunately it's easy to disable. Unfortunately it gets reenabled every single time you update Java, which is a fairly routine thing thanks to the massive number of security holes lingering in Java. (Even worse, if you allow it to update automatically, this just happens in the background, so your only sign that it got reinstalled behind your back is Firefox randomly being slower).

Honestly, I only have Java installed for a couple of "enterprise" applications I use that require the massive Java bloat. I'd much prefer it keep its hooks out of my browser: Java applets are dead and have been for years. The only reason I have Java at all is thanks to the "enterprise" weenies who think that J2EE makes everything better.

But you can't keep it out of your browser. Install it, and it sticks its hooks into your browser without giving you an option. Even better, it now advertises Open Office and demands that you register Java.

But this isn't really news - Sun's been doing that for at least the past year and quite possibly longer. It's not a new feature.

It's still scummy, and makes me incredibly wary about using any Sun software (eg Open Office and MySQL) for fear of what Sun bloat now lingers in them.

Re:You're right--convenience sucks

[SatanicPuppy]

It's automatically updating the entire JRE, and you're worried about some little plugin? That's like opting in to unprotected anal sex and then freaking out at the post-coital cuddling.

Re:You're right--convenience sucks

[TinBromide]

"It's automatically updating the entire JRE, and you're worried about some little plugin? That's like opting in to unprotected anal sex and then freaking out at the post-coital cuddling."

Can you phrase that in some form of a car analogy?

Re:You're right--convenience sucks

[techno-vampire]

I'm not objecting to the addon as such, but as a matter of principle: if they're going to give you a plugin as part of the update, they should at least have the good manners to ask you first. And, in fact, I'm not going to go looking for it on my copy of Firefox, because it only applies to Windows, and I use Linux.

Re:You're right--convenience sucks

[Anonymous Coward]

Its like getting a call from an auto dealer with the words "Thanks for buying the car, by the way there's a body in the trunk."

Re:You're right--convenience sucks

[fburton]

Users' choice between opt-in and opt-out should be made systemwide, imo. There should be an option to enforce the wish not to have any software installed on the computer (without the user being asked first).

Re:You're right--convenience sucks

[Tawnos]

It's like opting in to unprotected anal sex in the back of a voltswagen, then freaking out at the small back seat size when in post-coital cuddling?

Re:You're right--convenience sucks

[cabazorro]

Like getting a free oil change and complaining about the windshield sticker next service reminder?

Re:You're right--convenience sucks

[SatanicPuppy]

You're downloading the wrong packages. If you download from the main java download page it doesn't include the extra crapware.

It will still show a splashscreen for OpenOffice though. Shocking. Quite shocking.

Re:You're right--convenience sucks

[meatmanek]

There's a nifty program called fseventer which lets you watch file changes in real time.

Re:You're right--convenience sucks

[Anonymous Coward]

For those of us who don't drive cars, can you phrase that in some form of sticks and stones analogy?

Re:You're right--convenience sucks

[gEvil (beta)]

A voltswagen? Is that some new electric car I haven't heard about?

Re:You're right--convenience sucks

[Anonymous Coward]

I have no idea what you're talking about, because I have no idea where else you'd get Java from. My experiences come from downloading Java from the very link you gave.

Which means that, apparently, there is an even more bloated version of Java out there.

That's a scary thought.

Re:You're right--convenience sucks

[thetoadwarrior]

At least you can opt out. I still have MS' .Net framework assistant listed in my add-ons despite uninstalling the software that put it there.

Re:You're right--convenience sucks

[colinrichardday]

It's like playing Fast and Furious in rush-hour traffic, then worrying about developing carpal-tunnel syndrome from how you hold the steering wheel.

Re:You're right--convenience sucks

[Anonymous Coward]

I really appreciate all of the hard work the Mozilla team has put into their open source products. I wonder, however, why no one has mentioned them as part of the problem either today, or a couple of days ago when Slashdot had a similar story regarding Microsoft's forced hidden add-on installation.

I see a potential (and easy) solution: Have Firefox deny addition of any add-ons without the end-user explicitly agreeing that they are OK with the addition of the add-on.

[Mozilla used to allow one to download compressed binaries for windows instead of MSI packages. Wish they still had this as one of the download options ...]

Re:You're right--convenience sucks

[FearForWings]

It's made to have shocking sexual acts in. I hear the optional Tesla seat warmers help to electrify the mood on a cold night.

Re:You're right--convenience sucks

[ColdWetDog]

Nice, thanks.

Re:You're right--convenience sucks

[Anonymous Coward]

Which means that, apparently, there is an even more bloated version of Java out there.

that'll be when you start running Java apps :-)

Re:You're right--convenience sucks

[mrclisdue]

It's like throwing a stone to knock an apple out of a tree, only to find a worm in the apple.

Re:You're right--convenience sucks

[Anonymous Coward]

Tesla was celibate, you insensitive clod!

Re:You're right--convenience sucks

[ShieldW0lf]

You are opting in to the update, not the Firefox extension. That's installed silently as part of the update. The only reason it was detected was that Firefox told him that it had been installed, after the fact. If it were, as you claim, opt-in, he would have been asked if he wanted it before it was installed. See the difference?

I can't test this myself, don't have a Windows machine here, but every time I've installed Java on Windows in the past, it scanned my machine and asked me if I wanted to install support into each of my browsers, which generally consisted of Firefox and IE. And after I said yes, it did some mucking about in the internals of my browsers to make them interact properly with JRE.

If you already did this, in the past, then you already gave them consent to integrate into your browser. So, the difference is, now you can see the evidence in your Add-On's list, where before you couldn't.

So, this doesn't resemble MS's stunt at all. Nice move posting a big fat broken link right at the top of the story, by the way. Smooth...

Re:You're right--convenience sucks

[Anonymous Coward]

And why the hell are you installing Acrobat READER on Mac OS X anyway? The OS itself can open and print PDF files and can even "print to PDF" from all programs.

Re:You're right--convenience sucks

[Score Whore]

Um, JVM have always included plugins for browsers. Being shocked or surprised at this is like being flabbergasted and croggled by Mozilla Corp adding a "know your rights" bar rather than a click through EULA in version 3.05. Or like the FSF including a getwchar() in libc.

It is what it is.

Re:You're right--convenience sucks

[Anonymous Coward]

Well, he did click on a file stating he "wanted files installed on his computer".

If you want to get down to it, if I had to click yes no to each individual file (not program, but file) just to make sure it didn't install something I didn't "consent to" I'd be pretty annoyed during install.

Do you want to install "README.TXT"?
Do you want to install "RANDOM.INI"?
Do you want to install "SOMEOTHER.DLL"?

God forbid.

Oh god! ssh just made a directory called .ssh and installed some crap in there too! Without my consent?

And so on...

Re:You're right--convenience sucks

[Plug]

Sounds like a very uncomfortable place.

Re:You're right--convenience sucks

[davester666]

Every once in a while, a PDF will render better in Acrobat Reader than Preview. But I haven't come across one in quite some time. I used to have Reader 5 as my default PDF reader on Mac OS X (years ago), because it was faster and more compatible than Preview (back then), but with Tiger and Leopard, Preview has totally kicked Reader to the curb.

I would say, since version 8 (maybe even 7), Acrobat Reader has jumped the shark, with wacky 3D features, more DRM then you can shake a stick at, Javascript scripting, video and audio support, and now just throwing in AIR, just to artificially boost their install base. Adobe seems to have forgotten what their original reason for PDF was, and is now just throwing everything they can think of into it...

Re:You're right--convenience sucks

[Alien Being]

ANY VENDOR should make it an opt-in when they're about to change the behavior of ANY existing software on the install target.

Adding/substituting a JVM plugin to something as ubiquitous as Firefox is a blatant example of this type of negligence/abuse.

Comparing this to the addition of unicode support in an OS library is just trolling, Mr. Score Whore.

Re:You're right--convenience sucks

[Anonymous Coward]

Yes. They are used in the Library of Congress.

Re:You're right--convenience sucks

[Anonymous Coward]

automatic updates for java should only include packages that modify thier product, the java jre, jvm and jdk. they DO NOT get to install firefox extensions.

Re:You're right--convenience sucks

[krewemaynard]

It's like opting in to unprotected anal sex in the back of a voltswagen, then freaking out at the small back seat size when in post-coital cuddling?

Now we're getting somewhere.

Re:You're right--convenience sucks

[HJED]

This is not new there has been a browser plug-in auto installed at least since JRE 1.5

Re:You're right--convenience sucks

[HJED]

Part of the JRE is applet support in browsers so it is and always has been part of the JRE.

Re:You're right--convenience sucks

[Alsee]

That's like opting in to unprotected anal sex and then freaking out at the post-coital cuddling.

Sounds like my ex girlfriend.

-

Re:You're right--convenience sucks

[Anonymous Coward]

nice font asshole

Re:You're right--convenience sucks

[Score Whore]

I don't think you get it. These are pull updates, not push updates. No one forces you to upgrade. It is opt in.

And by the way this horrible, terrifying new plugin that has everyone cowering in fear -- you know, the one that preloads a bit of the JVM so that applets and whatnot start up faster -- is part of the JVM. It's exactly like any other new feature in an upgrade.

Stop crying and recognize that it is the user that chooses to click the update button in the notifier.

Re:You're right--convenience sucks

[Tawnos]

Dumb misspelling on my part, brilliant marketing for Volkswagen. "The Volkswagen Voltswagen - you can't spell it, but we sure can sell it!"

Okay, that was lame. I'll put down the bottle o' booze and leave now.

Re:You're right--convenience sucks

[BitZtream]

It was opt-in you moron, you opt'd in when you installed Java. Did you install Java to have it NOT work?

Re:You're right--convenience sucks

[Mozk]

You can uninstall the addon by opening regedit and deleting the jqs@sun.com entry under HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions.

Or just put this in a .reg file and run it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"=-

Re:You're right--convenience sucks

[theshowmecanuck]

Check this comment from up above.

Re:You're right--convenience sucks

[icannotthinkofaname]

It's like filling up your gas tank at a self-serve pump, and then complaining when you realize that the guy who runs the gas station replaced the fluids in your engine free of charge.

Re:You're right--convenience sucks

[thePowerOfGrayskull]

Combine 15% truth with 85% bullshit, and voila! Instant troll mix!

Re:You're right--convenience sucks

[ConceptJunkie]

Did you install Java to have it NOT work?

Based on my experiences with Java on Linux, I always assumed Sun thought that's what I was trying to do.

Re:You're right--convenience sucks

[shutdown -p now]

Its like getting a call from an auto dealer with the words "Thanks for buying the car, by the way there's a body in the trunk."

I'd have thought it's more like just getting the body in the trunk without the dealer warning you?

Re:You're right--convenience sucks

[Anonymous Coward]

Your last girlfriend gave you anal sex? Dude, I'm sorry to hear that.

Re:You're right--convenience sucks

[Anonymous Coward]

I usually ride the subway to work. Can you please use an analogy applicable to me? Thanks.

Re:You're right--convenience sucks

[knorthern knight]

> I see a potential (and easy) solution: Have Firefox deny addition of any
> add-ons without the end-user explicitly agreeing that they are OK with
> the addition of the add-on.

    Impossible. Firefox is *AN APPLICATION*. It runs part of the time, and only with user privileges. Most program installers/updaters require/demand that you
A) close all other applications
B) give them administrator privileges to perform the install

    How is a a user-level application *THAT ISN'T EVEN RUNNING* when the Java install/update takes place, going to stop an administrator-level program??? As for "explicitly agreeing", I'm sure that *AN ADMINISTRATOR-LEVEL APP* can start Firefox, and click on the "I Agree" dialogue button.

    The only way to be reasonably certain of no changes in your extensions is to
1) Get a list of all of files, and MD5 checksums thereof, in the extensions folder of each account for Firefox.
2) Un-protect a floppy disk
3) Save the filelist and checksums to a floppy
4) Set the write-protect tab on the floppy
5) Each time you willingly install an extension, GOTO 1
6) Start a background job, *WITH ADMINISTRATOR PRIVILEGES* to check all
      extension directories in all accounts against the data on the write-protected
      floppy, once every 5 minutes
7) If it finds any changes, have the background app jump out and warn you

Even that won't protect against a Sony rootkit that hides files from ordinary users.

Re:You're right--convenience sucks

[I cant believe its n]

Well, you need to keep up with the Jonses.

Re:You're right--convenience sucks

[Anonymous Coward]

That's like opting in to unprotected anal sex and then freaking out at the post-coital cuddling.

In different words: a typical male.

Re:You're right--convenience sucks

[mpe]

I see a potential (and easy) solution: Have Firefox deny addition of any add-ons without the end-user explicitly agreeing that they are OK with the addition of the add-on.

Interestingly it does make a fuss (as in requiring you to take several steps) if you attempt to install an XPI file from anywhere other than Mozilla addons site.
However here a third party installer adds the extension/add-on without either the installer or Firefox even mentioning it. It's also unclear if this has been installed globally or per user. If Sun wants to provide a Firefox extension they should provide an XPI file like everyone else!

Re:You're right--convenience sucks

[BitZtream]

You're whining because you can't uninstall (only disable) half a meg of application, but you're okay with having the entire JRE installed?

Do you have any idea how incredibly stupid you sound?

I'll help you though.

Open regedit
(the following should be done for both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER for any users you want this to apply to)

Go to the 'SOFTWARE\Mozilla\Firefox\Extensions' key (This may be different if you are using an alpha or other version running as a codename (like shredder) rather than a standard release build).

Remove the registry key for the offending extension.

After this, you can also probably remove the directory that key points at if you want it 'uninstalled', you really should use the apps uninstaller unless you're prepared to deal with issues later from the apps own upgrader/uninstaller. Since you're already being a whiney little bitch, I'll just accept you're going to do that no matter what happens.

Now, set the permissions for this registry key to deny write by everyone. You won't be able to write to it yourself, but you can fix the permissions later.

Next go to the directory where you installed firefox and remove the plugins from there. Again set the permissions on the directory (and subdirs/files!) so that you aren't allowed to write to them. You don't need to normally, writes go to your profile directory, only globals go to the main app dir.

Now, you can stop your whining because nothing is going to be installing random firefox plugins or extensions on you. You can then immediately start whining when you can't install some plugin/extension globally because you just made it impossible to do so.

As the original post said, You're right -- convenience sucks.

Further more, disabling a plugin is effectively the EXACT same as uninstalling it with the exception of when you open the plugin manager. If the plugin manager window is not open, the plugin has nothing in memory. The only thing loaded when the plugin manager window is open are what you see in the window and the manifest files that have to be loaded to find the information displayed in the plugin manager window.

I ask again, do you have any idea how stupid whining about the fact that you can't uninstall a half a meg portion of a 20 meg install sounds?

Re:You're right--convenience sucks

[BitZtream]

BTW, there are hooks like these in the unix versions as well, of course you don't use the registry, you use a file in /usr/local/etc (or wherever your os stores this particular type of config file). I've not done global installs of firefox extensions on unix in over a year, so I'm short on the exact details, sorry :/

And also note, installers can do the exact same 'sneaky' thing in every OS, this isn't just a windows thing or a firefox thing. This is what happens when you run someone elses code (regardless of where it came from or if its OSS) you really don't know whats happening under the hood unless you've audited every line and compiled everything yourself, including the compiler!

Re:You're right--convenience sucks

[try_anything]

Most software distributors provide an easy, careless route through the installer -- just keep clicking OK. I think that's a fine thing to do, since most people just don't care. What do I need installed for Java to run well on my system? Don't tell me; just do it.

People who are more picky can find out what's going to be installed and opt out. They're a (supposedly) more sophisticated minority, so they can assume the relatively light burden of finding the checkboxes, understanding what they mean, and checking them or unchecking them as they desire.

Anyone who takes the careless route through an installer -- not taking the time to find out what the installer actually installs, and just clicking "OK" as fast as possible -- can't really complain if they end up installing something they didn't want, unless the installer is labeled in bad faith. That certainly wasn't the case here. Sun just wants their product to perform better in Firefox so people are more likely to have a positive perception of it.

Re:You're right--convenience sucks

[mrclisdue]

It's like mugging someone on the subway for his ipod and discovering that it's a zune.

Re:You're right--convenience sucks

[leenks]

The last time I installed the JRE on windows I'm sure it asked me which browsers I wanted to install Java support into (on a wizard page that listed IE and Firefox with checkboxes next to them).

Re:You're right--convenience sucks

[Anonymous Coward]

Voltswagen: Ref to animated movie "Rock and Rule"?

Old

[RockMFR]

I mentioned this during the discussion about the Microsoft add-on three weeks ago. How is this news now?

Re:Old

[Anonymous Coward]

Here is your cookie.

Re:Old

[Cl1mh4224rd]

I mentioned this during the discussion about the Microsoft add-on three weeks ago. How is this news now?

And it's been going on for longer than that; a few months at least.

http://forums.mozillazine.org/viewtopic.php?f=38&t=921325&st=0&sk=t&sd=a&start=15

Re:Old

[antdude]

Who wants Internet cookies? :P

Re:Old

[Anonymous Coward]

I mentioned this during the discussion about the Microsoft add-on three weeks ago. How is this news now?

It's not. And the article poster seems to be confusing the MS approach of installing an addon you don't want & can't disable, with the Java quicklauncher.
And just for the record, the quicklauncher has always been there- in the past you didn't see it in any of the browsers & had to actually disable it via the Java console. This is actually a good change that happened at least a year ago... now the quickstarter will only kick on when you open the browser, and can be disable on a per-browser basis.

But keep whining, with a little luck they'll put the pre-loader back into the driver and just consume that memory 100% of the time.

Beurk

[Anonymous Coward]

Man, Windows GUI really looks like ass.

Or is that a screenshot from 1990?

Re:Beurk

[TheKidWho]

You judge how well your desktop works based on how "pretty" the GUI looks?

Re:Beurk

[Lord_Sintra]

It's using the `Windows 2000` theme, so it's 9 years old. How was Linux/Mac/OS-of-choice looking back in 2000?

Re:Beurk

[Anonymous Coward]

Better thanks to Enlightenment. ;)

Re:Beurk

[Forty Two Tenfold]

He does. He's an MacOS X user and runs Aqua. OOOOH LOOK MOMMY - A SPINNING CUBE!!!!!!11 MOMMY WHEN I CLOSE A WINDOW IT DISAPPEARS IN A PUFF OF SMOKE!!!1 I AM A L33T APPLE FANBOI AND MY SYSTEM KNOWS WHAT I WANT BETTER THAN I DO!! OH AND MY HAND ONLY HAS ONE FINGER!!

FTFY

Re:Beurk

[Anonymous Coward]

Actually, he didn't say anything about how well it worked. He said it looked like ass.

Surely even a Windows user can comprehend that something can work well *and* look like ass at the same time, right?

Re:Beurk

[geekboy642]

I know you're just trolling, but I would love an extension like Compiz for my mac. Sorry, I'm easily amused, and the professional, simple, clean graphics that come with OS X just get boring.

Re:Beurk

[_Sprocket_]

Kinda like some of the WinXP and Vista options I've seen recently. Seriously. I'd see some themed WinXP desktop and I'd wonder what Linux distro they're using.

Re:Beurk

[peragrin]

So go find quartz desktop and set your desktop background to a Quartz composition.

When i feel like burning CPu cycles cool and randomly. i use that with the RSS screen-saver. It makes an awesome but almost useless eye candy background. My only real wish with it, is if someone took, the RSS screen-saver and instead of rss feeds fed it cpu speeds, network data, HD performance, etc. that would be really cool Rotating information.

Re:Beurk

[Anonymous Coward]

You judge how well your desktop works based on how "pretty" the GUI looks?

I own a Mac, you insensitive clod.

So, yes.

Re:Beurk

[BitZtream]

Its the screenshot from a typical complainer, no change is ever acceptable, so when he upgrades his OS the first thing he does is tries to make it just like it used to be.

I used to be the same way. Now I have a 2 week rule, whenever I enter a new GUI enviroment I force myself to use it for 2 weeks in the way it was 'intended' to be used. If at the end of that 2 weeks its not pissing me off, then the problem was simply the change and getting used to it.

If at the end of the two weeks I still beat my head against the desk because its stupid (Vista) then I refuse to use it again, and don't.

This has made pretty much every OS I've used since 95 acceptable to me after the 2 week period, and I end up not getting so annoyed when I go use someone elses machine that uses defaults.

Vista failed this test (and for reference, that means so did Windows7 since there really aren't any noticeable changes other than the taskbar).

I find it amusing however that you pick on the GUI, unless you happen to be using OS X, I'd be willing to bet your OS of choice has a craptastic GUI as well.

Re:Beurk

[BitZtream]

Enlightenment didn't make shit look better. 10 hours screwing with it and customizing it did, which you could do with other window managers as well.

Screw with the Windows GUI settings for 10 hours, it probably will look good too, had you not been to wrapped up in yourself to realize that.

Re:Beurk

[Anonymous Coward]

I judge system performance based on how responsive the system is, it's total memory load index while idle, and the amount of pagefile use.

I agree with the GP. Java is not something I personally like, despite it's "cross platform capabilities." I have many reasons for disliking it, especially on a win32 machine:

1) It installs a boatload of processes which gobble up resources while idle, just so you can get that tiny added functionality out of Open Office (Which could have just as well been implemented using the win32 api, or some other standard GNU api set for linux instead, and been leaner, and not prone to #2 below)

2) It's presence is exploited by a number of viral/malware droppers via embedded java applets in webpages (specifically advertisement scripts from banners) which either inject a process outside of the JVM and into a core process (like explorer, or CSRSS) or drop files in sensitive areas which cause the system to automagically infect itself on reboot.

3) The functionality it provides is only useful to developers who have an explicit need for cross platform at the penalty of lugging a software virtual machine along for the ride. (Which is actually a very small number of highly specialized scenarios, and NOT the case for your average hobby project which would have been both leaner, and more efficient if you had just used native APIs instead.)

It has absolutely nothing to do with how "purdy" my GUI is. It has everything to do with how I personally detest Java for being a waste of resources, and a crutch for programmers to lean on so they dont have to make (or use) native (capable)libraries.

It was created to be implemented on set-top devices like DVRs, and in personal electronics, like Mobile Phones, so that Java can be the De-Facto standard for development on/for those platforms, even though the hardware of the devices can change drastically. It was NOT created to be used on platforms that ALREADY HAVE a native set of APIs.

Trying to force the issue with Java in your software is a one-way ticket for me to totally ignore your software, since it smacks of desperately trying to make a square peg fit a round hole, simply to convenience the programmer (which is something one could contend, because Java is pretty hard to program in, and do it 'well') at the expense of inconveniencing the end user, which is a terrible design approach to begin with.

Java should stay in the niche market it was DESIGNED for, and not try to self-promote itself in other areas, such as on personal computers, except for development environments for developing for said niche market devices.

Re:Beurk

[atraintocry]

He judged how it looked. Incidentally, that's a pretty good lookin' straw-man you set up.

Re:Beurk

[toddestan]

It's actually older than that. There wasn't much of a difference visually between Windows 2000 and Windows 98, with the most obvious being the switch from teal to light blue for the default background. And the 98 GUI was pretty much the same as Windows 95 if you installed IE4.

Re:Beurk

[fava]

Maybe that's my problem. I only used KDE4 for a week before throwing up my hands and went back to 3.5 So if I want to do this right do I have to use KDE4 for another week or do I have to start over again from the beginning?

Obviously this is something you need....

[dmomo]

Or so says Sun. That being said... I cannot think of one thing I might need a Java tool bar for. Honestly, I have not read the article yet and am sitting here trying to think of one useful thing such a tool might do for me. Anyone?

Re:Obviously this is something you need....

[dmomo]

Ahhh.. silly me. It's a toolbar to help Java start more quickly. Anyone find this valuable? Is there a yes/no toggle: "Start quickly, don't start quickly?"

If you encounter a java applet does a popup ask you... "would you like this to start quickly"? Can I disable it from starting quickly? HELP.. java is starting too quickly.

Deep breath.

Please discuss!

Re:Obviously this is something you need....

[Anonymous Coward]

Look a lot of apps have agents that load on startup so that when you want them the visual startup time is much shorter, because it has been differed to when the system started up.

Over the history of Java people have complained about how long the JVM startup time is. While Sun has made many improvements in this over the years, the FF add-on just assists this even more. When you launch FF and this add-on is enabled it initializes the JVM and the applet sub-system.

This way if you go to a site that has an applet on it, it will appear and be function much more quickly.

Re:Obviously this is something you need....

[radish]

It's not a toolbar (what made you think it was?). It's just an extension which preloads some java stuff so that applets load faster. Don't want it? Uninstall it.

Re:Obviously this is something you need....

[Anonymous Coward]

BTW, this is not a toolbar. It's an extension. it's easy enough to remove anyway... http://www.java.com/en/download/help/quickstarter.xml

Re:Obviously this is something you need....

[thetoadwarrior]

It's not a toolbar at all. It's not visible. It just improves Java start times which is why I didn't remove it. It's definitely more helpful than his silly and pretentious Latin generator to prove he's a "master" web designer or the google toolbar he has installed which is rather pointless seeing how Firefox searches google by default in its own search box.

Re:Obviously this is something you need....

[afidel]

This simply starts the JRE when you launch Firefox so that there isn't the delay when starting your first applet. It's the same as IE and Office being preloaded with Windows so that they pop up instantly when you click the icons.

Re:Obviously this is something you need....

[Anonymous Coward]

It's not a toolbar (what made you think it was?).

His hate-fueled delusions against anything that he doesn't personally approve of?

Re:Obviously this is something you need....

[gbjbaanb]

It's the same as IE and Office being preloaded with Windows so that they pop up instantly after your new 5 minute boot time.

there, fixed that for you.

Re:Obviously this is something you need....

[petermgreen]

Am I the only one who hates developers who decide to hide thier bloat somewhere the user won't associate it with thier software (such as the system startup time or the browser startup time)?

Wait, what?

[Anonymous Coward]

Dude, you installed the java taskbar updater and you're worried that it installed a little Firefox plugin? That thing is pointless as far as I'm concerned, but one of it's "features" is keeping the JRE in your browser up to date. That's what it does. That it adds on a plugin at the same time is trivial because updating the JRE is a much much bigger deal: Java ain't afraid to break shit with it's JRE updates.

If you don't want it pestering you and downloading tiny incremental JRE updates every week or so, don't fricking install it! It's purely optional. Everything works just as well if you don't have it installed, and it's really better to control your java lib upgrades. It's not quite as bad as letting glibc automatically update every time there is a new version, but it's up there.

Stop this right now

[AlterRNow]

Could Firefox add some sort of public/private key extensions signing so I can sign extensions I want to use? Then unsigned extensions wouldn't be loaded and this sort of thing could be stopped ( by the technical minded anyway ).

Re:Stop this right now

[dmomo]

Sounds like a great idea for an extension!

Re:Stop this right now

[TheKidWho]

Maybe, but the source code is available, why don't YOU do it?

Re:Stop this right now

[DJRumpy]

Why not just remove the Firefox exception from your Security / Exceptions so that it prompts for every addon you install, regardless of source?

Re:Stop this right now

[AlterRNow]

I would if I knew . But I don't.. yet.

Re:Stop this right now

[tkinnun0]

Firefox is open source, so WorksForMe and PatchPlease.

Re:Stop this right now

[AlterRNow]

Oops, that was supposed to read:

I would if I knew <insert programming language of Firefox> . But I don't.. yet.

Re:Stop this right now

[AlterRNow]

I'll be right on it after I have figured out if some people can tell the difference between an end-user demand ( which I agree would warrant the "it's open source, you can write a patch yourself" response ) and a programmer throwing an idea into the field for review because he *already knows* it is open source and he can write a patch himself.

Geez *eye roll*

Re:Stop this right now

[BitZtream]

Or, you could just disable the addon that it just told you was installed.

Signing will do you no good. You think Sun isn't going to sign their extensions if it became a requirement? When you implement crappy hacks like digital signatures as a 'safety feature' the bad guys are the FIRST ones that do it.

Digital sigs do nothing but help verify WHO SIGNED THE PACKAGE. They tell you nothing about who actually wrote it, what it does, if its safe, how much damage it can do or anything else.

Its good to see you suggesting things that you have no idea how they work though, thanks, contribute more to the problem.

Re:Stop this right now

[Renegade Iconoclast]

Could Firefox add some sort of public/private key extensions signing so I can sign extensions I want to use? Then unsigned extensions wouldn't be loaded and this sort of thing could be stopped ( by the technical minded anyway ).

Yes, it could. You can also take out your garbage, walk your dog, and feed your kids. Like, now dude. Chop chop!

Re:Stop this right now

[AlterRNow]

so I can sign extensions I want to use

Emphasis mine. I want to sign the extensions with *my* key pair. It'd be a completely local thing.
i.e. If an extension has not been signed by my private key ( verifiable by the corresponding public key I gave Firefox ), it is disabled.

Its good to see you replaying to suggestions without actually reading them though, thanks.

Re:Stop this right now

[AlterRNow]

Two things:
s/replaying/replying/;

Digital sigs do nothing but help verify WHO SIGNED THE PACKAGE.

The entire point behind my suggestion. Firefox, if I haven't signed this extension, don't load it.

Malware

[MoZ-RedShirt]

Watch out! It seems that some other malicious updaters installed IEtab and a twitter addon in your firefox, too!

Re:Malware

[Anonymous Coward]

and Google TOOLbar

I thought Google already was in the the little search bar by default anyway, what do you need another toolbar for?

Firefox exntension probably covered in the EULA

[normandr]

which no one reads

Re:Firefox exntension probably covered in the EULA

[Anonymous Coward]

Yeah, well, life's too short to waste it reading all that legal drivel. I click OK so the program will install, not because I actually agree to anything. Besides I let a feral cat that lives in my front yard install everything now.

simple solution,

[Anonymous Coward]

click dis-the fuck-able

Re:simple solution,

[legirons]

click dis-the fuck-able

Simple solution: read the EULAs in full. And when you don't like them (e.g. Google Earth EULA which gives them root access to your PC) then don't install.

And anyone whose product or business depends on you having Java installled... well this is a good discussion to point them to when you call their support line saying "it just doesn't work"
 

Re:simple solution,

[Toonol]

That's not a simple solution. It's faster and easier to laboriously go through directories, removing addins, fixing problems that might result... much easier to do that than to read in full every EULA you are presented with.

Re:simple solution,

[legirons]

That's not a simple solution. It's faster and easier to laboriously go through directories, removing addins, fixing problems that might result... much easier to do that than to read in full every EULA you are presented with.

Agreed, it's not practical to read every EULA if you use non-free software (although it's very easy if you use mostly GPL/BSD, or if you install from debian repositories where the licenses have already been checked for you)

However, even a quick scan of an EULA will tell you a lot.

For example, if it has an extra section tacked-on the end describing some 3rd-party license (e.g. iTunes EULA has this) then you know it's bundling some hidden extra software.

Similarly, blank-check licenses tend to stand-out -- if there's a section like "we will publish new copies of this license and you hereby agree to the new version" then run far far away. (in the physical world, banks tend to use this type of clause a lot)

Automated software updates tend to be described in their own section, so a quick scan of the EULA tells you whether to expect programs running constantly in the background (e.g. Google software)

You can also look for text which gives the vendor root-access to your computer (or to your company network, or to your buildings via audits), typically described in its own section. I haven't seen many of those recently though; having not installed much "enterprisey" software.

If you want to practice by reading an EULA which is pure evil and contains every malicious trick in the book, go and have a read of paypal.

EULAs can be quite insightful into the vendor's history and desires. Like the free downloads whose licenses still mention that you can't install *both* the 3.5" disks and the 5.25" disks to different computers. Or the software that prevents you benchmarking it (databases). You may not use the Solitaire game to control a nuclear power station. You may not export WinAmp to syria. Your database app is known to the state of california to contain chemicals that will cause infertility.

Relax...

[djupedal]

"First you bitch about the baby, then you bitch 'cause we're not married!"

Maybe the add-on is required by F'fox in order to enable new shizzy feature xyz - get over it.

If you really want something to bitch over, think about all the stuf that you NEVER know that comes deep within the package...

I think you have a bigger problem

[Anonymous Coward]

It looks like your desktop color depth comes from an 8-bit Nintendo pallet :(

some info, please

[bcrowell]

What is a "sysbar bubble based Java update?"

The whole thing seems like a total yawner to me. When I install a package on my ubuntu box, it will typically have side-effects. It may have to install other software that it depends on, and possibly make changes to my system's configuration (e.g., the default if you install apache or ssl is to activate the relevant service). I may or may not agree with Canonical and Debian's choices. If I disagree with them, I can either override them, or choose a different distro that I think does a better job in this area.

He seems to be having an experience on Windows where he's unhappy with the side-effect decisions Sun has made. Although it's on Windows, it seems to be basically the same as the type of issue you can get with a Linux distro, or with any other OS. One possible difference is that packaging of FOSS on non-free OSes generally sucks to high heaven compared to Linux -- and you generally have far fewer choices, and there's nobody looking out for your interests as a user. Well, you make your decision to use Windows and that means you've made your decision to use a system where FOSS packaging sucks.

Re:some info, please

[SatanicPuppy]

It's an automatic update watcher that runs all the time in your taskbar and keeps your JRE up to date.

It's an optional feature that is required by absolutely nothing, and one of the things it does is updates your browser. Apparently now it adds an extra update that does some prefetching that makes java load faster, and we must all riot because we didn't specifically ask for that one.

Re:some info, please

[Anonymous Coward]

I got to go through a Etch -> Lenny update (that for the record, I really didn't want to do) that caused all sorts of things to happen that I didn't want to happen as a side effect.

Like... why did Apache suddenly decide that *:80 meant only listening on IPv6 addresses? (I didn't even WANT IPv6 but I got it anyhow, plus the bonus of only listening on IPv6 addresses)

And so on.

telnet :: 80 works...
telnet 127.0.0.1 80 does not...

Needless to say, I had to disable IPv6 support in the kernel, 'cause for the life of me I couldn't figure out how to get Apache stop using IPv6 addresses exclusively. (everything was back to normal after removing IPv6 support from the kernel)

In the process it also installed apache2.2-common, and some other stuff I didn't expect.

Should I sue?

Re:some info, please

[Anonymous Coward]

Making Java load faster costs resources. Because it is now doing work that it would have to do when Java loads.

Let's assume you use Java twice per year, and then for only a specific application -- or hell, maybe you are just wanting to use Java for this specific program once ever.

Can you understand why the start-up time of Java matters a lot less than even a slight slowdown to Firefox startup, or spreading the surface of the attacks that can occur on your browser, or a slight load on your entire computer/bandwidth?

This user wants to be able to run Java apps, and wants the install to drain zero, nada, zilch other resources above and beyond that point.

Unlike Microsoft, this one benign and documented

[salahx]

All this plugin does is speed up loading of Java applets. Its benign, and Sun provides instructions on how to turn it off: http://www.java.com/en/download/help/quickstarter.xml .

Is this case a big deal?

[dwalsh]

Applets, you have heard of them?

When you install / upgrade Java, you get support for the latest Java runtime in your browser to run those applets. It has been thus since the olden times (the mid-nineties when Java was launched).

From the description, this is just a performance optimization so the runtime is loaded and you don't get a delay when there is an applet in the page.

Whether I am right about what the plugin does or not, installing / upgrading the Java Runtime Edition has always affected your browser.

Re:Is this case a big deal?

[gad_zuki!]

Right. There's always been a java extension/plugin/control etc. I guess slashdot is targeting the 'OMG ALL CORPORATIONS SUCK AND ARE AFTER ME!!!!' crowd, which sadly, gets ad impressions.

Re:Is this case a big deal?

[tepples]

From the description, this is just a performance optimization so the runtime is loaded and you don't get a delay when there is an applet in the page.

And then it slows down browser startup. This would appear to result in a net slowdown the majority of the time, when there isn't an applet on any page that I visit during a session. If your usage patterns differ from this and you do want to preload the JRE, try putting an applet on your homepage.

bitch, bitch, bitch. You wanted Java, right?

[ClioCJS]

And of course if it asked you and it said no, complainers like you would be complaining about how Firefox doesn't properly support JAVA later.

And of course, if you were a dumbass who didn't understand what extensions were, you might say No out of fear, and then later decide you don't like java. And then later decide buying an iPHone isn't that bad, because it doesn't support java, but java never works anyway.

At some point, you have to let the machine work for you. Remember all the people who complained about windows asking your permission before doing anything possibly harmful? Seems like whether you ask people or not, someone is going to whine on either side of the fence.

In a world of whiners, I'd rather have Javascript work on their browsers.

There's enough problems with things BROKEN because people DON'T do automatic updates. Then when updates to happen automatically, people STILL whine.

Can't win.

Re:bitch, bitch, bitch. You wanted Java, right?

[db32]

Java != Javascript.

Re:bitch, bitch, bitch. You wanted Java, right?

[Janek Kozicki]

I assigned F12 hotkey to quickly toggle javascript on/off. I don't need a hotkey to toggle java on/off because I use it so rarely, that I can go to menu and click to enable it.

Re:bitch, bitch, bitch. You wanted Java, right?

[r7]

And of course if it asked you

From the screenshot it doesn't appear there was anything to ask, as it was disabled. Installed but not enabled would seem to be as opt-in as plugins or extensions get. It is certainly better than the ones Mozilla installs that you can't even uninstall. Not different from what Ubuntu and MS are doing.
What we need now is an open repository for plugins. The current Mozilla-managed repo is a bit too Google-friendly for my tastes, especially when I'm looking for the Scroogle plugin.

Re:bitch, bitch, bitch. You wanted Java, right?

[Anonymous Coward]

java is to javascript as car is to carpet.

Re:bitch, bitch, bitch. You wanted Java, right?

[vikstar]

People who understand what "!=" means will already know that, so

Java does NOT equal Javascript.

Re:bitch, bitch, bitch. You wanted Java, right?

[weighn]

!= <> =

(Dilbert in a cap, with his tie stuffed in his mouth)

Re:bitch, bitch, bitch. You wanted Java, right?

[socsoc]

There is no real reason anyone needs Java, every applet I have seen can be accomplished in a better way.

Re:bitch, bitch, bitch. You wanted Java, right?

[Jurily]

Then when updates to happen automatically, people STILL whine.

I know I do. Mobile dialup, 3 Gb a month. After that, I pay per Mb. Anything that wants to use the internet without my explicit permission is BAD. Do I need to tell you how fast I'm deleting anything that doesn't play by my rules?

Automatic updates are good on grandma's broadband, but not all users are morons, and frankly, not even bothering to ask me is highly offensive.

P.S. This goes for some Linux distros as well.

Quickstarter....

[nvrrobx]

It helps preload the JVM so that any Java applets load faster.

It's not some evil conspiracy.

You told it to update your computer. It didn't tell you exactly what it was doing. Does Microsoft Update tell you everything it's going to touch?

If you don't like it, run Linux, install SELinux and block everything by default.

Not trying to sound like a dick, but this really is a non-issue.

Re:Quickstarter....

[FishWithAHammer]

You told it to update your computer. It didn't tell you exactly what it was doing. Does Microsoft Update tell you everything it's going to touch?

If you ask, yes.

(Even eeeeeeeeeeeevil WGA is in the list!)

Re:Quickstarter....

[Anonymous Coward]

So if we switch over to Solaris then we don't have to worry about Sun spying on us without our knowledge? Sounds like someone is overstepping their bounds a bit. With Microsoft, you know what you pay for and that's what you get. OSS works the same way but on a different spectrum. To be honest with you, I don't know where this fits.

Re:Quickstarter....

[Seth Kriticos]

Running Linux /w Firefox here. No default Java extension in sight here. If I want Java, then I have to use the system package manager and install one version of it purposefully (either the sun or the open source version).

With Windows it was always like giving up freedom for ease of use. Now it does stuff to ease use and you are all complaining. Can you please decide, if you want freedom or dictatorship? Both don't work together.

Re:Quickstarter....

[mcfedr]

It isnt a no issue, its not cool when the java automatic update, which you think, fine, that will update my java...but no! it comes with some dodge toolbar as well... so many people i know end up with loads of these things, not knowing where they are from or how to get rid of them the number of little things when your click through an installer and it has a tiny tickbox for 'install google toolbar' or whatever... not cool!

Re:Quickstarter....

[Blue Stone]

Are you kidding? How your troll of a comment ever got modded 5 Insightful, I don't know.

If you don't like it, dump your OS? This is as insightful as saying if you did't like the way Bush was running the USA, move to another country.

You're right it's not an evil conspiracy. Then again, no one ever said it was, apart form your straw man.

It is not a non-issue.

When a party modifies a third party's software without permission and blocks the uninstall facility of that modification it is an abuse - of trust and ownership of the computer in question.

It's entirely unacceptable.

In the spirit of your own comment (for illustraive purposes only, mods) if you don't like what I just said, stop using slashdot and move to digg.

Re:Quickstarter....

[Anonymous Coward]

The only thing I'd like is if an extension was installed in the system plugins area and not the users profile, the ability to uninstall it from user space... not having a grayed out uninstall button and having to jump through hoops.

Re:Quickstarter....

[Anonymous Coward]

This is the same bullshit Microsoft pulled, and it's just as bad. There's no opt-in, it modified stuff unrelated to what I'm updating (The JRE), and therefore it should be opt-in or disabled entirely.

Re:Quickstarter....

[Anonymous Coward]

by yelling at sun for sneaking this in without asking explicitly we sent the message to all software makers that we won't stand for crap like this. sun may be benign but then what would have been the harm in them bothering to ask first?

if a company like MS or Apple had attempted something like this you can bet you ass even if the extension were benign, they would have been using it to test the waters and gauge what else they can get away with.

Re:Quickstarter....

[ion.simon.c]

If you don't like it, run Linux, install SELinux and block everything by default.

Pff. I'm using grsecurity, you insensitive clod.

Re:Quickstarter....

[drolli]

Yes. If you dont like it change the OS. I did not like DOS, so i changed to OS/2. I did not like that OS/2 was not supported decently so i switched to Linux. What exactly is your problem. We live in a free world. On your personal perconal Computer you may install whatever you like. If something severy does not fit you, stop using it. And yes. One of the reasons why i did not consider to move to US was Bush. Not because of political reasons (although one could think about that too), but plainly because Visa procedures got completely unacceptable (I knew Germans having Position on extremely good universities in US, being stuck in Germany for weeks, because it was impossible to apply for an extension from inside US). I dont like waiting senselessly. And i don't exactly see how it is an abuse of trust if a Software whose main function is to provide java (mainly in Browsers) does something which causes java to load faster (even if in general would disgree about preloading as a good idea for performance, but thats just my two cents). And about stopping using slahsdot: his comment was moderated +5, yours +2. Works fine for me, so i stay. Rants on slashdot still dont get many modpoints. good.

Bug 446139

[Val314]

Just FYI: the RFE to remove those addons was marked WONTFIX by mozilla, because "they should be removed by the Installer that put the files there".

IMO it has to be possible to remove them from the Add-On manager.

Re:Bug 446139

[ADRA]

Why cry about a plugin. If you really hate the add-on enough then just disable it. Hate it so much that you can't live with it? Uninstall java and choose to never use it again.

Re:Bug 446139

[Val314]

I just want to manage *all* Firefox plugins from within Firefox, not only those that are in my profile

Why shouldnt this be allowed?

Re:Bug 446139

[BitZtream]

For many reasons. Firefox may not have rights to manage the files. Firefox may not have any idea of the secondary operations that need to happen during the uninstall process for a plugin.

Put simply, Firefox can not possibly deal with every variation of plugin out there, so expecting Firefox to be able to completely manage every plugin is just silly.

People have to make custom hacks and scripts for 'installers' that are designed to do just that (Your favorite package manager or InstallShield for windows, ect), you expect Firefox to know how to do everything they do as well?

Firefox's job is to let you browse the web, not function as a installer/uninstaller for every random app you come across. It can deal with some specific installations because they are limited in scope (basically they are 'copy file and extract here' operations). When a plugin needs to unregister itself from an SQL database, remove some files on a server, update a network service in another state, ect, ect, it gets slightly out of Firefox's domain, dont you think?

Re:Unlike Microsoft, this one benign and documente

[ADRA]

Yeah, what a complete waste of a story. It is installed with java which preloads core java so that when your browser runs applets, they start faster... Damn those frigging bastards at sun for making my life easier!

Same applies to AVG Internet Security

[Anonymous Coward]

I recently installed AVG Internet Security Suite on Windows, and noticed that it decided to install anti-malware software in Firefox.

I'm of two minds about this: on the one hand, I'm glad they're supporting Firefox, but on the other hand, I don't remember agreeing to add this extension to Firefox. It's ugly, takes up too much space, and has prominent buttons that I don't care about, and aren't easily disabled.

I would have been much happier if I'd been given the choice to install it or not; I would have. But if I'd known it would uglify Firefox, I would have made more of a point of getting a product that didn't.

Re:Same applies to AVG Internet Security

[Anonymous Coward]

If by decide, you mean ask if you'd like to install, then yes. Read the shit before you click ok.

Re:Same applies to AVG Internet Security

[Anonymous Coward]

I've installed anti-malware before that was much less intrusive. Since I don't really have a choice about installing some kind of anti-malware in Windows, I'd rather it be unintrusive. I remember saying it was okay to install to browsers (so that I could use anti-phishing features), but I didn't ask for toolbars that are an eyesore.

If you are suggesting I had a better alternative, then no, I didn't. I needed malware protection, and I wasn't the one buying the software. I never expected Firefox would allow plugins to install themselves like that. Seems like a huge security/privacy hole. I expected more from Firefox.

Re:Unlike Microsoft, this one benign and documente

[batkiwi]

What does the MS one do that's not benign?

Java came from the browser

[physburn]

Its not surprising java installs itself to firefox, java started as a language to run applets in the browser and still needs to be there. These days its nearly all cross-scripting prone javascript widgets instead of applets. I can program either, but frankly i'd rather have robust standardised java to program in, then different DOM from every browser javascript. Can someone get bring the applet back, maybe java-fx (actually the library with it, not the new scripting language, will help.

Re:Java came from the browser

[nabsltd]

Its not surprising java installs itself to firefox, java started as a language to run applets in the browser and still needs to be there.

This is about the 10th post that just doesn't understand the issue.

Running of Java applets within Firefox is controlled by a plugin. What is being installed by Java is an additional addon that is in the "extension" category, and is not required for running Java applets.

All this new extension does is preload Java when you start your browser, so that Java applets will appear to start faster. They won't really start any faster, since the pre-loaded code can be swapped out just like any other code. Likewise, if you have enough RAM, after the first Java applet runs, the Java runtime would be cached and future applets will start more quickly.

Even if applets do start faster, you are just changing when the time is taken (at browser load or at applet load).

Re:Unlike Microsoft, this one benign and documente

[Anonymous Coward]

So, in other words, it does the exact same thing the .NET Firefox extension does, except unlike .NET, it does it for things that no one still uses.

Java applets are dead. I can't remember the last time I ran into one.

I don't need Sun bloating up Firefox to make something that NO ONE USES run slightly faster.

Re:Unlike Microsoft, this one benign and documente

[MrMista_B]

So if someone breaks into your house and cleans your kitchen, you'd think that's okay too?

What did you update? Java or Firefox?

[angel'o'sphere]

If you did: "sysbar bubble based Java update" ... I assume you updated Java. In that caser it is completely correct that you get the relevant plug ins for every browser on your system installad as well. That is what Java always did so far on any system I had (Windows, Linux, Mac).
If you did a Firefox update then it is not Suns fault, but the fault of the guys who bundled the update that you where not asked beforehand.
I think the attitude towards Software Providers may it be MS or Sun, or any other, should be a bit more neutral. You have 2 completely "free as no fee" software packages (Java and Firefox) on your system, and you bitch about getting a few megabytes more than planned (which likely had downloaded later anyway manually!!) ... sorry, sounds pathetic to me.

angel'o'sphere

Re:Unlike Microsoft, this one benign and documente

[headLITE]

Yeah maybe, but Sun wants JavaFX (which is based on Java) to be a Flash killer, and for that I'm guessing it needs to load a lot faster than the typical Java applet used to...

Re:Unlike Microsoft, this one benign and documente

[TorKlingberg]

I would bet it also makes loading Firefox take longer and uses up RAM even when not using Java.

Re:Unlike Microsoft, this one benign and documente

[zullnero]

Neither is benign. When you tamper with a customer's third party software, you 1. Ask them first, and 2. Let them back out easily. Microsoft and Sun did neither of these. Not only are they spitting on good software standards, they're spitting on their users by doing this.

How it happened:

[Anonymous Coward]

I suppose you're wonderin' how this happened:

Sun executives were sitting around one day at a 3-hour lunch getting drunk and making rude remarks to the waitress. One of them said, "How can we sink the company?" After considerable deliberation, one of them had an idea. "I know, we'll get ourselves on Slashdot for doing something dastardly." Another executive said, "Brilliant! No reputable programmer will ever take a job at Sun again."

Then they had to think of something sufficiently sneaky. That's difficult for a drunk person, especially a drunk person that makes millions of dollars a year. That kind of money decreases initiative. Then one said, "We'll just imitate Microsoft! Almost everything they do is sneaky or mean."

And that's what they did.

Warning: Some of this may be fiction. Or, it may be true.

Re:Unlike Microsoft, this one benign and documente

[KiloByte]

It preloads all the bloatness of Java, every single time, even if you installed it just for a single page you visited half a year ago.

Re:Unlike Microsoft, this one benign and documente

[nabsltd]

Yeah, what a complete waste of a story. It is installed with java which preloads core java so that when your browser runs applets, they start faster...

They start faster because every time you open a browser window, the "Java quick start" has to take time to load, even if it was already loaded. If you don't believe me, try timing it.

Also, you now have memory used by a program "just in case you might want to use it someday". And, it's possible to configure the Java runtime to not be available as a browser add-on, but still allow you to run Java apps on your computer. Any bets on whether this extension will load regardless of your browser settings for Java?

Re:Unlike Microsoft, this one benign and documente

[Tony Hoyle]

Actually that'd be fine with me... my kitchen is a mess.

Re:Unlike Microsoft, this one benign and documente

[mysidia]

You install the Java plugin, you expect it to modify your browser.

Still, I would like Firefox to provide better controls of how plugins CAN and CAN'T be installed.

In particular, I would like the browser to ask for approval during startup before a newly installed plugin can be loaded, for the first time.

The approval process should be done in a way that a plugin can't easily fake approval, and if I reject it (I.E. Use of a settings file that only FF can update), the plugin stays disabled.

Haven't you heard?

[nurb432]

You don't own or are allowed to control the PC.

Just shut up and smile, we know best for you. "Where do you want us to take you today? Never mind we will take you where we want to go."

Possible Firefox Feature Needed?

[finity]

So, you install some software which automatically installs a Firefox addon. Then the next time Firefox runs the addon is automatically enabled? I know that's how plugins are installed. It would be nice if third-parties just didn't do this, but it seems like a change in Firefox must be made to prevent this.

Secure systems must include measures to prevent tampering. Installing code that automatically executes is most certainly tampering, and if my estimate of how this works is correct, I'd call this a Firefox security bug.

It may not be worth it, or even possible with current hardware, to prevent all software from installing addons "under the radar." Still, I'd bet that Firefox could incorporate a more secure way of keeping tabs on enabled addons.

With the Firefox plugin feature, Firefox could keep a list of installed plugins, their md5sums and their filenames. It could then hash this list and store the result somewhere. This would make it easy to detect changes to the installed plugins and prevent programs from simply changing the list of installed plugins. Malware could simply change the list then rewrite the hash, but I'm not sure you could ever get around security through obscurity (in this case) with a normal Linux install and consumer hardware. When different software is run as the same user and without any kind of sandboxing, this is what you get.

Maybe Linux distros need to make a change to enable more sandbox-type security. As Linux's popularity increases, I'll bet we see more of this behavior, just as we see so frequently in Windows. All the software already exists to implement this fairly well, and it's not like disk space is an issue anymore.

Microsoft should be making this change in Windows if building a more secure system is one of their goals.

Re:Unlike Microsoft, this one benign and documente

[StormyWeather]

Hell if they will do the bathrooms too I'd pay them.

Re:Unlike Microsoft, this one benign and documente

[Anonymous Coward]

Why can't Java be fast to begin with?

Pre-loading doesn't make it fast, it only makes it seem fast.

Even mozilla is doing this though...

[TheSimkin]

I updated to Firefox 3.0.6 and it installed a Yahoo tool bar and menu without me asking!

Re:Even mozilla is doing this though...

[BatsShadow2]

Is that on Windows only? Because I'm sure that didn't happen to me.

Re:Even mozilla is doing this though...

[perryizgr8]

well nothing of that sort happens when you update firefox. you must have installed some sort of crap from yahoo, like messenger.

Because they should?

[BitZtream]

So, they get the majority of the users out there with working Java in their web browser, which they would expect if they have Java installed, and in the process they piss off a few geeks who can't see beyond their own little basement walls.

Pardon me if I find this whole thing a little amusing. If you want Firefox to take over the world it has to be user friendly. As any Vista user will tell you, prompting you to do every little thing is fucking annoying, so they've taken a more traditional approach and just make Firefox aware of it out of the box.

So while there may be a great uproar on slashdot today, no one really cares or some actually appreciate the feature.

Why don't you bitch about Chrome automatically working with Flash or Java on your system out of the box?

It gets worse

[thetoadwarrior]

It seems Java modifies all browsers without you asking to allow them to run applets. That's not what I installed Java for!

I don't see the problem.

[argent]

There's lots of software that installs browser addons automatically, without even asking you. That's been normal and expected behavior for a decade, it's long since past time to raise Caine over this one.

I think Sun should be accoladed for giving you the option to opt out.

Ever try to install Acrobat without getting the browser plugin? You have to rummage around in the Acrobat directory and remove the plugin component or else EVERY TIME you run Acrobat the plugin will be reinstalled.

Re:I don't see the problem.

[Anonymous Coward]

Word. Java is a platform. It includes browser support (applets), webstart and other fun thingies. You asked to install java- you got java. It didn't format your harddrive and install Solaris, did it?

Re:I don't see the problem.

[Karellen]

OK, it's been a while since I've been around Windows (thank God) but I follow as much tech stuff as I can and really hadn't heard anything about this before.

Could you post links to 3 other bits of software which, as well as the "normal" software they install (whatever that is) also install Firefox plugins?

Re:I don't see the problem.

[argent]

Well, let's see, there's Google Earth, and Windows Media Player, and Realplayer, and Quicktime Player, and that's just off the top of my head.

Re:I don't see the problem.

[Anonymous Coward]

Something being "normal" and "expected" doesn't make it right. Something being around "for a decade" doesn't make it right either. I don't think Sun should be praised for this. It's kinda like saying the 419 scammers should be praised for not committing massive genocide.

Re:I don't see the problem.

[argent]

My mailbox doesn't have a "scam" API, it's got a "send me mail" API. It's normal and expected that people will send me mail. I get mail from my boss, and my brother, and from websites I register on, and that's normal, expected, and desirable.

Firefox doesn't have an "install malware" API, it's got an API for applications on your computer to install plugins and extensions, and register as helper applications. It's normal, expected, and desirable that they do so, and has been for the decade and a bit that browsers have been a normal part of a desktop environment.

If Sun was installing malware or trojan horses, with or without approval, then you'd have a point, but since it's just installing a normal and expected plugin that Sun has been installing when you install Java (and for most people, this plugin is WHY they install Java) since Java was invented, comparing it to email spam and scams is ludicrous.

Re:I don't see the problem.

[Anonymous Coward]

a normal and expected plugin

I consider every stealth install malware by default until proven otherwise. Computer security is where "guilty until proven innocent" applies.

Re:I don't see the problem.

[argent]

What bloody "stealth install"?

You download a browser plugin, you install it, it asks you if you want to install a Firefox extension. Where's the bloody "stealth" in that? You're just determined to be pissed off about something, I guess.

Re:I don't see the problem.

[Karellen]

Ah, sorry. You confused me by spuriously talking about browser plugins, instead of the subject of the article and almost every other comment which is about browser extensions. I mistakenly assumed you were talking about extensions like everyone else, only calling them plugins.

My bad.

INDIGNATION!

[wampus]

INDIGNATION!

Window manager

[Anonymous Coward]

Dude, looking at your screenshot, I have to wonder, what window manager are you using? I've never seen it before. That's definitely not GNOME. Oh wait, you're running Windows?!? Go back to Internet Exploder! Extensions never get installed there without your permission!

Re:Window manager

[BitZtream]

1995 called, they want their retarded IE jokes back.

Also, extensions can very easily be installed without your permission. It can be done via several methods to allow network admins to push extensions to all clients. All it takes is adding the extension somewhere on the file system and setting a registry key to point to it so Firefox picks it up on the next start.

Of course, if you spent less time acting like a retarded high school dork and actually learning about what you are talking about, you might know this.

As much as I hate windows, I'd take the classic Windows theme over anything Gnome has ever had to offer.

Security risc

[Anonymous Coward]

So, anyone can install an add-on on your Firefox without your concent, and even then, it will run without your prior authorization...

ok, in my way of sseing things maybe firefox ain't that secure...

Huh?

[Vexorian]

Yes, I could opt out of it, but why are Sun installing Addons to my Firefox without me making specific choices in the application itself?

Because you could opt-out of it.

Re:Huh?

[shentino]

The problem with "opt out" is it makes "yes" the default. If something happens and the "user override" gets konked, you're stuck.

Principle of Least Surprise.

name that malware?

[v1]

Is there a name for software that installs on the sly, or in an "automatic" way that is unexpected? I don't mean to say virus or trojan, but something that could more properly be associated with something that's not publicly accepted as "malware".

SlyWare? SneakWare?

I think the part of these I despise the most are the ones that keep trying to sneak in, that you can't tick a "don't EVER try to pull that again". Like when IE has a checkbox for "always make sure IE is your browser", instead of the "never ask me again" in FF etc. They're taking advantage of the system and hoping you screw up just once like a pushy salesman trying to get in the door.

Re:Unlike Microsoft, this one benign and documente

[gbjbaanb]

You install the Java plugin, you expect it to modify your browser.

only he didn't install the plugin, he updated the JRE.

I'm safe,

[Jamie's Nightmare]

I use Opera.

Re:I'm safe,

[Ash-Fox]

I use Opera.

I find Opera tends to be unreliable when it comes to loads of tabs with Java loaded. I don't get that in Firefox or IE.

There's a much simpler way

[Rix]

Simply only allow them to be installed through Firefox. If one of these crapware installers wants to ad one, make it open Firefox with the xpi installer.

And make it default to cancel.

Re:There's a much simpler way

[anaesthetica]

This is a security issue really. Firefox shouldn't run any extensions not explicitly approved by the user. If a third-party installer puts an extension in, Firefox should keep it disabled until the user explicitly enables it (or uninstalls it) in the Addons Manager.

If legitimate companies are stooping as low as illicit extension installs into Firefox, it is an obvious next step for spyware and malware programs running on people's computers to begin to do the same. It doesn't matter that Firefox alerts you when new extensions have been installed on startup—if a malware program installs an extension with an innocuous name (e.g. "MS Internet Security") most people won't think twice and will allow it to remain activated.

Mozilla should not wait for Fx3.1 or Fx3.2 to implement some kind of protection scheme against this—this should be rolled out to all Fx3.0+ users in a security update.

Re:There's a much simpler way

[Myen]

And then the crapware installers would drop things into Firefox's main directory, instead of being an addon. Oops, now you can't even disable them!

Yes, some other piece-of-crap already tried that; removing it involved manually finding the .jar and the .manifest and killing them in the Firefox install.

Re:There's a much simpler way

[Anonymous Coward]

If a third-party installer puts an extension in, Firefox should keep it disabled until the user explicitly enables it (or uninstalls it) in the Addons Manager.

On the other hand, if I want to replace Internet Explorer in my enterprise and I need to install a Firefox extension on hundreds or thousands of machines automatically, then there will need to be some type of facility to automatically install an extension... which malware or other apps could abuse to silently install extensions themselves.
 
Alas, while you present a good idea, it's an idea that actually itself should require an opt-in. (Though even if it did, you could undoubtedly script your way out of it.)

Re:There's a much simpler way

[BitZtream]

The user did approve them, by lettering code run on their machine that updated software. The security issue is the stupid users who allow the updaters to run and then get pissed off when they update stuff.

'OMG FIREFOX IS INSECURE BECAUSE THIS OTHER APP I LET RUN WITH ADMIN RIGHTS IS CHANGING FIREFOX'

Jesus I hate when idiots like you post.

This is a security issue, but it has nothing to do with Firefox, its the user. The user allowed the update to update his machine on its own. The security problem is that the user is too stupid to realize that when you allow apps to make whatever changes they want to your system on their own, that they may in fact do just that.

You think Sun is 'stooping as low' as installing an extension that makes the product you installed work?

If an app can write to your system in a way required to make firefox load a new extension, they can do far more dangerous things than installing a firefox extension. If something is writing files (AND registry keys in this case) to system folders, don't you think the problem is with your file/registry permissions, not the fact that the app is doing what it was designed to do?

The way this works is BY DESIGN. Its useful for allowing a plugin or extension to be installed BEFORE firefox, so you can install flash, acrobat reader, or some other random plugin, and then in the future when you run firefox for the first time, it will know about the plugin and it will just work.

You sir, are clueless about security. Please stop pretending you know about it.

Re:There's a much simpler way

[anaesthetica]

This is a security issue, but it has nothing to do with Firefox, its the user.

That's the excuse we used to use with Windows too. But everyone has since realized that while you can never inoculate against dumb users, some software is inherently less secure because of the way it is designed. You're right that if users had perfect knowledge of what they were running, what they were installing, and what it all meant, then there would be no problem. Unfortunately that is not the case—in practice, people have limited knowledge about what they're running and what they're installing, as evidenced by the wild success of spyware and adware and malware. Tens of millions of users have malware running local code while logged in on admin-level accounts, the malware is running without their full knowledge, and this presents a wide open vector for attack.

We can follow your model, in which we place the onus entirely on the user. And similar to abstinence-only sex ed, which ignores the well-demonstrated reality of human behavior, it will fail and Firefox will be exploited. Or we can follow my model, which adds another layer of security on the assumption that people do make mistakes and ill-informed decisions, and design around that. Firefox's good reputation will be preserved, with trivial hassle to the end user.

Re:There's a much simpler way

[fast turtle]

I have to agree with you on this. Anything that can install a plug-in w/o using the Firefox add-on manager is a potential security flaw that needs to be fixed yesterday if not earlier because as you said, it will be exploited by malware once they realize just how easy it is. Hell this falls into the same class as the IE active-x flaws we've screamed about for years so why does Firefox deserve any forgiveness for such a security flaw?

Re:There's a much simpler way

[BitZtream]

Your 'new layer of security' doesn't exist. If you understood one bit about how plugins in Firefox work (or any other application for that matter) you would understand why what your asking for really can't be done.

ANY app with permissions to the right registry keys and filesystem can install a plugin for ANY other app that supports plugins. Sorry, thats just reality. There is no amount of code you can write that will prevent this, not on any OS I am aware of at this time, including Solaris, Windows, BeOS, OS X, *BSD and Linux.

As long as an app has permission to modify the required resources, it can install a plugin. The only way you'll prevent that is by using digital signatures or something along those lines, in which cause the day after that happens all of slashdot will be screaming about how mozilla is trying to censor the internet or some other retarded bullshit.

For the record, the default permissions of windows ARE the problem and those ARE being fixed, and people like yourself are also bitching about that because all of the sudden you start to realize how much shit is happening behind the scenes.

You won't be happy ever, regardless of what gets done to fix it. As soon as 'your model' gets implemented, you'd realize how dumb it actually is and start bitching.

Re:There's a much simpler way

[BitZtream]

In order for this to happen, the installer already has permissions to modify the files and registry keys firefox uses to manage extensions. Theres no reason why you HAVE to use firefox's XPI manager, you can just use your own code to write the same databases and files that firefox uses.

And whats best, is that its open source, so you don't even have to reverse engineer what files you need to write to or what the format is, Mozilla freely gives them to you!

In short, thanks to the fact that its open source, what you suggest is effectively impossible. If it was closed source it would just take a little longer to reverse engineer, but the same would still hold true eventually.

This crap always fails. Look at the XBox, the iPhone, the XBox 360 and every other attempt to control who can run software on a particular device. All it does it makes it worse on legit users, the guys who want to break the rules are still going to do it, it just may be next week instead of this week.

Re:Unlike Microsoft, this one benign and documente

[gbjbaanb]

and in similar news, Sony installed a 'helpful system driver' that made your music playing and purchasing life easier too, helping to protect you from pirate music.

The point is simply that it gets installed on the sly, if its so helpful, they should make it opt-in and surely everyone will accept the install.

You willfully installed Twitterbar

[tezza]

so I don't think your judgement about what add-ons are appropriate should be considered.

22:33 UTC - Flamed on Slashdot for having TwitterBar. Why does kno1 nderstnd me?

Poster is a Dumb Ass

[Anonymous Coward]

The person that submitted this story is a dumbass - that's all there really is to it.

isn't this standard procedure in winduhs?

[weighn]

yes, this is terrible. A FF addon installed without saying/prompting.

Next thing you know they'll be adding crap to HKLM/Software/Windows/CurrentVersion/Run without asking ?

Oh wait ...

Mozilla needs to shut this down now

[Kaboom13]

How many IE installs have you seen with a dozen ugly search bar below the title bar? It seems like every app installs one, if you are lucky they hide a little checkbox and disclaimer in the installer to avoid it. it's one of peoples big annoyances with IE, even if at it's core it's not IE's fault. I installed Foxit Reader on my laptop the other day, and did not read all the options. To my surprise I had some ridiculous Ask.com toolbar in my firefox install.

Currently if you try to install an extension, Firefox pops a warning up. It needs to do the same if another app installs one. All extensions need to be uninstallable, they need to remove all options otherwise. Ideally, it would be able to verify the integrity of all browser files from a secure source and delete anything that did not follow the "rules" (I.e. can be uninstalled at any time).

All extensions not installed by direct user action (ie going to the firefox addons menu and choosing to install it) should start disabled and have to be manually enabled before they can work.

Firefox is gaining ground in the browser wars, and that means it is going to be targeted. Already malicious sites that attempt to exploit flaws in Firefox exist and are growing in number. I expect it's just a matter of time before spyware extensions start showing up, claiming to do something useful while reporting your browsing habits.

Mozilla foundation needs to keep in mind it is YOUR computer, and YOUR browser, and it should only do the things you want it to, regardless of what other companies want.

Ive been using Firefox since it was called Firebird, and despite the many improvements, it will be a victim of it's own success if it is not careful.

Re:Mozilla needs to shut this down now

[Anonymous Coward]

And how do you suggest they implement that? That information has to be persisted somewhere; all you have done is added an extra hoop for the bastards to jump through. When you run the installer for Java (or whatever else), it's going to have the necessary permissions to silently drop a Firefox extension (or whatever else). This is not a security issue so much as it is a trust issue. Unfortunately, trustworthiness is hard to come by.

Re:Mozilla needs to shut this down now

[Jessta]

This has nothing to do with Mozilla and everything to do with Microsoft. Mozilla has no way to prevent this, software installation and permissions in the responsibility of the operating system.
Using Windows, you ran the installer and you gave the installer the permissions to modify the files required to install an addon on for firefox.

If this is a problem for you then you should get an operating system that prevents this kind of problem occurring. This is software running on YOUR computer, YOU'RE in complete control.

Re:Mozilla needs to shut this down now

[Kaboom13]

Any sort of installer on linux will require root access to my knowledge, which means it could be just as sneaky. I realize repositories help alleviate this, because it is a trusted central source, but if Linux was as popular as Windows you would see a lot more of this kind of thing. If Ubuntu was the desktop of the masses, you think there would not be a lot of financial temptation for the maintainers to let this kind of thing slide?

Besides, the reality is Windows is the OS used by the vast majority of Firefox users. If you want Firefox to stay an example of how great open source can be, then they need to take steps to protect it from all the sleaze who will see it as an unexploited market.

Re:Mozilla needs to shut this down now

[BitZtream]

Currently if you try to install an extension, Firefox pops a warning up. It needs to do the same if another app installs one.

Already done, had you even read the summary you'd know thats how this started, the handitard that posted the original noticed it when Firefox warned him that a new one had been installed.

All extensions need to be uninstallable, they need to remove all options otherwise.

No, they don't. There are provisions that allow network admins to install plugins. Regardless of what you think, its not always up to you what runs on the PC your using. Firefox (the user running it) may not even have permission to remove the files or settings, in which case its going to fail.

Ideally, it would be able to verify the integrity of all browser files from a secure source and delete anything that did not follow the "rules" (I.e. can be uninstalled at any time).

You are obviously very young and naive. Its practically impossible. And even if it were possible, if they did this, then you would bitch that they were controlling what extensions could be installed (like apple and the app store). If they don't do it you bitch that they should.

All extensions not installed by direct user action (ie going to the firefox addons menu and choosing to install it) should start disabled and have to be manually enabled before they can work.

You have an extremely narrow view of the world. In a corporate network, users don't get to control everything so doing what you say would cause more problems and probably wouldn't work anyway as the network admins would probably have file permissions set in a way that the user wouldn't have a choice in the matter.

Mozilla foundation needs to keep in mind it is YOUR computer, and YOUR browser, and it should only do the things you want it to, regardless of what other companies want.

You need to keep in mind that no one cares what you do on your little home PC, and that there are far more reasons to use a PC that don't involve you, and many of those reasons probably don't fall into your little view of what would be perfect for YOU. There are many times when its NOT YOUR computer, so you DON'T get to do whatever you want with it. You are not entitled to have things your way just because you are alive.

Ive been using Firefox since it was called Firebird, and despite the many improvements, it will be a victim of it's own success if it is not careful.

So you've been using Firefox for a while, you're still clueless. If by victim of its own success you mean holding a large market share and being accepted by companies rather than being forced to use IE at work, then I'm okay with that.

You're going to be ignorant and bitch regardless, so Mozilla really could give a flying fuck what you think :)

Re:Mozilla needs to shut this down now

[BitZtream]

Uhm, so you want an OS that knows that you want to install part of the application in the installer, by reading your mind I presume?

When you started the installer as an admin account on your windows box, YOU gave it permission.

Run the installer on ANY OS and it would be the same. Its cute that you try to somehow point the blame at Windows here, but it applies equally to every OS.

It may be YOUR computer and you may think YOU'RE in complete control, and that makes YOU and idiot. You gave up complete control the instant you started using software you didn't write, I.E. when you turned it on, cause I seriously doubt you have ever written a line of code, let alone BIOS or other firmware. I don't care what OS you are using, you didn't write it. Linus didn't write Linux, he's certainly one hell of a contributor and founder, but he cant' claim to be in complete control of his machine any more than a Windows user at this point, he really can't claim to know every single line of code that he executes, and he wouldn't try to claim it.

Nice try on the MS FUD, but there is nothing MS specific about this other than the fact that more people use Windows so it gets mentioned more often.

Re:Mozilla needs to shut this down now

[BitZtream]

I realize repositories help alleviate this, because it is a trusted central source, but if Linux

I know I'm in the minority here on slashdot, but I trusted Sun before Linux was a gleam in Linus's eyes, and I will certainly still trust Sun over the various distros out there who are all capitulating with Microsoft at this point.

And in this case, I would be downright pissed if I told my FreeBSD machine to upgrade some ports and it decided NOT to install new features that were part of that upgrade.

Of course, slashdots fanboys have to whine and moan about everything that isn't just like they want it, regardless of the fact that pretty much everyone with any sanity would want it to happen the way it does.

Seriously, no sane person is bitching about the fact that the java updater installed an update that makes java work better in the browser.

If you want something to bitch about, bitch about the absolute hell it is to have acrobat installed and NOT have the browser plugin installed. Every damn time you start acrobat it reinstalls the plugin. If there is an option somewhere that lets me prevent this, please someone point me at it.

With Java in this case, its simple to disable both what caused the plugin to be installed and the plugin itself.

Re:Mozilla needs to shut this down now

[Ash-Fox]

I know I'm in the minority here on slashdot, but I trusted Sun before Linux was a gleam in Linus's eyes, and I will certainly still trust Sun over the various distros out there who are all capitulating with Microsoft at this point.

Old Unix guru I take it?

Seriously, no sane person is bitching about the fact that the java updater installed an update that makes java work better in the browser.

Unless at the expense, it slows down the rest of the system by loading something that is relatively unused most of the time.

If you want something to bitch about, bitch about the absolute hell it is to have acrobat installed and NOT have the browser plugin installed.

Yeah, I just delete the np plugin for Acrobat in Firefox's plugin directory.

nppdf32.dll on Windows, nppdf32 on Linux.

Re:Mozilla needs to shut this down now

[Jessta]

Yes, this isn't just a problem for Windows. It's a problem for most operating systems, but that doesn't mean it has to continue to be a problem.
 

It may be YOUR computer and you may think YOU'RE in complete control, and that makes YOU and idiot. You gave up complete control the instant you started using software you didn't write

Actually, to be more accurate, I give up control the instant I run software that I can't predict the behaviour of. I don't have to write it, I just have to be certain of what it will do and when it do it and for this behaviour to be agreeable with my goals.
 

I seriously doubt you have ever written a line of code, let alone BIOS or other firmware.

I've been doing various coding for upwards of 15 years, I haven't done a lot of system level stuff, but I have a good understanding of what's possible.

Re:Mozilla needs to shut this down now

[BitZtream]

Actually, to be more accurate, I give up control the instant I run software that I can't predict the behaviour of. I don't have to write it, I just have to be certain of what it will do and when it do it and for this behaviour to be agreeable with my goals.

And as I said, you gave up control when you turned your computer on. Unless you're trying to tell me you run code thats bugfree, or that you are aware of every bug in it.

When you get around to writing the software that can read peoples minds, let me know, I'll be the first to congratulate you. But you'll have to share with me whatever it is your smoking that allows your perspective to be so insanely warped.

Re:Mozilla needs to shut this down now

[BitZtream]

Old Unix guru I take it?

Not exactly, as much as I'd love to claim it. And its not that I don't 'trust' Linux distros, this response that Sun must be evil just pisses me off. I hate this sort of crap too, but as a developer I completely understand why Sun did it. They just included a new feature in the update, thats really not a big deal if you enabled auto-updates to me.

Does deleting the pdf dll persist across the stupid Adobe updates as well? I would presume not as that would probably be a crappy updater if it didnt' fix files broken like that (i.e. removed). I really wish they would just let me not use it, I prefer Foxit in my browser, even though for some reason with our color printers at the office, Acrobat will print faster than Foxit, we're talking over an hour to print a page or two of simple vector graphics and text in color with Foxit versus a couple minutes with Acrobat.

I don't think its really Foxit's fault as it also happens to some of our users printing google maps (both IE and firefox) so its likely a retarded printer driver or printer itself but I still have to keep acrobat around.

Re:Mozilla needs to shut this down now

[Kaboom13]

Nice flame jackass.
Popping up in an extensions list is way different from warning BEFORE it is actually installed.

Obviously a corporate environment is different, but Firefox has next to no real enterprise management tools to control what plug-ins you can't and can install anyways so the point is moot. I guess I was wrong in making an absolute statement. I'll correct it.

All extensions need to be uninstallable by the administrator of the system, they need to remove all options otherwise.

There.

Ideally, it would be able to verify the integrity of all browser files from a secure source and delete anything that did not follow the "rules" (I.e. can be uninstalled at any time).

You are obviously very young and naive. Its practically impossible. And even if it were possible, if they did this, then you would bitch that they were controlling what extensions could be installed (like apple and the app store). If they don't do it you bitch that they should.

Thats why I said "Ideally". As in an ideal that may not be technically possible. I;m not talking about the app store, where Mozilla would approve all extensions. Rather, I am talking about a way to prevent/disable plug-ins with malicious intent, that intentionally mislead the user. Is it technically challenging? Yes. But the alternative is the MS way, to just turn a blind eye to a real security problem and blame everyone else. If you didn't want the functionality, I'm sure a branch without it would be made.

Mozilla foundation needs to keep in mind it is YOUR computer, and YOUR browser, and it should only do the things you want it to, regardless of what other companies want.

You need to keep in mind that no one cares what you do on your little home PC, and that there are far more reasons to use a PC that don't involve you, and many of those reasons probably don't fall into your little view of what would be perfect for YOU. There are many times when its NOT YOUR computer, so you DON'T get to do whatever you want with it. You are not entitled to have things your way just because you are alive.

Personal attacks aside, isn't it obvious when I said YOUR computer I meant the owner? If the owner is a company, isn't it there right to control the browser? if it is a personal computer, it is that person's right? That is my point. A company benefits from having total control over their browser and what is installed in it as much (possibly more) as the home user. The point being that just because MS feels like they should get to install their extension, and Sun theirs, and Program X gets to install theirs, doesn't mean it should happen. In an ideal world we would avoid any app that tries, but in reality it is not possible to do so and still be productive.

Do you think the majority of malicious code is written for Windows and IE just because it is easier? Do you think if Firefox takes over they will just give up? Firefox is more secure by design, there is no doubt, but it still has security flaws being discovered all the time. The more successful it is the more it will be targeted, and in my opinion allowing any and every app the wants to install an extension is a gaping hole. There are already malicious sites out there that try to trick you into installing an extension, I have seen them.

You're going to be ignorant and bitch regardless, so Mozilla really could give a flying fuck what you think

It is because I like Firefox that I care about what they do moving forward. I suppose "better then IE" should be good enough forever? I'd rather Firefox did not follow IE's footsteps of achieving dominance then ignoring any problems from then on.

Re:Mozilla needs to shut this down now

[Kaboom13]

There is no evidence this actually helps with real world performance, it just preloads the JRE into memory. In effect you are trading performance every time you load your browser for performance the first time you need Java. Pretty harmless, but it is in essence a smokescreen move to make Java look better while making the overall system worse. The JRE by itself doing this is not a big deal, but we don't need apps getting into some sort of resource war to be the fastest launching with no regard to the rest of the system. It's a move straight out of MS's playbook, they did the exact same thing with IE to make it "load faster" then the competition. In reality it was just slowing down startup to give the appearance of loading faster.

If this is a truly beneficial feature, what harm would there have been in asking permission? A note in the installer that this update includes an optional Firefox extension to improve Java load times and there would be no fuss. With all the nonsense that goes on in the world of IE and spy-ware toolbars, Active-X controls that cause all sorts of problems, etc. People are justifiably wary of anything installing in their browser that is not upfront and honest about it's purpose.

Nothing for you to see here

[Nivag064]

"It seems it's not just Microsoft that have spotted a good opportunity to distribute their software ..."

I clicked on the link http://slashdot.org/article.pl?sid=09&tid=95, indicated above with bold italic, and got the text Nothing for you to see here. Please move along.


What's happening here???

Re:Nothing for you to see here

[perryizgr8]

shhh... we don't talk about that here.
Nothing for you to see here. Please move along.

The begining of the end for Firefox

[MadClown69]

More and more companies will begin piling on crapware to firefox. Eventually people will get tired of it and move to Google Chrome. Which by that time will have solved this problem in there own extension api.

Re:The begining of the end for Firefox

[BitZtream]

Just for reference, Chrome has the exact same feature already. Why do you think your little flash and pdf files work perfectly out of the box?

As for this being the begining of the end, I suppose tomorrow you'll tell us 2009 is the year of the linux desktop and the year that the internet runs out of bandwidth or diskspace or something else utterly retarded.

Introducing Java SE 6 update 10

[angrydotnerd]

For the paranoid...

http://java.sun.com/developer/technicalArticles/javase/java6u10/

Performance:
* Sun's JRE has been steadily getting faster over the years, and 6u10 is no exception. Key performance improvements are the introduction of Java Quick Starter, which will substantially improve Java cold start time on most systems, and a new graphics pipeline on Windows.

Re:Unlike Microsoft, this one benign and documente

[Anonymous Coward]

All this plugin does is speed up loading of Java applets. Its benign, and Sun provides instructions on how to turn it off.

Ah, yes. Another case of, rather than writing your code effficiently, you set it up to load automatically whenever the user starts Windows/I.E./Firefox so it's already there when needed. Sometimes known as The Lazy Way Out.

*NOT* a 'stealth' install !!!

[ymenager]

That's the most idiotic article i've seen in ages.

You've installed a JAVA VIRTUAL MACHINE, which includes BROWSER APPLET SUPPORT.

So yes, it will off course install something on the browser to make it work... which is a plugin (as it's always done in the past, and pretty much what you'd expect), and now they've just added an addon to pre-load the VM to make things faster (and put it as an addon rather than a plugin so that you can disable it more easily).

What's wrong with that ? By installing it, you asked for JAVA SUPPORT on your OS and your WEB BROWSER.

That's what the addon is.

What next, let's complain that adobe secretely install a plugin on your browser without asking when you install flash ??

Re:*NOT* a 'stealth' install !!!

[raynet]

I just wish all applications that want to install these "quicklaunch" tools would ask me before just going there and install themselves. I just hate to be always removing QTTask etc from my startup files on Windows and I really don't like if I need to begin to keep track of my browsers too.

Re:*NOT* a 'stealth' install !!!

[Anonymous Coward]

And THE NET FRAMEWORK also includes CLICKONCE SUPPORT. It's the same bullshit all over again, and it's just as bad. Oh and caps are awesome to make a point.

Re:*NOT* a 'stealth' install !!!

[BitZtream]

ClickOnce allows you to bundle the app and supporting files into a single executable package instead of a bunch of assemblies and other resources in a directory. This has absolutely 0 to do with ClickOnce or how it works. Think of it as a .tgz of the application directory that you can just execute the app and it will look inside the tarball rather than in a directory to get what it needs.

Please learn WTF you are talking about before talking.

And if you think this is bad, perhaps you should not run an AUTO-UPDATER and bitch when it AUTO-UPDATES.

You're right, its the same bullshit, an app working EXACTLY as intended and expected by any sane person, and a bunch of fanboys whine about it because they are too stupid to realize they told it to do what it did.

As for the caps, we have to find some what to get through your dense skull. I was voting for a drill or Dremel tool, but I was told thats illegal, so caps will have to due instead.

Re:Unlike Microsoft, this one benign and documente

[Ilgaz]

...and JRE finally, finally showed some kind of Desktop user touch by preloading frequently used classes (or their metadata, more like prebinding/prefetch) to memory in ages of 64bit running laptops with 4+ GB memory.

If I was still on windows and also using applets a lot, I would thank Sun via feedback especially if I had portable with traditionally fragmented NTFS disk.

They were doing harm to users and even Firefox by not implementing that long overdue optimisation which means browser was essentially freezing or choking when most basic java applet hits it.

They unimaginably trust to Apple for Java updates but if they manage to run it as normal (non admin) user, it would be a nice touch for Linux JRE.

Re:Unlike Microsoft, this one benign and documente

[Ilgaz]

Sun had no history of conspiring other peoples browsers, trying to kill them via bundling a browser and name it Internet, trying to force users of alternative browsers to use IE by rejecting to code NS Plugin for Windows Update etc.

It is karma. Sun has karma to waste a bit while other is below GNAA in regards of bundling extras.

Do you feel sorry about Real Networks getting flamed whatever they do including going completely open source? I do but... Their karma. Got it?

Are you morons?

[Nicopa]

3rd party program have installed plugins/extensions for ever...! This reminds me of a story by Asimov in which a man discovers he has something called a "skeleton" inside him. He is worried, because this thing is obviously against him. He consults a weird doctor to get this skeleton removed from him... So shut up, you, hypochrondriac computer users!

Re:Boycott Java

[binarylarry]

You can't really compare uTorrent to Vuze, Vuze is much more powerful.

timothy!!!!!!!!

[Anonymous Coward]

This is the United States, not Britain, so please make sure your subjects and verbs agree.

singular subject - singular verb
plural subject - plural verb

Like this:
"why IS Sun installing"
"not just Microsoft that HAS spotted"

Re:Unlike Microsoft, this one benign and documente

[EvilIdler]

My bank stupidly chose to implement a Java-based login system (which again is run by a major security company here), and it takes 20-40 seconds most of the time from I enter the login page until the password & code box appears. The rest of the time it fails due to timeouts.

If this Sun plugin preloads so I don't have to wait, it's great. It's welcome on my system. I have the RAM so I can take the miniscule hit (no laptop or desktop computer with less than 4GB RAM is allowed in my house :).

It comes as part of the Java plugin. You want the plugin, obviously, and you probably want it to operate smoothly. No reason to complain.

Re:Unlike Microsoft, this one benign and documente

[batkiwi]

This answer I can see. Either both are evil, or both are helpful. In fact, I'd say suns is worse because it preloads things into memory without asking you. All that the MS one does is change your user agent string to reflect that you have dotnet 3.5 installed. This then lets servers send down clickonce apps, as they won't do it (by default) if it doesn't think you can run it.

Of course...

[The Spoonman]

In the time it took you to write this article and submit it to Slashdot, you could've uninstalled the extension a dozen times.

Re:Unlike Microsoft, this one benign and documente

[sproketboy]

Er jqs on my machine is using 1,388k. Yeah huge bloat there.

At the very least they should make sure it works

[Anonymous Coward]

Not to mention that this update breaks a lot of things on FF on my Vista machine.

We work with a big ad provider and they require an applet to be included. Now for every page load where it executes I get a pause followed by a Java dialog stating "this requires a previous version of Java which might not be as secure, do you want to continue? Y/N".

Of course, clicking no means the dialog re-appears instantly and your FF won't respond to anything else (apart from a kill process command)...

New, but not really.

[Kasar]

Sun's Java has always added extras.
Try disabling jusched.exe and see how long it takes to reappear.

I prefer to run outdated programs to having things silently loading and running in the background.
There're enough things just with Windows running.

Re:New, but not really.

[Ash-Fox]

Try disabling jusched.exe and see how long it takes to reappear.

Alright, added a rule in Windows group policy to disable it from running. It's not reappeared since?

And it swings the other way.

[T-Ranger]

As a rule, for ever Linux based desktop that I've run (work, home, over 15 years.. maybe 50 unique installs/upgrades that lasted), the most most consistently flaky glue has been Java working in any browser.

Historically, I stumble across, and need, Java applets pretty infrequently. As a result, nearly 100% of the time I do stumble across, and want to run, a Java applet, it involves somewhere between 5 and 30 minutes of fucking around to make it work. Netscape, Mozilla, now Firefox automatic plugin find/install has worked exactly 0 times for a JVM. And, except for the last year or so, it was always a regular fight at java.sun.com to figure out exactly WTF I needed. I consider myself an educated person, but my paths usually led me to download a 200MB blob that included a IDE, but not a plugin for my always up to date browser. And does installing the JRE actually install the pulgin, when I do manage to get the right thing? No. Creating symlinks is apparently beyond Suns ability. Or maybe its a Java security thing; its quite willing to take up 2GB of memory, but creating a symlink is a violation of security. Fuckers.

In the last 18 months, I spent 9 of them as a Java developer, on a team of 13. I've yet to hear an adequate explanation as to what the difference between JSE, JEE, Java FX, J2ME, JDK, in less then 500 words. Sure, I know it now. Well, maybe not. WTF is JavaFX, and why, just now, when I click on "download JEE", it asks me to download "Glassfish"? THAT ISN'T WHAT I FUCKING ASKED FOR.

It amazes me that people are willing to put up with this shit at all. For a language that isn't even that good.

Anyway. If Sun has finally managed to ship something that actually manages to install a plugin without me digging around on the command line, I'm amazed. That it installs an extension as well is a small price to play.

Because no-one pays attention to you...

[Anonymous Coward]

And in fact, when you're not online, all we do is talk about that.

WTF?!!

[msimm]

How about if FF just tracks the extensions you've toggled and pressed the OKAY button for and simply offers to allow you to enable or to delete those extensions that helpfully get installed for you.

Frankly, I'd consider this a bug in FF behavior as much as anything and while wouldn't fault Mozilla developers for it I would love to see it quickly and efficiently addressed. Which to my mind is still what sets apart great open source projects from most of their closed/proprietary family.

Simple Solution:

[crhylove]

Don't install java. On anything. Ever. Every time I've installed java in the past, I've been instantly and immediately reprimanded by poor performance, extra processes, random slow downs, and other general crap.

I won't install java.

I won't install apps that require java.

People keep telling me "It's gotten better!" and some such nonsense, but so? It sucked so bad in the past, I'll give it another shot in say, five years, when it's been completely open sourced and fixed. I only use FOSS because it's good, not because I'm a zealot. :) Java is not good, no matter it's current state of source code availability or not.

Re:Simple Solution:

[Cow_woC]

The parent post is an obvious troll. There are numerous benchmarks that show that Java performance has increased in a big way over the past couple of years. Many operations now match C/C++ performance.

This isn't a question of performance. It's a question of anal users being paranoid of every little thing that gets installed on their computers. I've got a newsflash for you: software sucks. It's no coincidence that today's word processors use 100x more resources than a decade ago with little to show for it in terms of increased productivity. That's life.

Re:Simple Solution:

[Anonymous Coward]

crhylove,

Are you running Windows? Java often runs poorly on Windows machines running anti-virus with on-access scanning enabled. This is mainly due to the fact that Java Archives are zipped and require decompression prior to scanning, hence large delays prior to running.

If you've ever used Limewire (or Frostwire), uploaded a picture through facebook, or if you've spent a considerable amount of time playing online games, you'd know java isn't all bad. Cisco's Access Point manager uses it and so does portions of IBM's tape storage software.

In fact, if you've ever developed in C, C++, C#, you'd come to realize Java is much better in a lot of ways than other languages, especially when using pointers or talking directly to databases. (See JT400 and JTDS)

Your observations are correct, Java is sometimes slow to load, and for good reason. Java runs inside a framework that is pretty resource intensive. However, from my experience Java is much more reliable than some of the .NET battles I've had, where older versions of .NET and trusted apps keep programs from running at all.

Java is working hard on a JavaFX framework that will be an open-source competitor to Microsoft's Silverlight (or Moonlight) and Flash Player. Java is also nearly all GPL. Fedora uses "OpenJDK" which is a completely open source version of Java. Try saying the same about Flash, .NET, Silverlight.

So before you bash it, take the ignorant I'M AN END USER THAT ONLY USES FREE SOFTWARE THAT WORKS FASTER THAN NON-FREE SOFTWARE hat off and realize how Java is fundamentally a great framework and tool. Just because Java has put a sour taste in your mouth in the past, doesn't mean the entire world should outright reject it and remove it from their computer!

-Tres

Re:Simple Solution:

[Anonymous Coward]

http://shootout.alioth.debian.org/

Just for kicks

Re:Simple Solution:

[SomebodyOutThere]

Not insightful. Many of us have no choice but to use Java apps at work.

Re:Simple Solution:

[BitZtream]

Well, I'm not going to try to change your mind because I completely understand how you feel.

Until I was recently forced to write a Java app I was exactly the same way.

Afterwords I realized Java isn't the problem, the problem is that Java made it easy for the shitty VB developers to write in a new language.

Java apps can be fast. They can be reliable, and the really don't have to look and feel like ass. But doing so requires effort, just like any other programing language.

As for the FOSS part, making it OSS isn't going to make it better, it'll just cause it to splinter and make it worse as now we have a bunch of runtimes that all have their own set of bugs, and new forks appearing everyday cause a bunch of little brats who think GPL is gods gift to man also think that if you don't agree with the existing projects out there that they must be wrong on the brats idea is better. OSS is just going to make it worse, not better.

You are a zealot, your actions make it clear, saying your not doesn't make it true, anymore than me saying I'm unbiased would make it true. I guess you were joking there, I figured out is was a joke so we'll count it as a 'fail' and not an 'epic fail'.

Java is fine, most Java developers are just collage kids and VB twits who don't have a clue. When you lower the barrier to entry you get more entries, which means you get a lot more crap as well. But you would be amazed at the things you use that are powered by Java. You use it everyday even if you don't know it.

Thank you Firefox

[Anonymous Coward]

The heroes here are the mozilla developers for understanding that this type of thing can/will happen, and providing a mechanism to let the user know what is happening to their system...

Re:Unlike Microsoft, this one benign and documente

[Dolda2000]

Neither is benign. When you tamper with a customer's third party software, you 1. Ask them first, and 2. Let them back out easily. Microsoft and Sun did neither of these.

I wouldn't be so sure. When you install the JRE, you get to choose whether it should integrate with MSIE and/or Mozilla browsers. I can't say that I've tried, but I'd guess that if you choose for it not to, then it doesn't install any plugins. If, on the other hand, you choose for it to integrate with the browser (which is, reasonably enough, the default), then it does so.

I really don't see the big deal here. When you install the JRE, you would normally expect it to install a browser plugin, so that applets are displayed, and that's what it does.

Mind you, this differs from Microsoft's plugin, which arrived unannounced through Windows Update.

It gets worse

[Anonymous Coward]

Not only does it install this browser plugin, but after running this installer, it appears almost the entire JRE has been changed -- with no opt-out checkbox in sight!

Re:Boycott Java

[perryizgr8]

my point exactly. i just cant think why java apps have to be so damn bloated. i mean if you can write cpp code for utorrent in 250kb, you need 10mb of java code for vuze?

Re:You're right--convenience sucks--Not just volts

[davidsyes]

wagon...

It's voltsSHAAGGEN... fukengruven, ass in "Fahrvergnuegen"...

OTOH, it could be like opting in for anal sex in the back of a clunky car and complaining about bad tailpipe emissions...

Re:Old Easy now... Easy now... You might get mod

[davidsyes]

ded "off-topic"... I've been experiencing that off and on over the past year... Be gentle.... LOL

Re:Unlike Microsoft, this one benign and documente

[BitZtream]

This 'tampering' is done by design. The way it works is an intentional feature of FireFox designed to allow for JUST this sort of thing.

They did ask you, and you said 'yes, please automatically keep me up to date'.

And now you're bitching that they did what you said to do.

They only people spitting are those of you too stupid to realize that the 'problem' here was that you told it to go ahead and make changes to your system whenever it ones.

If this bothers you, you're an idiot for allowing something to change your system at its discretion. Don't use automatic updates, nothing happens.

So you bitch because its doing what you told it to?

That sir, is the most intelligent thing I've heard. Really.

You missed something!

[Trahald]

You only noticed the firefox addon !
Ha Ha. They also sneaked a service in there. Check out your control panel services thing. There's a new service "Java Quick Start".

Screenshot

[BitZtream]

This whole posting is dumb but...

I really fail to see how anyone with 'TwitterBar' extension installed can bitch about the Java quickstart extension.

I guess if I would have looked at the screenshot sooner I would have realized the guy is just a douche bag and skipped this one :/

Re:Unlike Microsoft, this one benign and documente

[Dhalka226]

A better analogy would be you pay somebody to come in and clean your kitchen, and find out they've left you a new phone that speed-dials out to re-hire them. You invited them in for a task and they left something behind unrelated to the task but to their benefit while they were there.

It's not entirely clear to me from the summary when the poster could "opt out of it." If it was during the standard "accept license/click okay/blah blah blah" procedure the analogy gets even stupider. If he just means he can uninstall it later I guess it'll do.

On a mostly unrelated point, why the bloody hell is a link to an old /. article, some fairly worthless bitching and a screenshot of soembody's Firefox add-on list considered front page news? Is it to cut down on the "RTFA" replies by not actually having an article? If so, kudos on streamlining our reading processes for us--but I think we all know the editors aren't that clever.

Firefox plugin...

[Bert64]

The install of Java already includes a java browser plugin, they are only extending it's functionality with a firefox addon rather than doing something completely new and unexpected.

Anybody else note this other recent change?

[Anonymous Coward]

I've been using Firefox for as long as I can remember because of great add-ons and a polite setup that allowed me to choose what gets installed on my computer. However, somewhere in the past week, the latest updated version overrode my choice to start up my browser with a blank screen and changed this to a google default startup screen. What's worse, the button that used to allow me to choose to start up with a blank page got blown away-- the interface looks the same, but the buttons have been changed.

Yes, I know that one can put in "about:blank" as the startup page and fix this, but I bet most folks don't know this off the cuff. And yes, I did notice the new place where they placed (buried?) the option to start up with a blank page.

Can someone tell me a sound reason for introducing a change that effectively walls off a user-chosen option like this? Because all I see is sketchy corporate "shepherding". This wouldn't have surprise me coming from Microsoft, but from Mozilla?!

Choices

[Anonymous Coward]

According to your screen shot you are running a Windows OS. By now you should be used to software making choices for you.
If you don't like it switch to an OS that puts you in control. But mind you, you actually have to think about what you're doing.

Java quick starter plugin == flash plugin

[ge0ffrey]

The Java quick starter plugin is a good thing. Finally Java is doing the same trick as Flash in your browser: start up in the background along with your browser, so when you see a Java applet on a webpage it doesn't take 5 to 20 seconds to show up. They should have done this 10 years ago. If you don't like Java, maybe you shouldn't be installing Java? :)

There was always the plugin

[Anonymous Coward]

There was always the Firefox plugin that Java installed (without asking you! Oh noes!)

Now they have added an addon to enhance the Java experience (yes, it's a buzzword, but that's what it's about here) and you cry!

The addon probably doesn't do a whole lot different from the plugin. Both is code that runs inside your browser.

Phones without MIDlet support?

[tepples]

Don't install java. On anything. Ever.

Wouldn't that restrict which mobile phone models you can buy? A lot of phones come with a MIDlet player based on the Java Micro Edition runtime environment.

Re:Phones without MIDlet support?

[aled]

Don't install java. On anything. Ever.

Wouldn't that restrict which mobile phone models you can buy? A lot of phones come with a MIDlet player based on the Java Micro Edition runtime environment.

and every Blu-Ray player.

Re:Unlike Microsoft, this one benign and documente

[gbjbaanb]

...and JRE finally, finally showed some kind of Desktop user touch by preloading frequently used classes (or their metadata, more like prebinding/prefetch) to memory in ages of 64bit running laptops with 4+ GB memory.

lucky for you. Most people don't have laptops with 4Gb+ of RAM. Sun still loads up the prefetch, so even if you just want to browse a static html site, you have to wait for a ton of unnecessary Java classes to be loaded. That you'll never use.

Its one of those optimisations that suit just you, and inconvenience hundreds, but you think its ok because it suits you. The recommended option in these situations is for you to install the pre-loaded addin separately.

I know there's a lot of preloading going on nowadays, has been for some time - every OEM ends up with a Java preloader, Adobe startsmart, Mozilla did it a while back IIRC, even Microsoft. Strangely we end up with systems that take ages to boot and everyone (rightly) complains.

The problem really is that these systems require such a large infrastructure that they're becoming unwieldy in practice. It might be fine for a developer to have a million pre-built classes in his language, but when they all have to be loaded up for his apps to work you begin to see why users are demanding smaller, faster, leaner systems. The ease for the developer inconveniences millions of his users. Its time that was reversed.

It also loads a new service on XP Pro

[Anonymous Coward]

For those who like the new addition from Sun, leave the new service running. For the rest, disable it, too.

This could bypass any signing anyway

[Nicolas MONNET]

It is not installed from the web, it's installed from outside the Firefox process by the Java updater if I understand correctly. There is no way FF can prevent it from installing, since it's not doing the installing itself.

Re:This could bypass any signing anyway

[AlterRNow]

I'm not saying this would prevent it from installing but it would prevent Firefox from loading and then running it.

Dumb.

[wasabii]

Dumb ass. You gave them permission when you ran their installation .exe on your system. Don't run it if you don't want them to do shit.

"Quick Start" gimmicks eat your machine

[Animats]

Too many vendors are dealing with their bloated program load times by trying to make their program permanently resident in memory. Microsoft started this with IE, and it's now in Firefox, Microsoft Word, Adobe's PDF viewer, OpenOffice, and now Java. You can lose most of your RAM to bloatware that way. If you let all that stuff install, performance is worse than with none of it. Instead of loading delays, you now get paging delays and boot delays.

We need more restrictive installers. Installers for "applications" shouldn't be allowed to install a service. Windows installers for applications should be restricted to writing into "Program Files/appname" and registry keys in "HKEY_LOCAL_MACHINE/appname".

Re:Unlike Microsoft, this one benign and documente

[mpe]

All this plugin does is speed up loading of Java applets.

Other people have complained that it slows down starting up Firefox. That is a common issue with "quick starters" they can easily slow down other things, especially when what they might "speed up" is only used very infrequently.

Re:Unlike Microsoft, this one benign and documente

[Anonymous Coward]

What if that tick box isn't there? How do you shut off the quickstarter? I just recently uninstalled Java because java quick starter would not let the computer go into standby mode in XP.

Untrolling you, and explaining important details

[Anonymous Coward]

1) The JQS is not "unneeded" because it significantly improves the user experience (perceived startup perfomance) for Java apps. This matter a lot to users and also to Java developers.

2) It doesn't "waste memory", it's a pretty smart quickstarter. It just hints the VMM to load a few of the JRE files - not everything, only some ~10Mb that are critical for its cold-start - in the filesystem cache. This space can be returned if Windows is tight on memory, and there are other tricks like the fact that the JQS goes quiescent if you start Windows on a laptop battery, just so avoid triggering HD activity that would burn a few seconds worth of battery.

3) It doesn't make Firefox "take longer to start", because it does everything it does in background. (You should surely know that one, but then, you were trolling.)

4) Java doesn't have a "massive number of security holes". Quite the opposite, Java's security track record is stellar compared to virtually any other platform (both commercial and FOSS ones). And not all JRE updates are security updates.

5) J2EE has nothing to do with the JRE plugin for browsers, just for the record. People who only need server-side Java will usually install only the JDK, which includes its own JRE without any browser integration, plus some J2EE container.

6) The installer doesn't "demand" registration; yeah it loads a registration site on your browser but you can just close that.

In addition, the JRE deployment technology (post-6u10) is pretty smart and unobtrusive in many aspects. For example, the auto-updater will only download files when your internet connection is detected to be idle, and these downloads are typically small because it fetches small patch files instead of full JRE installers.

Having said all that, I still complain to myself that each update activates stuff that I have to disable, because they are of no use for me - but that's because I am a power-user and a Java developer, so I have a powerful machine that doesn't benefit from the JQS (plus I'm a tidy-freak and a control-freak: after login my Windows session has ZERO preloaded programs, useful or not - I start even IM clients manually when/if I need); and I don't need the auto-updater because I manually update everything all the time, before Sun/Microsoft/Adobe/etc pushes new stuff through their auto-update channels. But I'm not the typical end-user for whom the JRE installation and deployment story was optimized for. Sun could certainly improve the JRE installer with a few options like "Want JQS or not?", but each extra checkbox in the installer would double the number of people bitching that installing Java is a complex and scary procedure compared to the zero-neurons-required, fully-transparent setup of Flash or some other competitor.

You're an idiot

[Rix]

I don't have a registry to worry about, nor do I run any third party updaters.

There is a security issue, but it's with an OS that relies on third party installers that are allowed to scribble over each other.

implied gratification

[epine]

... want it to operate smoothly. No reason to complain.

I guess I'm a more inventive complainer than you are.

Why, look you now, how unworthy a thing you make of me! You would play upon me; you would seem to know my stops; you would pluck out the heart of my mystery; you would sound me from my lowest note to the top of my compass: and there is much music, excellent voice, in this little organ; yet cannot you make it speak.

The day not long ago where I installed the USB protocol analyzer and it blue-screened my workstation every half hour all day, Firefox was adding another 2m to every round trip starting plug-ins that I wouldn't gain any advantage from until after another half-dozen blue screens.

When one application pauses to load a major plug-in, I have eight other desktops one keystroke away where I can continue to accomplish useful work. When Windows is so bogged down coming up from a cold-start that I can't the program menu to pop up, I'm pretty much dead in the water.

What I would really like is a global setting "how much does instant gratification rule your life?" Hint: I won't be picking "make it smooth". I'm no fan of gratification that arrives unannounced and doesn't sport an off switch.

Re:Untrolling you, and explaining important detail

[Anonymous Coward]

1) The JQS is not "unneeded" because it significantly improves the user experience (perceived startup perfomance) for Java apps. This matter a lot to users and also to Java developers.

Which is great, if anyone still used applets.

Applets are dead. No one uses Java from the browser. It's 100% useless. Everything applets used to be used for has been replaced with AJAX. Applets are obsolete.

Everything else you wrote about how it does waste memory and doesn't slow Firefox (which is demonstrably false, by the way) is irrelevant: because no one uses Java in the browser, any addition is worthless.

5) J2EE has nothing to do with the JRE plugin for browsers, just for the record. People who only need server-side Java will usually install only the JDK, which includes its own JRE without any browser integration, plus some J2EE container.

You're wrong, because I did only install the JDK and that's what dumped the useless extension into Firefox.

6) The installer doesn't "demand" registration; yeah it loads a registration site on your browser but you can just close that.

Shoving it in your face counts as demanding to me. You mean that it doesn't require registration. Which is true, but it asks. Every. Single. Freaking. Update. (We're up to what, 12 on the latest version?)

Re:Untrolling you, and explaining important detail

[Osvaldo Doederlein]

Applets are dead. No one uses Java from the browser.

Java applets are certainly not popular in recent years, although I wouldn't say dead, and recent improvements (from JDK 6u10+ to JavaFX) stand reasonable chance to resurrect applets (only time will tell). But this whole debate doesn't matter, because if you never visit any page that needs the JRE, you can just not install the JRE - simple, isn't it? And if you ever hit a single site that's interesting to you and uses a Java applet for some useful purpose, then they ain't dead.

You're wrong, because I did only install the JDK and that's what dumped the useless extension into Firefox.

The JDK installer has a option to not install the "public JRE" (public = integrated to Windows / browsers), just turn that off. It's recommended for server boxes where you don't want unnecessary browser plugins of any kind (I won't install even the Acrobat Reader in a server that's exposed to the internet). The installed JDK will still have an embedded jre directory with everything you need to run server-side and even standard client apps like Java IDEs, etc.

Shoving it in your face counts as demanding to me. You mean that it doesn't require registration. Which is true, but it asks.

Well, many installed software does that - pushing the user to the vendor's page. Even the browser itself does it... including addons; every week Firefox tells me that there's a new version of FlashGot or some other addon, and after I say Yes to download, update and restart, Firefox opens a new tab pushing me to the updated addon's page. Perhaps you think that opening a simple Release Notes page is okay, but opening a Registration page is not. That would be BS for me.

Every. Single. Freaking. Update. (We're up to what, 12 on the latest version?)

The true number is MUCH smaller. First, Sun moved from 6u7 to 6u10 (skipping versions 8/9) because 6u10 was a major feature update. Second, not all such versions are pushed through the auto-update channel; I don't know exactly what is Sun's criteria but it seems that only one out of each two or three minor versions are pushed. So, the net number of JRE updates that Sun forces through users with the auto-updater active is pretty small, perhaps 2-3 per year.

[P.S. I'm the poster of the msg you replied to; just for the record as I never post as AC except by accident.]

Jan Schotsmans

[Anonymous Coward]

Aren't applications that interface or alter applications from other vendors without notification or explicit and clear user approval normally called a virus?

Right on!

[krischik]

Right on. I am permanently on the hunt to delete those quick-starters. Some of those programs I only use once a month and yet they waste my precious boot time.

I am so fed up of it and one more reason why I use Mac at home nowadays.

Martin

BTW: did you know that on OS X applications are installed and de-installed by drag and drop. So simple, so elegant - in fact so simple and elegant that Microsoft displays are warning when you drag and drop an applications icon into the trash can. On OS X there is no warning - dragging and dropping the application into the trash can will de-install ;-) .

Same old thing...but different..

[ebresie]

Isn't this basically the way it was previously?

In the past, when you installed Java, it came with a plugin that was available for IE and Netscape...is that any different except now it gives you some notification of its installation?

I suppose if you don't have Java installed then yes this is new, but if you plan to visit a Java enabled site, then you would have the chance to install it then also (just like if you were trying to install the Flash plugin). With the new plugin it only installs the needed items (with the remainder of the JRE installing in the background).