Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Temptations of an open-source Chrome extension developer (2021)

github.com

Post reply on HN
Print view View original

271–280 of 374 posts

Re: Temptations of an open-source Chrome extension developer (2021)

#271

Post by gmerc »

ummonk wrote: post #262
ericd wrote: post #23

Earlier quoted context omitted.

The most galling offer we saw on the mobile app side was something that would turn on the user's microphone, and listen for ads on tvs around them to track what they'd been exposed to offline. Adtech is such a thoroughly gross field.

When I worked at Meta, the execs said that many users think they're being spied on when they see ads based on a conversation they've had in real life, but the execs categorically denied that this could be happening, and said it's all just a coincidence. I thought this was a completely unfounded denial, since Meta had no way of auditing 3rd party apps on the user's phone, and it's perfectly plausible for another app t…

In many cases it’s more than simple:

You had the conversation with someone and that someone googled/shopped/amaozned/clicked it. Or did before already, you don’t initiate every conversation in your life after all.

Now go and try getting a denial that they are not using the fact that you share a wifi with someone as parts of the recipe for the recommendation cake.

Re: Temptations of an open-source Chrome extension developer (2021)

#272

Post by Method5440 »

I really like Hover Zoom+. I’d be willing to pay $7,000 to $8,500 USD for each kidney you’d be willing to sell. Once we know the size/functioning we can determine exact figures. Happy to buy both if you no longer need them, you probably barely use them anyway.

Re: Temptations of an open-source Chrome extension developer (2021)

#273

Post by LoganDark »

wddkcs wrote: post #270
LoganDark wrote: post #246

Earlier quoted context omitted.

You're protecting yourself from targeted psychological manipulation. It's like the difference between someone spraying a cyber-attack over the entire IPv4 space, or spending a while trying to drill into a specific server. The latter is much scarier and harder to resist, but it's basically what targeted advertising is these days. They supposedly want just to help you find what you want to buy, but they do this by tryi…

Of course, someone who has been successfully manipulated would also think they've escaped manipulation. Isn't that the scariest part

Depends on the method of manipulation but yeah that is the scary part. It's probably part of what scares people into being so privacy conscious in the first place. Though for me it's more that I get really, really annoyed getting told to do things, because it triggers pathological demand avoidance. But that's just manipulating me in reverse (it's really easy to make me hate/avoid something just by annoying me with it)

Re: Temptations of an open-source Chrome extension developer (2021)

#274

Post by kevingadd »

c7DJTLrn wrote: post #93
GeekyBear wrote: post #61

Things have gotten bad enough that I've stopped using extensions that haven't been through a code vetting process. > Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status. h…

What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily malicious code could slip through. I'm surprised there hasn't been a mass cookie stealing attack yet.

CWS doesn't review every extension submission, at best they do some % of them along with anything that sets off red flags. Out of hundreds of times I pushed updates to my extension (~100k monthly users by the end) it was delayed for human review maybe... twice?

Re: Temptations of an open-source Chrome extension developer (2021)

#275

Post by dieulot »

The catch with those enticing monthly offers (versus selling the extension) is that you are taking the risk to get your extension taken down, while the offerors can at any time switch to another partner/victim.

Blog post from an ex-Chrome extension DevRel: https://dotproto.com/2023/06/06/a-warning-about.html

Re: Temptations of an open-source Chrome extension developer (2021)

#276

Post by GeekyBear »

extesy wrote: post #252
GeekyBear wrote: post #61

Things have gotten bad enough that I've stopped using extensions that haven't been through a code vetting process. > Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status. h…

Mozilla's review process is much more strict than Chrome's: they required me to produce original source code for all libraries that I am using (like jquery), forced me to get rid of some leftover eval's in javascript, etc. I don't think they read all source code, but they definitely look for some patterns.

Did your extension go through the normal vetting process or the extended review necessary to become a recommended extension?

Re: Temptations of an open-source Chrome extension developer (2021)

#277

Post by extesy »

GeekyBear wrote: post #276
extesy wrote: post #252

Earlier quoted context omitted.

Mozilla's review process is much more strict than Chrome's: they required me to produce original source code for all libraries that I am using (like jquery), forced me to get rid of some leftover eval's in javascript, etc. I don't think they read all source code, but they definitely look for some patterns.

Did your extension go through the normal vetting process or the extended review necessary to become a recommended extension?

If by recommended you mean "featured" flag on Chrome webstore then I believe that happens automatically if the extension satisfies their "best practices" criteria.

Re: Temptations of an open-source Chrome extension developer (2021)

#278

Post by mktk1001 »

ummonk wrote: post #262
ericd wrote: post #23

Earlier quoted context omitted.

The most galling offer we saw on the mobile app side was something that would turn on the user's microphone, and listen for ads on tvs around them to track what they'd been exposed to offline. Adtech is such a thoroughly gross field.

When I worked at Meta, the execs said that many users think they're being spied on when they see ads based on a conversation they've had in real life, but the execs categorically denied that this could be happening, and said it's all just a coincidence. I thought this was a completely unfounded denial, since Meta had no way of auditing 3rd party apps on the user's phone, and it's perfectly plausible for another app t…

Wdym? You cannot target specific individuals when creating ads on FB/IG?

Re: Temptations of an open-source Chrome extension developer (2021)

#279

Post by chii »

PNewling wrote: post #251
chii wrote: post #243

Earlier quoted context omitted.

and you are essentially trusting the moral integrity of the current maintainer. why can't there be a method for making sure that such trust cannot be abused? Is this a tractable problem at all?

You'd still have to rely on the trust of the original maintainer, but they could set up something like a warrant canary[0], but for if they sold it or if they added tracking items. [0] https://en.wikipedia.org/wiki/Warrant_canary

warrant canary assumes the maintainer is under coercion. But if the maintainer is untrustworthy, their warrant canary also won't be trustworthy, since it's trivial for the "sale" and the new maintainers to continue the existing warrant canary as though nothing has happened.

Re: Temptations of an open-source Chrome extension developer (2021)

#280

Post by malermeister »

alooPotato wrote: post #207
cal85 wrote: post #94

FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash offers from shady people who presumably want…

This seems so weird to me. You're clearly providing value to the world, and according to my moral view, should be entitled to capturing some of that value without resorting to something shady. I'm the founder of Streak where we directly monetize our extension (as do others like Grammarly). Have you tried directly asking your users for $ given the effort you put in?

I can't speak for parent, but some (including myself) see writing free software as an act of charity, done just to make the world a little bit better.

In this view, trying to make money from it corrupts the noble mission.

Post reply on HN