Closed Bug 797139 Opened 8 years ago Closed 8 years ago

blocklist Babylon Toolbar

Categories

(Toolkit :: Blocklist Policy Requests, defect)

x86
Windows 2000
defect
Not set
normal

Tracking

()

VERIFIED DUPLICATE of bug 788353

People

(Reporter: pjdkrunkt, Unassigned)

Details

User Agent: Mozilla/5.0 (Windows NT 5.0; rv:10.0.7) Gecko/20100101 Firefox/10.0.7
Build ID: 20120824135927

Steps to reproduce:

Search and urlbar hijackers like Babylon Toolbar have begun modifying the user.js file so that the usual "simple" methods of removal are no longer enough:

1. Uninstall Babylon Toolbar, Object Installer, Bprotector, and Browser Manager at the OS level.
2. Remove from Firefox Addons.
3. Remove from Firefox search engines.
4. Remove all "Babylon" entries from about:config.

This now includes:
5. Go into profile and remove "Babylon" entries from user.js.





Expected results:

User.js file should either not be accessible by extensions or created as a read-only file.  In addition, Babylon Toolbar should be blacklisted.
I'm going to morph this into just the blocklist request. The bug with the as-filed title "User.js should not be accessible by extensions" is not practical. Extensions are programs you install; they can do anything and access any file. If one is malware and on your system there's nothing that can be done to prevent them from doing anything. Screwing around with user.js is the least of your problems.

What exactly is it adding to user.js?
Component: Untriaged → Blocklisting
Product: Firefox → addons.mozilla.org
Summary: User.js should not be accessible by extensions. → blocklist Babylon Toolbar
I haven't personally been misfortunate enough to have this, but apparently they have begun to set keyword.URL and browser.newtab.url in the user.js so that even after complete removal of their program these preferences will continue to be reset every time the browser is restarted.  This used to be a pretty rare occurrence, but now that a "popular" toolbar has begun to do I wouldn't be surprised to see many many new copy-cats.  

Average and even many "advanced" users are highly unlikely to know what the user.js file is, including many who are aware of about:config.  

But to me this all comes back around to the problem of what to do about 3rd-party extensions installations.  Obviously this is needed for enterprise deployments, but for at-home users I can see no reason to allow other programs to install extensions into Firefox.
This is likely a duplicate if we want to just focus on Babylon. Please undupe and re-summarize if you decide a more broad-reaching approach is needed in terms of all add-ons.
Status: UNCONFIRMED → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 721264
Ooops, wrong bug. I shouldn't triage when I'm tired.
Duplicate of bug: 788353
Status: RESOLVED → VERIFIED
Product: addons.mozilla.org → Toolkit
You need to log in before you can comment on or make changes to this bug.