Live data from Hacker News

Google and Mozilla are failing to support browser extension developers

armin.dev

61–70 of 195 posts

Re: Google and Mozilla are failing to support browser extension developers

#61
If it's open source then anyone can fork, right? So sell the extension, fork it, publish a new non-shitty version, and let users know via some non-official means. The only losers are the ignorant people who don't switch and the people you sold it to.

Re: Google and Mozilla are failing to support browser extension developers

#62
post #55
post #50

Earlier quoted context omitted.

As an extension developer who recently got one of these offers, your analysis is a good verbalization of my gut feeling on the matter. I turned it down, of course. While users may feel bad about extension developers not being compensated, I feel like the larger story here is that: - Companies are buying extensions for nefarious purposes, which presents a huge security risk. - Evidently, app stores are sufficiently ba…

Yes, agree - detecting extensions that have changed hands into someone who wants to "monetize" it and preventing those updates from getting to users definitely seems like a thing that the browser manufacturers should be doing (even if - and perhaps especially if - it lowers the apparent market value of extensions) and that the onus is on browser manufacturers / extension store operators to do so.

I'm not sure how one would automatically detect such a thing as a browser extension changing hands. If you require signing extensions to make a release, there's nothing stopping a developer from selling their keys. And even without changing hands, the threat to users remains the same if the company just goes from "we'll give you $10k for your extension" to "we'll give you $10k to link this library into your extension and not ask what it does" (one might counter that an ethical developer could accept the former option while rejecting the latter, but it's hard to believe any developer willing to sell their extension in the first place isn't fully aware of what that means for the future of their users).

Re: Google and Mozilla are failing to support browser extension developers

#63
post #44

> It is a regular occurrence to hear about open source developers selling their browser extensions, only for their users to be exploited later on by the new owners. ... We are witnessing the failure of browser vendors to recognize the value of our labor and the important role it plays in a healthy browser ecosystem. So this is an interesting philosophical question - the market value of the extension is the value of "…

> Those point to wildly undervalued and wildly overvalued estimates of the fair market value of the developers' work.

Hrm. I would say that it indicates that there are two different types of market. There is the market for free, ethical extensions. This market is full of products that have no value, either being freely given away by their author, or having insufficient reach or utility to garner commercial success. Then there is the black market for remote access to millions of end user machines. This market is likely illegal, but plausible deniability allows unethical devs to sell access to end users on this market.

It should not surprise anyone that it's tough to get compensated when you don't charge anything for the product you sell. Despite the name "Chrome Web Store," I could not find any for-sale extensions on the featured page. It seems like it's not in the culture to pay for extensions, possible because most of them are low-effort and have little marginal utility.

The only people who are making money ethically on the Chrome Web Store are folks who are selling a service to which their extension is a portal. And I don't really see how it will ever be otherwise.

Re: Google and Mozilla are failing to support browser extension developers

#64
post #20

>The Chrome Web Store and the Microsoft Store do not offer features for supporting extension developers. That doesn't seem right - doesn't Google let developers monetize extensions in the chrome web store? You can publish Hosted Apps, Chrome Apps, Chrome Extensions, and Themes in the Chrome Web Store. Collectively these are called simply "Items". You have many choices when it comes to making money from items that you…

The Web Store Payments API is trash. I waded through the out-of-date, sparse documentation and examples, trawled stack overflow and 'Chromium Extensions' Google Group. Spent weeks of my life trying to find work arounds to various issues. Thinking of setting up a github repo with documentation about all the issues and workarounds. Shame on Google that they leave this online.

In the end, I couldn't get something satisfactory working, and went with Paddle for payments. Cost per transaction is quite high in our case ($0.75 on a $5 monthly subscription) but it was fairly painless to set up, and they handle VAT/sales tax. Would love to find a way to offer $3/month subscriptions without handling tax ourselves.

Re: Google and Mozilla are failing to support browser extension developers

#65
post #50
post #44

> It is a regular occurrence to hear about open source developers selling their browser extensions, only for their users to be exploited later on by the new owners. ... We are witnessing the failure of browser vendors to recognize the value of our labor and the important role it plays in a healthy browser ecosystem. So this is an interesting philosophical question - the market value of the extension is the value of "…

As an extension developer who recently got one of these offers, your analysis is a good verbalization of my gut feeling on the matter. I turned it down, of course. While users may feel bad about extension developers not being compensated, I feel like the larger story here is that: - Companies are buying extensions for nefarious purposes, which presents a huge security risk. - Evidently, app stores are sufficiently ba…

app stores are toxic wastelands. there's on the order of 1000 useful legitimate apps yet the app store is packed with 2,000,000 (ie 99.9% spyware)

Re: Google and Mozilla are failing to support browser extension developers

#66
post #44

> It is a regular occurrence to hear about open source developers selling their browser extensions, only for their users to be exploited later on by the new owners. ... We are witnessing the failure of browser vendors to recognize the value of our labor and the important role it plays in a healthy browser ecosystem. So this is an interesting philosophical question - the market value of the extension is the value of "…

> the market value of the extension is the value of "monetizing" it by stuffing ads, or worse, monitoring/tracking/exfiltration, into the extension Of even worse, inserting malicious code such as a keylogger.

aka microsoft windows/office

Re: Google and Mozilla are failing to support browser extension developers

#67
No way anyone google or Mozilla can compete with a potential sale of 30 cents a user. So if that’s truly they case they might was well expect the sales to happen and start to limit the power of extensions or put them behind expert-only gates, like Chrome flags.

Re: Google and Mozilla are failing to support browser extension developers

#68
post #62
post #55

Earlier quoted context omitted.

Yes, agree - detecting extensions that have changed hands into someone who wants to "monetize" it and preventing those updates from getting to users definitely seems like a thing that the browser manufacturers should be doing (even if - and perhaps especially if - it lowers the apparent market value of extensions) and that the onus is on browser manufacturers / extension store operators to do so.

I'm not sure how one would automatically detect such a thing as a browser extension changing hands. If you require signing extensions to make a release, there's nothing stopping a developer from selling their keys. And even without changing hands, the threat to users remains the same if the company just goes from "we'll give you $10k for your extension" to "we'll give you $10k to link this library into your extension…

It would not be about detecting the change of hands but about detecting the (malicious) monetization. Depending on the type of extension this might still be hard to do, but I could well imagine heuristics triggering a manual check from the extension store providers.

Re: Google and Mozilla are failing to support browser extension developers

#69
post #67

No way anyone google or Mozilla can compete with a potential sale of 30 cents a user. So if that’s truly they case they might was well expect the sales to happen and start to limit the power of extensions or put them behind expert-only gates, like Chrome flags.

Obviously none of us expect to be paid the black market value of extensions. The point is for browser vendors to offer better tools for sponsoring developers, because it benefits everyone.

And no, the reaction to security issues should not be to further limit the extension API and declare war on the concept of general computing.

Re: Google and Mozilla are failing to support browser extension developers

#70
Idea:

1. The browser introduces a flat monthly subscription, e.g., $5 per month.

2. If the user signs up, the browser would distribute the money between the extensions that the user has installed, by default.

3. The user would also have the option to direct the money to specific extensions and/or to exclude specific extensions from this payment.

4. This system would be completely optional, but the browser cold in return provide an advanced extensions UI with extra privacy and security options.

Post reply on HN