Temptations of an open-source Chrome extension developer (2021) • Hacker News Board

Re: Temptations of an open-source Chrome extension developer (2021)

#331

Post by Pxtl » Thu, Aug 10, 2023, 2:14 PM UTC

exikyut wrote: post #283

Pxtl wrote: post #242

Earlier quoted context omitted.

No idea of what API they're hitting but basically half of my old humble library won't run anymore - they show a warning about old APIs, show the title screen, then crash to desktop. Even some old games I paid for are gone from the Play Store too. Like, I paid for Puffle Launch and it's just plain gone from my library. Edit: ahah, I was looking in the wrong spot! Its still in my "not installed" list, just not in my "f…

Ah, 2011, the age of so many Angry Birds clones... I just found https://archive.org/details/PuffleLaunchAPK and https://archive.org/details/PuffleLaunchAmazonAPK (both point to each other), with a note that says that the latter generally works and the former crashes. I can verify this; on my (Android 8, 32-bit compatible) device the Play version crashes with: 08-10 14:55:03.864 25995 25995 E linker : ERROR: OOPS: 0 c…

Puffle Launch wasn't an Angry Birds clone, it was the barrel scenes from Donkey Kong Country expanded into a full game.

One problem is that some games aren't just incompatible, but also were enshittified with ads and nonsense after I paid for them (before they were killed altogether).

Offhand, the ones I remember: a paid version of Angry Birds Space, Amazing Alex (Rovio's excellent take on The Incredible Machine), Swords and Soldiers (fortunately there's a Steam version of that), Noodlecake's "Wave Wave", Pool Break Pro, and some classic ports like Dead Space, Spy vs Spy, and Ur-Quan Master, but there are better non-mobile ways to play those games.

Re: Temptations of an open-source Chrome extension developer (2021)

#332

Post by cactusplant7374 » Thu, Aug 10, 2023, 2:37 PM UTC

How much money could they have made?

Re: Temptations of an open-source Chrome extension developer (2021)

#333

Post by Phemist » Thu, Aug 10, 2023, 2:44 PM UTC

ummonk wrote: post #262

ericd wrote: post #23

Earlier quoted context omitted.

The most galling offer we saw on the mobile app side was something that would turn on the user's microphone, and listen for ads on tvs around them to track what they'd been exposed to offline. Adtech is such a thoroughly gross field.

When I worked at Meta, the execs said that many users think they're being spied on when they see ads based on a conversation they've had in real life, but the execs categorically denied that this could be happening, and said it's all just a coincidence. I thought this was a completely unfounded denial, since Meta had no way of auditing 3rd party apps on the user's phone, and it's perfectly plausible for another app t…

Wow what, facebook allows ad targeting based on a user's email?

Re: Temptations of an open-source Chrome extension developer (2021)

#334

Post by paulryanrogers » Thu, Aug 10, 2023, 2:53 PM UTC

btown wrote: post #220

imoreno wrote: post #131

Earlier quoted context omitted.

You're doing a very admirable thing, and this helps dispel the little voiced but commonly held perception that "everybody sells out" when they get big.

uBlock Origin is also an incredible success story here!

Yet the very same author turned over the OG uBlock to a shady character, having to launch a competitor to take back the momentum. To this day there is still confusion among normies.

Re: Temptations of an open-source Chrome extension developer (2021)

#335

Post by butz » Thu, Aug 10, 2023, 2:57 PM UTC

theandrewbailey wrote: post #96

butz wrote: post #41

Nuking all extensions that use any of the listed "monetization platforms" would make Chrome extension store a safer place for everyone.

They will just rename everything and operate under a new shell company. Then everything will be back to the status quo.

Google could launch a honeypot extension to get offers from those new companies and keep removing offending extensions.

Re: Temptations of an open-source Chrome extension developer (2021)

#336

Post by no_wizard » Thu, Aug 10, 2023, 3:00 PM UTC

There was a rumor I heard on some forums awhile back that at one point, ad tech companies wanted to kill uBlock Origin so bad that they were willing to offer a few million dollars to take it over, and gorhill stood tall.

If this is true (and its a huge if, again, I heard it in the context of a rumor), just makes them more of a stand up developer!

Re: Temptations of an open-source Chrome extension developer (2021)

#337

Post by cinntaile » Thu, Aug 10, 2023, 3:06 PM UTC

extesy wrote: post #103

cal85 wrote: post #94

FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash offers from shady people who presumably want…

If cash offers scale linearly with the number of users, then yours would be pretty tempting indeed. Respect for not selling out! Would you like to start publishing these offers, like what I'm doing?

I thought one of the interesting requests was the DNS error one. I'm guessing they want to find commonly visited websites that no longer exist and buy the domain names to run ads or malware on? Any other reasons anyone can think of?

Re: Temptations of an open-source Chrome extension developer (2021)

#338

Post by salawat » Thu, Aug 10, 2023, 3:06 PM UTC

afavour wrote: post #80

jstanley wrote: post #53

Earlier quoted context omitted.

But every time this comes up the threads are flooded with people saying it doesn't actually happen and the ad companies just work out what you're interested in by what you're browsing.

Two different things. The popular conspiracy theory is that the phone listens to and presumably transcribes your conversations, sending them to a third party. The example the OP gave is specifically listening for TV content: they’ll have hashes of known ads/shows/whatever to compare against rather than do something like live transcription. Don’t get me wrong it’s shitty and gross. But they are different things.

...They don't even need to hash content. Advertisers can just add ultrasound beacons to the audio track.

Imperceptible to human hearing, but readily picked up by a listening mic. In fact, there are static analysis tools for picking out apps that access such API's in FDroid, along with taking measures to feed said apps dummy data. At least for Android anyway.

Re: Temptations of an open-source Chrome extension developer (2021)

#339

Post by doix » Thu, Aug 10, 2023, 3:27 PM UTC

hot_gril wrote: post #116

This reminds me of a dirty plan I had as a kid in middle school. 1. Make a legitimately useful Minecraft Bukkit plugin. 2. Wait for lots of installs. 3. Add a well-hidden backdoor that makes me "op" (admin) on any server I choose. 4. Surprise some mean op on a public server by suddenly banning him. I got through step 2 then decided to stop there.

Minecraft Bukkit plugins are basically the wildwest. It's really hard to tell if something is intentional or not. I remember many years ago trying to find a motd (message of the day) plugin that would just display a message when you joined the server.

I found one that was simple enough, but it would ping home to check if there were any updates as well. Now it could have been just the developer trying to add a useful feature, but the cynic in me believes it's so that they could get IP addresses of the servers running the plugin.

It also had a debug command that wasn't authenticated that let you print the contents of any motd file in a folder. Except it didn't escape strings properly, so you could `../...` to escape out of that directory and print any file.

I have no idea if the author actually exploited this, or if they were a naive 14 year old writing their first plugin. If they were trying to exploit, I don't know which file they were going to print the contents of, but it definitely made me very suspicious.

Re: Temptations of an open-source Chrome extension developer (2021)

#340

Post by kmeisthax » Thu, Aug 10, 2023, 3:56 PM UTC

hot_gril wrote: post #116

This reminds me of a dirty plan I had as a kid in middle school. 1. Make a legitimately useful Minecraft Bukkit plugin. 2. Wait for lots of installs. 3. Add a well-hidden backdoor that makes me "op" (admin) on any server I choose. 4. Surprise some mean op on a public server by suddenly banning him. I got through step 2 then decided to stop there.

2b2t got backdoored several times this way. Several people had access to WorldEdit, creative mode, admin commands, etc.

Beyond ancient anarchy servers, right now the Minecraft mod community has been dealing with several supply chain attacks, deserialization vulnerabilities, and so on.