Hacker News Reader

Comment by briansmith | Hacker News Reader

Adobe, Skype, and almost every client software developer automatically and silently adds plugins to Firefox and other browsers. I recommend looking at your list of Firefox add-ons now (especially the plugins tab) and see how many of them were never specifically added to Firefox by you.

This is the kind of situation where the software vendor is damned if they do and damned if they don't. Mozilla simultaneously complains when they aren't getting the same treatment as IE, and when they do. People hate multi-page installation wizards that ask them to check all kinds of boxes; people hate when the software decides automatically what to do in order to avoid those pages of checkboxes.

View on HN

Why don't firefox make it so that the only way a plugin can be installed is with user confirmation? I'd never want a plugin automatically installed without knowing about it (I've never had that happen, but may be different on OSX).

That's impossible under traditional system configurations. Windows Update can always update whatever "user has confirmed" record Firefox stores, because it has administrative access to the machine.

Surely just make the [user confirmed plugin install] update something with a secret hash token.

When firefox starts, it checks each plugin has been explicitly accepted by the user. If not, it alerts them.

Sure, you could reverse engineer the signing token, and hack around it, but that wouldn't get you many friends.

Neither does including anti-Microsoft code in your product. (it doesn't protect against shadier players because those don't care about having friends.)

That's not anti-ms. That's just good security. I'd like to know when something is messing with my browser executable.

Like I said, it's not effective. If malware wants to futz with your browser executable, it's just going to patch the executable, not conveniently go through the plugin interface around which you've designed some forgeable security token.

the software vendor is damned if they do and damned if they don't.

Not true - the biggest problem with Microsoft's add on was the lack of an easy method of uninstalling it. All I ask is that vendors do two things when installing add-ons to firefox:

1. Ask my permission before installing.

2. Let me easily uninstall the add-on.

I recommend looking at your list of Firefox add-ons now (especially the plugins tab) and see how many of them were never specifically added to Firefox by you.

That's a good suggestion. I usually only look at the Extensions tab from the Add-ons menu, and the Plugins tab includes plug-ins I just had to look up on Google to even know what they are.

After edit: I just got the reminder from Firefox to restart to disable those Microsoft add-ons only just now, more than an hour after this thread opened. I should have already had a relevant Microsoft update by now, but Firefox is treating the add-ons as untrustworthy, and that's all right by me.

The minute I saw the Microsoft add-on in Firefox that I hadn't requested I disabled it. Same thing with Skype, Google bar, Yahoo bar, and any other add-on that slips through my obviously lacking scrutiny.

Wish they'd just stop. Then again I wish automatically updated things I want. I see your point.

Reply on news.ycombinator.com