Live data from Hacker News

Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

arstechnica.com

31–40 of 44 posts

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#31
post #12

I have a relatively popular novelty extension and I get approached by ad companies to buy/monetize it regularly. I refuse, because I despise advertising and I don't need the money. But I suspect I am in the minority and that many extension owners probably just decide it is easier to sell it and not think about it.

How much did they offer?

And for what reach?

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#32
post #30

Earlier quoted context omitted.

I switched my chrome extension to a paid model (one off payments). Most the offers from these shady people, work out as approximately 1 year worth of sales.

Who pays for extensions? Like, honest question.

3-4 people a day. My extensions are development tools so I’d imagine people get their companies to pay for it.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#34

Earlier quoted context omitted.

Do you live without adblock?

Yes, but I have JS disabled on most sites. Regarding adblock, there were posts that it slows the browser down, injects huge CSS rules into every iframe etc.

How do you selectively disable has without an extension?

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#35
Still a large risk, even though this was authored in 2014.

I would be surprised if extensions that "read and change content on all websites you visit" haven't yet been used in some wide-scale account/identity compromise without making much noise.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#36
post #22

It appears to be an easy way to at least weaken this practice: Why doesn't chrome prompt it's user / demands a confirmation of permissions when an extention changes ownership, before updating it again? It could at least impact the rentability of this buying up of extentions, but definitely help alert users of such things

before that - why doesnt Chrome let you DISABLE updates?

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#38
post #12

I have a relatively popular novelty extension and I get approached by ad companies to buy/monetize it regularly. I refuse, because I despise advertising and I don't need the money. But I suspect I am in the minority and that many extension owners probably just decide it is easier to sell it and not think about it.

How much did they offer?

Anywhere from $2-25k. But most don't give a price upfront and I just send it to my spam folder.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#39
post #19

Not even Firefox manually review extensions anymore. Sad, happened twice for me (one was a cryptominer) so now I have like 2 extensions installed.

Not true. Extensions are still subject to manual review, however they are permitted to be posted publically as soon as they pass a suite of automated checks.

You know what I mean. It's like checking for poison after you eat the entire pie.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#40
post #25

Earlier quoted context omitted.

Host blocking at the OS level. No need for extensions.

Sometimes you need to temporary disable filters or edit them. How do you manage that? Is it user-friendly?

Never ran into a problem really. Maybe a couple times a year I'll manually open the host file and ctrl+f a host I need to comment out temporarily after seeing it's causing an issue via the browser's network tools.
Post reply on HN