Forgot your password?
typodupeerror
Java Programming Mozilla Sun Microsystems The Internet

Sun Slips Firefox Extension Into Java Update 311

Posted by timothy
from the we-thought-you-wanted-it dept.
pcardno writes "It seems it's not just Microsoft that have spotted a good opportunity to distribute their software through Firefox Addons. On installing the latest annoying, sysbar bubble based Java update, my Firefox informed me that I had a wonderful new Java addon automatically. Here's the addon screenshot. Yes, I could opt out of it, but why are Sun installing Addons to my Firefox without me making specific choices in the application itself? To be clear — I have never chosen to install this Addon, yet it has been installed without my permission with the latest Java Update."
This discussion has been archived. No new comments can be posted.

Sun Slips Firefox Extension Into Java Update

Comments Filter:
  • by Divebus (860563) on Saturday February 21, 2009 @04:32PM (#26943269)

    You get what you pay for... and then some.

    • by TheKidWho (705796) on Saturday February 21, 2009 @04:52PM (#26943453)

      The less you pay, the more you get!!!

      And you'll like it too.

      • Re: (Score:3, Funny)

        by jetsci (1470207)
        ...the last time 'Sun' slipped me something I woke up groggy and sore...
    • Re: (Score:2, Informative)

      by Anonymous Coward

      or mozilla can fix the fucking bug.

      https://bugzilla.mozilla.org/show_bug.cgi?id=446139 [mozilla.org]

    • by Anonymous Coward
      I suppose you're wonderin' how this happened:

      Sun executives were sitting around one day at a 3-hour lunch getting drunk and making rude remarks to the waitress. One of them said, "How can we sink the company?" After considerable deliberation, one of them had an idea. "I know, we'll get ourselves on Slashdot for doing something dastardly." Another executive said, "Brilliant! No reputable programmer will ever take a job at Sun again."

      Then they had to think of something sufficiently sneaky. That's diffic
    • by BikeHelmet (1437881) on Sunday February 22, 2009 @02:38AM (#26946829) Journal

      I don't see why people are upset about this.

      1) The addon/plugin is tied to your computer - not your profile. It's similar to installing quicktime. It registers plugins with your browser. But for some reason it shows up as an addon rather than as a plugin - perhaps because of the featureset it requires? It looks like they split prefetching functionality from the main plugin, so that it can be disabled if desired.

      2) It's easy to turn off. Just go to the java control panel and disable it. If you can't figure it out, here [aaacomputer.com]. (first result on google)

      3) Prior to Firefox 3, nobody even knew this stuff was running. Now you do, and you actually have the option to disable it, or totally remove it. Isn't this a good thing? Why are you screaming now that you know it's there?

      4) This happened something like 6 months ago.

      5) This feature was not "slipped in". Sun wrote about it in April 2008 [sun.com]. Maybe if you were going to throw a fit, you should've done it when they first announced it.

      6) Technically you did choose to install the addon. It's part of Java. A checkbox when installing would be nice, but really, isn't required - especially since this is easy to disable, and the functionality is known, and has been disclosed for almost a full year.

      If you want something ludicrously invasive, go look at OpenOffice. It silently steals file associations, has no way to manually register extensions, etc.; half the changes they make are so poorly documented that deploying a new version in a production environment can leave things totally FUBAR.

      (not that I'm dissing them - just pointing out that this isn't a big issue to me, because Sun did just about everything right, and people are still screaming about it - typical)

  • by perspectival (906492) <zabinac AT nc DOT rr DOT com> on Saturday February 21, 2009 @04:33PM (#26943283)
    Yes, now you have Java working in Firefox. Turn it off if you don't like it. Simple.
    • by Jeff DeMaagd (2015) on Saturday February 21, 2009 @04:38PM (#26943327) Homepage Journal

      The problem is that this should be an opt-in system, not opt-out later by going in.

      You talk about convenience, but they certainly don't offer as convenient of an opt-out as they should have.

    • by Anonymous Coward on Saturday February 21, 2009 @04:54PM (#26943485)

      You're right, you have to turn it off - because you sure as hell can't uninstall it.

      It's unwanted, it's unneeded (Java works fine without it) and it's useless (all it does is waste memory and make Firefox take even longer to start).

      So why does Sun force it onto us without even asking? Damned if I know.

      Fortunately it's easy to disable. Unfortunately it gets reenabled every single time you update Java, which is a fairly routine thing thanks to the massive number of security holes lingering in Java. (Even worse, if you allow it to update automatically, this just happens in the background, so your only sign that it got reinstalled behind your back is Firefox randomly being slower).

      Honestly, I only have Java installed for a couple of "enterprise" applications I use that require the massive Java bloat. I'd much prefer it keep its hooks out of my browser: Java applets are dead and have been for years. The only reason I have Java at all is thanks to the "enterprise" weenies who think that J2EE makes everything better.

      But you can't keep it out of your browser. Install it, and it sticks its hooks into your browser without giving you an option. Even better, it now advertises Open Office and demands that you register Java.

      But this isn't really news - Sun's been doing that for at least the past year and quite possibly longer. It's not a new feature.

      It's still scummy, and makes me incredibly wary about using any Sun software (eg Open Office and MySQL) for fear of what Sun bloat now lingers in them.

  • Old (Score:5, Informative)

    by RockMFR (1022315) on Saturday February 21, 2009 @04:34PM (#26943289)
    I mentioned this [slashdot.org] during the discussion about the Microsoft add-on three weeks ago. How is this news now?
  • Or so says Sun. That being said... I cannot think of one thing I might need a Java tool bar for. Honestly, I have not read the article yet and am sitting here trying to think of one useful thing such a tool might do for me. Anyone?

    • by dmomo (256005)

      Ahhh.. silly me. It's a toolbar to help Java start more quickly. Anyone find this valuable? Is there a yes/no toggle: "Start quickly, don't start quickly?"

      If you encounter a java applet does a popup ask you... "would you like this to start quickly"? Can I disable it from starting quickly? HELP.. java is starting too quickly.

      Deep breath.

      Please discuss!

      • Re: (Score:3, Interesting)

        by Anonymous Coward

        Look a lot of apps have agents that load on startup so that when you want them the visual startup time is much shorter, because it has been differed to when the system started up.

        Over the history of Java people have complained about how long the JVM startup time is. While Sun has made many improvements in this over the years, the FF add-on just assists this even more. When you launch FF and this add-on is enabled it initializes the JVM and the applet sub-system.

        This way if you go to a site that has an app

      • by radish (98371)

        It's not a toolbar (what made you think it was?). It's just an extension which preloads some java stuff so that applets load faster. Don't want it? Uninstall it.

      • by afidel (530433)
        This simply starts the JRE when you launch Firefox so that there isn't the delay when starting your first applet. It's the same as IE and Office being preloaded with Windows so that they pop up instantly when you click the icons.
    • It's not a toolbar at all. It's not visible. It just improves Java start times which is why I didn't remove it. It's definitely more helpful than his silly and pretentious Latin generator to prove he's a "master" web designer or the google toolbar he has installed which is rather pointless seeing how Firefox searches google by default in its own search box.
  • Stop this right now (Score:4, Interesting)

    by AlterRNow (1215236) on Saturday February 21, 2009 @04:40PM (#26943343)

    Could Firefox add some sort of public/private key extensions signing so I can sign extensions I want to use? Then unsigned extensions wouldn't be loaded and this sort of thing could be stopped ( by the technical minded anyway ).

    • by dmomo (256005) on Saturday February 21, 2009 @04:48PM (#26943425) Homepage

      Sounds like a great idea for an extension!

    • Re: (Score:2, Insightful)

      by TheKidWho (705796)

      Maybe, but the source code is available, why don't YOU do it?

    • by Rix (54095) on Saturday February 21, 2009 @06:25PM (#26944231)
      Simply only allow them to be installed through Firefox. If one of these crapware installers wants to ad one, make it open Firefox with the xpi installer.

      And make it default to cancel.
      • Re: (Score:3, Insightful)

        by anaesthetica (596507)

        This is a security issue really. Firefox shouldn't run any extensions not explicitly approved by the user. If a third-party installer puts an extension in, Firefox should keep it disabled until the user explicitly enables it (or uninstalls it) in the Addons Manager.

        If legitimate companies are stooping as low as illicit extension installs into Firefox, it is an obvious next step for spyware and malware programs running on people's computers to begin to do the same. It doesn't matter that Firefox alerts yo

        • Re: (Score:3, Insightful)

          by BitZtream (692029)

          The user did approve them, by lettering code run on their machine that updated software. The security issue is the stupid users who allow the updaters to run and then get pissed off when they update stuff.

          'OMG FIREFOX IS INSECURE BECAUSE THIS OTHER APP I LET RUN WITH ADMIN RIGHTS IS CHANGING FIREFOX'

          Jesus I hate when idiots like you post.

          This is a security issue, but it has nothing to do with Firefox, its the user. The user allowed the update to update his machine on its own. The security problem is that

          • by anaesthetica (596507) on Sunday February 22, 2009 @01:27AM (#26946493) Homepage Journal

            This is a security issue, but it has nothing to do with Firefox, its the user.

            That's the excuse we used to use with Windows too. But everyone has since realized that while you can never inoculate against dumb users, some software is inherently less secure because of the way it is designed. You're right that if users had perfect knowledge of what they were running, what they were installing, and what it all meant, then there would be no problem. Unfortunately that is not the case—in practice, people have limited knowledge about what they're running and what they're installing, as evidenced by the wild success of spyware and adware and malware. Tens of millions of users have malware running local code while logged in on admin-level accounts, the malware is running without their full knowledge, and this presents a wide open vector for attack.

            We can follow your model, in which we place the onus entirely on the user. And similar to abstinence-only sex ed, which ignores the well-demonstrated reality of human behavior, it will fail and Firefox will be exploited. Or we can follow my model, which adds another layer of security on the assumption that people do make mistakes and ill-informed decisions, and design around that. Firefox's good reputation will be preserved, with trivial hassle to the end user.

    • by tkinnun0 (756022)
      Firefox is open source, so WorksForMe and PatchPlease.
  • Malware (Score:3, Funny)

    by MoZ-RedShirt (192423) on Saturday February 21, 2009 @04:41PM (#26943349)

    Watch out! It seems that some other malicious updaters installed IEtab and a twitter addon in your firefox, too!

  • What is a "sysbar bubble based Java update?"

    The whole thing seems like a total yawner to me. When I install a package on my ubuntu box, it will typically have side-effects. It may have to install other software that it depends on, and possibly make changes to my system's configuration (e.g., the default if you install apache or ssl is to activate the relevant service). I may or may not agree with Canonical and Debian's choices. If I disagree with them, I can either override them, or choose a different di

  • by salahx (100975) on Saturday February 21, 2009 @04:48PM (#26943417)

    All this plugin does is speed up loading of Java applets. Its benign, and Sun provides instructions on how to turn it off: http://www.java.com/en/download/help/quickstarter.xml [java.com] .

    • Re: (Score:3, Insightful)

      by ADRA (37398)

      Yeah, what a complete waste of a story. It is installed with java which preloads core java so that when your browser runs applets, they start faster... Damn those frigging bastards at sun for making my life easier!

      • by KiloByte (825081) on Saturday February 21, 2009 @05:19PM (#26943723)

        It preloads all the bloatness of Java, every single time, even if you installed it just for a single page you visited half a year ago.

      • by nabsltd (1313397)

        Yeah, what a complete waste of a story. It is installed with java which preloads core java so that when your browser runs applets, they start faster...

        They start faster because every time you open a browser window, the "Java quick start" has to take time to load, even if it was already loaded. If you don't believe me, try timing it.

        Also, you now have memory used by a program "just in case you might want to use it someday". And, it's possible to configure the Java runtime to not be available as a browser add-on, but still allow you to run Java apps on your computer. Any bets on whether this extension will load regardless of your browser settings for Jav

    • Re: (Score:3, Insightful)

      by batkiwi (137781)

      What does the MS one do that's not benign?

      • by zullnero (833754) on Saturday February 21, 2009 @05:12PM (#26943673) Homepage
        Neither is benign. When you tamper with a customer's third party software, you 1. Ask them first, and 2. Let them back out easily. Microsoft and Sun did neither of these. Not only are they spitting on good software standards, they're spitting on their users by doing this.
    • Re: (Score:3, Insightful)

      by MrMista_B (891430)

      So if someone breaks into your house and cleans your kitchen, you'd think that's okay too?

    • I would bet it also makes loading Firefox take longer and uses up RAM even when not using Java.

    • by gbjbaanb (229885)

      and in similar news, Sony installed [wikipedia.org] a 'helpful system driver' that made your music playing and purchasing life easier too, helping to protect you from pirate music.

      The point is simply that it gets installed on the sly, if its so helpful, they should make it opt-in and surely everyone will accept the install.

  • Applets, you have heard of them?

    When you install / upgrade Java, you get support for the latest Java runtime in your browser to run those applets. It has been thus since the olden times (the mid-nineties when Java was launched).

    From the description, this is just a performance optimization so the runtime is loaded and you don't get a delay when there is an applet in the page.

    Whether I am right about what the plugin does or not, installing / upgrading the Java Runtime Edition has always affected your browser.

    • by gad_zuki! (70830)

      Right. There's always been a java extension/plugin/control etc. I guess slashdot is targeting the 'OMG ALL CORPORATIONS SUCK AND ARE AFTER ME!!!!' crowd, which sadly, gets ad impressions.

  • And of course if it asked you and it said no, complainers like you would be complaining about how Firefox doesn't properly support JAVA later.

    And of course, if you were a dumbass who didn't understand what extensions were, you might say No out of fear, and then later decide you don't like java. And then later decide buying an iPHone isn't that bad, because it doesn't support java, but java never works anyway.

    At some point, you have to let the machine work for you. Remember all the people who complained about windows asking your permission before doing anything possibly harmful? Seems like whether you ask people or not, someone is going to whine on either side of the fence.

    In a world of whiners, I'd rather have Javascript work on their browsers.

    There's enough problems with things BROKEN because people DON'T do automatic updates. Then when updates to happen automatically, people STILL whine.

    Can't win.

    • by db32 (862117) on Saturday February 21, 2009 @05:03PM (#26943577) Journal
      Java != Javascript.
    • I assigned F12 hotkey to quickly toggle javascript on/off. I don't need a hotkey to toggle java on/off because I use it so rarely, that I can go to menu and click to enable it.

    • by r7 (409657)

      And of course if it asked you

      From the screenshot it doesn't appear there was anything to ask, as it was disabled. Installed but not enabled would seem to be as opt-in as plugins or extensions get. It is certainly better than the ones Mozilla installs that you can't even uninstall. Not different from what Ubuntu and MS are doing.
      What we need now is an open repository for plugins. The current Mozilla-managed repo is a bit too Google-friendly for my tastes, especially when I'm looking for the Scroogle plugin.

  • Quickstarter.... (Score:5, Insightful)

    by nvrrobx (71970) on Saturday February 21, 2009 @04:51PM (#26943447) Homepage

    It helps preload the JVM so that any Java applets load faster.

    It's not some evil conspiracy.

    You told it to update your computer. It didn't tell you exactly what it was doing. Does Microsoft Update tell you everything it's going to touch?

    If you don't like it, run Linux, install SELinux and block everything by default.

    Not trying to sound like a dick, but this really is a non-issue.

    • You told it to update your computer. It didn't tell you exactly what it was doing. Does Microsoft Update tell you everything it's going to touch?

      If you ask, yes.

      (Even eeeeeeeeeeeevil WGA is in the list!)

    • Running Linux /w Firefox here. No default Java extension in sight here. If I want Java, then I have to use the system package manager and install one version of it purposefully (either the sun or the open source version).

      With Windows it was always like giving up freedom for ease of use. Now it does stuff to ease use and you are all complaining. Can you please decide, if you want freedom or dictatorship? Both don't work together.
    • Are you kidding? How your troll of a comment ever got modded 5 Insightful, I don't know.

      If you don't like it, dump your OS? This is as insightful as saying if you did't like the way Bush was running the USA, move to another country.

      You're right it's not an evil conspiracy. Then again, no one ever said it was, apart form your straw man.

      It is not a non-issue.

      When a party modifies a third party's software without permission and blocks the uninstall facility of that modification it is an abuse - of trust and ow

  • Just FYI: the RFE to remove those addons [mozilla.org] was marked WONTFIX by mozilla, because "they should be removed by the Installer that put the files there".

    IMO it has to be possible to remove them from the Add-On manager.

    • by ADRA (37398)

      Why cry about a plugin. If you really hate the add-on enough then just disable it. Hate it so much that you can't live with it? Uninstall java and choose to never use it again.

  • If you did: "sysbar bubble based Java update" ... I assume you updated Java. In that caser it is completely correct that you get the relevant plug ins for every browser on your system installad as well. That is what Java always did so far on any system I had (Windows, Linux, Mac).
    If you did a Firefox update then it is not Suns fault, but the fault of the guys who bundled the update that you where not asked beforehand.
    I think the attitude towards Software Providers may it be MS or Sun, or any other, should b

  • So, they get the majority of the users out there with working Java in their web browser, which they would expect if they have Java installed, and in the process they piss off a few geeks who can't see beyond their own little basement walls.

    Pardon me if I find this whole thing a little amusing. If you want Firefox to take over the world it has to be user friendly. As any Vista user will tell you, prompting you to do every little thing is fucking annoying, so they've taken a more traditional approach and ju

  • It seems Java modifies all browsers without you asking to allow them to run applets. That's not what I installed Java for!
  • by argent (18001) <peterNO@SPAMslashdot.2006.taronga.com> on Saturday February 21, 2009 @05:53PM (#26944003) Homepage Journal

    There's lots of software that installs browser addons automatically, without even asking you. That's been normal and expected behavior for a decade, it's long since past time to raise Caine over this one.

    I think Sun should be accoladed for giving you the option to opt out.

    Ever try to install Acrobat without getting the browser plugin? You have to rummage around in the Acrobat directory and remove the plugin component or else EVERY TIME you run Acrobat the plugin will be reinstalled.

  • by Vexorian (959249)

    Yes, I could opt out of it, but why are Sun installing Addons to my Firefox without me making specific choices in the application itself?

    Because you could opt-out of it.

  • so I don't think your judgement about what add-ons are appropriate should be considered.

    22:33 UTC - Flamed on Slashdot for having TwitterBar. Why does kno1 nderstnd me?
  • yes, this is terrible. A FF addon installed without saying/prompting.

    Next thing you know they'll be adding crap to HKLM/Software/Windows/CurrentVersion/Run without asking ?

    Oh wait ...

  • by Kaboom13 (235759) <kaboom108@nOSPAM.bellsouth.net> on Saturday February 21, 2009 @06:51PM (#26944383)

    How many IE installs have you seen with a dozen ugly search bar below the title bar? It seems like every app installs one, if you are lucky they hide a little checkbox and disclaimer in the installer to avoid it. it's one of peoples big annoyances with IE, even if at it's core it's not IE's fault. I installed Foxit Reader on my laptop the other day, and did not read all the options. To my surprise I had some ridiculous Ask.com toolbar in my firefox install.

    Currently if you try to install an extension, Firefox pops a warning up. It needs to do the same if another app installs one. All extensions need to be uninstallable, they need to remove all options otherwise. Ideally, it would be able to verify the integrity of all browser files from a secure source and delete anything that did not follow the "rules" (I.e. can be uninstalled at any time).

    All extensions not installed by direct user action (ie going to the firefox addons menu and choosing to install it) should start disabled and have to be manually enabled before they can work.

    Firefox is gaining ground in the browser wars, and that means it is going to be targeted. Already malicious sites that attempt to exploit flaws in Firefox exist and are growing in number. I expect it's just a matter of time before spyware extensions start showing up, claiming to do something useful while reporting your browsing habits.

    Mozilla foundation needs to keep in mind it is YOUR computer, and YOUR browser, and it should only do the things you want it to, regardless of what other companies want.

    Ive been using Firefox since it was called Firebird, and despite the many improvements, it will be a victim of it's own success if it is not careful.

    • Re: (Score:3, Insightful)

      by BitZtream (692029)

      Currently if you try to install an extension, Firefox pops a warning up. It needs to do the same if another app installs one.

      Already done, had you even read the summary you'd know thats how this started, the handitard that posted the original noticed it when Firefox warned him that a new one had been installed.

      All extensions need to be uninstallable, they need to remove all options otherwise.

      No, they don't. There are provisions that allow network admins to install plugins. Regardless of what you think,

  • Screenshot (Score:3, Insightful)

    by BitZtream (692029) on Sunday February 22, 2009 @02:22AM (#26946757)

    This whole posting is dumb but...

    I really fail to see how anyone with 'TwitterBar' extension installed can bitch about the Java quickstart extension.

    I guess if I would have looked at the screenshot sooner I would have realized the guy is just a douche bag and skipped this one :/

  • Firefox plugin... (Score:3, Insightful)

    by Bert64 (520050) <bertNO@SPAMslashdot.firenzee.com> on Sunday February 22, 2009 @05:17AM (#26947293) Homepage

    The install of Java already includes a java browser plugin, they are only extending it's functionality with a firefox addon rather than doing something completely new and unexpected.

Arithmetic is being able to count up to twenty without taking off your shoes. -- Mickey Mouse

Working...