Microsoft Hides Firefox Extension In Toolbar Update 285
Jan writes "As part of its regular Patch Tuesday, Microsoft released an update for its various toolbars, and this update came with more than just documented fixes. The update also installs an add-on for Internet Explorer and an extension for Mozilla Firefox, both without the user's permission."
Re:It is just an update to an existing toolbar (Score:5, Informative)
No. From TFA:
On one of our Windows systems, we had the Windows Live Toolbar installed for Internet Explorer but not for Firefox. Nevertheless, installing this update added the add-on/extension to both browsers without telling us that it would do so. On our second system, we had the Bing Bar installed for Internet Explorer, but it was disabled. Firefox was not installed. This system already had the update in question, so we decided to install Firefox. Not only was the Bing Bar extension present upon Firefox's first launch, but so was the Search Helper Extension.
Re:Again? (Score:5, Informative)
The difference being that that add-in was arguably useful. It enabled click-once in firefox, iirc, which is a fairly handy experience for running small apps over the web. If I recall, Java does the same thing. The problem then was that firefox had no way to distinguish between a version with a flaw, and a version without a flaw, so they had no choice but to temporarily blacklist it (and there was that issue with not being able to disable it due to permissions).
Browser toolbars, however, never strike me as a nice addition to a product without asking.
The update doesn't install a browser toolbar, it updates the browser toolbar for users that already have it installed. Users who haven't installed it won't see this update.
For once the Slashdot summary actually got this correct, and from the original article: "Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed,"
Re:It is just an update to an existing toolbar (Score:5, Informative)
Except even if the toolbar is disabled it still installs and enables the toolbar in Firefox. It also auto-enables the toolbar upon a new installation of Firefox if Firefox was not previously installed.
Re:Again? (Score:5, Informative)
Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed
Yes, but irrespective of whether it's installed for IE or Firefox. Just because I have the Live Search Toolbar installed for IE doesn't mean I want it turning up in Firefox unannounced.
Re:A different kind. (Score:5, Informative)
no evil? how about deliberatly holding back on the browser hooks and infrastructure to allow for comprehensive robust adblock/scriptblock/etc ad-ons, due to such things being completely against their business model that is based on supplying advertisements?
I suppose that's not "evil", bit it is a pretty damn big roadblock to me adopting chrome over FF.
Re:Again? (Score:5, Informative)
Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed
Yes, but irrespective of whether it's installed for IE or Firefox. Just because my OEM put the Live Search Toolbar on IE doesn't mean I want it turning up in Firefox unannounced.
fix'd
Re:Here we go again (Score:5, Informative)
Removing the .NET plugin:
del /q "%SystemRoot%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll" /v {20a82645-c095-46ed-80e3-08825760534b} /f > Nul /q %SystemRoot%\System32\dllcache\*.*
reg DELETE HKLM\SOFTWARE\Mozilla\Firefox\Extensions
del
I also remove the Media player DRM plugin: /q "%ProgramFiles%\Windows Media Player\npdrmv2.dll" /q "%ProgramFiles%\Windows Media Player\npwmsdrm.dll"
del
del
Re:Plugin uninstaller for Firefox? (Score:1, Informative)
Mozilla has -- there's supposed to be an Uninstall button next to them.
Unfortunately, Microsoft didn't allow the Uninstall button to work, and you could only Disable. This is not a Mozilla problem in not providing a mechanism -- this is Microsoft and Sun making shitty add-ons.
Don't confuse "extensions" with "plugins". In Firefox, an extension is something that is installed from within Firefox, and it can be enabled/disabled or removed entirely from within Firefox. Conversely, a plugin is a completely different mechanism that is designed to allow external applications to add features to Firefox without even having to have Firefox running. It is added from outside Firefox, and it is removed from outside Firefox. Mozilla designed this system so that Firefox has no control over it.
In the previous case of the .NET update, it was installing a plugin, so it was by Mozilla's design that you can't remove it using the Firefox Add-On dialog. However, in this case, they're installing an extension, so it is supposed to be removable. If it's not, then that is still Mozilla's fault. It should not be possible for an extension to be installed without Firefox's knowledge, and it should not be possible for an extension to disable its "Remove" button. If that is what has really happened, then Firefox's extension mechanism is broken.
Re:Didn't Change My Firefox (Score:2, Informative)
Ahem.
http://altavista.digital.com
Re:Plugin uninstaller for Firefox? (Score:4, Informative)
They should make it impossible for anyone to install plugins/extensions without user interaction
Normally you're prompted to install extensions, and add-ons are usually by way of installer. The problem here is that the user DID interact - at some point they opted to receive an update from Microsoft. MS is COMPLETELY at fault here as they slipped a DLL into a folder where Firefox would find it and go "Geez, thats an add-on!" No install necessary in FF, just put the extension in the right place and bingo!
As far as not being able to uninstall it...if its a "plugin" like Shockwave or Flash, you should note that the ability to Disable/Enable ONLY is there because any user can and should have access to that plugin. Extensions, on the other hand, should have the ability to be uninstalled unless they fall into this "any user could and probably wants" this extension category.
Re:Ubuntu isn't much better (Score:5, Informative)
Because you installed the 'ubufox' package (probably by default), by chance? The package even says something about "remove this to have a vanilla firefox."
Re:It is just an update to an existing toolbar (Score:3, Informative)
It seems that your beef should be with Verizon, not microsoft. MSFT just cut a deal. It's verizon that treated their customer like shit in your situation.
Re:yay (Score:3, Informative)
In my personal experience, I've had good luck with them from a security and stability standpoint. Granted, there is better stuff out there, but it still works pretty well for me. I also have a few music programs and games that I use which don't work on Linux (yes, even through WINE), and I don't want to have to pay extra for Apple-branded hardware, so Windows + self built systems it is.
Re:Here we go again (Score:2, Informative)
There are two separate add-on mechanisms: plugins and extensions. Extensions are managed by Firefox, and plugins are not. The .NET "extension" was actually a plugin, and that's why you have to go outside of Firefox to remove it. This is the way Mozilla designed it.
Extensions should always be manageable through Firefox. The fact that Mozilla has provided the ability for an extension to disable its "Uninstall" button is a problem, and it's Mozilla's problem.
Re:Here we go again (Score:1, Informative)
Good attempt, but we can refine the argument a little more and get a better result.
"Goodness" or "badness" is necessarily measured by the impact resulting from the action, mitigated by the degree of proximity of the action to the result and the degree of intent/knowledge that one would lead to the other. There is nothing inherently wrong with thrusting your fist outwards, unless you happen to hit someone.
The problem with the MS/Install-without-permission and Apple/Appstore-lock-in is that the action and the result are absolutely intertwined (by other facts). The problem with MS is the result - unwanted and often undesirable (i.e. "bad") software on the computer. Put another way, they are 'damaging' your property, also called trespass to chattel (legalese - IAAL). There is nothing inherently wrong with the act of MS installing software on the computer - sometimes we want that (e.g. useful security updates). However, the act isn't merely installing software, it is installing software without permission, a more specific act. This more specific act is bad because of the result, the alteration (i.e. damage) to the computer (i.e. property). The act is inherently bad because the bad result is inescapable from the act.
This is as if it were impossible to thrust your fist outward and NOT hit someone. Or rather, the fist thrusting was always a punch (and not a stretch, reach, etc.). The act is only inherently bad when it is inextricably linked to the bad result. If these two things can be decoupled, then we've created a nice [potential] solution.
Re:Embrace, extend, extinguish..... (Score:3, Informative)
The only people I can understand thinking they need ms are the gamers, and really that's on them to vote with their dollars and make the game publishers release for more platforms.
They don't, for the same reason I don't cancel my netflix membership and tell them it's because of silverlight -- because it's very inconvenient. Though I have sent about a dozen emails telling them the silverlight choice sucks...
Right now, I'm typing this on my work laptop that's running Linux. I have a VirtualBox config that runs WinXP. That exists solely because of a select few pieces of enterprise IT software that only exists in Windows and doesn't play nice with WINE. Occasionally I'll fire up Outlook on it to do something particularly annoying calendar operation on Exchange that doesn't work well in Evolution or Exchange OWA. And then there's the odd Word doc that borks under OpenOffice (more so with the latest MS Office that they're kicking around right now).
I've played this game for years now. The only reason I ever have a need for Microsoft is because Microsoft is entrenched in the IT industry. Most of the time we've been able to avoid this trap. But once in awhile, someone sticks their foot in to it and I'm guaranteed to need a VMWare (or now VirtualBox) setup for another X years.
Re:A different kind. (Score:5, Informative)
compare adblock in chrome to adblock in FF.
NOT the same thing. at all. chrome makes the ads not displayed (usually, sometimes it even fails at that), but they're still there in all their cpu abusing, bandwidth hogging, spyware laden goodness. hell sometimes you can still accidently click on them.
FF keeps them from loading entirely. I know that websites prefer the latter to the former, but I certainly do not.
Re:Wow! (Score:5, Informative)
This isn't old news. This happened for me with the most recent Windows 7 update set. I was notified of the updates this week. I saw this "search enhancement" update and it appeared to only affect IE so I accepted it. Now I'm stuck with this search add-on in Firefox. I disabled it but it's not possible to uninstall it from the FF add-on GUI. Probably if I delete some folders somewhere it will disappear but googling didn't turn up much when I searched -- mostly referring to older updates that sound similar -- possibly what you're referring to as well.
Re:Wow! (Score:3, Informative)
>>>When you buy and/or install Windows, you explicitly give Microsoft permission to [update Firefox]
I doubt that is true, and even if it were it violates multiple U.S. and EU Consumer Protection Laws. The only reason MS gets-away with it is because nobody's bothered to sue them yet & challenge the TOS.
Re:Didn't Change My Firefox (Score:3, Informative)
nor mine, but then I never installed the PoC Microsoft toolbar that needs to be updated:
From TFA:
Additional testing determined that the update is only being offered to those with one of the Microsoft toolbars installed, regardless of whether they are enabled or disabled. It's unknown how many users fall into that scenario, but the toolbars often come bundled with new PCs and popular Microsoft downloads.
So.. the moral here is: don't install any Microsoft software and you won't have these problems :)
Re:Again? (Score:4, Informative)
Both.
If the toolbar exists (either because Windows Update installed it automatically, or because somebody for some reason actually installed the toolbar manually), then Windows Update will automatically update the toolbar. It does not install the toolbar, only updates it.
The update also installs an extension for both Internet Explorer and Mozilla Firefox... and nobody seems to know what the extension is for or what it does.
The extension is not the toolbar, and it does not seem to be an update to the toolbar. It just comes piggy-backed with an update to the toolbar.
Re:Again? (Score:5, Informative)
No EULA may violate the law. We already have laws expressly concerning unauthorized access of computer resources.
Their EULA is null and void in this instance. EA tried this same BS with me when I sued the crap out of them for Spore and the SecuROM DRM. That argument HELD NO WATER.