Microsoft Secretly Installs Firefox Extension Through Windows Update

http://www.osnews.com/story/23436/Microsoft_Secretly_Installs_Firefox_Extension_Through_WU

by VeXocide • 16 years ago

80 28 16 years ago

osnews.com

BonoboBoner• 16 years ago

If only we could sneak in Google Chrome Frame into IE this way...

rbanffy3• 16 years ago

Or Firefox...

ojbyrne• 16 years ago

This happened last year too: http://annoyances.org/exec/show/article08-600

euroclydon• 16 years ago

I hope they are doing it for security reasons. I seem to recall that if your default browser is set to Firefox, and you click the Windows Update link, that Windows Update won't run correctly because it depended on an ActiveX control.

rbanffy3• 16 years ago

If a specific critical piece of the OS relies on defaults to select the only environment it can run on, then it's very poorly designed.

Somehow, this doesn't surprise me one bit.

sid0• 16 years ago

There is no such thing as a "Windows Update link" in modern Windows.

wheaties• 16 years ago

I can't figure out which bothers me more: Microsoft being so underhanded with these updates to software it doesn't produce or that they allow pretty much any company to install an add-on within Firefox without user consent. This has happened once before with Microsoft and it's even happened with Skype, a company founded by modern, savvy entrepreneurs. Why won't Firefox add a feature to disable an installed add-ons until flagged as wanted by the user?

pmjordan2• 16 years ago

Windows Update presumably runs with System privileges and therefore can do anything to the computer. OK, the Firefox developers could make it harder to slip in add-ons, but not impossible.

illumin8• 16 years ago

They could make an addon installer that obtains a signature from Mozilla's server before installation, and blocks addons that haven't been signed with the appropriate key.

Say all you want about central app stores that control things, but based on the amount of browser exploits that come from shady toolbars, I'd like this kind of security applied to code that runs in my browser.

Lendal• 16 years ago

You consented when you selected "Install updates automatically," instead of "Check for updates but let me choose whether to download and install them."

rbanffy3• 16 years ago

You may be right, but only if the description of the update described all it did.

WiseWeasel2• 16 years ago

We're talking about a new Firefox add-on being installed here, not an update to one already installed. That's a huge difference.

ck2• 16 years ago

Firefox central can "recall" and block any rogue extension.

They did it last year when Microsoft tried this, they should do it for this one too asap.

I purposely do not run as the default firefox profile, so I don't think Microsoft got me this time...

patio112• 16 years ago

You can get outraged that updates do not list every package affected, or you can have your software used by people who think both Internet Explorer and Firefox are actually called "the Google", but you cannot have both. I think MS is making the right call here: assume that a user who has expressed desire for a toolbar, via installing it and requesting an update, wants it in all browsers.

The four people in the world who use both IE and Firefox and wanted the bar in IE but not in Firefox are capable of tweaking that setting themselves.

enjo• 16 years ago

I'm willing to bet that it was a logic error. The type of thing that slips through QA since no one had exactly that configuration going.

  if <has_ie_toolbar> or <has_firefox_toolbar>
      update_toolbars

That sort of thing.

fakeempire2• 16 years ago

Why is this getting upvoted? That is a monkey chatter comment. That's the stupidest justification I've ever heard. This is scummy tactics. Period. Why would you defend it unless you had a vested interest in doing so? You know its bad. Why on earth would I EVER want someone to install additional software on to my computer without consent or notification.

I NEVER WOULD. That simple. You wouldn't either.

Google's update tactics are really shitty as well but at least you know you are installing it in the first place. This is just crap and you know it.

There is a third option to get outraged about that you didn't mention. Shitty tactics. It was obviously a sneaky move. You know it, they know it and I know it.

patio112• 16 years ago

Why would you defend it unless you had a vested interest in doing so?

Because I have a longstanding, passionate interest in making software which can be used by people who do not make software. If your software requires package management, they can't use it. If your software requires configuration, they can't use it. If your software requires consent or notification, they either a) click right past without reading it or b) can't use it because they process anything longer than one sentence as "The scary box is showing me an error message."

Let me give you an example, taken straight from Ubuntu/Firefox. Firefox depends on ubuntu-desktop, a meta-package. Ubuntu-desktop contains, among other things, ure.

Do you really want to show my aunt -- who thinks Firefox is called "the Google" -- "Firefox requires installing a piece of software called 'ure' on your computer. Think carefully whether you consent to installing 'ure'."

[Install Ure] [Don't Install Ure] <-- P.S. My aunt does not understand this will cause her to fail at what she is trying to do.

There are several dozen other packages to run through, too.

My aunt is not capable of making that decision. She doesn't know what ure is. Hell, I don't even know what ure is (+), and it is my business to know things like this. It is her business to teach high schoolers and she has told you she wants to use Firefox to do it. Make it happen and get out of her way.

+ On checking with the Googles, I have discovered it is an OpenOffice run-time component. Duh, why didn't I think of that.

DrSprout• 16 years ago

You have a very low opinion of users, but you have a very high confidence in their knowledge of what is installed on their computers. Even the assumption that they intentionally installed the toolbar to begin with is unwarranted. As you say, most people with Firefox likely never open IE. So they likely didn't even know this toolbar was installed.

strebler• 16 years ago

Let's just hope this update doesn't have any security vulnerabilities, unlike the last time they did this:

http://cagematch.dvorak.org/index.php?topic=7280.0

mleonhard• 16 years ago

The original article:

http://arstechnica.com/microsoft/news/2010/06/microsoft-slip...

Qz• 16 years ago

While the indirect way they did this is less than ideal, I think they have the right idea. IE and Firefox are browsers. A search toolbar is something that goes in a browser. Odds are, if you installed a search bar in your browser (not that I personally would ever do such a thing), you want it in whichever browser you use. It would be better if they just asked, 'hey do you want us to install this for firefox too?' (maybe?) but I'm not terribly upset by the idea of it.

redstripe• 16 years ago

Did any of you outraged people actually have the toolbar installed? My auto updates are on and I don't have it in either browser.

If you already had it then it's not so inconceivable that they would update both browsers through lazy programming. No conspiracy theory required.

melvin2• 16 years ago

I don't think you can 'accidentally' install a toolbar in Firefox.

melvin2• 16 years ago

Microsoft intentionally made Netscape (more) unstable and slower, if I recall. is there any reason to think they wouldn't respond to Firefox's growing popularity is to intentionally make it perform poorly? I'm very, very suspicious of Microsoft interacting with Firefox in any way whatsoever. No doubt they'd like to exert control over it in some way.

Microsoft Secretly Installs Firefox Extension Through Windows Update

Related Stories