912741 - Blocklist AVG Toolbar and AVG Safe Search

Status: RESOLVED WORKSFORME

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Kris Maglione [:kmag]]

The TopArcadeHits installer from download.com tried to install this. It did not bypass about:newaddon, but it did change the homepage beforehand, and without consent.

ID: avg@toolbar

Comment 1

[Kris Maglione [:kmag]]

Accepting the installation and then disabling the extension also does not revert the homepage.

Comment 2

[Kris Maglione [:kmag]]

I just installed KMplayer from download.com. Same deal.

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

I've contacted AVG through my known contacts.

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

From bug 1094654 there's a report that the installer changes the homepage without the add-on being installed (the opt-in works correctly). I also received a separate report that the installer also installs an application that prevents settings from being reverted. Both are guideline violations.

Comment 6

[Marco Castelluccio [:marco]]

This happens every time you update AVG. Why aren't we blocklisting this addon?

Comment 7

[Marco Castelluccio [:marco]]

There's also bug 774436 that is related to this and is very old. If they're ignoring our guidelines, we should block them.

Comment 8

[Marco Castelluccio [:marco]]

Why aren't these extensions being blocklisted?

Comment 9

[Jorge Villalobos [:jorgev] (he/him)]

With signing we have better control over what the add-ons do, though their installers might still do some things wrong. It's also easier for us to get in touch with them now. If you can confirm that this is still reproducible, I can try to get in touch with them about it.

Blocking them isn't something we take lightly because those add-ons had huge usage numbers and many users will misinterpret what we're doing by blocking them.

Comment 10

[Marco Castelluccio [:marco]]

(In reply to Jorge Villalobos [:jorgev] from comment #9)
> With signing we have better control over what the add-ons do, though their
> installers might still do some things wrong. It's also easier for us to get
> in touch with them now. If you can confirm that this is still reproducible,
> I can try to get in touch with them about it.
> 
> Blocking them isn't something we take lightly because those add-ons had huge
> usage numbers and many users will misinterpret what we're doing by blocking
> them.

I understand. At the same time I believe we should protect users from misbehaving
add-ons.
Isn't the blocklist a way to force add-on developers to follow our guidelines?

This add-on in particular is changing the homepage without asking the user,
even if it's never enabled (see bug 1094654). The "funny" thing is that they're
doing this in Firefox but not in IE or Chrome...

If I understand correctly, you already contacted AVG multiple times (bug 774436).
They haven't fixed their add-on anyway, maybe they would if we blocklisted it?

Anyway, I'm not sure when I'll be able to try reproducing it, so it'd be better
if someone else tried.

Comment 11

[Tracy Walker [:tracy]]

Assignee: :tracy
Link to add-on: part of a security suite : http://free.avg.com/us-en/download-free-all-product
Contact info for add-on: jorge has contact info
Bug #: this bug and bug 774436
Add-on ID: avg@toolbar
How well does it work?: complaints are about home page highjacking
Any obvious performance problems? no
SDK-based: yes
Chromium version: yes

Comment 12

[Marco Castelluccio [:marco]]

I saw this again at a friend's house. This time no add-on was installed in Firefox, but the homepage was changed, I'm not sure how they did it.

Again, they are only changing the homepage in Firefox, not in IE or Chrome.

Comment 13

[Jorge Villalobos [:jorgev] (he/him)]

Please open a new bug if this continues to happen.