If you do anything with web3 crypto or even money, always use different browser profiles.
The profiles that you use for Metamask, don't install any extensions into those beyond MM.
Temptations of an open-source Chrome extension developer (2021)
121–130 of 374 posts
Re: Temptations of an open-source Chrome extension developer (2021)
#122So much sleaze with extensions, it's nice to see it documented. Have to be honest the name "HoverZoom" was spoiled for me because it was one of the first fraud extensions I was a victim of. Nice to see this open source fork with an author concerned about the problem.
These days I pretty much only install open source extensions. Ironically I was using Imagus, just switched to HoverZoom+ thanks to this post.
Re: Temptations of an open-source Chrome extension developer (2021)
#123>Monetizing anonymous user data is happening on almost every website we visit - you may be leaving alot of money on the table by not monetizing your anonymous user data. Try dowloading Ghostry to see for yourself.
Some people have no shame at all. It's like the caricature of the Devil from a Sunday Morning cartoon, offering you riches and power untold for the low, low price of your soul.
Like dude, how do you know what Ghostery is and don't get why people use it?
Re: Temptations of an open-source Chrome extension developer (2021)
#124Earlier quoted context omitted.
The most galling offer we saw on the mobile app side was something that would turn on the user's microphone, and listen for ads on tvs around them to track what they'd been exposed to offline. Adtech is such a thoroughly gross field.
But every time this comes up the threads are flooded with people saying it doesn't actually happen and the ad companies just work out what you're interested in by what you're browsing.
That was an official feature of the Facebook app at one point. Like 10 years ago. It's absurd that anyone would deny this. It was right there as a feature! Default off I think. But it was definitely there.
Re: Temptations of an open-source Chrome extension developer (2021)
#125Earlier quoted context omitted.
I mean showing you ads for diapers because you googled "best diapers" falls under that same category and I daresay isn't evil at all
I am pretty convinced that modern advertising - from the most inane and innocent to tracking users 24/7 pretty clearly falls under evil. Gone are the days of advertising trying to raise product awareness and convert purchases - that field now exists to create demand. It induces desires in the recipients that play on psychological factors like FOMO to create customers out of thin air - and that process causes we the c…
I'm not a radical about many subjects, but I'm certainly radically anti-advertising.
Re: Temptations of an open-source Chrome extension developer (2021)
#126Of all of these, I appreciated the one from 05/11/2016 the most. It felt the least shady because they were very up front with the scope and the data collected (which was narrowly focused), and left the implementation up to the developer (along with an optional script they could use). They also provided several options for sending the data, just to guarantee that the extension couldn't be compromised by their code. Th…
non existent domains are the ones that are most likely to be somehow personal to the user, because they weren't trying to enter a domain at all but it got interpreted as one accidentally. Eg a password they meant to type into a password field but the url bar was highlighted. If they were interested in statistics regarding popular domains, like google or facebook, then it would actually be less of a privacy intrusion, because it would only end up telling you about populations, not individual users.
I don't know what they actually intended to use this data for, but its telling that they don't mention that in their proposal.
Re: Temptations of an open-source Chrome extension developer (2021)
#127Yep, I've been getting these emails since 2014, around 200 in total. My extension has had between 30,000 and 100,000 active users. They often quote up to $500 a month per 1000 users, which sounds too good to be true.
Re: Temptations of an open-source Chrome extension developer (2021)
#128ChatGPT for Google was #1 on HN earlier this year. Check out the GitHub repo now: that person sold the extension. I had a small side project extension, ~25,000 installs & free to use. I got enough inbound interest trying to "help me monetize" that I thought it would be worth cataloguing all the different unsavory avenues: https://mattfrisbie.substack.com/p/the-ugly-business-of-mone...
The most galling offer we saw on the mobile app side was something that would turn on the user's microphone, and listen for ads on tvs around them to track what they'd been exposed to offline. Adtech is such a thoroughly gross field.
When I worked on audio firmware for the BlackBerry, one of the external devices I had to support was called a "security plug", which just shorted the headset mic and headphones to ground. It always seemed kind of silly to me because there was still the handset mic on the phone that could be activated separately.
Re: Temptations of an open-source Chrome extension developer (2021)
#129Earlier quoted context omitted.
How does manifest v3 combat this?
Without the additional constraints manifest v3 puts on what code an extension can run at runtime, an extension author can just slip some "grab some code from a server I control and eval it" logic into their extension, which Google can't vet. That makes it possible for an extension that was fine yesterday go to "harvesting your PII to send to a company that is building an AI based on your click frequency" today with n…
Detect if the extension downloads and executes arbitrary code, and ban it if it does. That should be just as easy to detect as detecting that the code does something bad directly. In fact, the way extension policing works is (afaik) completely reactive: if someone reports that an extension is doing something bad, then the extension/the developer thereof is banned. No/minimal policing is done at the time of publishing. The exact same policy applies unchanged to extensions that download malicious code instead of packaging it directly: wait until someone complains about the malicious code, ban the extension for having malicious code.
Re: Temptations of an open-source Chrome extension developer (2021)
#130Earlier quoted context omitted.
Without the additional constraints manifest v3 puts on what code an extension can run at runtime, an extension author can just slip some "grab some code from a server I control and eval it" logic into their extension, which Google can't vet. That makes it possible for an extension that was fine yesterday go to "harvesting your PII to send to a company that is building an AI based on your click frequency" today with n…
Detect if the extension downloads and executes arbitrary code, and ban it if it does. That should be just as easy to detect as detecting that the code does something bad directly. In fact, the way extension policing works is (afaik) completely reactive: if someone reports that an extension is doing something bad, then the extension/the developer thereof is banned. No/minimal policing is done at the time of publishing…
In manifest v2, downloading and executing arbitrary code is a feature.
What you're describing is the migration path from v2 to v3. "Detect if the extension downloads and executes arbitrary code, and ban it if it does" is isomorphic to "deprecate the eval arbitrary code permission, cease supporting it in the store, and provide an alternative declarative model to get some of the behavior back;" it's what Google is trying to do.