Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Temptations of an open-source Chrome extension developer (2021)

github.com

Post reply on HN
Print view View original

151–160 of 374 posts

Re: Temptations of an open-source Chrome extension developer (2021)

#151

Post by jabradoodle »

camdat wrote: post #92
jabradoodle wrote: post #83

Earlier quoted context omitted.

Wouldn't cost that much if the transcribing is done on device

This would be immediately obvious in a cursory analysis of performance. On-device transcription is not only computationally infeasible, it would also require model capabilities far beyond what is currently SOTA. Google had (and has afaik) significant challenges implementing multiple wake-word detection for precisely this reason. Transcribing a couple of words accurately on-device without a major performance penalty (…

I would have to take your word for it but my phone is able to transcribe speech with no problem and no internet connection.

Of course running it 24/7 in the background would ruin my battery, you would have to be smarter than that.

Re: Temptations of an open-source Chrome extension developer (2021)

#152

Post by RHSeeger »

Brusco_RF wrote: post #104
Buttons840 wrote: post #90

Earlier quoted context omitted.

> the ad companies just work out what you're interested in The word "just" doesn't belong in that sentence. The ad companies being able to know things about you without actually listening to you is even more scary. Evil-Ad-Company Neo: "You're telling me I can know things about my customers by secretly listening to them?" Evil-Ad-Company Morpheus: "No Neo, I'm telling you that with the right license agreements, data…

I mean showing you ads for diapers because you googled "best diapers" falls under that same category and I daresay isn't evil at all

Sure, if you take the most benign examples, it doesn't sound so bad. But it's so much worse than that. Going back to 2012 for "acting on data analysis gone wrong"

Target Sends Coupons to Pregnant Girl and Unawares Dad Explodes

https://www.workplaceethicsadvice.com/2012/02/target-sends-c...

> Pole had identified about 25 products that, when analyzed together, allowed him to assign each shopper a "pregnancy prediction" score. More important, he could also estimate her due date to within a small window, so Target could send coupons timed to very specific stages of her pregnancy.

And things just get worse from there, as companies figure out more and more ways they can extract information from the information they have about you, and share it with each other.

Re: Temptations of an open-source Chrome extension developer (2021)

#153

Post by sphars »

NelsonMinar wrote: post #122

So much sleaze with extensions, it's nice to see it documented. Have to be honest the name "HoverZoom" was spoiled for me because it was one of the first fraud extensions I was a victim of. Nice to see this open source fork with an author concerned about the problem. These days I pretty much only install open source extensions. Ironically I was using Imagus, just switched to HoverZoom+ thanks to this post.

I too was a heavy user of imagus, until it stopped receiving updates and the owner went silent. I know there's a subreddit with some people picking it back up, but I've moved on to HZ+ now. And it's for reasons like the maintainer of HZ+ standing up morally being one of the reasons.

Re: Temptations of an open-source Chrome extension developer (2021)

#154

Post by lmm »

comboy wrote: post #77
ericd wrote: post #23

Earlier quoted context omitted.

The most galling offer we saw on the mobile app side was something that would turn on the user's microphone, and listen for ads on tvs around them to track what they'd been exposed to offline. Adtech is such a thoroughly gross field.

Why broadcasted ads which are the same for everybody? Is it trying to track effectiveness of these ads?

Probably to target an ad for the same product/service at someone who was in the same room as a TV ad. About 10 years ago I worked for an ad targeting company and we got ~50% more click-through on a web ad just by showing it shortly after a TV ad aired in that location (just using the geoip timezone and hoping they might've been watching the right channel), if you could do that only for people who've actually been exposed to the TV ad there's the potential for huge uplift there.

Re: Temptations of an open-source Chrome extension developer (2021)

#155

Post by eviks »

collaborative wrote: post #56

I don't know what the solution to this is, but I know a few trusted/legitimate companies that sell their user data for around £20/year even after having monetized their users with actual money I will never do this because violating privacy goes against the core of my beliefs, but there is a conflict I can't seem to work out. On the one hand, I KNOW that the vast majority of users prefer to sell their privacy than pay…

The solution of for the app store owner to develop a better monetization scheme that would reward developers

+ track change of ownership

+ some distributed review system

+ better sandboxing

+ no forced autoupdates

+ A few other things

Re: Temptations of an open-source Chrome extension developer (2021)

#156

Post by bensecure »

shadowgovt wrote: post #130
bensecure wrote: post #129

Earlier quoted context omitted.

Detect if the extension downloads and executes arbitrary code, and ban it if it does. That should be just as easy to detect as detecting that the code does something bad directly. In fact, the way extension policing works is (afaik) completely reactive: if someone reports that an extension is doing something bad, then the extension/the developer thereof is banned. No/minimal policing is done at the time of publishing…

In manifest v2, downloading and executing arbitrary code is a feature. What you're describing is the migration path from v2 to v3. "Detect if the extension downloads and executes arbitrary code, and ban it if it does" is isomorphic to "deprecate the eval arbitrary code permission, cease supporting it in the store, and provide an alternative declarative model to get some of the behavior back;" it's what Google is tryi…

It's a composition of two features, both of which are useful on their own. Removing this "feature" requires removing at least one of those sub-features, in this case eval. We could alternatively allow eval to be used, but ban it from being used on code downloaded from the internet. This would require vetting the code, rather than a fully automated check. The goal of such a removal is, supposedly, to enable manual vetting to be more effective. However, the only reason to prefer an outright removal over a conditional ban is that it obviates the need for manual review. Do you see the contradiction?

Re: Temptations of an open-source Chrome extension developer (2021)

#157

Post by onli »

ehsankia wrote: post #115
alyandon wrote: post #99

Earlier quoted context omitted.

Android phones that are 8 major versions out of date because the OEM won't support them probably don't have that feature.

8 major versions, that is surely less than 5% of the Android population. I'm sure the security flaws in those non-updated phones is far more serious than the lack of microphone indicator.

According to https://source.android.com/docs/core/permissions/privacy-ind..., the microphone indicator is only in there since Android 12. Android 12 and 13 cover only 50% of Android phones, according to https://gs.statcounter.com/os-version-market-share/android/m.... There were some "access to the microphone is restricted for background apps" changes earlier, reported for Android 9. But I wouldn't rely on them, and even if those restriction always worked, that still made ~10% of Android phones vulnerable.

Re: Temptations of an open-source Chrome extension developer (2021)

#158

Post by [deleted] »

cal85 wrote: post #94

FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash offers from shady people who presumably want…

[deleted]

Re: Temptations of an open-source Chrome extension developer (2021)

#159

Post by GeekyBear »

c7DJTLrn wrote: post #93
GeekyBear wrote: post #61

Things have gotten bad enough that I've stopped using extensions that haven't been through a code vetting process. > Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status. h…

What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily malicious code could slip through. I'm surprised there hasn't been a mass cookie stealing attack yet.

> What does that mean in reality?

It means taking malware seriously, even if that means you have to pay human beings to vet code manually. I realize that Google wants to avoid paying human beings at all costs, but too bad.

Re: Temptations of an open-source Chrome extension developer (2021)

#160

Post by iraqmtpizza »

munk-a wrote: post #110
Brusco_RF wrote: post #104

Earlier quoted context omitted.

I mean showing you ads for diapers because you googled "best diapers" falls under that same category and I daresay isn't evil at all

I am pretty convinced that modern advertising - from the most inane and innocent to tracking users 24/7 pretty clearly falls under evil. Gone are the days of advertising trying to raise product awareness and convert purchases - that field now exists to create demand. It induces desires in the recipients that play on psychological factors like FOMO to create customers out of thin air - and that process causes we the c…

Advertising is nudge theory without the do-gooder mystique
Post reply on HN