Micro$oft's sneaky firefox add-on...

Story: Microsoft to EU: new browser rules will help GoogleTotal Replies: 2
Author Content
henke54

Jun 01, 2009
9:42 AM EDT
Quoting:With Firefox, I just went to download a certain new version 2.0 web browser and and was surprised that after hitting the license accept button Firefox started up an installer, downloaded the application and installed it without any prompts or questions. This is not the security experience with Firefox I've been accustomed to.

I did some digging around in the page's code, a little searching, and found I had the "Microsoft .NET Framework Assistant" installed into my Firefox add-ons. A little more digging and I found it was silently installed with .NET 3.5 SP1. Yes, that's right, I said silently. What's more, the default settings of this add-on allow sites to start installers without prompting.
http://www.communities.hp.com/securitysoftware/blogs/spilabs...
gus3

Jun 01, 2009
12:39 PM EDT
The story got picked up (again) by Slashdot, linking to a story that provides a link to Brad Abrams' blog entry about it... and lookie there, comments got disabled faster than you can say "Microsoft programs are insecure"!

http://blogs.msdn.com/brada/archive/2009/02/27/uninstalling-...
gus3

Jun 01, 2009
4:42 PM EDT
A thought just flashed through my head.

Did Microsoft use any Mozilla-licensed or (L)GPL-licensed code, in either the installer or the .NET Framework Assistant? If so, did they do so in contravention of the stated terms?

Posting in this forum is limited to members of the group: [ForumMods, SITEADMINS, MEMBERS.]

Becoming a member of LXer is easy and free. Join Us!