846451 - Blocklist RealDownloader add-on

Status: RESOLVED WONTFIX

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Kris Maglione [:kmag]]

+++ This bug was initially created as a clone of Bug #845581 +++

Silently installed by the RealPlayer installer when run from the Fun4IM installer. Not entirely sure what it does.

RealDownloader: {34712C68-7391-4c47-94F3-8F88D49AD632}

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Sent an email to the developers. Let's wait and see what they say.

Comment 2

[Dave Herrera]

Hi Kris and Jorge,

This is Dave Herrera, the QA Manager for RealPlayer. The RealDownloader is a component of RealPlayer and users would have to go through an install flow where our EULA is accepted and they know what is being installed. If there is a situation where RealPlayer is being installed without a user's knowledge, then I'd like to know about it. I've noticed that Fun4IM is not longer available for download in the top sites where it seems to have previously been distributed.

Kris, can you explain to me the install flow you saw, or provide a direct link to the Fun4IM installer? I'll investigate immediately and if there is a partner distributing improperly we'll take immediate action.

Thanks,

Dave Herrera
Sr. QA Manager, RealPlayer Engineering.

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Thank you for your reply Dave.

Please note that we require all externally-installed add-ons to use our opt-in screen, as shown in this post: https://blog.mozilla.org/addons/2011/08/11/strengthening-user-control-of-add-ons/. This is a requirement even if the installer has an opt-in or opt-out of its own.

Comment 4

[Dave Herrera]

Attachment: Install_Add-on_Screen_RealDownloader

Comment 5

[Dave Herrera]

Jorge: Please see the attachment. That was with an install of RealPlayer 16, and the proper notifications were given in Firefox.

You'll also notice that the GUID {34712C68-7391-4c47-94F3-8F88D49AD632} is identical to Kris' GUID.

Is there a scenario you've found where we don't show this screen on Firefox launch?

Comment 6

[Kris Maglione [:kmag]]

Dave,

See the description in bug 845581. When installed via the Fun4IM installer, the add-on is installed without the about:newaddon opt-in. If that's not your intent, you need to make it clear to your distribution partners that distributing your add-on in bundles that cause this behavior is not acceptable.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

Dave, do you have any updates about this?

Comment 8

[Jorge Villalobos [:jorgev] (he/him)]

Does Fun4IM still bundle the RealDownloader add-on? I have other contacts at Real that can look into this if this is still a problem.

Comment 9

[Kris Maglione [:kmag]]

(In reply to Jorge Villalobos [:jorgev] from comment #8)
> Does Fun4IM still bundle the RealDownloader add-on?

Yes.

Comment 10

[Jorge Villalobos [:jorgev] (he/him)]

Our realnetworks contact has repeatedly stated that all of their affiliate installers are following our rules. Kris, do you have exact steps to reproduce the silent install?

Comment 11

[Kris Maglione [:kmag]]

They seem to have migrated their RealDownloader users to an add-on with a new ID: {FCE04E1F-9378-4f39-96F6-5689A9159E45}

Comment 12

[Jorge Villalobos [:jorgev] (he/him)]

The question from comment #10 is still pending, though. Are there any silent installs happening?

Comment 13

[Kris Maglione [:kmag]]

Sorry. As I said in the email thread relating to this bug, the installer that I used the first time was apparently an ad disguised as the download button for the Fun4IM listing, and provides a different installer now, so I can't duplicate it.

Comment 14

[Jorge Villalobos [:jorgev] (he/him)]

OK, I'm closing this for now. If any more silent installs are detected, please open a new bug. I think in future cases we should also record the download URL and attach the installer so we have more reproducible information to work with.

Comment 15

[Kris Maglione [:kmag]]

This is bundled with the installer from vdownloader.com. When installed from there, about:newaddon is not triggered and the extension is enabled by default.

Comment 16

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to Jorge Villalobos [:jorgev] from comment #14)
> OK, I'm closing this for now. If any more silent installs are detected,
> please open a new bug. I think in future cases we should also record the
> download URL and attach the installer so we have more reproducible
> information to work with.

Please open a new bug and attach the installer.