Live data from Hacker News

Temptations of an open-source Chrome extension developer (2021)

github.com

171–180 of 374 posts

Re: Temptations of an open-source Chrome extension developer (2021)

#171
This is terrifying. I'm glad the developer of Hover Zoom+ is both ethical and has a backbone. He demures, but I know that having a decent job has not kept other people from taking the money when presented with similar offers. I see that he's in this thread, so: hats off to you.

What I'd like to know is, how many different entities are represented in this compilation? Since everything is redacted, it's not easy to tell. I was surprised that there are so many offers by, seemingly, so many different scumbags. I mean people.

Re: Temptations of an open-source Chrome extension developer (2021)

#172
post #92

Earlier quoted context omitted.

Wouldn't cost that much if the transcribing is done on device

This would be immediately obvious in a cursory analysis of performance. On-device transcription is not only computationally infeasible, it would also require model capabilities far beyond what is currently SOTA. Google had (and has afaik) significant challenges implementing multiple wake-word detection for precisely this reason. Transcribing a couple of words accurately on-device without a major performance penalty (…

rewind.ai has entered chat.

Re: Temptations of an open-source Chrome extension developer (2021)

#173
post #138

Earlier quoted context omitted.

>They would gladly click on a "sell my data" over a "pay money" button any day of the week. You don't know that because no one is given a clear choice like you present (and even saying "data" is opaque to joe average user). And this is what regulations like EU's and CA's should be enforcing. Imagine if the choice was: We have this data about you (a comprehensive list of all the fruits of our creepy stalking: a,b,c,d,…

> this is what regulations like EU's and CA's should be enforcing. Imagine if the choice was: We have this data about you (a comprehensive list of all the fruits of our creepy stalking: a,b,c,d, etc...), if you let us violate your privacy in a myriad of ways, we will let you have this little trinket for free. Otherwise, it will cost you x. How many people would select privacy violation? Unfortunately under the GDPR w…

It is legal[1] to require users to agree to data collection or pay a subscription. Some news sites have already begun to implement this scheme.

[1] At least according to some countries' DPAs, and as long as the price is "fair".

https://www.iubenda.com/en/help/24487-cookie-walls-gdpr

Re: Temptations of an open-source Chrome extension developer (2021)

#174

So much sleaze with extensions, it's nice to see it documented. Have to be honest the name "HoverZoom" was spoiled for me because it was one of the first fraud extensions I was a victim of. Nice to see this open source fork with an author concerned about the problem. These days I pretty much only install open source extensions. Ironically I was using Imagus, just switched to HoverZoom+ thanks to this post.

I discovered Imagus yesterday thanks to another thread in here about extensions, and today I read this.

Re: Temptations of an open-source Chrome extension developer (2021)

#175
Ruffle's official e-mail inbox is chock full of these. The sums of money being offered for a free and Free extension are so high that I can only assume the buyers are looking to load it up with whatever malware won't immediately get it banned by Google or Mozilla[0].

My personal opinion is that you shouldn't be allowed to transfer an extension between owners without prior approval and vetting of the new ownership structure. This should deliberately be harder than just setting up a new extension, because new listings won't have reviews or trust associated with it. I'm saying this as the person who occasionally gets caught on the business end of some of these policies[1] and knows how much of a pain it is to navigate bureaucracy. The underground extension sales marketplace is incredibly sketchy and plays fast and loose with user trust.

[0] Joke's on them, our AMO listing is already flagged for machine-generated code (because we use Rust/WASM), so our extension submissions only get approved if Mozilla is able to reproduce our builds byte-for-byte.

[1] https://ruffle.rs/blog/2023/04/23/mozilla-extension-postmort...

Re: Temptations of an open-source Chrome extension developer (2021)

#176

The root problem here is that there's no legitimate way to monetize browser extensions. Extensions are meant to be simple, so it's hard to sell premium features. Extensions usually don't "own" any space to embed ads in.

Might at least make these attacks harder if users could disable extension updates, or had to opt into them. Most of these extensions are simple and don't really need to be updated, yet the update mechanism is silent full auto bada bing bada boom no rollbacks. I can't think of any updates more aggressive, not even Steam.

Yet another opportunity to recommend Firefox to readers.

I'm not sure I advise doing it, but you can go to about:addons and hit the gear icon and you can uncheck "Update Addons Automatically". Even better, click on an extension and under the "details" tab there's an option per-addon to set whether you want automatic updates or not, so you can disable updates just for the one addon you don't trust (or enable updates just for the one addon you do trust).

Also, want to run older version of an extension? The Mozilla Addons page for each extension has a list of every release and you can download each version independently as a signed XPI file if you want to sideload it.

The big thing I wish Mozilla would add is self-compiled releases like F-Droid does, especially since their ill-advised signing process means it's hard for users to compile an extension from source -- it's way too easy for a submitted extension to deviate from its source code. But that (admittedly large) issue aside, Firefox offers a lot of control for users who want to manage their own extension versions. Forced automatic updates are a Chrome problem.

Re: Temptations of an open-source Chrome extension developer (2021)

#177
post #27

I wonder whether there exists a cottage industry of fake extension writers pumping up their numbers with fake installs, all with the goal to sell the fake extensions to these scammers.

I also wonder how they make these sales. Is there an escrow for this? Are Chrome extension transfers non-reversible? Can't imagine such a shady deal is safe for either party.

Re: Temptations of an open-source Chrome extension developer (2021)

#178

I don't know what the solution to this is, but I know a few trusted/legitimate companies that sell their user data for around £20/year even after having monetized their users with actual money I will never do this because violating privacy goes against the core of my beliefs, but there is a conflict I can't seem to work out. On the one hand, I KNOW that the vast majority of users prefer to sell their privacy than pay…

The Internet has no easy to use fully-anonymous cash equivalent. If you pay for something, you're giving away your identity information anyway. The value exchange is definitely lopsided, but if I have to share my identity AND pay to get X, I'm out money AND shared my identity info. If I share my identity info and get X for free, at least I'm not out the money.

Extensions are centrally distributed on platforms that could at least nominally handle payment. The problem is that $0.01 is infinitely more expensive than free.

In order for me to pay you, I at a minimum have to do some amount of mental gymnastics to convince myself that it's worth it for me to pay you. This has a perceived cost even if the money spent is trivial. This is why people who take money in small increments - i.e. mobile games, arcade operators, casinos, and so on[0] have you buy a large amount of some scrip that they control, and then make it so easy to spend it that you might accidentally do so.

Nobody is thinking "I'd buy this, but only if I can leave no record of ownership[1]", they're thinking, "is it actually worth buying". Identity and privacy isn't a thing that people actually account for when making purchases - mostly because it's never actually mentioned[2] in the terms of purchase. It's snuck in. So the choice is just "the free one" and "the $2 one", where the value of the $2 extension can never hope to overcome the mental transaction costs.

[0] Nintendo and Microsoft used to do this around the Wii and 360 eras. While on the Wii it was 1 point equals 1 penny/yen, Xbox did something nasty and made it 80 points equals 1 dollar.

[1] That would mean that setting up a new computer or browser profile loses you all your existing extensions that you paid for.

[2] I do not consider legal disclaimers to be adequate notice, and neither should you. Dropping a clause in a EULA is the equivalent of dropping rohypnol in your drink.

Re: Temptations of an open-source Chrome extension developer (2021)

#179

Earlier quoted context omitted.

Both iOS and Android show when your microphone is active so the whole conspiracy theory about it always listening to you and sending it back is pretty bullshit. And no one has yet found evidence of such network traffic either.

except it's always listening for you to say "siri" or "google assisstent". Some androids also show what music is playing nearby. You can thankfully opt-out but the ability to is still there.

They do that with local processing. For the music thing it calculates a hash locally and send it to their servers.

Re: Temptations of an open-source Chrome extension developer (2021)

#180
post #110

Earlier quoted context omitted.

I mean showing you ads for diapers because you googled "best diapers" falls under that same category and I daresay isn't evil at all

I am pretty convinced that modern advertising - from the most inane and innocent to tracking users 24/7 pretty clearly falls under evil. Gone are the days of advertising trying to raise product awareness and convert purchases - that field now exists to create demand. It induces desires in the recipients that play on psychological factors like FOMO to create customers out of thin air - and that process causes we the c…

You do realize all forms of media embed advertising directly into the content going right back to the beginning, right? There's nothing modern about it. Showing you a product when you actually want to see it is the most effective way to induce demand. All your favorite shows, movies, youtube personalities, etc. still do this.
Post reply on HN