Microsoft Secretly Installs Firefox Extension Through Windows Update | Hacker News Reader

Microsoft Secretly Installs Firefox Extension Through Windows Update

osnews.com

80 pointsVeXocide28 comments

You can get outraged that updates do not list every package affected, or you can have your software used by people who think both Internet Explorer and Firefox are actually called "the Google", but you cannot have both. I think MS is making the right call here: assume that a user who has expressed desire for a toolbar, via installing it and requesting an update, wants it in all browsers.

The four people in the world who use both IE and Firefox and wanted the bar in IE but not in Firefox are capable of tweaking that setting themselves.

I'm willing to bet that it was a logic error. The type of thing that slips through QA since no one had exactly that configuration going.

  if <has_ie_toolbar> or <has_firefox_toolbar>
      update_toolbars

That sort of thing.

You have a very low opinion of users, but you have a very high confidence in their knowledge of what is installed on their computers. Even the assumption that they intentionally installed the toolbar to begin with is unwarranted. As you say, most people with Firefox likely never open IE. So they likely didn't even know this toolbar was installed.

Let's just hope this update doesn't have any security vulnerabilities, unlike the last time they did this:

http://cagematch.dvorak.org/index.php?topic=7280.0

Why is this getting upvoted? That is a monkey chatter comment. That's the stupidest justification I've ever heard. This is scummy tactics. Period. Why would you defend it unless you had a vested interest in doing so? You know its bad. Why on earth would I EVER want someone to install additional software on to my computer without consent or notification.

I NEVER WOULD. That simple. You wouldn't either.

Google's update tactics are really shitty as well but at least you know you are installing it in the first place. This is just crap and you know it.

There is a third option to get outraged about that you didn't mention. Shitty tactics. It was obviously a sneaky move. You know it, they know it and I know it.

Why would you defend it unless you had a vested interest in doing so?

Because I have a longstanding, passionate interest in making software which can be used by people who do not make software. If your software requires package management, they can't use it. If your software requires configuration, they can't use it. If your software requires consent or notification, they either a) click right past without reading it or b) can't use it because they process anything longer than one sentence as "The scary box is showing me an error message."

Let me give you an example, taken straight from Ubuntu/Firefox. Firefox depends on ubuntu-desktop, a meta-package. Ubuntu-desktop contains, among other things, ure.

Do you really want to show my aunt -- who thinks Firefox is called "the Google" -- "Firefox requires installing a piece of software called 'ure' on your computer. Think carefully whether you consent to installing 'ure'."

[Install Ure] [Don't Install Ure] <-- P.S. My aunt does not understand this will cause her to fail at what she is trying to do.

There are several dozen other packages to run through, too.

My aunt is not capable of making that decision. She doesn't know what ure is. Hell, I don't even know what ure is (+), and it is my business to know things like this. It is her business to teach high schoolers and she has told you she wants to use Firefox to do it. Make it happen and get out of her way.

+ On checking with the Googles, I have discovered it is an OpenOffice run-time component. Duh, why didn't I think of that.

Well your passion is misguided and you should quit the software business now. Seriously.

Your argument is completely invalid. You are debating a dependency issue vs the installation of additional unrelated software.

I'm sure Microsoft has your aunts best interests in mind when they put their search bar into a product that they dont maintain.

If you are all for software companies installing random peices of bullshit software on your computer during regular updates of their software, then I'll gladly setup an update server that you can use. Dont worry, your aunt wont have to make any decisions.

I can't figure out which bothers me more: Microsoft being so underhanded with these updates to software it doesn't produce or that they allow pretty much any company to install an add-on within Firefox without user consent. This has happened once before with Microsoft and it's even happened with Skype, a company founded by modern, savvy entrepreneurs. Why won't Firefox add a feature to disable an installed add-ons until flagged as wanted by the user?

Windows Update presumably runs with System privileges and therefore can do anything to the computer. OK, the Firefox developers could make it harder to slip in add-ons, but not impossible.

They could make an addon installer that obtains a signature from Mozilla's server before installation, and blocks addons that haven't been signed with the appropriate key.

Say all you want about central app stores that control things, but based on the amount of browser exploits that come from shady toolbars, I'd like this kind of security applied to code that runs in my browser.

I doubt Mozilla will want to review all add-ons. And if review isn't required for a signature, Microsoft can just get theirs signed. Moreover, why wouldn't the MS add-on pass review? If it didn't, would that make Firefox the new iPhone?

You consented when you selected "Install updates automatically," instead of "Check for updates but let me choose whether to download and install them."

We're talking about a new Firefox add-on being installed here, not an update to one already installed. That's a huge difference.

Windows Update installs new software all the time.

Windows Update installs new software in the domain of Windows and other Microsoft products. It is not expected to install updates or extensions to any 3rd party software.

You may be right, but only if the description of the update described all it did.

If only we could sneak in Google Chrome Frame into IE this way...

Or Firefox...

This happened last year too: http://annoyances.org/exec/show/article08-600

Firefox central can "recall" and block any rogue extension.

They did it last year when Microsoft tried this, they should do it for this one too asap.

I purposely do not run as the default firefox profile, so I don't think Microsoft got me this time...

I hope they are doing it for security reasons. I seem to recall that if your default browser is set to Firefox, and you click the Windows Update link, that Windows Update won't run correctly because it depended on an ActiveX control.

If a specific critical piece of the OS relies on defaults to select the only environment it can run on, then it's very poorly designed.

Somehow, this doesn't surprise me one bit.

There is no such thing as a "Windows Update link" in modern Windows.

While the indirect way they did this is less than ideal, I think they have the right idea. IE and Firefox are browsers. A search toolbar is something that goes in a browser. Odds are, if you installed a search bar in your browser (not that I personally would ever do such a thing), you want it in whichever browser you use. It would be better if they just asked, 'hey do you want us to install this for firefox too?' (maybe?) but I'm not terribly upset by the idea of it.

Microsoft intentionally made Netscape (more) unstable and slower, if I recall. is there any reason to think they wouldn't respond to Firefox's growing popularity is to intentionally make it perform poorly? I'm very, very suspicious of Microsoft interacting with Firefox in any way whatsoever. No doubt they'd like to exert control over it in some way.

Did any of you outraged people actually have the toolbar installed? My auto updates are on and I don't have it in either browser.

If you already had it then it's not so inconceivable that they would update both browsers through lazy programming. No conspiracy theory required.

I don't think you can 'accidentally' install a toolbar in Firefox.

The original article:

http://arstechnica.com/microsoft/news/2010/06/microsoft-slip...

Reply on news.ycombinator.com