Running Windows? Use Firefox? Read this

[slowfox]

As part of Windows Update, which we're all told we must use etc etc, Microsoft quietly rolled out an 'enhancement' to Firefox, relating to the .NET framework, which allows the browser to quietly install downloaded programs from a web-page without the user's permission (or knowledge).

This is not considered a good thing, from a security standpoint, and indeed was one of the drivers for people migrating away from IE to Firefox. It seems a little... strange that Microsoft would, as part of Windows Update, update software that isn't even theirs, odder still that they wouldn't explicitly mention it up front, and terrible that they make it so hard to uninstall (but disabling it is relatively straightforward).

Now, this issue blew up last week - it may be that things have been resolved in the 2nd Tuesday of the Month update that we should have picked up yesterday, and is whirring in the background as I type this, but in case it's not...

From the Tools menu in Firefox, select 'Add ons':


This brings up the Add ons window, which has four modes - here it's showing Themes:


Select the jigsaw-piece icon to view installed Extensions:


Note that in the pic above, my Web Developer Extension has both a 'Disable' and an 'Uninstall' option. It should be relatively easy to guess what effect pressing one of those buttons might have...

However, when we look at the options for Microsoft's .NET Assistant...

...we see that the 'Uninstall' option is ghosted, and unavailable. However, you can at least disable it (this will require you to then restart Firefox for the change to take effect).

Now, Microsoft have a support article on how to completely remove the .NET assistant from Firefox here. I have to say, it doesn't seem to be the most straightforward of matters, so for the time being I'm leaving it Disabled, rather than attempting to uninstall it.

Comments

[yvi]

WTF???

And it needs to be remove by either changing the registry by hand or using a command prompt.

Wow, Microsoft, I can't believe you are giving me more reason to be glad I am not using your products anymore.

[slowfox]

Still, to be fair, at least, since it's part of Windows Update you can opt out of it altogether. Oh, wait...

This is quite staggeringly bad PR for them.

[yvi]

I hope so. Seriously, no other company would get away with that.

And even if you could really opt out of Windows Updates, wouldn't that kind of make your computer so insecure you'd not be able to use it with an internet connection?

[slowfox]

And even if you could really opt out of Windows Updates, wouldn't that kind of make your computer so insecure you'd not be able to use it with an internet connection?

Indeed :-/

[ex_simon644]

My method of uninstalling it is slightly different:
1) Order, or download, Ubuntu, or similar, CD.
2) Install, overwriting Windoze.
Hey presto, no more dodgy extension! :D

[slowfox]

Yep, that works for me, too - Castle Fox is WindowsFree™ Sadly, work are less understanding (although I have installed Ubuntu on one of the PCs).

[yvi]

I am actually running a dual-boot on my home laptop (Debia and Vista Enterprise), but I have yet to boot into Windows :)

[tikiberry]

Stupid Microsoft...

Thanks for the heads up!

[slowfox]

Glad to be of service!

[alicit]

Thanks for the heads up. Do you mind if I like to this post on my own journal?

[alicit]

I mean link, not like.

[slowfox]

Feel free to link - it's here so people can find it :-)

[cynthia_black]

That does sound rather underhand of them, to say the least :-/

You know, I wouldn't know what effect such a 'Framework Assistant' would have - glad there are teccies like you about :-)

[slowfox]

The 'Framework Assistant' enables 'Click once' program installation to work from the web browser, and makes life a little 'easier', if also a little less secure.

And hey, I didn't work this out myself - this is dragged up from a couple of interweb sources, and MS themselves (for the guide on complete uninstallation).

It's rather puzzling that they chose to do this this way. There are technical reasons why you can't offer an 'Uninstall' button for the extension, although they've managed to overcome these with version 1.1 of the Assistant, which rather makes you wonder, through gritted teeth, why they couldn't have bothered doing it that way In The First Place.

[loup_noir]

Thus far, my Firefox doesn't show that problem. Yet. When did this go into effect? I've got the usual MS updates waiting for me to bless them.

[slowfox]

Ooh, interesting! The reports I'd heard/read about, suggested that this had been included in an Update a while back, but it only really came to attention last week (ie, before yesterday's routine set of updates), and it wouldn't be a huge surprise if Microsoft put managed to fix this since it was made public (that said, my PC, and colleague's here, both were affected).

The latest version of the .NET Assistant (v1.1) does allow you to uninstall it, which is definitely an improvement.

[slowfox]

The uninstallation guide at Microsoft is dated 2 June, so it evidently went into effect before that date. Most curious...

[anotherpenguin]

for some reason, the thing doesn't show at all in my add-ons list. Is that only something for Vista? I still have XP...

[ms_katonic]

I've got Vista and it's not on mine either, don't think it ever has been. :)

[anotherpenguin]

Oh, actually, I re-checked tonight after having 14 Windows updates installed on my computer this afternoon... and now I do have the annoying add-on thing on Mozilla. So I disabled it ... thanks for the advice, slowfox!
My husband has Vista and the thing hasn't appeared yet, though... :)

[slowfox]

alicit found this story at IT Wire which explains that the Update only applies to machines with version 3.5 of the .NET Framework. At a guess, I'd say that you don't have that installed on your machine...

[aome]

Will thinks he already disabled it during the update process, but he's glad of your links so he can double check. Thanks for the PSA. :D

[slowfox]

Smart of him! I tend not to read through the list of updates, just trusting Microsoft to do their thang, but methinks now I'm going to go back to perusing things a little more carefully once more.

I have since learned (see today's post) that this Update was only triggered if you had the .NET 3.5 framework installed. If you had an earlier version (such as 2.0), then the Assistant wasn't installed...

[ms_katonic]

Ta for the heads-up - will pass this on to the flists, although fortunately I appear to have escaped unscathed.

[slowfox]

alicit found this article at IT Wire, which may explain why you escaped - the Update only affected machines with version 3.5 of the .NET framework installed. So if you weren't at 3.5, you'd have been safe.

Can't say (yet) what might happen when you do reach v3.5, though - so keep an eye on those extensions...

[linaelyn]

Thank you for the information, though Casa Telcontar-Longshanks is also a Windows-free zone. I will pass this on to others.

[slowfox]

Microsoft handled this one badly, IMHO - hopefully the bad PR they're now reaping will mean that they're not quite so surreptitious about what they're doing next time.