Some applications, when installed, like to connect to the internet to display a “Thank you for installing” page, for example. This is sometimes undesirable because there may not be an active browser at the moment, and there may be reasons that we don’t want it started right then and there.
On several occasions I’ve had a just-installed program open a web page, and a moment later I receive an alert from CFW, asking me if it’s OK for this app to connect to the internet.
Why is the alert appearing after a connection was already made and page displayed? ???
I think the alert is not for the opening of the webpage. If you use the firewall at safe mode, you will not receive firewall alerts for safe applications which are running outside the sandbox. Since the browser is opening the webpage and the browser is trusted and outside the sandbox, there is no alert. It’s probably a part of the installed application trying to connect.
Since this would be the first time I run this install, which is a relatively new file in the entire universe, presumably it would not be a “safe application”, correct?
Hmmm, yes, of course. I should have thought of this myself. So I imagine the following sequence of events:
App wants to display “thank you,etc”, so it attempts to connect, just in case I am not connected.
App does not wait for confirmation that connection has been established.
App invokes browser in order to display the “Thank you” HTML page. Meanwhile, connection request is still being processed.
Connection request finally trapped by FW, which issues an alert.
Please feel free to revise if the above is not logical or not likely to be correct.
You are making me see things that I’d missed before:)
The program I was installing is SUMO (Software Update bla bla). I just noticed that it is not the install program itself that is responsible for the Alert, but rather it’s a file created by this installer in the Windows TEMP folder. I would guess that this .tmp file is essentially a copy of the installed program, which, I imagine, would be invoked if I were to answer YES to the question Launch Sumo now after the installation is complete. So it looks like the connection attempt is made in anticipation of a YES (I normally reply NO to such events).