Why does installing moonlight require access to all data on my computer? How concerned should I be?

Question

When attempting to install Moonlight

This is very concerning. This seems like something that our IT group would want to ban.

I don't understand why anyone would agree to this. How concerned should I be? Is the same true for silverlight?

Answer 1

Silverlight does not touch your files by itself, but it allows trusted (digitally signed and approved) applications to access the file system. The confirmation is shown because it is not possible for Chrome to know when and why the filesystem access will be needed, so it needs you to approve this at installation time.

Another possible reason is caching of Silverlight applications (could be similar to Java's applet cache).

Answer 2

The problem with Chrome extensions is that the permission messages often tend to scare people because of what they do. By themselves, Chrome extensions are quite limited, and if a Chrome extension has to check and run on each page(for instance, a Moonlight plugin) it has to inject itself into everypage via a content script.

Unless the extension developer defines that the extension requires access to inject itself on all pages( via the manifest) - it will not be injected. It also doesn't help that "it has access to all data and websites" in reality means "it can attach itself to all pages so as to run it, without which the plugin cannot run".

As for access to filedata - @grawity explains it well. This is not limited to just Moonlight, it is applicable to all extensions which require data processing per page. ( Try installing Adblock Plus/AutoPager for instance).

Answer 3

It looks like Moonlight needs root to be installed. At least you / your IT group can audit the source code.

That's a very bad dialog for UX.

Answer 4

This is a old post but I was just trying to install Moonlight and I had the same message. One of the first things humans do is ignore their gut and ignore the warning signs and feel that things are just trying to scare them. That message told you what the program WILL DO if you install it. I decided to not install the program.

I'm happy it showed me the message that it would do that because most of the time you won't get that and it will just install whatever you agreed to. If you want that application to see what you're doing then install it. Putting up ad blocker isn't the problem or the solution. It's not a ad issue it's a warning, an alarming one.