Running Windows? Use Firefox? Read this

[slowfox]

As part of Windows Update, which we're all told we must use etc etc, Microsoft quietly rolled out an 'enhancement' to Firefox, relating to the .NET framework, which allows the browser to quietly install downloaded programs from a web-page without the user's permission (or knowledge).

This is not considered a good thing, from a security standpoint, and indeed was one of the drivers for people migrating away from IE to Firefox. It seems a little... strange that Microsoft would, as part of Windows Update, update software that isn't even theirs, odder still that they wouldn't explicitly mention it up front, and terrible that they make it so hard to uninstall (but disabling it is relatively straightforward).

Now, this issue blew up last week - it may be that things have been resolved in the 2nd Tuesday of the Month update that we should have picked up yesterday, and is whirring in the background as I type this, but in case it's not...

From the Tools menu in Firefox, select 'Add ons':


This brings up the Add ons window, which has four modes - here it's showing Themes:


Select the jigsaw-piece icon to view installed Extensions:


Note that in the pic above, my Web Developer Extension has both a 'Disable' and an 'Uninstall' option. It should be relatively easy to guess what effect pressing one of those buttons might have...

However, when we look at the options for Microsoft's .NET Assistant...

...we see that the 'Uninstall' option is ghosted, and unavailable. However, you can at least disable it (this will require you to then restart Firefox for the change to take effect).

Now, Microsoft have a support article on how to completely remove the .NET assistant from Firefox here. I have to say, it doesn't seem to be the most straightforward of matters, so for the time being I'm leaving it Disabled, rather than attempting to uninstall it.

Comments

[cynthia_black]

That does sound rather underhand of them, to say the least :-/

You know, I wouldn't know what effect such a 'Framework Assistant' would have - glad there are teccies like you about :-)

[slowfox]

The 'Framework Assistant' enables 'Click once' program installation to work from the web browser, and makes life a little 'easier', if also a little less secure.

And hey, I didn't work this out myself - this is dragged up from a couple of interweb sources, and MS themselves (for the guide on complete uninstallation).

It's rather puzzling that they chose to do this this way. There are technical reasons why you can't offer an 'Uninstall' button for the extension, although they've managed to overcome these with version 1.1 of the Assistant, which rather makes you wonder, through gritted teeth, why they couldn't have bothered doing it that way In The First Place.