527135 - Blocklist AVG Safe Search extension, version "8.5" and below.

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Justin Dolske [:Dolske]]

Bug 519340 contains an investigation into a topcrash seen with Firefox 3.5. Older versions of the "AVG Safe Search" extension were found to be the cause. We want to blocklist the older versions because it causes Firefox instability.

AVG issues periodic updates to their product automatically, but up until now the Firefox extension's version has remained fixed at "8.5". At the beginning of this week, AVG began pushing an update which included a bump of the extension version number to "8.5.0.423". Future minor updates will also be bumping the version number. So, now have the option to blocklist version "8.5" without impacting users who have upgraded to "8.5.0.*" (which is not causing stability issues).

Bug 457970 contains an older topcrash issue involving AVG 8.0, which should also be resolved by this blocklist addition.

Users who encounter this blocklist are advised to upgrade their AVG installation to the current version, which will re-enable the Safe Search extension.

Note that this blocklist addition will ONLY disable the "AVG Safe Search" extension. The rest of the AVG product is unaffected, and virus scanning on the system will remain unchanged. Firefox's built-in malware / anti-phishing protection provides a similar capability to Safe Search, so users unable to upgrade AVG (for whatever reason) have the option to make sure these Firefox features are active to remain secure.

Comment 1

[Justin Dolske [:Dolske]]

Also, I should note that we've discussed this plan and timing with AVG, such as to minimize the impact on users.

Comment 2

[Justin Dolske [:Dolske]]

Update: the newly-released version is actually "8.5.0.423", and was released yesterday. So, we should want some more for sufficient update before blocklisting.

Comment 3

[Justin Dolske [:Dolske]]

"8.5.0.424", rather. .423 was the info we had from earlier in the week.

Comment 4

[Justin Dolske [:Dolske]]

And we should *wait* some more. I clearly can't type today. :(

Comment 5

[Justin Dolske [:Dolske]]

Ok, AVG update has had time to roll out to users, so let's proceed with blocklisting.

I think morgamic handles the actual addition to the blocklist, so over to him.

Comment 6

[Michael Morgan [:morgamic]]

For add-ons we need the guid.  Justin is pulling that.

Comment 7

[Michael Morgan [:morgamic]]

We want to blocklist versions equal to or less than 8.5.0.424 ?

Comment 8

[Michael Morgan [:morgamic]]

GUID: {3f963a5b-e555-4543-90e2-c3908898db71}

Comment 9

[Michael Morgan [:morgamic]]

Need to blocklist 8.5 and less.

Comment 10

[Justin Dolske [:Dolske]]

Yeah, just the plain "8.5" and below, the newer update has a more detailed version number (eg "8.5.0.424") and is ok.

Also, I verified that my old AVG installer gave me the addon with that GUID, version "8.5"... Updating AVG refreshed the addon; same GUID, now version "8.5.0.424".

Comment 11

[Michael Morgan [:morgamic]]

Attachment: v1, adding 8.5

Resulting blocklist after changing 8.0 -> 8.5.

Comment 12

[Justin Dolske [:Dolske]]

Comment on attachment 414122 [details]
v1, adding 8.5

Looks good, I verified that it does not block an up-to-date AVG Safe Search extension, and that the old one is blocked. [Also had the AVG Security Toolbar installed, which didn't seem to have any obvious problems with the other addon being disabled.]

One small change: so that we can close out bug 457970, please drop the targetApplication minVersion to 3.0. There are still a few of those crashes affecting FF3.0 users.

Comment 13

[Michael Morgan [:morgamic]]

This is going out today. Will resolve when pushed.

Comment 14

[Michael Morgan [:morgamic]]

This is updated in prod:
https://addons.mozilla.org/blocklist/1/%7Bec8030f7-c20a-464f-9b0e-13a3a9e97384%7D/3.5.5/

Comment 15

[Justin Dolske [:Dolske]]

Does https://www.mozilla.com/en-US/blocklist/ need updated? It still only mentions AVG 8.0.

Comment 16

[Michael Morgan [:morgamic]]

Yeah, edited that already on trunk.  Should be out shortly on prod.

Comment 17

[Justin Dolske [:Dolske]]

Please don't mess with the bug flags.