Microsoft Hides Firefox Extension In Toolbar Update

Jan writes "As part of its regular Patch Tuesday, Microsoft released an update for its various toolbars, and this update came with more than just documented fixes. The update also installs an add-on for Internet Explorer and an extension for Mozilla Firefox, both without the user's permission."

Comments

1st

[Anonymous Coward]

1st yes

stop it MS

[Anonymous Coward]

MS stop acting like spyware....

Wow!

[Enuratique]

Old news is so exciting!

Re:Wow!

[Culture20]

Old news is so exciting!

Is it old news, or did MS decide that since only "Firefox geeks" complained about it last time that it's open season to add Firefox extensions without asking?

Re:Wow!

[jandersen]

When you buy and/or install Windows, you explicitly (although in very small print) give Microsoft permission to do exactly this, as far as I recall; it should be in your EULA. I can't say that it worries me a lot - I use Linux.

Re:Wow!

[Peach Rings]

The worst part is that the purpose of the update is to fix a bug in data reporting with their optional spyware program!

In an Internet browser, you specify a homepage that is not a fully qualified URL. However, Windows Live Toolbar, MSN Toolbar, or Bing Bar may not categorize your homepage correctly. Therefore, the homepage reporting may be generated incorrectly for users who select the Help improve our services option when they install these toolbars

g

Re:Wow!

[DrgnDancer]

I think this is a new, though similar story. The link article was last edited 16 hours ago. I remember something similar a month or two ago though.

Re:Wow!

[Anonymous Coward]

You may be using Linux, but are you also using Firefox? Is the extension add-on only for the Windows version, or is it a universal add-on?

Re:Wow!

[Amanieu]

I doubt he'll be running MS Update on Linux :P

Re:Wow!

[Anonymous Coward]

I'll run Windows Update from Linux and let you know what happens.

Re:Wow!

[dkleinsc]

Why not? There's a decent chance it will work under Wine!

Re:Wow!

[bill_mcgonigle]

I can't say that it worries me a lot - I use Linux.

But I run automatic updates in Windows and don't trust Microsoft! Oh, wait.

Re:Wow!

[jabbathewocket]

Pay attention buddy, the idiot user of the system installed a MS branded toolbar.. which when installed will install an extension in firefox if it is installed.. understand? Lemme spell it out in BIG GIANT LETTERS

Person decides he wants the bing toolbar from MS.. he happens to have firefox and IE8 on his system..

The bing toolbar being a toolbar.. that is a bloody browser extension

Now it has to add itself to both IE and Firefox..

So when that toolbar gets updated

Still following along? GOOD

Yep thats right.. when the original toolbar which installs both IE and firefox extensions is updated...

SO ARE THE FIREFOX AND IE EXTENSIONS



This is not news, this is dumb people who forget that they clicked download installed something in IE a year or more ago, and now suddenly get emo that they restarted firefox and see a new extension (or updated extension)

For some reason this triggers them to go into a frenzy of posting on slashdot and elsewhere about how evil MS is for updating the product that the dumb user installed and forgot about.

Re:Wow!

[Anonymous Coward]

I doubt he'll be running MS Update on Linux.

Tired of your software not running on Linux? Tired of the Linux re-install treadmill? Click HERE to automatically replace your Linux installation with Microsoft Windows 7 (TM)!

Only $189.99 while this offer lasts! 43.93% OFF! (Please have your Paypal login credentials available)

Re:Wow!

[Blue Stone]

>When you buy and/or install Windows, you explicitly (although in very small print) give Microsoft permission to do exactly this

I don't think the word 'explicitly' means what you think it means. Even more so in very small print.

Re:Wow!

[Unequivocal]

This isn't old news. This happened for me with the most recent Windows 7 update set. I was notified of the updates this week. I saw this "search enhancement" update and it appeared to only affect IE so I accepted it. Now I'm stuck with this search add-on in Firefox. I disabled it but it's not possible to uninstall it from the FF add-on GUI. Probably if I delete some folders somewhere it will disappear but googling didn't turn up much when I searched -- mostly referring to older updates that sound similar -- possibly what you're referring to as well.

Re:Wow!

[commodore64_love]

>>>When you buy and/or install Windows, you explicitly give Microsoft permission to [update Firefox]

I doubt that is true, and even if it were it violates multiple U.S. and EU Consumer Protection Laws. The only reason MS gets-away with it is because nobody's bothered to sue them yet & challenge the TOS.

Re:Wow!

[Khyber]

"When you buy and/or install Windows, you explicitly (although in very small print) give Microsoft permission to do exactly this, as far as I recall;"

No EULA may contradict the Unauthorized Access of a Computer laws we have.

Microsoft is breaking the law and they need to pay for it, PERIOD.

Re:Wow!

[zuperduperman]

I'm pretty sure that Windows Update gets permission / consent somewhere along the line to umm.... you know... update your computer?

You might dislike any particular update it does, but if you just blindly turned on automatic updates and set them install automatically without review then please don't complain that these things are happening without your consent. It's perfectly possible to configure Windows Update to just download the updates and let you review them before you install.

Re:Wow!

[Anonymous Coward]

So why are you here? Other then to act like a smug ifag I mean.

Re:Wow!

[Khyber]

You apparently aren't understanding the issue.

If the toolbar is installed for IE, but not Firefox, and you update the IE toolbar, IT AUTO-INSTALLS to FIREFOX.

This is a violation of the law, regarding unauthorized usage of computer resources (other programs a company has NO RIGHT TO MODIFY IN ANY FORM.) If you cannot understand the law, perhaps you should just throw yourself in jail right now and save us the headache.

Re:Wow!

[jandersen]

So why are you here? Other then to act like a smug ifag I mean.

Do I need any other purpose? And what is an iFag? A gay man, who works for Apple?

However, just because I am smug, and justifiably so, doesn't mean that I don't have a point - which is that far too many people have for far too long allowed the likes of Microsoft far too long a leash. I don't know why that is - their main products (Windows and Office) have for most of the time been cumbersome and faulty; perhaps the explanation is simply that only few people actually cared one way or the other. I think the main reason they are now crumbling at the edge is that people begin to realise that there is not much reason to keep paying money for what is mostly glitter, when you can get the same or better elsewhere.

It is remarkable how people pay for allowing others to screw them over well and good; it isn't just MS - it is this whole consumerism thing. We have built up a culture where we are more or less imprisoned in crap we don't need and probably don't actually want, and which is harmful to our health, not to mention the wallet.

yay

[Pojut]

I like your products, Microsoft...but I still abhor your business practices.

Kinda like Sony, Apple, etc...

Re:yay

[couchslug]

"I like your products, Microsoft...but I still abhor your business practices."

Not enough to stop using their software, hence not enough to matter.

Re:yay

[Anonymous Coward]

What do you like about Microsofts products?

Re:yay

[Anonymous Coward]

Polut is probably a typist...

Re:yay

[Pojut]

In my personal experience, I've had good luck with them from a security and stability standpoint. Granted, there is better stuff out there, but it still works pretty well for me. I also have a few music programs and games that I use which don't work on Linux (yes, even through WINE), and I don't want to have to pay extra for Apple-branded hardware, so Windows + self built systems it is.

Re:yay

[Anonymous Coward]

fascinating.

your experience doesn't include supporting very many people beyond yourself, does it.

Re:yay

[Pojut]

Of course it didn't, the question was specifically directed at me:

What do you like about Microsofts products?

Why would I talk about other people if someone is specifically asking why I like something?

Re:yay

[Anonymous Coward]

In my personal experience, I've had good luck with them from a security and stability standpoint...

That's funny, because in my decades of experience with Microsoft operating systems, security and stability, in that order, have been their top-two worst points.

Re:yay

[Anonymous Coward]

In my personal experience, I've had good luck with them from a security and stability standpoint...

That's funny, because in my decades of experience with Microsoft operating systems, security and stability, in that order, have been their top-two worst points.

What's "funny" about two different people having different experiences. That's just how the world works.

Re:yay

[GWBasic]

I like your products, Microsoft...but I still abhor your business practices.

I get the impression this is a lack of oversight / management issue. Some lazy contractor or employee probably wrote the plugin, and QA and management didn't realize that's how the problem was fixed.

Re:yay

[pwnies]

What about OSX86? Been running that for the last few months. It's fancy.

Re:yay

[Wildclaw]

Not enough to stop using their software, hence not enough to matter.

Just like someone who never intends to buy their products because of ideological reasons doesn't matter.

The only people who matter for businesses/politicians are the customers who may take their business elsewhere and the non-customers that are considering to become customers. And only if they exist in large enough amounts to be noticeable statistically.

That is why monopolies are bad. They make customers matter less.

Here we go again

[__aaelyr464]

...cue the generic nerdrage against Microsoft. Not that I'm saying they should be allowed to push updates like that, but what's the harm in some ridiculous search extension being added? Not like it's crippling FF or anything (from what I can see right now).

Re:Here we go again

[Pojut]

Disclaimer: This is only my opinion, nothing more.

It's the same problem I have with Apple keeping people locked into the Appstore. It's not that the action itself is a big deal, it's the fact that they are actually doing it that's the problem. The consequences of that action is irrelevant; the action itself is bad.

Re:Here we go again

[Pojut]

The consequences of that action are irrelevant

Fixed.

Re:Here we go again

[gstoddart]

Not that I'm saying they should be allowed to push updates like that, but what's the harm in some ridiculous search extension being added?

Well, the problem is, nobody knows exactly what it is and why it's there. Given Microsoft's lousy record with internet security, what's to say they haven't inadvertently created a security loophole?

From the looks of it, they're installing toolbars into Firefox. Since they're for Bing and for Search helper, I'm sure they're directing people to their own search engine. Which means they're taking advantage of their control over the OS to meddle with my browser.

And, most importantly, they didn't ask. Since this isn't Microsoft's software, WTF are they doing jamming in add-ons without notifying the user or making it possible to delete it?? When they installed the last .NET extension to my Firefox, I can't delete it -- only Disable it. It's not up to Microsoft to "enhance" my user experience in software that isn't theirs.

Seriously, you have to ask why installing additions into other companies' software without asking the user or allowing them to delete it is just plain wrong? What next, deleting any software which competes with their own offerings?

Re:Here we go again

[mr_mischief]

Contact the EU. Seriously, this is just after (in bureaucrat time) they were forced to offer browser choices. Now they're trying to lure people to their search engine to generate ad revenue by abusing the same near-monopoly on desktop OSes.

Not to mention this is a horrible security practice -- force-installing software someone didn't request. This should be prosecuted as unauthorized access to millions of computers.

Re:Here we go again

[Anonymous Coward]

When they installed the last .NET extension to my Firefox, I can't delete it -- only Disable it.

Of course you can delete it. It's just files on a disk. You can't delete files on a disk?

What you can't do is disable it from inside Firefox. And why is that? Because that's how Firefox was designed.

Re:Here we go again

[nschubach]

Removing the .NET plugin:

del /q "%SystemRoot%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll"
reg DELETE HKLM\SOFTWARE\Mozilla\Firefox\Extensions /v {20a82645-c095-46ed-80e3-08825760534b} /f > Nul
del /q %SystemRoot%\System32\dllcache\*.*

I also remove the Media player DRM plugin:
del /q "%ProgramFiles%\Windows Media Player\npdrmv2.dll"
del /q "%ProgramFiles%\Windows Media Player\npwmsdrm.dll"

Re:Here we go again

[hAckz0r]

But its not benign in any sense of reality. Think of it this way, for every 1000 lines of code there is an average of 1-1.5 defects even in highly scrutinized Government sponsored "secure" programs. If Microsoft wrote 10k lines of code (conservative I think) that is, given Microsoft's current defect track record, about 12 real defects in that hypothetical extension (I don't know the actual size of the code base). If even one of those defects provides a security vulnerability your system gets hacked. How secure are you? You don't even know its vulnerable, and if you did, you may not even be able to remove it entirely because Microsoft doesn't provide that capability on purpose. Even if you find a way to deactivate it there is still code on your system that might be abused without clicking on the GUI taskbar. Removing these Microsoft 'add-ons' generally requires a knowledgeable person to essentially hack you Firefox/OS installation just to remove it. The real twist to the reality is that they even want Firefox to be unstable and cause you problems, so what is their incentive to make it defect free? They are not going to put much effort into ensuring that a competitors product continues to beat them in the open market. Microsoft likes to win. History itself tells the truth about their true motivations. I won't even go there.

Re:Here we go again

[Anonymous Coward]

Apple don't update other company's applications, though. MS just did.

Re:Here we go again

[Anonymous Coward]

So every time you don't put that disclaimer, may we assume that what you write is 100% objectively factual?

Why do some people have such an inflated sense of their own opinion that they believe it somehow warrants a disclaimer?

Re:Here we go again

[gstoddart]

What you can't do is disable it from inside Firefox. And why is that? Because that's how Firefox was designed.

Really? I've got two add-ons with a nice shiny Uninstall button next to them that is enabled should I decide to push it. (Why I would uninstall noscript, I don't know, but it's there).

I also have Java Add-ons and .NET add-ons which have the Uninstall button disabled.

Methinks if Firefox was designed to prevent uninstalling add-ons, there would be no such button.

And, really, unless you know exactly which files to delete and if you can do it safely, deleting the files from the disk isn't really an option.

Re:Here we go again

[siloko]

Apple don't update other company's applications

True, when Apple sees functionality in an App they don't like they just ban the app!

Re:Here we go again

[devent]

I'm pretty sure it's in their EULA. Try read it sometimes :)

Re:Here we go again

[blackraven14250]

It was designed to give developers the choice as to whether a user can uninstall from Firefox.

Re:Here we go again

[sjonke]

Actually, on the iOS, unlike in MacOS, they do, but that's part of why they have a testing process for app submissions. Of course the anti-Apple folks like to look at it... no actually they just prefer to turn away and imagine what it might be like.

Re:Here we go again

[gstoddart]

I'm pretty sure it's in their EULA. Try read it sometimes :)

Wait, are you seriously contending that the Microsoft EULA for the OS gives them blanket permissions to alter 3rd party software as they see fit??

That should be illegal. Well, then again, so should the way most EULAs/TOS get updated unilaterally.

Re:Here we go again

[sjonke]

To be clearer, I meant they install updates provided by 3rd party app developers, which they don't do in MacOS (Software Update in MacOS only updates Apple software). Tthey don't change other's apps or install their own things in them. So, actually I guess they don't, in the sense you are meaning.

Re:Here we go again

[Pojut]

Because around here, whenever I don't include that disclaimer and my opinion grates against the common opinion, people do assume that what I write is 100% objectively factual. This happened a couple of days ago here on Slashdot with my opinion on the iPhone.

I'd rather not go through that malarky again, hence the disclaimer.

Re:Here we go again

[Anonymous Coward]

There are two separate add-on mechanisms: plugins and extensions. Extensions are managed by Firefox, and plugins are not. The .NET "extension" was actually a plugin, and that's why you have to go outside of Firefox to remove it. This is the way Mozilla designed it.

Extensions should always be manageable through Firefox. The fact that Mozilla has provided the ability for an extension to disable its "Uninstall" button is a problem, and it's Mozilla's problem.

Re:Here we go again

[Anonymous Coward]

Good attempt, but we can refine the argument a little more and get a better result.

"Goodness" or "badness" is necessarily measured by the impact resulting from the action, mitigated by the degree of proximity of the action to the result and the degree of intent/knowledge that one would lead to the other. There is nothing inherently wrong with thrusting your fist outwards, unless you happen to hit someone.

The problem with the MS/Install-without-permission and Apple/Appstore-lock-in is that the action and the result are absolutely intertwined (by other facts). The problem with MS is the result - unwanted and often undesirable (i.e. "bad") software on the computer. Put another way, they are 'damaging' your property, also called trespass to chattel (legalese - IAAL). There is nothing inherently wrong with the act of MS installing software on the computer - sometimes we want that (e.g. useful security updates). However, the act isn't merely installing software, it is installing software without permission, a more specific act. This more specific act is bad because of the result, the alteration (i.e. damage) to the computer (i.e. property). The act is inherently bad because the bad result is inescapable from the act.

This is as if it were impossible to thrust your fist outward and NOT hit someone. Or rather, the fist thrusting was always a punch (and not a stretch, reach, etc.). The act is only inherently bad when it is inextricably linked to the bad result. If these two things can be decoupled, then we've created a nice [potential] solution.

Re:Here we go again

[Pojut]

Good attempt, but we can refine the argument a little more and get a better result.

"Goodness" or "badness" is necessarily measured by the impact resulting from the action, mitigated by the degree of proximity of the action to the result and the degree of intent/knowledge that one would lead to the other. There is nothing inherently wrong with thrusting your fist outwards, unless you happen to hit someone.

The problem with the MS/Install-without-permission and Apple/Appstore-lock-in is that the action and the result are absolutely intertwined (by other facts). The problem with MS is the result - unwanted and often undesirable (i.e. "bad") software on the computer. Put another way, they are 'damaging' your property, also called trespass to chattel (legalese - IAAL). There is nothing inherently wrong with the act of MS installing software on the computer - sometimes we want that (e.g. useful security updates). However, the act isn't merely installing software, it is installing software without permission, a more specific act. This more specific act is bad because of the result, the alteration (i.e. damage) to the computer (i.e. property). The act is inherently bad because the bad result is inescapable from the act.

This is as if it were impossible to thrust your fist outward and NOT hit someone. Or rather, the fist thrusting was always a punch (and not a stretch, reach, etc.). The act is only inherently bad when it is inextricably linked to the bad result. If these two things can be decoupled, then we've created a nice [potential] solution.

Damn, you MUST be a lawyer :p Joking aside, well said.

Re:Here we go again

[Anonymous Coward]

Seriously?

If that's how it's done on windows then I don't understand what the fuss is about the console in Linux. People don't like it's color or something?

Re:Here we go again

[Anonymous Coward]

The problem, as someone earlier has already stated, is that the updates are done in a non-user way. I'm not sure how Firefox handles uninstalling plugins that are installed via SYSTEM or a similar account, but it makes some sense that you can't uninstall it from User mode, especailly if the plugin is installed System-Wide. It may be done stupidly (they should have an uninstall as Admin option, for instance), but it makes some sense.

Re:Here we go again

[c 0xFF]

Actually, I prefer:

rmdir /S /Q %SystemRoot%

You might have to reinstall a few things afterwords, but that's a minor step.

Re:Here we go again

[clone53421]

Of course you can delete it. It's just files on a disk. You can't delete files on a disk?

What you can't do is disable it from inside Firefox. And why is that? Because that's how Firefox was designed.

It’s bloody wrong and I want it fixed.

Yes, it’s installed as a system-wide extension and can’t be uninstalled by a user-level program. That is what UAC is for: to elevate privileges out of the user level so I can perform admin actions (such as uninstalling system-wide extensions).

I want a button with the little UAC access-control icon (the shield) next to “Uninstall”, so that I know I can’t uninstall it unless I’m an administrator. Maybe put a little warning message “uninstalling this extension will affect all users on this computer... you must be an administrator to perform this action...”

I want to click the button, be presented with a UAC prompt, type the administrator password, and have the damn extension uninstalled.

That is how things are supposed to work.

In the meantime, how do I uninstall it? I hate having greyed-out disabled extensions cluttering up my list of extensions. (Same goes for plugins, actually.)

Re:Here we go again

[Dragonslicer]

Of course you can delete it. It's just files on a disk. You can't delete files on a disk?

It's Windows, so the answer to that question may very well be "No, I can't."

Re:Here we go again

[Anonymous Coward]

On my system running XP service pack 3, I tried to delete these files:

        del /q "%ProgramFiles%\Windows Media Player\npdrmv2.dll"
        del /q "%ProgramFiles%\Windows Media Player\npwmsdrm.dll"

either with windows explorer or the command shell, and the files magically reappear a few seconds later.

What gives?

Re:Here we go again

[zuperduperman]

Really? You think MS updated FireFox itself and didn't use FireFox's blessed extension mechanism specifically provided so that third parties can *their own* functions to FireFox?

Surely you troll ...

Re:Here we go again

[nschubach]

Run this immediately after it:
del /q %SystemRoot%\System32\dllcache\*.*

That removes the files form cache and the WFP won't put it back. There's nothing in there that won't be automatically populated when it's needed again so you're not going to screw anything up. If you are worried about it, reboot.

Re:Here we go again

[cosmas_c]

Well said! I have 256 add-ons (some kind of 8bit limit in my head)

Re:Here we go again

[thsths]

> The consequences of that action is irrelevant; the action itself is bad.

The consequence are near nil. The plugin will get blacklisted by Firefox within days, and hopefully Microsoft takes the hint. I doubt they will play the cat and mouse game, so the only other options are to wise up or to give up.

Again?

[tom17]

Didn't they do this before with a .net update?

Re:Again?

[ashridah]

The difference being that that add-in was arguably useful. It enabled click-once in firefox, iirc, which is a fairly handy experience for running small apps over the web. If I recall, Java does the same thing. The problem then was that firefox had no way to distinguish between a version with a flaw, and a version without a flaw, so they had no choice but to temporarily blacklist it (and there was that issue with not being able to disable it due to permissions).

Browser toolbars, however, never strike me as a nice addition to a product without asking.

Re:Again?

[Anonymous Coward]

The difference being that that add-in was arguably useful. It enabled click-once in firefox, iirc, which is a fairly handy experience for running small apps over the web. If I recall, Java does the same thing. The problem then was that firefox had no way to distinguish between a version with a flaw, and a version without a flaw, so they had no choice but to temporarily blacklist it (and there was that issue with not being able to disable it due to permissions).

Browser toolbars, however, never strike me as a nice addition to a product without asking.

The update doesn't install a browser toolbar, it updates the browser toolbar for users that already have it installed. Users who haven't installed it won't see this update.

For once the Slashdot summary actually got this correct, and from the original article: "Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed,"

Re:Again?

[logjon]

One of. If you have it installed on IE, it installs it on firefox, even if you didn't have the firefox one. Even if you don't even have firefox installed.

Re:Again?

[Spad]

Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed

Yes, but irrespective of whether it's installed for IE or Firefox. Just because I have the Live Search Toolbar installed for IE doesn't mean I want it turning up in Firefox unannounced.

Re:Again?

[logjon]

Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed

Yes, but irrespective of whether it's installed for IE or Firefox. Just because my OEM put the Live Search Toolbar on IE doesn't mean I want it turning up in Firefox unannounced.

fix'd

Re:Again?

[Yvan256]

So, to use a car analogy, it's like Microsoft is installing a new rooftop on their own car, and if you don't own a car from the other company they just install a new rooftop that just floats in mid-air next to your Microsoft car?

Neat!

Re:Again?

[logjon]

Yeah, and if you do wind up buying another car from the other company, the roof installs itself as soon as you park it in the driveway.

Re:Again?

[Anonymous Coward]

"temporarily blacklist it"

It is still blacklisted with no view to be permitted as of yet, AFAIK.

Re:Again?

[Anonymous Coward]

It's more like them installing a public bathroom on the roof of your car where the plumbing consists of an open pipe directly over the driver's head.

At least that's how I view toolbars.

Re:Again?

[Anonymous Coward]

Why does an OEM have to put in the Live Search Toolbar? Couldn't the user have installed it him/herself?

Re:Again?

[spun]

Why does an OEM have to put in the Live Search Toolbar? Couldn't the user have installed it him/herself?

It's possible. It is also possible that the user could deliberately stab themselves in the eye with a rusty nail, exfoliate with a belt sander, or give themselves dozens of tiny paper cuts on their genitalia. Many things are possible, and some of those things indicate mental illness of some sort.

Re:Again?

[Unequivocal]

I'm one of those users. I recently bought a new laptop and who knows what the OEM put in IE because I never open IE. I was pissed when I saw an uninvited add-on in Firefox. A little research determined that it was related to this microsoft search update. But it's not possible uninstall it via the Firefox add-on GUI. So I disabled it and presumably someone will tell me the right way to get rid of it soon.

Re:Again?

[Golddess]

The update also installs [...] an extension for Mozilla Firefox

You say that TFS "got it right", but you also say the MS update does not install the toolbar, it only updates it if it exists.

So which is it?

(What? RTFA? But that's not what I want to know, I want to know what AC is saying.)

Re:Again?

[Anonymous Coward]

The update also installs [...] an extension for Mozilla Firefox

You say that TFS "got it right", but you also say the MS update does not install the toolbar, it only updates it if it exists.

So which is it?

(What? RTFA? But that's not what I want to know, I want to know what AC is saying.)

There are two separate issues/updates here. An update to the toolbar. And the search helper extension.

Re:Again?

[Khyber]

Call Microsoft and threaten to sue for unauthorized modifications of programs on your computer.

Watch how fast you get it fixed.

Re:Again?

[clone53421]

Both.

If the toolbar exists (either because Windows Update installed it automatically, or because somebody for some reason actually installed the toolbar manually), then Windows Update will automatically update the toolbar. It does not install the toolbar, only updates it.

The update also installs an extension for both Internet Explorer and Mozilla Firefox... and nobody seems to know what the extension is for or what it does.

The extension is not the toolbar, and it does not seem to be an update to the toolbar. It just comes piggy-backed with an update to the toolbar.

Re:Again?

[maxwell demon]

Are you sure there's no clause in the Windows EULA that effectively says Microsoft may mess around with any program running under Windows?

Re:Again?

[dna_(c)(tm)(r)]

So, to use a car analogy, it's like Microsoft is installing a new rooftop on their own car, and if you don't own a car from the other company they just install a new rooftop that just floats in mid-air next to your Microsoft car?

Neat!

No, not on their car, on your car that they manufactured and sold to you.

So it's more like they disconnected the brakes and replaced the pedal with a super-rocket-booster-hyper-activator overnight - without telling you. You will be pleasantly surprised at the next crossroads.

Re:Again?

[Khyber]

No EULA may violate the law. We already have laws expressly concerning unauthorized access of computer resources.

Their EULA is null and void in this instance. EA tried this same BS with me when I sued the crap out of them for Spore and the SecuROM DRM. That argument HELD NO WATER.

Re:Again?

[davester666]

You had me at "Didn't they do this before"

Re:Again?

[soppsa]

EA tried this same BS with me when I sued the crap out of them for Spore and the SecuROM DRM.

Yea YOU (personally) sued the crap out of them alright. What did you net from that epic law suit of YOURS?

Re:Again?

[Khyber]

Umm, what, you didn't read McQuown vs Electronic Arts? YES I SUED THEM. IT WAS A SLASHDOT STORY.

And I'm currently not allowed to disclose what I won, as the settlement is still being approved by the judge. I *CAN* say it's far more than the $5 off coupon you're likely to say I'm going to get.

Buy Em Out

[Stenchwarrior]

Microsoft needs to just go ahead and buy out Mozilla.

Re:Buy Em Out

[erroneus]

Sounds like a simple enough idea, but the DoJ might take a pretty dim view of that action. There is a reason that many large businesses have to first gain approval of various government agencies before buying up the competition.

Done before...

[Vanderhoth]

I'm pretty sure this was done at least once before sometime in May in 2009. I was managing a conference and a "debate" about MS doing this broke out because supposedly if you tried to disable the plug-in Firefox would break. If I can find a reference to this I'll post it.

It is just an update to an existing toolbar

[rhvarona]

The patch installs an update to a toolbar that you must have already installed.  The patch is not available if you don't have the browser toolbar already installed.

Re:It is just an update to an existing toolbar

[logjon]

No. From TFA:

On one of our Windows systems, we had the Windows Live Toolbar installed for Internet Explorer but not for Firefox. Nevertheless, installing this update added the add-on/extension to both browsers without telling us that it would do so. On our second system, we had the Bing Bar installed for Internet Explorer, but it was disabled. Firefox was not installed. This system already had the update in question, so we decided to install Firefox. Not only was the Bing Bar extension present upon Firefox's first launch, but so was the Search Helper Extension.

Re:It is just an update to an existing toolbar

[Anonymous Coward]

Yeah not really much of an issue in my book seeing as I don't have any type of search toolbar installed in any of my browsers (Iron, IE, FF.) Consequently I didn't get some "unwanted sekrit mystery update" when I installed updates Tuesday.

Re:It is just an update to an existing toolbar

[LightningTH]

Except even if the toolbar is disabled it still installs and enables the toolbar in Firefox. It also auto-enables the toolbar upon a new installation of Firefox if Firefox was not previously installed.

Re:It is just an update to an existing toolbar

[clang_jangle]

The more MS tries to force Bing down everyone's throats, the more determined I am to boycott Bing. It pissed me off so much the day I found that Verizon had signed a deal with MS to make Bing the exclusive (not merely default) search provider on my Blackberry. Of course, I countered by putting google at the top of my bookmarks, but really I shouldn't have to maneuver around microsoft's asshat shenanigans just to use my search provider of choice on my phone (and yes, I resent verizon for that as well).

Plus obviously one has to wonder: "If Bing is so freaking great than why is MS paying to have it force-fed all over? Like all those pop-up ads so many sites have now that resolve to Bing -- and they count those as hits for their search engine, which probably at least quadruples their numbers.

It's inconvenient to dislike MS, because they're everywhere. I'd rather be able to embrace them, I really would. But their behavior is just so objectionable in so many ways it's impossible.

Re:It is just an update to an existing toolbar

[OhHellWithIt]

I didn't get the patch; however, I don't have the browser toolbar installed at all. I am reluctant to install anyone's toolbar because it gives them another point of entry into my privacy. It seems that this time, the paranoia paid off.

Re:It is just an update to an existing toolbar

[Garwulf]

I would like to point out, as somebody who has and uses Firefox and does not use the toolbar, that it didn't install on my computer when I updated Windows.

Re:It is just an update to an existing toolbar

[Logical Zebra]

According to TFA, a Microsoft spokeshuman didn't even know about the toolbar being forcefully installed:

"The worst part of this issue is that Microsoft does not seem to be aware of it: a Microsoft spokesperson simply pointed us to the aforementioned Microsoft Support page that inaccurately describes the update. We asked the company for an explanation of why the extension was installed and what it does, but have yet to receive a reply."

Re:It is just an update to an existing toolbar

[Alpha830RulZ]

It seems that your beef should be with Verizon, not microsoft. MSFT just cut a deal. It's verizon that treated their customer like shit in your situation.

Re:It is just an update to an existing toolbar

[pitdingo]

sure, just like the ss was following orders

Re:It is just an update to an existing toolbar

[Anonymous Coward]

It isn't being forced down anyone's throat, at least not in this case. The update is for a toolbar that was already installed manually by the user. Only on /. could people get their collective panties in a bunch over something so trivial.

Re:It is just an update to an existing toolbar

[myspace-cn]

I noticed Ars only use's the win 7 updater. Hope that's not the future trend.

If you've been around for any amount of time you know these toolbars are all crap for the most part and any little benefit you might get, quickly becomes old, and eventually a waste of productive real estate space on your monitor. As you harden over the years, you don't install such crap in the first place.

But I have to admit, I must have been psychic, cause unlike other updates in 2010, I had this "feeling" I should wait a day or two on this patch Tuesday 6/08/2010 And sure enough some people got bit.

With all the lies in the world we don't need deceptions from our "trusted sources" even minor deceptions. I agree with your bold two liner, for the most part your spot on, but it seems there is a complaint here by folks who had only installed it on one thing, having it force installed on another. What if say someone in firefox doesn't want it when they DO want it in IE. Your saying the toolbar is one size fits all. While we are saying, keep your fucking toolbar out of my 4 portable firefox's opera's and whatever else you feel like attacking from the known paths. If I come to you with IE presented, only present IE with shit. It's lazy and it's deceptive, and it questions trust itself.

But for the most part I agree with you.

Re:It is just an update to an existing toolbar

[myspace-cn]

While this is a non-issue for most hardened people out there, it does beg the question.

Are we just one update cycle away from "lights out?"

(Where "lights out" means our systems are down and not productive because they have been broken in some way because of a scheduled update.)

Re:It is just an update to an existing toolbar

[Anonymous Coward]

Repeating that lie doesn't make it any more true. MS forced a bing toolbar on firefox, full stop.

Re:It is just an update to an existing toolbar

[Unequivocal]

To add a second data point to your collection: I use Firefox on a Lenovo laptop with basically a factory installation/config. This update did install the search bar into FF for me.

Re:It is just an update to an existing toolbar

[Your.Master]

That's further from the truth than the person you responded to.

Microsoft installed it on Firefox if a previous version was already installed on either Firefox or IE. The one case is trivial and non-problematic, the other unusual but wrong when it does hit.

Re:It is just an update to an existing toolbar

[kjart]

Plus obviously one has to wonder: "If Bing is so freaking great than why is MS paying to have it force-fed all over? .

Google pays Mozilla so that they use it as the default search engine in Firefox. Does that reflect poorly on Google?

Re:It is just an update to an existing toolbar

[maxwell demon]

There's a difference between being default and being the only option.
If Google payed Mozilla to have Google as the only search engine for the search bar, it would reflect poorly on Google.

Microsoft hides...

[Chameleon Man]

Microsoft hides extension in awkward zipper malfunction.

(Sorry, it's one of those mornings)

Re:Microsoft hides...

[Red Flayer]

(Sorry, it's one of those mornings)

What, one of those mornings where you wake up, roll out of bed, step on a rusty nail that protrudes from the floorboards, limp to the bathroom, have the cold water stop during your shower so you get scalded, the toilet gets clogged and overflows, the coffeemaker shorts out and starts a small fire in your kitchen, your dog eats something bad and barfs all over your feet, and then you get your penis caught in your zipper?

Wait, that is not really analogous to this update... that kind of morning is more analogous to installing windows in the first place.

Re:Microsoft hides...

[Anonymous Coward]

> Wait, that is not really analogous to this update... that kind of morning is more analogous to installing windows in the first place.

no way... at least, not until the mafia guys come to your door asking for extortion money.

Re:Microsoft hides...

[Anonymous Coward]

then you get your penis caught in your zipper

I had always wondered what "girlintraining" meant.

PS) captcha for this post was: salami

A different kind.

[kiehlster]

So glad I don't use Firefox anymore. I'm thoroughly enjoying Chrome. And hey, Google does no evil. Right? Right?! I'm just hoping Microsoft doesn't start making ghostly add-ons for Chrome.

Re:A different kind.

[f3rret]

Well Chrome does all kinds of evil, it is just better at hiding it.

Re:A different kind.

[Skarecrow77]

no evil? how about deliberatly holding back on the browser hooks and infrastructure to allow for comprehensive robust adblock/scriptblock/etc ad-ons, due to such things being completely against their business model that is based on supplying advertisements?

I suppose that's not "evil", bit it is a pretty damn big roadblock to me adopting chrome over FF.

Re:A different kind.

[Jer]

How can you be running a browser without something like NoScript these days? It's almost as bad as running a Windows machine without anti-virus software.

I tried Chrome for a while, but the "work around" for the lack of NoScript was just annoying. It certainly isn't as robust as I'm used to with NoScript. So I barely use it anymore. I wouldn't recommend it to anyone until a good NoScript solution gets worked into the system.

Re:A different kind.

[chronosan]

https://chrome.google.com/extensions/detail/gighmmpiobklfepjocnamgkkbiglidom

Re:A different kind.

[mister_playboy]

I agree. I think it's no coincidence that real content blocking isn't available in Chrome. The speed advantage of the browser itself is more than negated by the slowness induced by ads that can't be blocked, so it simply cannot replace FF or Opera on my computer.

Re:A different kind.

[protektor]

I have Ad Block Plus installed on Chrome. So I am not exactly sure what in the world you are even talking about.

Re:A different kind.

[protektor]

I would imagine that you can block scripts with ad block plus, or one of the other blocking add-ons I have seen for Chrome. I would think if Ad Block doesn't do it then Blocker would.

Blocker for Chrome.
https://chrome.google.com/extensions/detail/epdedalbkhcbhcmcpfglmhngjpgimcmm?hl=en

I would think between the two of them, you should be able to block what you want in Chrome.

Re:A different kind.

[kiehlster]

You know, anti-virus software does a better job for me by running on your computer rather than on mine. I'll let you find the virus and stop it/submit it, then I'll listen to your advice on valid safe surfing spots. Our Internet society has created a form of cloud anti-virus for the Internet as well as device purchasing just by using word-of-mouth and common sense. Like running from a bear, my wits just need to be faster than yours, and anti-virus does nothing to help me. Rather than being greedy trying to steal all the gold from the dragon, I'll just live with what I have in hand instead of attempting to grab one more piece and get eaten. Of course, if lots of people take my philosophy on anti-virus, I'll have to pick it up in order to be the last man standing.

Re:A different kind.

[Skarecrow77]

compare adblock in chrome to adblock in FF.

NOT the same thing. at all. chrome makes the ads not displayed (usually, sometimes it even fails at that), but they're still there in all their cpu abusing, bandwidth hogging, spyware laden goodness. hell sometimes you can still accidently click on them.

FF keeps them from loading entirely. I know that websites prefer the latter to the former, but I certainly do not.

Re:A different kind.

[Anonymous Coward]

I have Ad Block Plus installed on Chrome. So I am not exactly sure what in the world you are even talking about.

Adblock on Chrome doesn't block ads.

Re:A different kind.

[Bing Tsher E]

That's a mighty friendly URL you gave us, to that article on Google's server telling us more about a Chrome extension to adblock. I am away from my desk but would like to jot it down in case I can't remember it later. Would you please read it out over the phone?

Re:A different kind.

[m1ss1ontomars2k4]

Wait, don't you mean that websites prefer the former to the latter? Because otherwise your statement that you "certainly do not" makes no sense.

Re:A different kind.

[Skarecrow77]

you're completely right and that's what I get for posting while trying to do work at the same time. next time i'll put the work aside first.

Re:A different kind.

[Khyber]

Sue the plugin maker for false advertising, then.

Re:A different kind.

[Simetrical]

no evil? how about deliberatly holding back on the browser hooks and infrastructure to allow for comprehensive robust adblock/scriptblock/etc ad-ons, due to such things being completely against their business model that is based on supplying advertisements?

Chromium is open-source, you know. You don't need hooks and infrastructure to modify it, you can just hack the source. I doubt it would be very hard. Chromium extensions are very limited overall, I think so that they work reliably across versions. Just because this feature hasn't been added yet doesn't mean there's a sinister plot by Google – tons of other Firefox extensions aren't possible in Chromium, AFAIK.

Besides, Google makes most of its money from text ads, which few people block. It has no reason to object to ad blockers: you're primarily blocking its competitors.

Re:A different kind.

[Anonymous Coward]

"How can you be running a browser without something like NoScript these days?"

By not having my AdBlock installation jacked.

I don't use NoScript for the same reason I don't use Chrome: their business models rely on the ads I'm trying to block, and it is in their financial interests to screw over the end-user in their service to their true customers.

I would trust IE over NoScript at this point, as advertising at least isn't Microsoft's main source of income.

Re:A different kind.

[TangoMargarine]

How can you be running a browser without something like NoScript these days? It's almost as bad as running a Windows machine without anti-virus software.

1. Many sites rely on scripts for major functionality. Have you ever tried doing *anything* in Dillo? But then again, I've never used NoScript so maybe I have no idea.

2. I do not feel the need to parnoically maintain a whitelist and waste all my time figuring out what is safe.

3. As long as you are not a fucking idiot online, you're not likely to get infected with anything to begin with. I can count the number of times that AVG* has told me of a threat that I was actually surprised at, over the last 3 years, on the fingers of one hand. Ergo, "running a Windows machine without anti-virus software" is actually possible.

But on the other hand, I just have this habit of refusing to get into things that everybody is crazy about. This is why I neither use NoScript, or Chrome, or own any Apple products, or use iTunes, or listen to the shitty hip-hop music these days. So get off my lawn! :)

*Yeah yeah, tell me to use a different antivirus. Which kind of addresses my point anyway.

Re:A different kind.

[soppsa]

I'm amused by how many of your slashdot posts are recommending that people sue people the way YOU "sued the crap" out of EA for Spore. America... america, fuck yeah!

Sue *, its always the answer.

Re:A different kind.

[protektor]

If they aren't there, then how in the world are you able to "still accidentally click on them"? That doesn't make any sense. You said it makes them not displayed, but you can click on them? How in the world can you click on something that isn't displayed? That makes no sense at all.

If your not getting you ads blocked then I would suspect that you have something set up wrong on your copy of Chrome. I get the ads blocked no problem on my install. Also if there are elements that you want blocked further then install Blocker for Chrome. That will get the other HTML elements blocked that you don't want as well. So that is another option.

Re:A different kind.

[savethelecture]

It is not called "evil" any more. Now we call it "expressed insecurities" and "complexive behaviour".

Plugin uninstaller for Firefox?

[Anonymous Coward]

Why the hell hasn't Mozilla made it easy to remove plugins from Firefox? You have to Google solutions to find out how to remove Microsoft (and in some cases old Java) shit.

Re:Plugin uninstaller for Firefox?

[gstoddart]

Why the hell hasn't Mozilla made it easy to remove plugins from Firefox? You have to Google solutions to find out how to remove Microsoft (and in some cases old Java) shit.

Mozilla has -- there's supposed to be an Uninstall button next to them.

Unfortunately, Microsoft didn't allow the Uninstall button to work, and you could only Disable. This is not a Mozilla problem in not providing a mechanism -- this is Microsoft and Sun making shitty add-ons.

Re:Plugin uninstaller for Firefox?

[mister_playboy]

The problem is these add-ons (they are not plugins) aren't installed with user privileges, but admin privileges. How would you have Mozilla fix this? By magically circumventing the permissions system in Windows?

Perhaps MS hopes that people will place the blame on Mozilla as you have done.

Re:Plugin uninstaller for Firefox?

[jack2000]

No it's Mozilla's problem. They should make it impossible for anyone to install plugins/extensions without user interaction and further more they should make it impossible for the uninstall button to be disabled. Have a damn "delete plugin dlls" button if nothing else damn it!

Re:Plugin uninstaller for Firefox?

[laron]

IMHO it is a flaw in the way FF handles extensions, if an extension can protect itself from being uninstalled.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

(different AC here, not that you can prove it, just have to take my word for it I suppose)

One could argue that Mozilla could have simply made it so that every add-on has an Uninstall button whether or not those who developed the add-on wanted it to have one or not. That way any add-on could be easily removed even if it did not have a button through incompetence or design.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

Why the hell hasn't Mozilla made it easy to remove plugins from Firefox? You have to Google solutions to find out how to remove Microsoft (and in some cases old Java) shit.

Mozilla has -- there's supposed to be an Uninstall button next to them.

Unfortunately, Microsoft didn't allow the Uninstall button to work, and you could only Disable. This is not a Mozilla problem in not providing a mechanism -- this is Microsoft and Sun making shitty add-ons.

Don't confuse "extensions" with "plugins". In Firefox, an extension is something that is installed from within Firefox, and it can be enabled/disabled or removed entirely from within Firefox. Conversely, a plugin is a completely different mechanism that is designed to allow external applications to add features to Firefox without even having to have Firefox running. It is added from outside Firefox, and it is removed from outside Firefox. Mozilla designed this system so that Firefox has no control over it.

In the previous case of the .NET update, it was installing a plugin, so it was by Mozilla's design that you can't remove it using the Firefox Add-On dialog. However, in this case, they're installing an extension, so it is supposed to be removable. If it's not, then that is still Mozilla's fault. It should not be possible for an extension to be installed without Firefox's knowledge, and it should not be possible for an extension to disable its "Remove" button. If that is what has really happened, then Firefox's extension mechanism is broken.

Re:Plugin uninstaller for Firefox?

[vlueboy]

The problem is these add-ons aren't installed with user privileges, but admin privileges. How would you have Mozilla fix this?

Easy! FF needed these same admin privileges to be installed at some point; programs routinely ask for elevation, and FF is just trying to play 'usermode' too much, without a general picture of general systems management. Put the now-standard API call that "elevates" my rights to do sys admin tasks in Windows, and presto.

By magically circumventing the permissions system in Windows?

If a virus can "magically circumvent permissions", to root a Windows machine just because the writers learn the Windows API better, then a legal program ain't trying hard enough. After all, the Windows API does allow for elevation in two ways that I know of. 1) Ask the user for a PW per change 2) Or, register a daemon at install time that runs without limitations, like Firewalls and Antispyware programs do.

Re:Plugin uninstaller for Firefox?

[gstoddart]

So ... Mozilla bad, Microsoft good? WTF?

Re:Plugin uninstaller for Firefox?

[denmarkw00t]

They should make it impossible for anyone to install plugins/extensions without user interaction

Normally you're prompted to install extensions, and add-ons are usually by way of installer. The problem here is that the user DID interact - at some point they opted to receive an update from Microsoft. MS is COMPLETELY at fault here as they slipped a DLL into a folder where Firefox would find it and go "Geez, thats an add-on!" No install necessary in FF, just put the extension in the right place and bingo!

As far as not being able to uninstall it...if its a "plugin" like Shockwave or Flash, you should note that the ability to Disable/Enable ONLY is there because any user can and should have access to that plugin. Extensions, on the other hand, should have the ability to be uninstalled unless they fall into this "any user could and probably wants" this extension category.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

Obviously blaming Mozilla is blaming a victim, but the thing is Mozilla is more likely to actually DO something about it than Microsoft.

It seems that Mozilla should be able to make all extensions 'uninstallable' even if that will bring up the UAC.

Re:Plugin uninstaller for Firefox?

[bill_mcgonigle]

By magically circumventing the permissions system in Windows?

But Mom, everybody else is doing it!

Re:Plugin uninstaller for Firefox?

[Alpha830RulZ]

This is a really bad idea. Browsers shouldn't be able to elevate privileges. That's a key mechanism in preventing content from being able to hijack the system. The LAST thing I want in a browser is for it to operate as admin/root.

Re:Plugin uninstaller for Firefox?

[protektor]

HP Web Printing does this and Move Media Player does this. Both are old plug-ins that are disabled because they don't work with the current version of Firefox that I have, and they won't update, and I can't uninstall them either. So there are many companies that are making Firefox add-ons/plug-ins that are not able to be installed. That should not be an option at all. If you can't uninstall it then it shouldn't be possible to install it all. This is something that Mozilla/Firefox people need to work on fixing.

The Move Media Player is what you have to have to watch streaming TV from the CW network. HP Web Printing was installed when I installed the drivers and software for my printer. Now I am stuck with both of them that don't work and can't be removed and won't update either.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

The problem is these add-ons (they are not plugins) aren't installed with user privileges, but admin privileges. How would you have Mozilla fix this? By magically circumventing the permissions system in Windows?

Firefox is supposed to manage extensions. If Firefox is unable to manage an extension due to file permissions, then Firefox should not run that extension.

Perhaps MS hopes that people will place the blame on Mozilla as you have done.

Or maybe they're just using a system as it was designed.

Re:Plugin uninstaller for Firefox?

[jack2000]

You can always hunt down the dlls of the plugins and then you can delete them manually. You get the dlls' paths from: about:plugins

Re:Plugin uninstaller for Firefox?

[Jack9]

Are you retarded? MS has almost unfettered access to your filesystem and OS code. How does an application prevent changes at the OS level, when it's an APPLICATION?

Re:Plugin uninstaller for Firefox?

[SydShamino]

If Firefox can identify them as new, Firefox can prevent them from running as part of their application.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

The problem is these add-ons (they are not plugins) aren't installed with user privileges, but admin privileges. How would you have Mozilla fix this? By magically circumventing the permissions system in Windows?

When I run firefox WITH ADMIN PRIVILEGES, I should be able to remove anything from firefox that I choose.

After all, I installed firefox WHEN I WAS LOGGED ON ADMIN PRIVILEGES. And WHILE LOGGED ON ADMIN PRIVILEGES, I should be able to modify my firefox installation.

Clear enough for you?

Perhaps MS hopes that people will place the blame on Mozilla as you have done.

MS may have messed up, but Mozilla also messed up by not allowing the user WITH ADMIN PRIVILEGES to control their firefox installation.

Re:Plugin uninstaller for Firefox?

[unix1]

they slipped a DLL into a folder where Firefox would find it and go "Geez, thats an add-on!" No install necessary in FF, just put the extension in the right place and bingo!

That's the problem. Firefox should say - "hey user, I've never seen this extension file before (and you didn't download it via Firefox either); you didn't mean to install this stuff did you?" The default answer should be to skip installation of the extension. Problem solved. MS would be a lot more hesitant to try to "hack" around to circumvent this process.

if its a "plugin" like Shockwave or Flash, you should note that the ability to Disable/Enable ONLY is there because any user can and should have access to that plugin.

How so? If a user is able to install the plugin (systemwide for all users - assuming that's what you mean), that same user should be able to uninstall it in the same manner. If a plugin is installed via an escalated privilege, then Firefox should attempt the same escalation during the removal.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

Microsoft installs stuff as Adminstrator/System. Firefox doesn't run with Administrative permissions. On a multi user system, it's perfectly reasonable for one user to want to use an extension and another user not to.

Thus, Firefox can't uninstall the extension (especially when it's run from an account that isn't even an administrator), nor should it (because that would hurt other users).

The advantage of a single installation location is that when ms updates their buggy addon, it updates for all users w/ a single download cost and no additional firefox restarts.

If you really don't approve of such things, you can play w/ registry and file system acls. For the average case, what Firefox did is correct. What MS did is questionable, but it isn't like they could run code in firefox to check to see if the toolbar is there, firefox would show the user the presence of that code just as it lists the toolbar.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

Processes in Windows can't have their privileges changed once they start. They can only spawn new processes with different privileges.

Basically, you hit the "uninstall" button, and Firefox starts a new process as admin, which asks the user for permission to start it. This process removes the addon, and then notifies firefox that it has been removed. If firefox was infected and tried to start a different process as admin the user would be warned that the program was "downloaded" before asking them to escalate it. Then all you need is that the helper uninstaller is written in such a way that it only uninstalls addons.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

Worse, there's also an option for extensions to not even be shown in the list!

The Sun Java Console extension uses it. Find the install.rdf text file for it, open it in notepad and change hidden from true to false. It will then appear in the add-ons list.

No-one tell Microsoft, or the next update probably will hide the extension.

Re:Plugin uninstaller for Firefox?

[the_B0fh]

I like how people who have no idea how technology works blames the wrong people. How the hell is Mozilla/Firefox supposed to protect against Microsoft who owns the Operating System they run on? Whatever mechanisms Mozilla put in place, Microsoft can bypass, because, well, they own the Operating System!

Remember, Microsoft *bypassed* the standard Firefox mechanism in the first place!

Re:Plugin uninstaller for Firefox?

[Your.Master]

Do you completely lack imagination? You can generate a signature and stuff it into a binary blob only after approving them for first use. You could append metadata to an alternate data stream that is based off a per-installation GUID. There are lots of things you can do to prevent unauthorized add-ons from running.

Sure, hypothetically Microsoft could just replace firefox.exe with a version built from the same source except removing the chunk that checks signatures, but I'd bet ten thousand dollars that it would not happen.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

The problem is these add-ons (they are not plugins) aren't installed with user privileges, but admin privileges. How would you have Mozilla fix this? By magically circumventing the permissions system in Windows?

How about the following? When Firefox starts up and encounters new plugin DLLs, or extensions that weren't installed through Firefox itself, it lists them in a dialog box and asks the user "do you really want to enable this". And if the user says "no", they'll get deleted.

Re:Plugin uninstaller for Firefox?

[ElKry]

Mozilla could just not allow loading plugins that haven't been added via Firefox. And yeah, I know microsoft could just bypass that with some hacking into whatever system is used to keep a record of them or sign them, but then it would be clearly intentional that they want to bypass a security feature, as opposed to "we just put the dll in the right folder for your convenience!".

Re:Plugin uninstaller for Firefox?

[clone53421]

Where is it? Where is the add-on? I want to delete it for godssakes. If it won’t let me uninstall from Firefox (which is stupid; ask me for the admin password and get the rights escalated if need be), then tell me where it is so I can delete it from Windows Explorer.

Re:Plugin uninstaller for Firefox?

[clone53421]

Firefox can't uninstall the extension (especially when it's run from an account that isn't even an administrator)

Wrong... heard of rights escalation? UAC?

nor should it (because that would hurt other users)

Wrong... if I have the admin password, it should let me do stuff that would affect other users. If I have the admin password you can assume by default that I’m trying to administrate the computer and not trying to “hurt other users”.

Re:Plugin uninstaller for Firefox?

[clone53421]

Not true... extensions can also be part of a plugin, and as such if the plugin cannot be uninstalled neither can the extension be.

The Java Quick Start extension was like that. I couldn’t uninstall it, but when I shut down Firefox and deleted the .dll for the Java Quick Start plugin, when I restarted Firefox the extension had vanished too.

Re:Plugin uninstaller for Firefox?

[clone53421]

Even if you run it from an admin account, it isn’t really running with admin privileges. It sandboxes itself to prevent exploits and as such it can’t just go haphazardly changing stuff in the system.

However it should be able to spawn a new process as admin, getting the admin password if necessary, and that admin process could uninstall whatever you wanted. That’s how it should work.

Re:Plugin uninstaller for Firefox?

[ultranova]

They should make it impossible for anyone to install plugins/extensions without user interaction

That's not possible in this case. Microsoft update mechanism can simply alter the on-disk data structures to make it seem like the user has agreed to installation. The browser has no magical way of knowing that it's data files were changed by the OS to insert a malicious extension there.

Re:Plugin uninstaller for Firefox?

[ultranova]

Do you completely lack imagination? You can generate a signature and stuff it into a binary blob only after approving them for first use. You could append metadata to an alternate data stream that is based off a per-installation GUID. There are lots of things you can do to prevent unauthorized add-ons from running.

Do you completely lack intelligence? The attacker will simply generate this signature and stuff it into the proper place, along with the add-on.

Sure, hypothetically Microsoft could just replace firefox.exe with a version built from the same source except removing the chunk that checks signatures, but I'd bet ten thousand dollars that it would not happen.

Hypothetically your "security" feature is completely broken, even you seem to realize this, yet you suggest using it anyway.

Do you perhaps work for Microsoft?

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

I thought that Mozilla locked extensions down to keep this from happening again, because of the LAST time Microsoft did this?

http://it.slashdot.org/story/09/10/16/189243/Sneaky-Microsoft-Add-On-Put-Firefox-Users-At-Risk

Re:Plugin uninstaller for Firefox?

[ultranova]

The LAST thing I want in a browser is for it to operate as admin/root.

It doesn't really matter. Browsers usually run with enough privileges to completely hose the user who's running them. Now, if it was possible to sandbox everything, it would make sense to worry about this; but, it isn't, so...

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

The problem is these add-ons (they are not plugins) aren't installed with user privileges, but admin privileges. How would you have Mozilla fix this? By magically circumventing the permissions system in Windows?

Perhaps MS hopes that people will place the blame on Mozilla as you have done.

Way to be an ass. I'm completely fine with having to login as an admin to remove plugins. A little language reminding users of that may be necessary, but IF THE FUCKING PROCESS FOR REMOVING A GODDAMN ADD-ON ACTUALLY FUCKING WORKED, then users could control their own browsers.

But maybe attitudes like yours are why I have to Google and sift through my goddamn directory tree looking for where this crap is stored.

Re:Plugin uninstaller for Firefox?

[The MAZZTer]

Uninstall button is hidden for system-wide extensions that affect all Firefox profiles on the machine. The idea being that one user should not have the power (and may not have the permissions necessary) to remove a system-wide extension.

Early Firefoxes let users set them up but now extensions are usually installed per-user by default. Usually.

Re:Plugin uninstaller for Firefox?

[Unoti]

I sympathize with your palpable frustration. Perhaps you should channel that energy into getting off Windows. It takes lots of effort, but it feels really good afterwards, like kicking a difficult addiction.

Re:Plugin uninstaller for Firefox?

[bk2204]

This doesn't work when you have a system-wide installation. For example, I use Debian and have the DOM Inspector add-on installed through the package manager. The only way to remove the code in question is as root—and hopefully you're not using Firefox as root.

Re:Plugin uninstaller for Firefox?

[diamondsw]

By magically circumventing the permissions system in Windows?

You're telling me there's no way for a program to temporarily request privilege escalation? In other words, no sudo? Seriously?

Re:Plugin uninstaller for Firefox?

[Stray7Xi]

No it's Mozilla's problem. They should make it impossible for anyone to install plugins/extensions without user interaction and further more they should make it impossible for the uninstall button to be disabled. Have a damn "delete plugin dlls" button if nothing else damn it!

So you think Firefox should go from legitimate software to something shady. Software that prevents the OS from performing operations on it. Windows as the OS can decide to change firefox to pink ponies and rainbows and there's nothing Mozilla can do to stop it, nor should they try to. That's the beginning of making a rootkit.

This is exact reason the plugin (versus extension) architecture exists. If it didn't other programs with the authority to modify firefox would do it in unfriendly ways. Then firefox starts crashing because adobe wanted to patch firefox binaries right where microsoft patched them. Just accept that root does what root wants, and expect good times if all your software is running as root.

Heck this is such a problem for windows that it's common practice for A/V programs to modify the kernel. Which is why windows came up with patchguard. Worse yet people accept software using these egregious techniques. Imagine if in linux every program wanted to load kernel modules.

Re:Plugin uninstaller for Firefox?

[mathfeel]

A similar situation used to occur in Gentoo where there is a package called "noscript". So an admin has to install that package through portage and an admin has to remove that package through portage. A regular user would see no-script as an add-on with a disabled Uninstall button.

Gentoo have since removed it as a system-wide package and I think that's a good idea. I also think it is a good idea that firefox should NEVER have the ability to escalate itself to admin privilege.

Re:Plugin uninstaller for Firefox?

[jack2000]

Are you really that unimaginative. Very well I'll give you a through example.
Make a username with password, encrypt config files with the builtin ntfs encryption system that makes them transparently encrypted to programs on read/write as long as the program is running under the credentials for that user and his password matches( isn't changed by someone ). Now all you have to do is run a fork of your app and execute it wit the credentials for that other user with the password and you're set. The system can't touch your config files, neither can autoupdate.

Re:Plugin uninstaller for Firefox?

[bingoUV]

So simply copying profile folder won't replicate all my plugins/history etc. from one machine to another? Even on Linux where there are no evil MS updates to screw up my browser? No thanks.

Re:Plugin uninstaller for Firefox?

[Anonymous Coward]

I think that needs to be fixed. I can't think of a legitimate reason Firefox should automatically install extensions without at least asking the user if he or she wants to install that extension. The way Firefox automatically installs extensions without prompting is just asking for trouble. It's on par with inserting a Sony CD-ROM in the drive and automatically getting infected.

Yes, Microsoft is at fault for slipping the extension into the Firefox extensions folder but I think Firefox shares some of the blame for picking up the extension and magically installing it without asking permission first. In fact, I question whether Firefox should even bother looking for new extensions anywhere on the drive in the first place.

Re:Plugin uninstaller for Firefox?

[denmarkw00t]

It's not that it gets "installed" by Firefox - it works by the fact that "If there is a dll in this folder, I'm going to load it." It's no different from having files in a library folder for any other application - if I find a library there I'm going to load it at startup.

I smell a loophole that puts MS in a bad spot...

[morphotomy]

My XP installation is quite old. So old in fact I was a minor when I clicked the "I agree" on the EULA. The EULA is a contract, which cannot be legally entered into by a minor in the good ol US of A, voiding the contract. Since MS never got permission to install this add on to my computer, could I go after them for unauthorized access to my system?

Re:I smell a loophole that puts MS in a bad spot..

[Skarecrow77]

pretty sure that means you're not using a legally authorized version of windows, since you were not leagally able to authorize the installation due to not being able to sign the licensing agreement.

FIRE

[Stan92057]

FIRE FIRE FIRE!!!!!

Re:I smell a loophole that puts MS in a bad spot..

[Anonymous Coward]

I hope someone does. Regardless of intention, updating other manufacturers' software without notification or approval should be considered a crime. Think about it this way: If you wrote a plugin that updated Word from time to time with an additional toolbar, do you think Microsoft would be upset?

I will be delaying Microsoft software approvals and suggesting non-Microsoft equivalents in my company because of tricks like this. They're totally out of control.

/. Drinking Game

[DIplomatic]

My friend and I played a drinking game to /. once. One person clicks on a story involving Microsoft or Apple or Linux or polotics and the other person has to take a drink for every bullsh*t post about "M$" or Apple's App Store or Android FTW and everything else completely unrelated to what the actual post is about. Let me just say, don't attempt this in the morning...


ps. Slashdot community, I love you all but some days you make me pull my hair out. :)

Re:/. Drinking Game

[rotorbudd]

Oh yea, a fork of the old Hi Bob Drinking Game.

Re:/. Drinking Game

[Anonymous Coward]

What is your point?

Sure, there are a lot of bad entries on /. but this is not one of them. Micro$oft is a fucking malware peddler.

Re:/. Drinking Game

[Anonymous Coward]

I was going to post this as it's own thread, but I figure if I post it as a reply, yall can take a shot:

You can tell Microsoft is on the way out -- they didn't dare do it to Chrome, because Google would obliterate them in court.

Didn't Change My Firefox

[Toad-san]

I don't have no steenking Bing searchbar in my Firefox browser (no searchbars at all, in fact). The new extension did NOT show up in my Firefox addons, although I received my Windows updates yesterday.

So I'm not affected directly. But, as many others have said, I do NOT appreciate Microsoft changing ANYTHING in my computer without my specific, informed permission. Okay, they can change their own OS if necessary (since they usually accept responsibility for disasters that occur). But leave MY programs the hell alone!

Re:Didn't Change My Firefox

[Skarecrow77]

Sonny, I remember the days when we had to manually type in http://www.altavista.com/ or http://www.lycos.com/ into our browsers to get to a search engine. We had to use our keyboards and everything! Then the search engine took a long time and returned bad results... and we liked it!

These newfangled search bars, they're the devil's work I tell ya.

Re:Didn't Change My Firefox

[Anonymous Coward]

Ahem.

http://altavista.digital.com

Re:Didn't Change My Firefox

[tehcyder]

Then the search engine took a long time and returned bad results...

But on the plus side, you got a lot more links to random pr0n sites. Apparently.

Re:Didn't Change My Firefox

[Anonymous Coward]

Yeah, but back then the pr0n was 320 x 200 pixel GIFs of some fat chick.

Re:Didn't Change My Firefox

[camperdave]

But on the plus side, you got a lot more links to random pr0n sites. Apparently.

On the minus side, they were ASCII.

Re:Didn't Change My Firefox

[Anonymous Coward]

I can remember further than that! I still remember a time when search engines did just that... search!

Re:Didn't Change My Firefox

[Anonymous Coward]

I give you an 8 out of 10 for effort, but you could have gone for the hat trick by mentioning Ask Jeeves.

Re:Didn't Change My Firefox

[sv_libertarian]

You had search engines? You young whippersnapper get off my lawn! I remember using web crawler, and thinking 64mb ram on a packard bell 486 was freaking awesome. This after coming off an old 8088 machine.

Re:Didn't Change My Firefox

[gbjbaanb]

nor mine, but then I never installed the PoC Microsoft toolbar that needs to be updated:

From TFA:
Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed, regardless of whether they are enabled or disabled. It's unknown how many users fall into that scenario, but the toolbars often come bundled with new PCs and popular Microsoft downloads.

So.. the moral here is: don't install any Microsoft software and you won't have these problems :)

Re:Didn't Change My Firefox

[KiloByte]

You mean, "altavista.com"? That's a new-fangled URL. Back in the day, the address was "altavista.digital.com", because a gimmick like internet search certainly wasn't important enough to warrant a domain on its own.

Re:Didn't Change My Firefox

[jwhitener]

They should never ever change even the OS without user interaction and consent. People running windows servers or huge desktop install bases have to test updates before applying them in a business setting.

Re:Didn't Change My Firefox

[Anonymous Coward]

Sonny, I remember the days when we had to manually type in http://www.altavista.com/ or http://www.lycos.com/ into our browsers to get to a search engine. We had to use our keyboards and everything! Then the search engine took a long time and returned bad results... and we liked it!

These newfangled search bars, they're the devil's work I tell ya.

Newbie! It used to be http://altavista.digital.com

Re:Didn't Change My Firefox

[ndege]

my fingers still occasionally, start to type http://altavista.digital.com/ when my brain wants results from something that isn't google.

Re:I smell a loophole that puts MS in a bad spot..

[rotorbudd]

You could if you weren't a minor.
But you are so you can't.

Isn't this...

[Que914]

A textbook example of what our anti-trust laws are supposed to address a company using it's monopoly in one market (OS) to trying and gain an advantage in another market (search).

Sigh...

Re:Isn't this...

[shutdown -p now]

It's not. It doesn't get pushed to everyone via something like Windows Update. It only gets pushed to those who have Live Toolbar (for either browser) installed. Which is still not a good thing to do, but I don't think any monopoly issues arise here, unless you're willing to claim that MS has a monopoly on browser toolbars...

Windows Practices make me angry...

[Tei]

I have two windows, a netbook with windows 7, and a XP, and the general malpractices of the software that this OS use is really anoying. Stuff like the printer driver creates a resident program (HP something) on the toolbar. Other applications after running only once, set itself to start at restart. WTF LOL!?. How is that possible? a OS sould ask user permission with something like sudo for setting apps to auto-run at restart. All these apps that start and are doing nothing at all make the start very long, and take screen space.
So.. is bad enough wen people like HP, Impulse or others do this, but.. Microsoft? In a way, is like Microsoft is sanctioning this evil practice thenselves.

Re:Windows Practices make me angry...

[mr_mischief]

The HP thing is actually optional. You can install just the driver or the driver and all the add-ons. The HP web site and every HP driver CD I've used allow installing just the drivers.

The add-ons offer things like ink level updates, scanning across the network (if you have a multi-function), mapping the card reader on your HP printer as a drive on your desktop system (even across the network), and some fax/image fixup/color matching/misc. other document-related software.

HP does charge a metric shit-ton of cash for their inks, with the Vivera six-color system being somewhat more reasonable than some shitty tri-color single cartridge. They don't force you to install things you don't want, though.

Re:Windows Practices make me angry...

[Anonymous Coward]

Youve never used one of their laptops have you?

Re:Windows Practices make me angry...

[mr_mischief]

Several, in fact. You can uninstall all the non-driver printer crap from the control panel on every one I've ever used. If not, it'd get wiped and reinstalled. Right now, I don't have any laptops running Windows at all, though, so I usually do that already.

Re:Windows Practices make me angry...

[shutdown -p now]

How is that possible? a OS sould ask user permission with something like sudo for setting apps to auto-run at restart.

Well, it doesn't have to, on Linux. X session data is writable by the user, and therefore also by any application he runs, without any prompts. And there's always a brute-force solution of appending whatever it wants to, say, ~/.bashrc.

Of course you can change permissions on ~/.bashrc so that it's non-writable, but that is not the default. Similarly, you can change permissions on various "Run" and "RunOnce" registry keys in Windows so that they're non-writable, but that is not the default, either.

Though you're right that it probably should be.

Re:Windows Practices make me angry...

[clone53421]

Get an app to manage startup entries. Or, if you’re feeling adventurous, look up the registry keys where the startup entries are stored and learn how to disable them yourself... and get ready to go digging through their preferences when you discover that actually using the program causes it to check to make sure its startup entry is installed and it reinstalls it without asking you. Quicktime, I’m looking at you.

Note, part of learning how to disable them includes learning which ones are important and which can be disabled. For a beginner I recommend using google.

Re:Windows Practices make me angry...

[Simetrical]

Stuff like the printer driver creates a resident program (HP something) on the toolbar. Other applications after running only once, set itself to start at restart. WTF LOL!?. How is that possible? a OS sould ask user permission with something like sudo for setting apps to auto-run at restart.

If you install a program as root, that means the installer is running as root. That means it can do anything, including making something run at startup. It did ask for your permission to give the installer root privileges, when you started the program, and you gave it. (Maybe it's possible even for non-root processes to do this, but most programs are installed as root anyway, so it doesn't make a huge difference.)

Re:Windows Practices make me angry...

[Khyber]

It's apparent YOU never have.

-Former HP Laptop repair tech, both business and commercial units.

Re:Windows Practices make me angry...

[Anonymous Coward]

So, a couple weeks ago, I installed Minitab, a statistics program, on my Windows machine. A few days later, I'm playing a game on-line, and my system is gradually slowing to a crawl. It turns out that Minitab has also installed (without asking) goddamn InstallShield Update Manager, which has gone completely zombie (2 processes that, between them, have consumed 100 hours of CPU time, and are currently pegging the CPU), automatically starts when I reboot, and when I try to open the control panel for it, the damn thing won't even draw correctly, so I can't see any of the settings to possibly make it stop. It's not in the list of programs I can uninstall. I can't see that it's in the registry in any of the normal places. Finally, I found the folder in program files and just deleted all the files. I'd rather get weird error messages about missing files than have to worry about whether this shit program is running all the time.

Fuck these people and their autoupdaters. I don't mind if a program asks me if I'd like to check for updates when I start it. But I don't want every goddamn program I install running when I boot my computer. I also don't want 'quickstart' bullshit. I'm looking at you guys, MS and OO offices. It all makes me nostalgic for the bad old days before multitasking.

There is nothing inherently wrong with this...

[dejanc]

My Ubuntu installation at work installed a Firefox extension by default. It also made numerous modifications to packages installed on my computer - from bash to Xorg to Gnome. Both legal and morally acceptable.

Same thing is with Microsoft, with the only difference being that there is no assumed connection between Windows and Firefox (Microsoft doesn't package Firefox)

Your OS will tamper with the rest of your machine. The question is: do you trust your operating system with your computer?

Re:There is nothing inherently wrong with this...

[NullProg]

Same thing is with Microsoft, with the only difference being that there is no assumed connection between Windows and Firefox (Microsoft doesn't package Firefox)

It is not the same difference. All those updated packages came with the distribution.

This is more like installing Opera on your Ubuntu system and Canonical adding plugins and changing the default behavior without your permission? (Hint, Opera isn't in the default repositories).

Enjoy,

Oh get a sense of perspective FFS

[Viol8]

Its a friggin browser extension. We're not talking a Sony rootkit here!

I'm no MS fan but this constant MS bashing from self righteous geeks who smell an easy target gets tedious after a while.

If you really hate MS so much why are you running Windows in the first place to get upset about it? Install Ubuntu
or buy a Mac and shut up.

Re:Oh get a sense of perspective FFS

[ffreeloader]

So, you would have no problem with me modifying software on your computer without your consent or knowledge? I'll be there directly and modify the way most of your software works in some way or another.

You'll have no problem with that at all, right? It's just software, right?

Re:Oh get a sense of perspective FFS

[jack2000]

It is something you didn't ask for, that was installed as a plugin to a program that is not owned by Microsoft. It's about the principle!

Re:Oh get a sense of perspective FFS

[Vandilzer]

Let me put on my tin foil hat here for a second...

1) Unknown extension
2) Online transactions (internet banking, e-bay, amazon, etc...)

This my not be a system rootkit but it has just as much potential to do just as much damage. As a vehicle to run any number of thing or provide an entry point to a system for something far more nefarious...

And I do use Ubuntu, but most of the world uses Windows, whether it be by societal force or inheritance.

Vandilzer...
Kari: There are a lot of things we really don't want you to try at home!
Tory: Yes, try it at your neighbor's house.

Re:Oh get a sense of perspective FFS

[Anonymous Coward]

I AM running Ubuntu, you insensitive clod!

Re:Oh get a sense of perspective FFS

[vlueboy]

If you really hate MS so much why are you running Windows in the first place to get upset about it? Install Ubuntu
or buy a Mac and shut up.

Instead of their recent tendency of messing with my browser so they can get search revenue, why do they not fix their Windows boot loader so it will not overwrite my Grub menu? The exact problem is that MS plays favorites and interoperates only when it can profit from OSS installs.

PS: It's not unheard of to have Windows updates be interactive. WGA and the Malicious removal tools actively ask you to read EULAs before they continue. This tech can be used if they must mess with programs not directly created by them. The FF move is underhanded, but I'll admit that it's little known the Windows EULA forces the licensee to wave away any rights to deleting files from your PC and the like, without your consent.

Re:Oh get a sense of perspective FFS

[Spad]

Bad analogy time. It's akin to me breaking into your house and wandering around a bit before leaving; sure, I didn't nick anything, but I was still walking around your house without your permission.

Re:Oh get a sense of perspective FFS

[Viol8]

I wouldn't be dumb enough to run windows in the first place. You pays your money...

This is news?

[Schnoogs]

This is a point of concern? Oh noes!!!! They didn't get the users approval!!!! From now on I want to be asked line by line of machine code whether or not I want it installed or not!

Ubuntu isn't much better

[SCHecklerX]

Every time ubuntu updates firefox, it slams it's own list of search engines into my browser, and I have to yet again remove them. Why would a system update muck with personal settings like that?

Re:Ubuntu isn't much better

[Krneki]

Every time ubuntu updates firefox, it slams it's own list of search engines into my browser, and I have to yet again remove them. Why would a system update muck with personal settings like that?

Who gives a shit about users anyway?

Re:Ubuntu isn't much better

[Rhys]

Because you installed the 'ubufox' package (probably by default), by chance? The package even says something about "remove this to have a vanilla firefox."

Re:I smell a loophole that puts MS in a bad spot..

[mister_playboy]

since you were not leagally able to authorize the installation due to not being able to sign the licensing agreement.

Did you sign your Windows licensing agreement? I doubt it.

A EULA is not a contract.

Rogue Corporate Mentality Revealed...

[LifesABeach]

In the U.S. there has emerged a business model that uses the math of, "it is better to ask for forgiveness than permission." Personally, I'm getting more "bang for the buck" by going to other businesses and asking, "how much?"

This shit has to stop

[YA_Python_dev]

Dear Mozilla developers, please disable by default *all* extensions except:

1. the ones that are manually installed by the user using the standard UI inside Firefox;
2. the ones that are manually enabled by the user using a menu switch inside Firefox for EACH externally installed extension (do NOT show a confirmation dialog if a new extension appears out of nowhere: users always click "yes").

The power to choose what to install in their browsers must reside only in the hands of the users.

If a vendor actively tries to circumvent this new protection mechanism, permanently blacklist ALL its extensions, plugins and whatnot. Report them to antivirus vendors as malware.

It's not the first time this happens and it actively damages users, with slower browsing experience, less screen space for actual content, huge undisclosed privacy and security breaches (you can BET they exists, even if they are not made public).

This shit has to stop.

P.S. to the users of Microsoft products: please any time you can, try to avoid this company, you're not their customer, you're their victim. There are other software vendors that respect you much more than that.

Re:This shit has to stop

[Culture20]

Dear Mozilla developers, please disable by default *all* extensions except:

1. the ones that are manually installed by the user using the standard UI inside Firefox;
2. the ones that are manually enabled by the user using a menu switch inside Firefox for EACH externally installed extension (do NOT show a confirmation dialog if a new extension appears out of nowhere: users always click "yes").

The power to choose what to install in their browsers must reside only in the hands of the users.

Ah, but what if sysadmins want their users to - by default - be using adblock or noscript?

Re:This shit has to stop

[fzammett]

P.S. to the users of Microsoft products: please any time you can, try to avoid this company, you're not their customer, you're their victim. There are other software vendors that respect you much more than that.

Even if I agree with your characterization of Microsoft (which I'm inclined to do for the most part), I'd *REALLY* like to know who these other vendors are that respect me much more. So far, I've seen none that I'd say respect me worth a damn... ok, respect me *more* than Microsoft, maybe, so your statement is technically true perhaps... but the spirit of it I don't think is. We're all nothing but profit generators to any vendor, some just show their disdain for us a little more freely.

Re:This shit has to stop

[jack2000]

If they are sysadmins they can push settings with active directory or what have you magical Domain control structure windows domain users use nowadays.

Re:This shit has to stop

[Anonymous Coward]

Dear idiot,

You are an idiot.

Sincerely,
Developers

Seriously, you have no idea what you are talking about. If you want to complain about some extension from Microsoft installing during Windows Update, maybe complain to Microsoft? They made the software! What is next? People bitching that Microsoft updates their C library fixing a bug causing some software to fail because it relied on that bug to function?!

If you are going to bitch at something, at least understand whom to blame and why software works like it does. If you don't like it, write your own browser.

Finally, why are you bitching at Microsoft if you are not using Microsoft products? kthnxby

Re:This shit has to stop

[troll8901]

Good idea, perhaps Firefox can allow automatic install if the machine is joined to a domain, and if the add-ons can be authenticated somehow.

But what about domain-joined machines that receive Microsoft updates? After all, these updates run at SYSTEM-level privileges.

And do we really want anti-tampering measures in Firefox?

Something is nagging at me about the feasibility of implementing such measures, but I don't know enough to put it in words.

Re:This shit has to stop

[jack2000]

I'd rather have a tickbox somewhere in the options that prevents any new extensions/plugins from installing.

Re:This shit has to stop

[Simetrical]

Dear Mozilla developers, please disable by default *all* extensions except:

1. the ones that are manually installed by the user using the standard UI inside Firefox;
2. the ones that are manually enabled by the user using a menu switch inside Firefox for EACH externally installed extension (do NOT show a confirmation dialog if a new extension appears out of nowhere: users always click "yes").

So it should be impossible for Windows Update, running as administrator, to add extensions to Firefox? How exactly is this miracle to be accomplished? Last I checked, the administrator can modify any program arbitrarily, such as by adding an entry to a database saying that the user manually installed a particular add-on.

Re:This shit has to stop

[YA_Python_dev]

So it should be impossible for Windows Update, running as administrator, to add extensions to Firefox? How exactly is this miracle to be accomplished?

Seriously, have you even read the comment to which you're replying? I never said anywhere that it should be "impossible" and I clearly described what the Mozilla developers should do if any program tries to circumvent this mechanism.

Re:This shit has to stop

[Simetrical]

Seriously, have you even read the comment to which you're replying? I never said anywhere that it should be "impossible" and I clearly described what the Mozilla developers should do if any program tries to circumvent this mechanism.

Yes, I read it. It made no sense. What was your suggestion? "permanently blacklist ALL its extensions, plugins and whatnot. Report them to antivirus vendors as malware"? Blacklisting won't help, because they could just change the vendor name slightly. And you think Mozilla is going to convince antivirus vendors to flag Windows Update as malware?

If you use Windows, Microsoft controls the system. There's nothing an application developer like Mozilla can do about it. If you don't like Microsoft changing installed programs whenever they please, your one and only option is not to use Windows (unless you consider "never update" an option).

There is nothing Mozilla could do here. Your complaints need to be directed against Microsoft and Microsoft alone.

Search Enhancement Pack

[KarlIsNotMyName]

The first thing I think of when I see that is; spyware. The enhancement is probably only to their benefit, not yours.

Embrace, extend, extinguish.....

[Anonymous Coward]

You wish to embrace Microsoft, but find it hard to do so? A suggestion to help you on this, consider actively supporting the WINE project in some fashion. In this way, you can embrace Microsoft products, extend them for use with a Linux based environment, and eventually, extingush the need for for such an invasive OS as Windows has been.

Re:Embrace, extend, extinguish.....

[clang_jangle]

That's a nice idea and all, but quite honestly I fail to see any "need" for microsoft products. Other than codecs for wma/wmv (and pirated windurrs in virtualbox for testing and the occasional netflix streaming), I haven't needed any microsoft products in years. The real need is to convince people (and netflix) they don't need microsoft. It's not as if they have any "killer apps" anymore. They're just coasting on the momentum they built by strong-arming the OEMs into making them the only OS available on new PCs.

The only people I can understand thinking they need ms are the gamers, and really that's on them to vote with their dollars and make the game publishers release for more platforms. They don't, for the same reason I don't cancel my netflix membership and tell them it's because of silverlight -- because it's very inconvenient. Though I have sent about a dozen emails telling them the silverlight choice sucks...

Re:Embrace, extend, extinguish.....

[_Sprocket_]

The only people I can understand thinking they need ms are the gamers, and really that's on them to vote with their dollars and make the game publishers release for more platforms.
They don't, for the same reason I don't cancel my netflix membership and tell them it's because of silverlight -- because it's very inconvenient. Though I have sent about a dozen emails telling them the silverlight choice sucks...

Right now, I'm typing this on my work laptop that's running Linux. I have a VirtualBox config that runs WinXP. That exists solely because of a select few pieces of enterprise IT software that only exists in Windows and doesn't play nice with WINE. Occasionally I'll fire up Outlook on it to do something particularly annoying calendar operation on Exchange that doesn't work well in Evolution or Exchange OWA. And then there's the odd Word doc that borks under OpenOffice (more so with the latest MS Office that they're kicking around right now).

I've played this game for years now. The only reason I ever have a need for Microsoft is because Microsoft is entrenched in the IT industry. Most of the time we've been able to avoid this trap. But once in awhile, someone sticks their foot in to it and I'm guaranteed to need a VMWare (or now VirtualBox) setup for another X years.

Re:Embrace, extend, extinguish.....

[logjon]

Microsoft is entrenched in every industry. I work IT at an accounting office, and it would be chaos trying to replace the functionality we would lose if we switched everyone to linux.

Re:Embrace, extend, extinguish.....

[_Sprocket_]

Microsoft is entrenched in every industry. I work IT at an accounting office, and it would be chaos trying to replace the functionality we would lose if we switched everyone to linux.

Sure - any industry that relies on IT is going to trip over Microsoft products in one way or another. In other words, Microsoft's entrenchment in IT means it is likewise entrenched elsewhere as well.

I should note that in some cases, Microsoft's solution works fine. But in my case, there are usually plenty of other solutions that work just as well and it is the fact that Microsoft is involved that demands that I have to use additional Microsoft products to interact with another.

Re:Embrace, extend, extinguish.....

[logjon]

The problem isn't entirely Microsoft solutions. The problem is a lot of applications that rely on Microsoft solutions that just have no real alternative that will run on a FOSS OS.

Re:Embrace, extend, extinguish.....

[_Sprocket_]

The problem isn't entirely Microsoft solutions. The problem is a lot of applications that rely on Microsoft solutions that just have no real alternative that will run on a FOSS OS.

Yes and no. Our shop will avoid a Microsoft-only solution as much as possible. There are times when the Microsoft (or Microsoft-dependent) solution works so well for us that it over-rides that bias. But there have been plenty of times where we scratched the surface, found Microsoft, and went with a competitor with no regrets. Almost every time we've ended up with something based on Microsoft products, we've had to have additional Microsoft products to properly use / manage it.

Of course, devil's in the details. YMMV. My industry view (admittedly entirely IT focused) may not reflect any other given industry who's niche might be entirely served solely by something built on Microsoft products.

Bing is an acronym.

[Anonymous Coward]

BING: But... It's not Google!

Re:Bing is an acronym.

[smithtodda]

I thought it was a recursive acronym: bing is not google

Gad... rather than look for a quick buck...

[IANAAC]

Why don't you take that energy and look for an alternative?

They exist.

Re:Gad... rather than look for a quick buck...

[morphotomy]

I dual-boot linux, but theres some things that are just easier to do under windows.

Didn't happen on my systems. Anyone else?

[Anonymous Coward]

Both of my systems updated yesterday and neither received this toolbar or extension. One system is XP, the other is 7.

Re:Didn't happen on my systems. Anyone else?

[aaron552]

Did you have the bing toolbar installed (in IE or firefox)? If not, then this update won't do anything. RTFA.

Re:I smell a loophole that puts MS in a bad spot..

[Alpha830RulZ]

A EULA is not a contract.

IANAL, but I suspect that it is in fact a contract. It may be a bad contract, and somewhat unenforcable, but if it wasn't a reasonable valid contract people would be suing the shit out of MSFT for every BSOD and error that was encountered in windows and Office. There aren't a bajillion lawsuits out there, so I suspect this means that the EULA is sufficiently a contract to protect MSFT in the majority of cases.

This is an abuse of monopoly power

[erroneus]

As small and simple as this may be this is a monopoly desktop OS vendor using its position to push out things to support its internet and marketing activities. Using one position as monopoly to prop up or support another activity in another market place. That pretty much defines what they have been getting in trouble for over the past 20 years in multiple jurisdictions.

They show no signs or intention of change. They need to be broken up.

Re:I smell a loophole that puts MS in a bad spot..

[morphotomy]

I havent been a minor for nearly 3 years now. Surely there is no provision that caused me to automatically agree to the EULA on my 18th birthday.

It didn't auto-update Portable Firefox

[jbarr]

...so no harm, because I don't use the installed version.

Re:I smell a loophole that puts MS in a bad spot..

[rotorbudd]

Three years?
Sorry, you're out of luck. Statue of Limitations and all.

WSUS

[Thalagyrt]

I suppose it's a good thing that I run a WSUS server for my Windows based computers and specifically picked upstream products that I want - Bing Search Enhancement Pack not being one of them. This 'update' never showed up for me anywhere - not even the WSUS server. :)

Doesn't happen if you don't have MS Search?

[EWAdams]

I installed Microsoft Search a while back, discovered that it screwed up the ordinary mechanism for searching for files, and dumped it. The offending update was not among those proposed for my most recent Automatic Update, so I'm guessing that it's connected to Microsoft Search.

I don't see any need for Microsoft Search anyway; Locate32 and Everything work a lot faster with a far smaller footprint.

Of course it's hidden

[bobdehnhardt]

From the article:

Both seem to be installed in "C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\." Inside, there is a file called "SEPsearchhelperie.dll" that is responsible for the IE add-on and a "firefoxextension" folder responsible for Firefox.

See? It's surrounded by a SEP field. Nobody will notice it.

Still, it is nice to see Slartibartfast is gainfully employed...

Re:I smell a loophole that puts MS in a bad spot..

[DragonWriter]

My XP installation is quite old. So old in fact I was a minor when I clicked the "I agree" on the EULA. The EULA is a contract, which cannot be legally entered into by a minor in the good ol US of A, voiding the contract.

This premise is incorrect. In general, contracts with minors are not void, they are voidable by the minor. The precise details may vary by jurisdiction, but, IIRC, generally for the minor to exercise this power, they must do so prior to or within a very specific window after majority.

Of course, voiding the contract also means that the minor loses any rights they hand under the contract.

Re:I smell a loophole that puts MS in a bad spot..

[morphotomy]

Statute of Limitations of what? The unauthorized installation happened just days ago...

Re:I smell a loophole that puts MS in a bad spot..

[DragonWriter]

Did you sign your Windows licensing agreement? I doubt it.

A EULA is not a contract.

Mutual consideration and acceptance are required for a contract, a signature is generally not. Signatures of both parties on a written document of the contract terms is a common and particularly desirable form of evidence of both what the actual terms of the contract are and that those terms were, in fact, agreed to and accepted by both parties, but it is not a requirement to have a valid contract in most cases (there are certain cases where there is a requirement that a contract be supported by a signed, written document to be valid, such as certain real estate transactions, but these are exceptions to the normal rule, under which contracts which are neither signed nor even reduced to writing are valid and enforceable.)

There are issues with the validity of EULAs (and, IIRC, court decisions on their validity and enforceability are mixed), but the one you raise isn't really one of them.

Re:I smell a loophole that puts MS in a bad spot..

[rotorbudd]

Oh, so you admit to an unauthorized installation?
Please submit your personal information to the following. . . . http://www.bsa.org/country.aspx?sc_lang=en

This is so simple

[HalAtWork]

As a security measure, shouldn't Firefox prevent access to plugins that weren't explicitly registered by the end user? If it discovers something new upon startup, then warn the user, circle it in red in the extensions list, and disable it. Allow an "enable" button, but again, warn the user and demand confirmation if it is enabled. Every time extensions are modified explicitly by the end user (like the way they ask you if it's ok for you to install a plugin from the web with a dialog that is not supposed to be trapped by other processes), make a list of the state of extensions, and use that to compare with on startup.

Re:This is so simple

[Quantumstate]

This is useless as a security measure. If the software is installed on your system then it has enough access for whatever it wants to do anyway. On startup it already opens the addons window and highlights the newly installed item giving a message saying it has been installed.

Re:This is so simple

[Anonymous Coward]

You mean that it can go in and manipulate Firefox's configuration files? Sure, but a patch manipulating a 3rd party program like that is another matter altogether and it would be a lot easier to call MS out on doing such things.

"Firefox geeks with Windows Live toolbar"

[Joce640k]

You missed an important circle on your Venn diagram.

The subset of "Firefox Geeks" with "Windows Live Toolbar" is probably quite small and I can't imagine any of them will mind too much (I mean, they actually installed Windows Live toolbar so how much of a "Firefox Geek" can they be...?)

Still, this is Slashdot so I'll let everybody get back to their Microsoft bashing.

Re:"Firefox geeks with Windows Live toolbar"

[Unequivocal]

My recently purchased T410s from Lenovo apparently came with this pre-installed. I have no idea about it or what it does b/c I never run IE (I've only opened it once to download firefox). So when I saw a search bar enhancement from MS in the recent updates I accepted it b/c it seemed to relate only to IE. But now I'm stuck with this in FF (no FF add-on GUI way to delete it). So I'm fairly geeky and I ended up with this search bar in Firefox that I didn't want.

Re:"Firefox geeks with Windows Live toolbar"

[Anonymous Coward]

I thought if these kind of toolbar is installed, it should appear in your Add/Remove Programs panel?

Whenever I buy new computer or format/reinstall my computer. The first thing I do is the clear off all the useless programs installed on it and disable bunch of windows services that I don't need. Since, you never know what these programs do to slow your computer down or mess your computer up during updates etc.

It's your own fault

[rrohbeck]

"Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed, regardless of whether they are enabled or disabled."

And there you have it. It's your own fault if you install any MS extension. Or any other extension from one of the big SW companies. Extensions are allowed to do almost anything to your browser.

Re:It's your own fault

[lordlod]

But the twist is you don't have to have the toolbar installed in Firefox.

Having the toolbar installed in IE (even disabled) will result in it miraculously appearing in Firefox.

It's a little bit like an old school virus. Once you let it into one of your executables it takes it as permission to jump into them all.

A Message From God?

[BigBlueOx]

I'm using an older laptop that has several black marks indelibly marked on its screen. When this article's summary appeared on my screen, one of the black marks was so positioned to make the summary read: "Microsoft released an update for its various foolbars".

Minefield walking

[Tiger4]

I'd like to again thank those of you that run the update Tuesday minefield for me. I set my machines to notify but not install when a new update comes out. Then I wait a week or so, just in case something like this kind of trickery manifests. So now I know to wait a bit longer on actually runnig the update, until a "fix", if needed, comes out.

Thanks guys!

Much ado about nothing.

[Beelzebud]

I didn't see this update at all yesterday, but then again, I didn't install their search program.

So we're now going to bash MS for putting an update out for some of their software that people had to manually install?

Sooo

[ThatsNotPudding]

how's that second liver working out?

Agreed. Grandparent is quite factually inaccurate.

[Anonymous Coward]

Additionally, net searches (yes we called them that because of the Net Search button in Netscape) were actually better back then because you could actually navigate all search results for simple search terms!

Imagine a time when Yahoo would give about 22 search results for Mario Kart. Then when it was done, it provided a link to continue searching with Alta Vista with even fewer results. And every search result was actually relevant, leading to a home page by dedicated fans.

Boy I miss the mid-1990s.

Uuuh

[Anonymous Coward]

So just because the system finds a DLL, all kinds of shit gets ran by my computer?

Oh yeah, this is how "security" works on Windows...

This is just non-sense. There's no way it needs to work the same borked way in Linux and Firefox and all other products, just because Microsoft does it.

You have to have one to get one

[Anonymous Coward]

It updates previously installed toolbars, so unless you have one, you won't get it.

The bigger problem is that if, for example, you have the old toolbar installed for IE (but not for Firefox), it'll install it for both IE *and* Firefox, rather than just updating the old one.

Problem Solved

[hduff]

TFA: "Both seem to be installed in "C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\." Inside, there is a file called "SEPsearchhelperie.dll" that is responsible for the IE add-on and a "firefoxextension" folder responsible for Firefox. The update can't be uninstalled, but deleting these files works just fine. "

Again, "deleting these files works just fine."

Re:

[clint999]

The difference being that that add-in was arguably useful. It enabled click-once in firefox, iirc, which is a fairly handy experience for running small apps over the web. If I recall, Java does the same thing. The problem then was that firefox had no way to distinguish between a version with a flaw, and a version without a flaw, so they had no choice but to temporarily blacklist it (and there was that issue with not being able to disable it due to permissions).Browser toolbars, however, never strike me as a nice addition to a product without asking.

Re:

[clint999]

One of. If you have it installed on IE, it installs it on firefox, even if you didn't have the firefox one. Even if you don't even have firefox installed.

This is funny

[Veretax]

When i saw that update i instinctively unchecked it because I thought it was related to that annoying search enhancement that Microsoft released for XP a couple years ago which actually made searching even more cumbersome in the long run. I was more than happy with searching as it was, I just never thought that update had to do with "web searching" (And it apparently is there for IE 7 too btw). Strange though I don't remember having any tool bars in IE that the article mentions.