Gnome weather extension as malware?

[Robert Moskowitz]

Is anyone running the Gnome weather extension?  I have disabled it and 
my system is running better. Or rather FIrefox is working 'right' again.

This extension gets its weather information from the Norway weather 
service, and you can't change this.  I had noticed that many places I 
was going to in Firefox took a long time to reply.  It was as if Firefox 
was hanging, and other Firefox windows were not responding either.

I finally fired up wireshark and I was seeing that requests for things 
like apis.google.com (or some such) was being routed through a .no site 
(by reverse lookup on IP address).  Perhaps this extension was altering 
Firefox's proxy settings.

I don't have the time or resources to do a serious review, but I am 
pointing this out and perhaps others may have noticed this as well. Or 
are suffering and not knowing it.  This may be accidental or really 
actually malicious; just don't know.

[Fernando Cassia]

On Fri, May 2, 2014 at 12:26 AM, Tim <ignored_mailbox(a)yahoo.com.au&gt; wrote:

>  Unless you're actually in the airport control tower, or flying a
> plane,
>  I doubt you need to keep updating a weather report that often.
>  
LOL your comment made my day. Well said. :)

Although by reading some other mailing lists, I could quickly conclude that
some people are not flying planes but are still
high above the ground...
;-)

FC
-- 
During times of Universal Deceit, telling the truth becomes a revolutionary
act
Durante épocas de Engaño Universal, decir la verdad se convierte en un Acto
Revolucionario
- George Orwell

[Tim]

Tim:
> > While that sounds reasonable, the 15 second refresh period does
> not.
> > Does it really do that?  Is it really necessary to do so?  
Steven Stern:
>  I've left the capture running for a while and it seems that the
> timing
>  varies.  It's been a while since it last checked.  It seems that the
>  checks are once per 30 seconds.  So, that's one http call per 30
>  seconds. I can live with that. 
I was thinking of the other side of the equation:  Thousands of Linux
users all blasting some server every few seconds for the next few years.

Unless you're actually in the airport control tower, or flying a plane,
I doubt you need to keep updating a weather report that often.

-- 
tim@localhost ~]$ uname -rsvp

Linux 3.13.10-200.fc20.i686 #1 SMP Mon Apr 14 21:00:56 UTC 2014 i686

All mail to my mailbox is automatically deleted, there is no point trying
to privately email me, I will only read messages posted to the public lists.

George Orwell's '1984' was supposed to be a warning against tyranny, not
a set of instructions for supposedly democratic governments.

[SternData]

On 05/01/2014 07:47 PM, Tim wrote:
>  Robert Moskowitz:
> >> This extension gets its weather information from the Norway weather service,
> >> and you can't change this.
>  
>  Suvayu Ali:
> > This is standard practise among many FOSS weather monitoring tools.  A
> > year or so back most popular weather feeds either stopped, went
> > proprietary, or kept changing their feed structure too often.  At this
> > point many FOSS weather tools moved to the service provided by Norwegian
> > Weather Institute.  It is never going to go proprietary, and will most
> > likely stay alive for the foreseeable future.  It is also rather
> > reliable.
>  
>  While that sounds reasonable, the 15 second refresh period does not.
>  Does it really do that?  Is it really necessary to do so?
>   
I've left the capture running for a while and it seems that the timing
varies.  It's been a while since it last checked.  It seems that the
checks are once per 30 seconds.  So, that's one http call per 30
seconds. I can live with that.

The wireshark filter I'm using is

http and ip.dst_host == 157.249.32.164

I have two locations enabled.



-- 
-- Steve

[Tim]

Robert Moskowitz:
> > This extension gets its weather information from the Norway
> weather service,
> > and you can't change this. 
Suvayu Ali:
>  This is standard practise among many FOSS weather monitoring tools. 
> A
>  year or so back most popular weather feeds either stopped, went
>  proprietary, or kept changing their feed structure too often.  At this
>  point many FOSS weather tools moved to the service provided by Norwegian
>  Weather Institute.  It is never going to go proprietary, and will most
>  likely stay alive for the foreseeable future.  It is also rather
>  reliable. 
While that sounds reasonable, the 15 second refresh period does not.
Does it really do that?  Is it really necessary to do so?

-- 
tim@localhost ~]$ uname -rsvp

Linux 3.13.10-200.fc20.i686 #1 SMP Mon Apr 14 21:00:56 UTC 2014 i686

All mail to my mailbox is automatically deleted, there is no point trying
to privately email me, I will only read messages posted to the public lists.

George Orwell's '1984' was supposed to be a warning against tyranny, not
a set of instructions for supposedly democratic governments.

[Suvayu Ali]

Hi,

Disclaimer: I do not use this extension, but I do use the XFCE counterpart.

On Wed, Apr 30, 2014 at 10:29:24AM -0400, Robert Moskowitz wrote:
>  
>  This extension gets its weather information from the Norway weather service,
>  and you can't change this. 
This is standard practise among many FOSS weather monitoring tools.  A
year or so back most popular weather feeds either stopped, went
proprietary, or kept changing their feed structure too often.  At this
point many FOSS weather tools moved to the service provided by Norwegian
Weather Institute.  It is never going to go proprietary, and will most
likely stay alive for the foreseeable future.  It is also rather
reliable.

I hope that explains why it cannot be changed, no options out there.

Cheers,

-- 
Suvayu

Open source is the future. It sets us free.

[Robert Moskowitz]

On 04/30/2014 10:44 AM, Steven Stern wrote:
>  On 04/30/2014 09:29 AM, Robert Moskowitz wrote:
> > Is anyone running the Gnome weather extension?  I have disabled it and
> > my system is running better. Or rather FIrefox is working 'right' again.
> >
> > This extension gets its weather information from the Norway weather
> > service, and you can't change this.  I had noticed that many places I
> > was going to in Firefox took a long time to reply.  It was as if Firefox
> > was hanging, and other Firefox windows were not responding either.
> >
> > I finally fired up wireshark and I was seeing that requests for things
> > like apis.google.com (or some such) was being routed through a .no site
> > (by reverse lookup on IP address).  Perhaps this extension was altering
> > Firefox's proxy settings.
> >
> > I don't have the time or resources to do a serious review, but I am
> > pointing this out and perhaps others may have noticed this as well. Or
> > are suffering and not knowing it.  This may be accidental or really
> > actually malicious; just don't know.
> >
> >
>  I just fired up Wireshark and set it to monitor all HTTP traffic from my
>  machine to any address. I'm not seeing anything untoward with respect to
>  the Weather extension, although I wonder if it's necessary for it to
>  check in every 15 seconds. 
Maybe that was all I was seeing.

>     FWIW, I'm not using any extensions from the
>  repo; I've installed them all directly from the Gnome extensions site. 
I also installed from the Gnomes extensions site.
>  There are no slowdowns with either Chrome or Firefox.
>  
I will keep monitoring the situation and see if any slowdowns develop.  
Then maybe turn the extension back on (maybe check if there have been 
any updates?).

[SternData]

On 04/30/2014 09:29 AM, Robert Moskowitz wrote:
>  Is anyone running the Gnome weather extension?  I have disabled it
> and
>  my system is running better. Or rather FIrefox is working 'right' again.
>  
>  This extension gets its weather information from the Norway weather
>  service, and you can't change this.  I had noticed that many places I
>  was going to in Firefox took a long time to reply.  It was as if Firefox
>  was hanging, and other Firefox windows were not responding either.
>  
>  I finally fired up wireshark and I was seeing that requests for things
>  like apis.google.com (or some such) was being routed through a .no site
>  (by reverse lookup on IP address).  Perhaps this extension was altering
>  Firefox's proxy settings.
>  
>  I don't have the time or resources to do a serious review, but I am
>  pointing this out and perhaps others may have noticed this as well. Or
>  are suffering and not knowing it.  This may be accidental or really
>  actually malicious; just don't know.
>  
>   
I just fired up Wireshark and set it to monitor all HTTP traffic from my
machine to any address. I'm not seeing anything untoward with respect to
the Weather extension, although I wonder if it's necessary for it to
check in every 15 seconds.  FWIW, I'm not using any extensions from the
repo; I've installed them all directly from the Gnome extensions site.

There are no slowdowns with either Chrome or Firefox.

-- 
-- Steve