When I look under plugins in the Firefox add-on manager I notice many plugins there that I never use.
Among them illustrious plugins like Google Update, iTunes Application detector, Microsoft Office 2010, Windows Activation Technology or Windows Live Photo Gallery.
To be honest, I sometimes do not even know what purpose they have. Google Update for instance, why is that listed as a plugin in the Firefox web browser?
I have disabled all those plugins and noticed a few months ago that Firefox sometimes re-enables those plugins automatically. When does it happen? I verified that plugins are automatically enabled whenever I switch Firefox versions. My main Firefox installation runs the latest Aurora build, but I have a stable version of Firefox installed on the same computer.
Yesterday I had to switch versions to check out Twitter’s implementation of Content Security Policy which has been only enabled for Firefox 4 versions and not the Aurora builds which are already listed as Firefox 5.
Today when I checked my plugins in Firefox 5 I noticed that they all had been re-enabled. To verify that the version switch was indeed the culprit I disabled all plugins again, closed Firefox 5, loaded and exited Firefox 4, and opened Firefox 5 again. The result? All previously disabled plugins were enabled again.
There may be additional circumstances where plugins are re-enabled automatically. Browser updates are one possibility. Please note that I have not verified this.
The core problem now is that there is no option available to users to block plugins from being installed in the browser. Well, that’s not entirely true but the controls are insufficient at best. See, you can disable plugin scanning, but this will remove already installed – and probably in use – plugins from the browser as well. So that is not really an option.
You can block some plugins either in the Windows Registry, if you use Windows, in the Firefox about:config configuration settings or by deleting plugins locally. All three methods have disadvantages.
Only some plugins can be blocked in the Registry by deleting their keys. While that’s nice and all, it is insufficient to resolve the issue with other plugins that still get re-enabled automatically. It is also likely that updates or new installations of programs that have added the plugins to the Registry in first place will re-add them there.
The Firefox about:config dialog holds options to block all plugin scans, or scans for Acrobat, QuickTime, SunJRE, and WindowsMediaPlayer. The latter can be blocked by changing the minimum version number requirement to a version that is not yet available, for instance 99. Look for plugin. scan.(Plugin-name) to find those plugins after entering about:config in the Firefox address bar. The description on the Mozilla help page seems to suggest that it is possible to add custom plugin names as a parameter, but that’s not explained anywhere on site.
Setting plugin.scan.plid.all to false blocks most plugin scans during startup of the browser.
Deleting plugins locally finally is an option, but those plugins are likely added again if the software that they are linked to is updated or re-installed. You can look-up the path of every active Firefox plugin by setting the parameter plugin.expose_full_path to true. The paths are then shown if you enter about:plugins in the Firefox address bar.
Your best bet currently is a mixture of all methods described above. But even if you manage to remove all plugins that you do not need, there is no guarantee that they won’t reappear later again.
Mozilla recently announced that they would make changes to the automatic integration of plugins in Firefox. This step is long overdue.