Microsoft quietly adds Firefox extension, blocks uninstall

[bilateralrope]

And then disables the uninstall button.

Annoyances.org

Remove the Microsoft .NET Framework Assistant (ClickOnce) Firefox Extension

The Microsoft .NET Framework 3.5 Service Pack 1 update, pushed through the Windows Update service to all recent editions of Windows in February 2009, installs the Microsoft .NET Framework Assistant firefox extension without asking your permission.

This update adds to Firefox one of the most dangerous vulnerabilities present in all versions of Internet Explorer: the ability for websites to easily and quietly install software on your PC. Since this design flaw is one of the reasons you may've originally choosen to abandon IE in favor of a safer browser like Firefox, you may wish to remove this extension with all due haste.

Unfortunately, Microsoft in their infinite wisdom has taken steps to make the removal of this extension particularly difficult - open the Add-ons window in Firefox, and you'll notice the Uninstall button next to their extension is grayed out! Their reasoning, according to Microsoft blogger Brad Abrams, is that the extension needed "support at the machine level in order to enable the feature for all users on the machine," which, of course, is precisely the reason this add-on is bad news for all Firefox users.

Here's the bafflingly-convoluted procedure required to remove this garbage from Firefox:

1. Open Registry Editor (type regedit in the Start menu Search box in Vista/Windows 7, or in XP's Run window).
2. Expand the branches to the following key:
* On 32-bit systems: HKEY_LOCAL_MACHINE \ SOFTWARE \ Mozilla \ Firefox \ Extensions
* On x64 systems: HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Mozilla \ Firefox \ Extensions
3. Delete the value named {20a82645-c095-46ed-80e3-08825760534b} from the right pane.
4. Close the Registry Editor when you're done.
5. Open a new Firefox window, and in the address bar, type about:config and press Enter.
6. Type microsoftdotnet in the Filter field to quickly find the general.useragent.extra.microsoftdotnet setting.
7. Right-click general.useragent.extra.microsoftdotnet and select Reset.
8. Restart Firefox.
9. Open Windows Explorer, and navigate to %SYSTEMDRIVE%\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation.
10. Delete the DotNetAssistantExtension folder entirely.
11. Open the Add-ons window in Firefox to confirm that the Microsoft .NET Framework Assistant extension has been removed.

It will be a great day when PC users no longer have to waste this much time to protect themselves from those who write the software they use. (And if you're thinking, "Why not just use a Mac," may I remind you of the MobileMe junk recently installed on so many Windows machines without their owners' permission!)

Forcefully altering a competitors product without permission from the person who owns the computer, while also blocking an easy uninstall. Is this a new low for Microsoft ?

[Zac Naloen]

Why doesn't disabling it work?

[bilateralrope]

I've got two issues with this extension:

1 - It was more difficult to uninstall than other extensions. No matter how bad the Firefox code is, it does not excuse Microsoft either not testing the uninstaller, or deciding to release while knowing that the uninstall button didn't work.

2 - It was installed without the user being asked. The DOM inspector and Talkback plugins were installed with Firefox, so I've always seen that as being asked about them when I installed Firefox.

As for this being old, it's the first I've heard about it.

[Uraniun235]

(And if you're thinking, "Why not just use a Mac," may I remind you of the MobileMe junk recently installed on so many Windows machines without their owners' permission!)

I don't get it.
"Why not just use a Mac?"
"Remember when MobileMe got installed on Windows without their owners' permission?"
???

... first, no, I don't remember that, thanks for not leaving a link to an example in your article, buddy. Second, how is that a retort to "why not just use a Mac?"

[Oskuro]

But it is so much easier to say 'lol m$ft $ux' than to write good software.

Considering the price tag on their OS, as well as all the stupid hoops we have to go through on a regular basis, I'd say it's not only easier, it's our fucking right as customers.

I don't expect Firefox to be perfect, because, quite simply, I didn't pay a dime for it. If it is abismally flawed, I'll stop using it. But I payed good money for Windows, so it's their fucking job to not screw up their product. Yeah, I could drop Windows, but I doubt I'll get a refund, and more importantly, their market pressence makes it difficult to do so, wich leads to all that antitrust stuff I'd rather not delve into right now.

So yes, writing perfect code is impossible, but Microsoft has no excuse to screw their paying customers' systems.


Of course, this also doesn't excuse lousy stuff in Firefox, or in any other software, be it free or not. Just lets not jump into a stupid polarization of the issue. Sayin MS is bad is not saying everyone else is great, nor is it the other way around. But MS is getting payed, so it is substantially more news and wrath-worthy.

[rhoenix]

Wait, Destructionator, let's go through the steps here:

1. Microsoft writes an add-on specifically for Firefox.
2. Said add-on is installed automatically, and installs other software automatically.
3. Said add-on cannot be removed by the average user.

I'm really not seeing how this can be pinned on Mozilla's codebase. Complaining that there are multiple methods of uninstalling and such is great and all, but somehow other addon writers for Firefox get it right, and they get reviewed, and they're optional installs.

Can you explain how Microsoft should just get a free pass for not properly QA'ing their own work on a rival company's product?

[rhoenix]

I'm really not seeing how this can be pinned on Mozilla's codebase.

Firefox is the program displaying the grayed button, not anything Microsoft made. How can you blame them for something that isn't their code?

Because an addon that is installed without the user's permission or consent obviously wasn't QA'ed properly on Microsoft's side?

This is like trying to blame Microsoft for a program in Windows that won't remove itself from Add/Remove Programs, or a website that doesn't display properly in anything other than IE. It is still the author's job to get it working properly, not the originating company's job to alter their entire codebase to get one addon working right.

This add-in doesn't change the Firefox codebase at all - it is just a standard plugin for the browser. If Firefox can't handle that properly, that's their problem.

Oh, so Microsoft doesn't have to QA check their own work?

Can you explain how Microsoft should just get a free pass for not properly QA'ing their own work on a rival company's product?

Can you explain how Microsoft should take the blame for a rival company's shitty code? (This happens all the time, but that doesn't make it right.)

The plugin surely works fine. The uninstall button is outside the scope of any individual add-in.

Because checking addon code for errors is the job of the Mozilla programmers and not the addon programmers, right?

[Sarevok]

I have not installed the update yet in question so I need to know this.

Does it mention in a clear (as in not techno-legalse textdump found in MS installers) way that the update will affect Mozilla Firefox ?

[Oskuro]

But MS is getting payed, so it is substantially more news and wrath-worthy.

So is Mozilla, quite handsomely, too; they turned a profit of over $40 million in 2007.

Irrelevant to my point, since that money is not coming out of my pocket. If Microsoft decides to obtain its profits solely from publicity, or from selling apple pie in the streets of Camboya, then I might change my attitude.

Also, enough with the red herring. Mozilla's mistakes do not excuse Microsoft's mistakes.

[Guardsman Bass]

Where is this supposed to be located? I just opened my "add-ons" bar with Firefox and didn't see anything by the name listed above in the OP (Microsoft .Net Framework Assistant extension).

[Dominus Atheos]

Second, how is that a retort to "why not just use a Mac?"

Because Apple is evil too. MobileMe is some thing Apple slipped into iTunes that advertised the computer to Macs on the LAN. Or something; I had to google it myself.

I assume he's talking about the time Apple made it so the iTunes/Quicktime updater installed Safari without permission.

[Stark]

Thats funny, it asks me. iTunes does in a roundabout way try to 'sneak' MobileMe onto your system by nagging a few times, but it clearly doesn't do it silently because... I don't have it installed, and I have QT/iTunes/Safari installed.

Shock, it's bullshit! Who could have guessed?

[Zac Naloen]

I still haven't had it answered why it isn't sufficient just to disable to addon...

[Oskuro]

Their mistake is making an extension install without the user's consent, specially an extension they knew full well would be near impossible to uninstall by the average user.

This whole issue has nothing to do with how bad or good the Mozilla codebase is, but is a simple matter of Microsoft forcing updates on users. Argue all you want about the virtues of their software, but their attitude is unexcusable. And don't give me examples of other software companies pulling the same crap, I know full well they do, and they are as inexcusable as MS might be, but in this particular case, it so happens that MS is being directly payed for this, while Mozilla is not.

Also, imagine you install a piece of software under Windows, and it fails to work as expected, even causing trouble or annoyances. Now, the creators of said software come up and blame it on Windows being implemented they way it is. Would you buy that excuse? It was them who developed the add-on, it was their resposability to make sure it worked properly, not Mozilla's, and if Firefox's code did not allow for the correct functioning of the addon, they should have dropped it, or, at least, warn the user about that fact and let it choose if it wants to install the addon or not.

[Beowulf]

What does the .NET framework assistant do?

The .NET Framework Assistant for Firefox


--------------------------------------------------------------------------------


The .NET Framework Assistant for Firefox enables ClickOnce stand-alone applications to run from the Firefox browser. The .NET Framework Assistant functions identically when installed before and after the Firefox browser. When the Firefox browser is launched and the .NET Framework Assistant is present, Firefox finds and installs the add-on. Users can configure the assistant to do the following:

Prompt before running the application.

Report all installed versions of the .NET Framework or just the latest version.

The .NET Framework Assistant is installed with the .NET Framework version 3.5 Service Pack 1.

Since I'm not running Firefox at the moment, I don't know how to have it prompt. However, I actually don't see the big deal. MS followed the Firefox API and best practices. The fact that the best practices don't include a functioning uninstall is not MS's problem.

Also, this isn't all that similar to MobileMe and Safari. MobileMe is a paid service that most user won't end up using. Installing it with iTunes was a bit of jackassery because it's a pay service. Similarly, Safari is the same way. The Firefox extension is to support MS technology that allows an easy deployment method. Doing this allows MS to say click-once works with any machine with .NET 3.5 SP1 installed.

As for what clickonce is:

What Is a ClickOnce Application?


--------------------------------------------------------------------------------


Simply stated, a ClickOnce application is any Windows Presentation Foundation, Windows Forms, or console application published using ClickOnce technology. You can publish a ClickOnce application in three different ways: from a Web page, from a network file share, or from media such as a CD-ROM. A ClickOnce application can be installed on an end user's computer and run locally even when the computer is offline, or it can be run in an online-only mode without permanently installing anything on the end user's computer. For more information, see Choosing a ClickOnce Deployment Strategy.

ClickOnce applications can be self-updating; they can check for newer versions as they become available and automatically replace any updated files. The developer can specify the update behavior; a network administrator can also control update strategies, for example, marking an update as mandatory. Updates can also be rolled back to an earlier version by the end user or by an administrator. For more information, see Choosing a ClickOnce Update Strategy.

Because ClickOnce applications are isolated, installing or running a ClickOnce application cannot break existing applications. ClickOnce applications are self-contained; each ClickOnce application is installed to and run from a secure per-user, per-application cache. By default, ClickOnce applications run in the Internet or Intranet security zones. If necessary, the application can request elevated security permissions. For more information, see ClickOnce Deployment and Security.

So it's a way of publishing applications. Doing it from the internet severely limits what you can access with that deployment method. All this hoopla? FUD.

[Joviwan]

Thats funny, it asks me. iTunes does in a roundabout way try to 'sneak' MobileMe onto your system by nagging a few times, but it clearly doesn't do it silently because... I don't have it installed, and I have QT/iTunes/Safari installed.

Shock, it's bullshit! Who could have guessed?

I have no idea what Mobile Me is, but I do know that when Safari was first offered to PCs, it was clumped together with Apple's incessant and insistent "important updates," thing that you had to drill down into in order to deselect Safari for installation. That changed after people threw a hissy, and they placed it under "optional" or whatever. Is Mobile Me similar?

[Crayz9000]

What does the .NET framework assistant do?

[...]

So it's a way of publishing applications. Doing it from the internet severely limits what you can access with that deployment method. All this hoopla? FUD.

Well, it might be FUD until someone figures out a way to jailbreak .NET applications. Which, given Microsoft's past, I wouldn't act very surprised at.

It's more the fact that they are throwing this in automatically as a security update that annoys me. This should be an optional component, not a "critical update". Then again, it's not like we haven't seen them abuse Automatic Updates in the past...

[Stark]

I have no idea what Mobile Me is, but I do know that when Safari was first offered to PCs, it was clumped together with Apple's incessant and insistent "important updates," thing that you had to drill down into in order to deselect Safari for installation. That changed after people threw a hissy, and they placed it under "optional" or whatever. Is Mobile Me similar?

MobileMe appears to be some kind of online content storage; it's supposed to make data management on iPhones easier. I have no interest in it so I've nver looked too closely.

It just used the Apple Update thing to prompt you to install it, and iTunes did it a few times too. It wouldn't surprise me if bits of MobileMe were already installed (given how integrated it is with iTunes) but it's certainly not usable on my system without choosing to install it.

[Xon]

Well, it might be FUD until someone figures out a way to jailbreak .NET applications. Which, given Microsoft's past, I wouldn't act very surprised at.

The nature of .NET's sandbox makes breaking out when you are in untrusted mode unbelievable difficult. You can't run any native code, and all your code is statically vertifiable that it is 'safe'. the entire .NET framework has a good record, and they do issue patches for any flaws quite quickly.

It's more the fact that they are throwing this in automatically as a security update that annoys me.

It is part of a critical update which updates the .NET framework to the newest codebase. This includes a host of other features and fixes as well.

[Crayz9000]

It is part of a critical update which updates the .NET framework to the newest codebase. This includes a host of other features and fixes as well.

Let me restate my question:

Why is a new Firefox extension part of a critical update?

[Faqa]

It is part of a critical update which updates the .NET framework to the newest codebase. This includes a host of other features and fixes as well.

Let me restate my question:

Why is a new Firefox extension part of a critical update?

My best guess is that they want Firefox users to be able to use ClickOnce, and know full well that the technology isn't sexy enough to mandate an update. Therefore, they sneak in the extension as part of the framework that makes it possible.

The big question is whether you can choose to not install it when installing the Framework. If not, that's out of line.

[Xon]

Why is a new Firefox extension part of a critical update?

Anti-trust.

ClickOnce has recieved major improvements, a lot of that relying on general improvements in the .NET framework itself. So with updates to the framework, you basicly get the new ClickOnce for 'free'. Untill this Firefox plugin, ClickOnce was IE only. And given Microsoft still has to comply with anti-trust oversite about IE not being required, Microsoft had a legal madate to offer this product to other browsers.

[General Zod]

It is part of a critical update which updates the .NET framework to the newest codebase. This includes a host of other features and fixes as well.

Let me restate my question:

Why is a new Firefox extension part of a critical update?

My best guess is that they want Firefox users to be able to use ClickOnce, and know full well that the technology isn't sexy enough to mandate an update. Therefore, they sneak in the extension as part of the framework that makes it possible.

The big question is whether you can choose to not install it when installing the Framework. If not, that's out of line.

Apparently both my Firefox browsers at home and work have it installed. I don't recall being asked whether I wanted to or not.

[Beowulf]

MS KB article on uninstalling it

[The Yosemite Bear]

Is it bad that I recall when Microsoft added code to early versions of Windows and MS-Dos6 that killed all non IDE format HDDs?