Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Temptations of an open-source Chrome extension developer (2021)

github.com

Post reply on HN
Print view View original

341–350 of 374 posts

Re: Temptations of an open-source Chrome extension developer (2021)

#341

Post by hot_gril »

doix wrote: post #339
hot_gril wrote: post #116

This reminds me of a dirty plan I had as a kid in middle school. 1. Make a legitimately useful Minecraft Bukkit plugin. 2. Wait for lots of installs. 3. Add a well-hidden backdoor that makes me "op" (admin) on any server I choose. 4. Surprise some mean op on a public server by suddenly banning him. I got through step 2 then decided to stop there.

Minecraft Bukkit plugins are basically the wildwest. It's really hard to tell if something is intentional or not. I remember many years ago trying to find a motd (message of the day) plugin that would just display a message when you joined the server. I found one that was simple enough, but it would ping home to check if there were any updates as well. Now it could have been just the developer trying to add a useful…

> It also had a debug command that wasn't authenticated that let you print the contents of any motd file in a folder. Except it didn't escape strings properly, so you could `../...` to escape out of that directory and print any file.

That's hilarious and showcases how un-sandboxed those plugins are.

Re: Temptations of an open-source Chrome extension developer (2021)

#342

Post by xmprt »

jkingsman wrote: post #239
r1ch wrote: post #100

Earlier quoted context omitted.

I used to have an extension that promised to never be sold or even updated beyond the initial release, since it was a one-liner that can't possibly ever need to change. The Chrome Web Store took it down after 5+ years, presumably because I never published an update so the the now-mandatory fields were empty.

Curious to know if they gave valid reasons or just "you don't update this enough and it's coming down" a la Apple's terrible 'policy'. I've got a few set-and-forget extensions I haven't uploaded a new package for in 5+ years but I have periodically had to log in (per email warning) and check a new box e.g. assert I'm not collecting user data or pledge compliance with a new privacy directive.

They usually don't require code updates but as the platform changes, they might have changing requirements or new policies that need to be acknowledged. I don't do extension development but I have a few apps and over the years I've had to rebuild them to target newer API versions, add data privacy policies, add child safety policies, etc., that weren't there when I first released the app. I haven't had to change any of the code though.

Re: Temptations of an open-source Chrome extension developer (2021)

#343

Post by dspillett »

chii wrote: post #240
karpierz wrote: post #217

Earlier quoted context omitted.

They're saying it's scarier that ad companies can figure out these things without the data because it means that you can't protect yourself by withholding your data.

> you can't protect yourself but what are you protecting yourself from? What's the threat model?

Firstly there is the emotional response: I don't want to be followed around in everything that I do for someone else's benefit, and I not at all convinced of arguments that targetted advertising is done for my benefit.

Then there is the fact that a large amount of data about me is being stored, possibly insecurely for people with even less scruples to analyse. I have very little to hide (white, middle class, straight, male, cis, no criminal activity beyond some unlicensed TV/film access, etc – there is little or nothing about me that would be frightening for anyone else to know) but there are many out there who do have things that could be (unfairly) held against them with terrible consequences. Consider women in Texas where there is effectively a reward/bounty program to encourage snitching on those who have had, or are considering, an abortion, or people in law enforcement who don't want certain groups to be able to derive their home address with any accuracy, people in one or more closets through fear of being ostracised from their family/community and left pennyless & without support, and so forth. I grew up with friends who were gay when it was still effectively illegal to be, despite what the Sexual Offences Act (1967) said, and when getting beaten up for being gay was almost acceptable (“act more straight, and it wouldn't have happened”: something a friend was once told by a policeman that saw no cause for arrest) – the fear of consequences from collected information “getting out” and/or being used to derive other information (true or otherwise) is real and for many people not at all irrational.

Back to my icky feelings, which are perhaps a little bit less rational: I wouldn't be happy with someone following me between shops, watching what I'm perusing, then to the pub and noting who I was there with, then back to my home, in order to be able to serve me relevant ads (perhaps for shoes that would be more comfortable for that much walking? or for condoms because they noticed I was accompanied by a female friend, and you never know, right, nudge nudge wink wink), and I'm not happy about the same happening in a more virtual environment. How do I trust that is really (or only) why I'm being followed? And I how do I know who else my stalker is selling news of my activity to?

[actually, the “I have little or nothing to fear” isn't entirely right – any of us could suffer from plain old identity theft in various ways]

Re: Temptations of an open-source Chrome extension developer (2021)

#344

Post by justsid »

extesy wrote: post #97
justsid wrote: post #87

Earlier quoted context omitted.

I really appreciate the transparency from you. I don't use Chrome anymore, but back in the day I absolutely loved Hover Zoom+ and my wife is still loving it to this day. It's a great extension and having read your comment and the linked Github issue, I feel even better about it. Thanks for your hard work.

Thank you for the kind words. I actually publish hoverzoom+ to Firefox and Edge as well (links are in the repo's readme) so you can use it there too.

Wow! This just made my day, thanks so much. I don’t know why I never bothered to check if there was a Firefox version. Thank you!

Re: Temptations of an open-source Chrome extension developer (2021)

#345

Post by nick-of-time »

Terr_ wrote: post #208
myshpa wrote: post #198

Earlier quoted context omitted.

> Advertising, by its very nature, is emotional manipulation with the goal of getting you to give up some of your money for something you most likely don't really need and won't improve your life all that much I've heard somewhere that ads are rich people screaming "give me money". (i know, i know, but i like it) > To me, that's evil. Bill Hicks on marketing: https://www.youtube.com/watch?v=tHEOGrkhDp0

> I've heard somewhere that ads are rich people screaming "give me money". That makes me think of this Paul Graham piece on "the PR industry, lurking like a huge, quiet submarine beneath the news." [0] [0] http://www.paulgraham.com/submarine.html

He makes one really good insight:

> If you really want to be a critical reader, it turns out you have to step back one step further, and ask not just whether the author is telling the truth, but why he's writing about this subject at all.

Followed quickly by being hopelessly naïve about the future:

> Whatever its flaws, the writing you find online is authentic. It's not mystery meat cooked up out of scraps of pitch letters and press releases, and pressed into molds of zippy journalese. It's people writing what they think.

Re: Temptations of an open-source Chrome extension developer (2021)

#346

Post by Chatting »

Kbelicius wrote: post #318
Chatting wrote: post #173

Earlier quoted context omitted.

It is legal[1] to require users to agree to data collection or pay a subscription. Some news sites have already begun to implement this scheme. [1] At least according to some countries' DPAs, and as long as the price is "fair". https://www.iubenda.com/en/help/24487-cookie-walls-gdpr

> It is legal[1] to require users to agree to data collection or pay a subscription. Some news sites have already begun to implement this scheme. From your link, almost at the top: "The cookie wall is a mechanism where the user has only one option to access the website: accept the processing of the cookies. The cookie wall is prohibited.". So no, requiring users to agree to data collection, per your article, is prohi…

You have to read the whole article though, not just stop at the first paragraph.

The article makes a distinction between cookie wall (accept or no access) and paywall[1] (accept or pay). The former is prohibited, the latter has been okay'd by several national DPAs.

> The Austrian, French and Danish DPAs have already indicated that the paywall system is a valid solution as long as the subscription to the site has a modest and fair cost so that it does not constrain the user’s free choice.

> The Spanish DPA indirectly shared its position implying that cookie walls can be used as long as the user has been clearly informed of the two available options for accessing the service: 1. accepting the use of cookies; or 2. another alternative, “not necessarily free of charge“, that doesn’t require giving consent to cookies.

[1] Not to be confused with the "hard" paywall (pay or no access) we see on some publications. They've just called it like that for lack of a better term.

Re: Temptations of an open-source Chrome extension developer (2021)

#347

Post by hiatus »

Buttons840 wrote: post #90
jstanley wrote: post #53

Earlier quoted context omitted.

But every time this comes up the threads are flooded with people saying it doesn't actually happen and the ad companies just work out what you're interested in by what you're browsing.

> the ad companies just work out what you're interested in The word "just" doesn't belong in that sentence. The ad companies being able to know things about you without actually listening to you is even more scary. Evil-Ad-Company Neo: "You're telling me I can know things about my customers by secretly listening to them?" Evil-Ad-Company Morpheus: "No Neo, I'm telling you that with the right license agreements, data…

> The ad companies being able to know things about you without actually listening to you is even more scary.

This has been true for years to the extent that the nature of your purchases can tell a lot about you. https://www.forbes.com/sites/kashmirhill/2012/02/16/how-targ...

Re: Temptations of an open-source Chrome extension developer (2021)

#348

Post by ummonk »

Phemist wrote: post #333
ummonk wrote: post #262

Earlier quoted context omitted.

When I worked at Meta, the execs said that many users think they're being spied on when they see ads based on a conversation they've had in real life, but the execs categorically denied that this could be happening, and said it's all just a coincidence. I thought this was a completely unfounded denial, since Meta had no way of auditing 3rd party apps on the user's phone, and it's perfectly plausible for another app t…

Wow what, facebook allows ad targeting based on a user's email?

Yup. The typical use case is e.g. if someone logs in to your e-commerce site with their email and looks at a product but doesn’t purchase, then you can show them an ad for that product to try to remind them to go back and buy it.

It’s a really creepy feature though that can easily be abused.

Re: Temptations of an open-source Chrome extension developer (2021)

#349

Post by unhammer »

Not that one should have to, but for Firefox you can

    cd .mozilla/firefox/$profile
    git init
    git add extensions
    git commit -am init
    echo '*.xpi diff=zip' >>.gitattributes
    echo '[diff "zip"]' >>.git/config
    echo ' textconv = unzip -c -a' >>.git/config
which at least lets you take a peek at what kind of nefarious updates you're getting.

Re: Temptations of an open-source Chrome extension developer (2021)

#350

Post by yomlica8 »

jabradoodle wrote: post #83
gregschlom wrote: post #62

Earlier quoted context omitted.

This matches the audio signature of the TV ad - basically, it's like Shazam, but for TV ads. It's currently not economically possible to listen to user's conversations, transcribe them to text, and serve ads based on that. It would cost orders of magnitude more in processing power than you could get from the extra sales. This might change in the future, of course

Wouldn't cost that much if the transcribing is done on device

There's this weird narrative I see that "computers just aren't powerful enough" to do things I remember them already doing on Pentium 1 class machines in the 90s.
Post reply on HN