Slashdot Mirror
Mozilla Unblocks Microsoft's .NET Addon
bonch writes "Mozilla previously blocked the Firefox addons Microsoft included with .NET, citing security concerns. After talking with Microsoft, they have now unblocked the .NET Framework Assistant addon and are working on a way for enterprise users to unblock the Windows Presentation Foundation addon as well."
MS09-054
FAQ for HTML Component Handling Vulnerability - CVE-2009-2529
If I use Firefox, which Internet Explorer update do I need to
install?
If a computer system is configured for Automatic Update, the
correct update will be downloaded and made available for installation depending
on the Automatic Update configuration. In the event that a computer system is
not configured for Automatic Update, users should verify which version of the
Windows operating system and Internet Explorer is on their system and download
the appropriate update.
If I install this security update, do I need to disable the Windows
Presentation Foundation Plug-in in Firefox to be protected from this
vulnerability?
No. Customers who have installed the security updates
associated with this security bulletin are protected from this
vulnerability.
If I have not yet applied this security update, how do I disable the
Windows Presentation Foundation plug-in in Firefox?
If you have not yet
applied this update, you can disable the Windows Presentation Foundation plug-in
in Firefox to block this vulnerability. To do this, launch the Firefox browser,
select the Tools pull-down menu, and then click Add-ons. Select
the Plugins icon at the top of the Add-ons window. In the list of
Plugins, select Windows Presentation Foundation 3.5.30729.1 and click
Disable.
If I uninstall the .NET Framework Assistant extension, does it disable or .NET .NET Framework Assistant and
remove the Windows Presentation Foundation plug-in?
If the
Framework Assistant extension is uninstalled it does not disable or remove the
Windows Presentation Foundation plug-in. The
Windows Presentation Foundation plug-in are controlled through different screens
in the Firefox Add-ons management window.
Oh come on. As anyone who's following this story is aware, Mozilla has an "approved" method of installing plugins without using the add-ons panel. So pick your bone with them.
There are two kinds of people: 1) those who start arrays with one and 1) those who start them with zero.
Is this a failed attempt at trolling?
It's a PLUGIN, not an ADD-ON. There is no way to uninstall ANY Plugins in Firefox. You can disable Add-Ons, you can uninstall Add-Ons and you can disable Plugins. But you cannot uninstall Plugins from within Firefox. Firefox simply loads all files in a specific Internet Plugins folder (not a Firefox-only plugin folder) and if it detects a plugin, it uses it.
Delete the file and you're good to go.
It can, however, be removed via the package manager.
Can the .NET addon be removed at all, without hacking the registry?
No, using the package manager is not even remotely comparable to hacking the registry.
Don't thank God, thank a doctor!
Microsoft forcibly installed said plug-in, and prevented its removal.
The first statement is debatable, since the plugin is a part of the .NET Framework, and people can choose not to install the .NET Framework — although I realize newer versions of Windows have it preinstalled, so there's less of a choice there, which is why I say it's debatable.
However, the second statement is just wrong. It's not Microsoft who prevented removal of the plugin, it's Mozilla. Firefox does not provide a mechanism for removing any plugins.
"You cannot simultaneously prevent and prepare for war." -- Albert Einstein
Why did it take 7 long months for Microsoft to issue this patch? Fixes using Registry hacking were available on theweb immediately then...
If you keep throwing chairs, one day you'll break windows....
Host your own blocklist and point extensions.blocklist.url to it. Or locally: http://kb.mozillazine.org/Blocklist.xml
Simply enter the address 'about:config' and then do a search for blocklist.
There, you'll see a setting called 'extensions.blocklist.enabled'. Set it to False if you don't want Mozilla to decide what plugins/add-ons you shouldn't use. Restart Firefox after making changes to take effect.
Sure it isn't obvious for majority of users, but then again on Windows it isn't obvious what registry entries to hack in order resolve issues either. Firefox does have its own (evil?) registry too.
This space is not for rent.
Actually, the most recent version (not sure of the number) has the normal Uninstall button enabled, and overall it seems to be behaving pretty well.
The government can't save you.