Slashdot Mirror
Sneaky Microsoft Add-On Put Firefox Users At Risk
CWmike writes to mention that the "Windows Presentation Foundation" plugin that Microsoft slipped into Firefox last February apparently left the popular browser open to attack. This was among the many things recently addressed in the massive Tuesday patch. "What was particularly galling to users was that once installed, the .NET add-on was virtually impossible to remove from Firefox. The usual 'Disable' and 'Uninstall' buttons in Firefox's add-on list were grayed out on all versions of Windows except Windows 7, leaving most users no alternative other than to root through the Windows registry, a potentially dangerous chore, since a misstep could cripple the PC. Several sites posted complicated directions on how to scrub the .NET add-on from Firefox, including Annoyances.org."
Maybe it's a little paranoid, but... Doesn't Microsoft potentially benefit from Firefox vulnerabilities? I mean, IE isn't doing so well right now, and this could discredit Firefox a little.
I went through the process of removing the plug-in. While I was incensed that it was installed without so much as a by-your-leave, the removal method I used didn't require registry hacks or anything so high falutin.
That said, I should not have had to have gone to any such effort in the first place.
Scientists point out problems, engineers fix them
altslashdot.org: The future of slashdot.
The only thing worse than installing without asking is uninstalling without asking.
This is from the same people that claimed that the Google Chrome Render plugin for IE6+ will make the browser less secure?
"Microsoft fixes vulnerability in their own Firefox Addon"? The summary would then point out that this was covered and Microsoft fixed the problem. But I guess calling Microsoft "sneaky," ignoring the fact that this was already posted on slashdot, and then minimizing the fact that MS actually fixed the problem was too appealing to pass up.
But then I realized the cable was blue, so I only gave it one star. I hate blue.
There are lots of programs that install plugins automagically...Skype, antiviruses, and Picasa are a few that I can think of off the top of my head. The only bad part of this whole thing is that MS screwed up the remove/uninstall feature by making it show up for all users.
No. Wrong. Installing plug-ins or extensions without asking is bad. Period. Full stop. End of story.
So firefox allows a rogue addon to install without any user intervention and the story is all about how evil MSFT is?
Sure, they did it. Bad Microsoft.
But isn't the bigger issue that now that this is known....*anyone* can pull this on firefox users?
No. I am not apologizing for Microsoft. This was "Sony Stupid" of them. We're used to that here, though. What we're not used to (and apparently sweeping under the rug) is the massive, unholy hell of a mess mozilla's extension system for firefox is....
Anyone that can run executable code on your system can do anything to your system. The "good guys" aren't supposed to do things to your system without asking you first. The "bad guys" can simply replace Firefox entirely with a version that has what ever features they want. If you let someone run code on your system, you lose. Firefox cannot stop that code from doing what ever it wants. The point is that you're supposed to only install software from vendors you trust. You should be able to trust Microsoft and that your trust was abused and abused in a way that caused you to be vulnerable to remote exploits is the story here.
or ... here's a novel idea ... get ready ...
maybe microsoft could try making good quality products that people want to use instead of spending all their money on subversive, childish, and frankly idiotic, endeavors to stem the flow of users away from their products.
they have been doing the same crap for years with every piece of software in the market that's not theirs. they release an update that makes it insecure or unstable.
not that they care, but i have no respect whatsoever for the poor excuses for businessmen that run Microsoft.
nothing new though i guess ... rather than come out with something useful that makes the world better they just keep churning out the same old crap and bulldoze anyone who gets in their way just like the insurance industry, petroleum industry etc. /sigh
Which is exactly what makes it outrageous.
What the fuck kind of business does MS have with patching someone else's friggin software?
I'd say that MS is illegally making a derivative binary work and should get nailed for infringing on mozilla copyrights.
Additionally, I also say that MS is engaging in anti-competitive behavior by sabotaging a rival product.
To be honest though, parking a crap add-on and then blaming Firefox for any security issues over it would sound par for the course as per Microsoft...
Well, of course it is... After all, isn't being unable to prevent the company that controls the OS your program runs under from automatically installing unremovable exploit code a severe security hole in your program? So clearly it's a problem with Mozilla, and has nothing to do with Microsoft at all.
I know you didn't start this, but I have to say:
2k10... 2k08...
What the hell? Are these supposed to be short for 2010 and 2008? What's the freaking point of writing them like that?