Comment Understanding ClickOnce (Score 1) 803
It's interesting how articles crop up in the media and the public goes into an uproar. It's possible that some may not fully understand the issue. My personal feeling is that Microsoft shouldn't jack with software that doesn't belong to them. It's my computer, it runs the way I want it to, don't install !@#! I don't want. But I also understand what ClickOnce is and I understand that it's the user-installed application that sends .NET version information back to the web server the application is installed from, not the browser and not the browser extension. So, the fact that it's there doesn't concern me so much, except for the resources that I know it's taking up.
About ClickOnce:
In ~ August, 2008, Microsoft released Visual Studio 2008 Service Pack One. Visual Studio 2005/2008 allows content creators to produce web applications based on a number of programming languages. These applications can be run as stand-alone or driven through web sites, either way, linked back to database servers, behaving similarly to Flash-based applications driven through Adobe Air. One of the technologies deployed with Visual Studio is ClickOnce, a system which allows the installed application to check for updates upon launch and prompt for new versions. The idea is that once the application is installed, it keeps itself up to date and the user doesn't have to continually mess with software revisions. Microsoft .NET 3.5 SP1 and VS 2008 SP1 releases silently install an extension for Mozilla Firefox, called .NET Framework Assistant, which "Adds ClickOnce support and the ability to report installed .NET versions to the web server."
The Problem:
Users are stating they were not told that the Firefox extension was being installed and are only finding out of its existence after-the-fact. To further complicate the issue, once installed, the extension appears with the uninstall button disabled. Users, who don't understand what ClickOnce is and don't understand what is meant by "the web server", are very upset about what this means and what information could be potentially outbound from their PC. Numerous forums list post after post from users who are extremely vocal about Microsoft's audacity of installing plug-ins to non-Microsoft applications and further providing no method for it's removal. While the tactics are dirty, Microsoft is not the first to do this. Sony used music CDs to install a virtually invisible "rootkit", DRM software to PCs to keep tabs on music placed on a host PC. Apple installs a host of applications as part of iTunes, which includes several resource consuming TSRs and Microsoft Outlook components, even if a user doesn't own an iPod.
The Technology:
ClickOnce in and of itself, is not a bad thing. Mini applications built on Visual Basic, VB.NET, C# and others, can be written with Visual Studio 200( x ) and delivered to a host PC through a web-installer. These applications require the Microsoft .NET framework to be installed and if set up correctly, when an update to the software is available, the user is automatically notified and the update applied, eliminating the burden of needing to check for updates. The extension for Firefox allows the user to visit a web page and see information about one of these applications, click on a link and be prompted for it's installation. This is not necessarily a bad thing. The extension simply allows the user access to the installer, it doesn't collect data and send it back to Microsoft or anywhere else. The installed application, upon launch, sends the currently installed version number back to the programmers web server and checks if a newer version is available. If a newer version is available, it notifies the user asks to be installed. The real problem is that Microsoft installed the extension without being asked and after being installed, disabled the uninstall button.