Temptations of an open-source browser extension developer #670
Replies: 31 comments 39 replies
-
|
My favourite: ...we provide several methods of monetizating- from the soft to the hard methods. 😰 |
Beta Was this translation helpful? Give feedback.
-
|
Is there a reason you redacted the companies? I think naming and shaming companies that are willing to do this kind of thing would be a public service. |
Beta Was this translation helpful? Give feedback.
-
|
In an ideal world - yes, I would agree with you. But some of these companies might be rich and operating legally. I don't want to piss them off badly enough to sue me. This is not a kind of risk I'm willing to take for a browser extension. |
Beta Was this translation helpful? Give feedback.
-
|
There are huge players in the aff iliate space that quite frankly, better to have know and have as an ally, than be against. For an indy developer with 1 project/extension and a great salary from your main or other gig it's ok to isolate; however, you never know when the landscape, the ecosystem...everything might change. And to me, AI+crypto+politicalilzation and weaponsization of ideas, faiths, nationalism feels like one of those times is at least more possible. |
Beta Was this translation helpful? Give feedback.
-
|
I think these shady practices need much more awareness among users and extension devs. Perhaps this could be spun-off into a separate project? |
Beta Was this translation helpful? Give feedback.
-
|
This is something I've been thinking about more lately as someone who's been in every part of the Google Asds Monop...I mean ecosystem since around 2003: working at Google, at DoubleClick, at Adobe's Google agency/ad partner Efficient Frontier acquired by Adobe to be Adobe Marketing Cloud -> Ad Cloud -> Experience Cloud, at perhaps the largest mainstream and sex dating affiliate program... as well as various side gigs, investments, advisory roles. Each another perspective into Google's "Don't Be Evil" maxim. |
Beta Was this translation helpful? Give feedback.
-
|
I'm ignorant to exactly how they make money, can someone explain this? If they control the extension and inject their code they can monitor what websites the users visit? What other information are they trying to collect? Can they get passwords and personal information? |
Beta Was this translation helpful? Give feedback.
-
|
Popup ads are easy to notice and disable the extension causing them. Stealthy approaches can last a long time. |
Beta Was this translation helpful? Give feedback.
-
|
The order of things from more to less legal is probably reflected in the pricing scheme. |
Beta Was this translation helpful? Give feedback.
-
|
Many of these sell user data for AdTech/RTB purposes through various layers of personal data laundering. It's a way to get a slice of the advertising revenues of the oligopolists. See https://privacyinternational.org/learn/adtech . |
Beta Was this translation helpful? Give feedback.
-
|
More to less legal by geo-locational laws, customs and regulatory schemes as well. Gambling, porn, sex dating, outright steeling money under the guise of 'entertainment' are tolerated in various degrees. Chargebacks are a huge problem and VISA, MC and the mainstream credit card billing don't want to participate in places where they may run afoul with the regulators that matter in their largest markets |
Beta Was this translation helpful? Give feedback.
-
|
One of these folks wants to collect domain names that users tried to visit but don't exist. My immediate assumption is that they want to buy domains for common typos or expired domains, with the intent to hijacking those users' navigation. Another guy wants the extension to be transferred to their account. This can be monetised by snooping on user credentials, but also by selling botnets. See this article from today which shows a real-life example of an app getting purchased by a company only to include a botnet-sdk in it: https://robins.one/notes/uninstall-the-nightowl-app-now.html |
Beta Was this translation helpful? Give feedback.
-
|
props for anonymizing this and having the guts to post this public & live. |
Beta Was this translation helpful? Give feedback.
-
|
Someone had to. The situation around malicious extensions is bad enough already. More people need to be aware. |
Beta Was this translation helpful? Give feedback.
-
|
Based, not selling out your users. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
To rephrase the quote, I think these emails expose weak points in an extension's security where strong enough financial pressures (for example, the developer going broke) are able to puncture. |
Beta Was this translation helpful? Give feedback.
-
|
Are you related to the Hover Zoom this site mentions? If not, then you should rename your extension as the name has been tarnished. |
Beta Was this translation helpful? Give feedback.
-
|
Another reason why you shouldn't keep this name is because many users are confused about the two and think they are the same. As such they might be leaving feedback on your non-malware extension telling others that it is malware. I've seen several comments in the store saying this. I get that it is a good name, but is it worth it? Most users won't click on your github link and check the code themselves. They will see one review saying it's malware and move on. I bet you could come up with a better name anyway. Maybe create a discussion asking for ideas on a new name. |
Beta Was this translation helpful? Give feedback.
-
|
As info, I do see in the comments of that site that Sam claims to have tested HoverZoom+
|
Beta Was this translation helpful? Give feedback.
-
|
There will always be people on the entire spectrum of security consciousness and risk tolerance. I do not have a goal of capturing every single user. So far more than 300K people have decided that this extension provides value to them. I'm not going to change the name just because I might be loosing a few thousands more potential users. This is a free unmonetized extension, I do not get anything back. So I am also not going to spend time proving somehow that I publish unmodified code. The lack of any proof of my malicious intent in the past 5 years is good enough for me. |
Beta Was this translation helpful? Give feedback.
-
I might be missing something, but can you not just audit a local copy of the code and build and install it yourself? This is part of why open source software is great, you don't have to install it from random sources if you don't want to. |
Beta Was this translation helpful? Give feedback.
-
|
@tacerus You can use a .crx downloader and audit the official thing. All extension is "source" avaliable. |
Beta Was this translation helpful? Give feedback.
-
|
Do you ever get these kind of reviews? They somewhat coincide with the offers but I don't want to jump to the conspiratorial take. |
Beta Was this translation helpful? Give feedback.
-
|
Usually not. Most of negative reviews are complaints that the extension does not work on some website. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah those are also a pain. I guess my users are more likely to install questionably secure extensions then 🙃 |
Beta Was this translation helpful? Give feedback.
-
|
These emails are gold mine. Either they were written by couple of people, or the industry is so competitive they end up copying each other/converging to the same kind of sweet talk. Fascinating! |
Beta Was this translation helpful? Give feedback.
-
|
Fast forward to August 2023 and the ChatGPT revolution. Imagine with THIS^ becomes something the AI's just negotiate among themselves without "business development managers" (who just manage themselves!); who knows what fun and unintended consequences will arise? |
Beta Was this translation helpful? Give feedback.
-
|
AI and automation in our cuurent economic system will degenerate into one set of agents digging holes and the other set filling them just so our fundamentally absurd economy doesn't implode. |
Beta Was this translation helpful? Give feedback.
-
|
I remember reading about a research DeepMind conducted concluded that its about designing learning policies of ai. Of course it is impossible to come to a generalization without trying it at scale, but I am optimistic about things if we can design with long term benefits in mind with full transparency and rigorous monitoring. Research: https://www.deepmind.com/blog/human-centred-mechanism-design-with-democratic-ai |
Beta Was this translation helpful? Give feedback.
-
|
This just hit reddit - it'll become famous internet history! |
Beta Was this translation helpful? Give feedback.
-
|
We're also debating about this here: https://groups.google.com/a/chromium.org/g/chromium-extensions/c/IIktiPkwlwI |
Beta Was this translation helpful? Give feedback.
-
|
My reddit comrade only got an offer of $50 for theirs https://www.reddit.com/r/chrome_extensions/comments/rr52nd/so_one_person_wants_to_buy_my_extension/ |
Beta Was this translation helpful? Give feedback.
-
|
damn, these spam mails to add ads to the extension are crazy. thank you for not giving in! |
Beta Was this translation helpful? Give feedback.
-
|
On hacker news now |
Beta Was this translation helpful? Give feedback.
-
|
I hope it inspires other developers to take a stand. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for posting these - it's very illuminating to see how the data marketplace operates behind the scenes, which is something many consumers don't get to witness often. You should collect these in a separate repository and/or a Github website to make them them easier to read and update (for you). You can put one letter per Markdown file. |
Beta Was this translation helpful? Give feedback.
-
|
Good idea, I'll think about it. |
Beta Was this translation helpful? Give feedback.
-
|
lol you'd think they would be decent with grammar before trying to propose a partnership/scam or maybe that's exactly why they don't? someone taking it seriously would already pass the "I didn't realize it's a scam" test like most phishing e-mails do. |
Beta Was this translation helpful? Give feedback.
-
|
I respect the decision to not spy on users or include third party code to a browser extension. I value my privacy and I myself select the software I am using according to how it values privacy. But quite honestly, I suppose I couldn't have resisted to follow up on some of the offers given to you. I just started to read this post and already the 3rd or 4th offer that was made to you, would have catched my attention:
Even with a well-paid job and a strong moral compass, I would have considered implementing this. I would have made it an opt-out setting, so that privacy concerned users could simply deactivate this. I am just curious: How would you feel if you would realize that a browser extension that you are using is actually sending telemetry data about NX_DOMAIN requests. Would you mind at all? Would you tolerate it? Or would you feel that your privacy is invaded and be enraged? Keep in mind that the data would be anonymized. |
Beta Was this translation helpful? Give feedback.
-
|
You raise very good points. As a user, I have much less control over what telemetry is being sent by the software that I'm using. In most cases I attempt to deactivate it, anonymized or not. In a few cases (for example, for Jetbrains IDEs, because they are awesome) I leave it turned on. But overall I'm striking a balance between usefulness of the software and invasiveness of the tracking. If I discover that some tools cross this threshold then I uninstall them. But that is a user's perspective. This tolerance is different for different people. As I developer, I have control over it and I can reach the widest audience by not implementing any tracking at all. This practice also avoids questions about the degree of anonymization and simplifies my decision process about what is acceptable or not. |
Beta Was this translation helpful? Give feedback.
-
|
@extesy thank you for appreciating our IDEs and helping in their improvement! |
Beta Was this translation helpful? Give feedback.
-
The point of this "research" isn't research, it's so malware authors and phishers can find commonly typoed domains to typosquat. |
Beta Was this translation helpful? Give feedback.
-
|
As a user, is there any reliable method to find whether an extension is "monetized"? |
Beta Was this translation helpful? Give feedback.
-
|
The most reliable method is to read the source code, but other than that you can look at a few signals:
All of the above could be faked, so it's more about confirming guilt rather than proving innocence. |
Beta Was this translation helpful? Give feedback.
-
|
I would say the even easier way than reading the source code (which can be difficult when people use Webpack etc) would be just to check out the network requests an extension is making. Are they making a bunch on every website? That's a bad sign. You should also inspect the background or the service worker to see what requests it is making. There is also a way to "quarantine" extensions, so they're only activated on click or on certain sites. Many extensions will run in the background on every single webpage when they don't really need to. To do this, right-click the extension icon > manage extension > Site Access > On Click. I do this for basically all extensions (except Grammarly, which I've basically accepted is selling me to death). |
Beta Was this translation helpful? Give feedback.
-
|
It's offtopic, but I would like to express my appreciation that the content of this page is available via a simple GET. |
Beta Was this translation helpful? Give feedback.
-
|
$9000 a day for 8 lines of code? Ask them to pay upfront for 5 years (or just 2 years). I am tempted to make chrome extensions with these great people and great offers. You lucky b.. |
Beta Was this translation helpful? Give feedback.
-
|
They're probably lying. |
Beta Was this translation helpful? Give feedback.
-
|
Not the hero we deserve, but the hero we need. As a fellow dev, I appreciate the work you're putting others. You are one gem of a person! |
Beta Was this translation helpful? Give feedback.
-
|
This is astonishing, and I truly applaud your integrity. I am now wondering how many of the 20-odd other active extensions I have active, have succumbed. |
Beta Was this translation helpful? Give feedback.
-
|
(here from TL;DR newsletter) I'm also an extension developer (170k users) and I have received many of these similar offers. As a poor college student, it's certainly tempting to just cash out my oblivious users, but I've been able to monetize in other non-intrusive ways. Plus I always kind of assumed these people are going to scam me. |
Beta Was this translation helpful? Give feedback.
-
|
Coming from HN. I feel the same way - I rather deleted my extension than risk receiving the wrong payment. Post: Microsoft Forces Me to Delete My 230K User Extension 🗑️ @ Sunghyun Cho |
Beta Was this translation helpful? Give feedback.
-
|
Coming from HN, please accept those, make some money and feed them fake data. |
Beta Was this translation helpful? Give feedback.
-
|
@magusd You seem to misunderstand how they usually work. The idea is transferring repo ownership. See greatsuspender/thegreatsuspender#1175 |
Beta Was this translation helpful? Give feedback.
-
|
not all of them, there are a lot of SDK installation requests to collect user data. |
Beta Was this translation helpful? Give feedback.
-
|
You are and have been for awhile, getting a lot of offers, congrats on sticking with it and not selling out. If I were to create my own extension, I don't plan on ever giving in as well, but what did you include exactly in your code and UI to make it so valuable to people to want to use it so much? Is it just security or the UI exp overall. Just like to know a few tidbits of what is making it so widely usable that people want to use your extension over others or use it more so than the regular browser from chrome? Also what is the biggest difference of why I would ever use an extension over just using the regular browser, I just never understood why people would want to use an extension, like ever, besides seeing a cool background or something like that? Sorry def not trying to knock your extension by all means I think it's cool and useful just trying to understand for myself why. Thank you and thank you for showing all of us the emails you have been getting for close to 10yrs now, which is crazy to think about! |
Beta Was this translation helpful? Give feedback.
-
|
Two main reasons:
These two combined create a large potential attack surface on end users which means large potential profit for bad actors. |
Beta Was this translation helpful? Give feedback.
-
|
Great messages list! I mention it in my blog post about hijacking browser extensions by scammers https://vitonsky.net/blog/2023/09/01/malware-in-browser-extensions We have to keep in mind that any extension may be hacked, even very popular. The most usual reasons is not enough funding of project and low programming skill of extension author. This is why we have to keep installed as minimal extensions as possible and donate its authors to minimize risks |
Beta Was this translation helpful? Give feedback.
-
|
Can you share what information they shared about their partnership with Dark Reader? Seems like Dark Reader accepted a deal to sell out users data |
Beta Was this translation helpful? Give feedback.
-
|
They shared some payment details but that does not mean Dark Reader has the same arrangement. Everybody negotiates their own deal. |
Beta Was this translation helpful? Give feedback.
-
|
You are the best! |
Beta Was this translation helpful? Give feedback.
and others
-
Over the years, I have received many proposals to monetize this extension so I think I'll just start posting them here for fun (but not for profit). The main reason I continue to maintain this extension is because I can hardly trust others to not fall for one of these offers. I'm fortunate to have a job that pays well enough to allow me to keep my moral compass and ignore all of these propositions. I realize that not everyone has the same financial security so hopefully this thread would shed some light on what kind of pressure is put on extension developers.
09/28/2015
06/17/2015
04/26/2016
05/11/2016
05/26/2016
06/07/2016
7/29/2016
9/6/2016
9/19/2016
10/5/2016
10/25/2016
11/22/2016
2/26/2017
3/29/2017
4/11/2017
5/4/2017
5/16/2017
6/8/2017
7/4/2017
8/28/2017
8/30/2017
10/12/2017
10/12/2017
10/16/2017
10/30/2017
12/18/2017
1/21/2018
1/27/2018
2/13/2018
3/11/2018
3/15/2018
3/19/2018
3/22/2018
4/30/2018
5/9/2018
9/17/2018
11/6/2018
11/22/2018
12/11/2018
3/21/2019
4/16/2019
4/27/2019
5/19/2019
7/30/2019
8/23/2019
10/7/2019
12/3/2019
2/26/2020
4/3/2020
4/27/2020
5/3/2020
5/11/2020
5/20/2020
5/27/2020
6/8/2020
6/15/2020
6/29/2020
7/7/2020
7/16/2020
7/23/2020
8/15/2020
10/7/2020
10/12/2020
11/12/2020
12/4/2020
1/25/2021
1/25/2021
1/28/2021
2/17/2021
3/4/2021
3/5/2021
3/7/2021
3/20/2021
3/22/2021
4/30/2021, 5/10/2021
5/12/2021, 5/17/2021, 5/24/2021, 5/31/2021
5/27/2021, 6/16/2021, 7/9/2021
07/29/2021
08/04/2021
08/12/2021, 08/25/2021
08/18/2021
09/08/2021
09/15/2021
12/14/2021
1/11/2022
1/16/2022
3/24/2022
4/20/2022
5/1/2022
6/8/2022
6/14/2022
7/8/2022
7/13/2022
7/27/2022
7/30/2022
8/16/2022
8/24/2022
08/29/2022
09/11/2022
09/30/2022
10/02/2022
10/10/2022, 10/19/2022, 10/23/2022, 10/30/2022, 11/06/2022
10/12/2022
10/16/2022, 10/27/2022
12/08/2022
01/10/2023
02/08/2023
02/28/2023
03/27/2023
03/29/2023
05/10/2023
05/28/2023, 07/19/2023
06/28/2023
07/12/2023
07/13/2023, 07/25/2023
07/14/2023
08/03/2023
08/07/2023
08/09/2023
08/15/2023 (moved from comments)
08/16/2023
08/21/2023
09/05/2023
09/11/2023
09/20/2023
10/11/2023
10/24/2023
10/31/2023
12/01/2023
12/16/2023
12/17/2023
01/07/2024
01/09/2024
01/11/2024
01/17/2024
01/17/2024
01/18/2024, 01/22/2024
01/22/2024
01/30/2024, 02/01/2024
01/30/2024, 02/14/2024
02/03/2024
03/12/2024
03/17/2024, 03/20/2024, 3/25/2024
04/02/2024
04/04/2024
05/15/2024
05/30/2024, 06/03/2024, 06/13/2024
05/31/2024
06/06/2024
07/29/2024
09/09/2024, 09/11/2024, 09/16/2024
09/13/2024, 09/15/2024
09/27/2024
11/16/2024
Beta Was this translation helpful? Give feedback.
All reactions