Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSON formatter Chrome plugin now closed and injecting adware

github.com

Post reply on HN
Print view View original

41–50 of 146 posts

Re: JSON formatter Chrome plugin now closed and injecting adware

#41

Post by Legend2440 »

Animats wrote: post #29
jkl5xx wrote: post #2

Noticed a suspicious element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in the chrome inspector today. Turns out about a month ago, the popular open source [JSON Formatter chrome extension]( https://chromewebstore.google.com/detail/json-formatter/bcji... ) went closed source and started injecting adware into checkout pages. Also seems to be doing some geolocation tracking. I didn't see this come up on h…

It's OK to inject ads, but not OK to remove them, under Google's current policies.

Well no, actually. Both halves of that statement are false.

Injecting ads will get you removed from the extension store if caught, while adblockers are advertised on the front page of the store.

Re: JSON formatter Chrome plugin now closed and injecting adware

#42

Post by vadansky »

binaryturtle wrote: post #18

I guess you really need to unpack each and every extensions before installation and carefully inspect the code manually to see if it only would be doing what the extensions is advertising. Darn… and I thought that the JSLibCache extension was forcing every site into UTF-8 mode (even those that need to run with a legacy codepage) was a critical issue. A problem I encountered yesterday… took me a while to figure out to…

Or just use it as an example to vibecode your own. Extension laundering through vibecoding.

Re: JSON formatter Chrome plugin now closed and injecting adware

#43

Post by Animats »

Legend2440 wrote: post #41
Animats wrote: post #29

Earlier quoted context omitted.

It's OK to inject ads, but not OK to remove them, under Google's current policies.

Well no, actually. Both halves of that statement are false. Injecting ads will get you removed from the extension store if caught, while adblockers are advertised on the front page of the store.

Google's "Manifest 3" rules, vs. ad blocking, in Ars Technica.[1]

Did the JSON formatter with ads get kicked out of the extension store yet?

[1] https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-...

Re: JSON formatter Chrome plugin now closed and injecting adware

#44

Post by endofreach »

jansommer wrote: post #13

Guy talks about switching to the "Classic" version if > you just want a simple, open source, local-only JSON-formatting extension that won't receive updates. Wow that sounds like a tough choice. JSON formatting is moving at such a fast pase that I don't know if I should pay a JSON formatting SaaS a monthly subscription, or if I really can live without updates.

Lol. I mean what the hell is this. I have this weird feeling this guy got tricked by an LLM into thinking this move is smart... "what you've built is not just a json formatter, it's the next big...".

I mean good luck to that guy. Everyone should have a shot at turning his free work into something worth it. I think i've been using that extension as well. But yeah, i never cared enough to know if it was this one. But i do hope there are others who did & he can surprise me and turn this user base into customers of a commercial product. If he pulls that of, i'd be truly impressed.

Re: JSON formatter Chrome plugin now closed and injecting adware

#45

Post by tadfisher »

Groxx wrote: post #9
tadfisher wrote: post #7

WebExtension permissions are fucking broken if the set of permissions necessary to reformat and style JSON snippets is sufficient to inject network-capable Javascript code into any page. If basically any worthwhile extension can be silently updated to inject tags anywhere, then it's time to call this a failed experiment and move on. Bake UBlock and password-management APIs into the browser. Stop the madness.

- click install - "It can: Read and change all your data on all websites" It's not alarming sounding enough for what that implies, but "it can trigger requests under its control" seems fairly obvious from that. The permission it uses to inject ads can be used to inject ads (or block them). Why a JSON formatter needs any permission at all is something anyone installing it should be asking themselves. --- This is not m…

"Read and change data on all websites" does not, to me, imply "make network requests on the user's behalf". Yes, I can put on my developer hat and surmise that, under the hood, the extension's injected payload can make network requests by adding elements to the DOM. No user will ever understand this, no matter how much you try to educate them through the permission prompt.

This ends up being significantly worse than any other widely-used permissions system, because injected scripts act as the website, not the extension. If you've already granted location permission to a website, then it is effectively granted to the extension. There is no other ecosystem that works like this.

And to do basically anything worthwhile, including certain types of content blocking, you need this God permission that essentially disables the WebExtension permissions system. This should never have been greenlit in the first place.

Re: JSON formatter Chrome plugin now closed and injecting adware

#46

Post by SquareWheel »

Animats wrote: post #43
Legend2440 wrote: post #41

Earlier quoted context omitted.

Well no, actually. Both halves of that statement are false. Injecting ads will get you removed from the extension store if caught, while adblockers are advertised on the front page of the store.

Google's "Manifest 3" rules, vs. ad blocking, in Ars Technica.[1] Did the JSON formatter with ads get kicked out of the extension store yet? [1] https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-...

Manifest 3 explicitly enables ad blocking through the declarativeNetRequest API. It's trivial to do so, and many blockers exist in the Chrome Web Store.

Re: JSON formatter Chrome plugin now closed and injecting adware

#47

Post by arikrahman »

endofreach wrote: post #44
jansommer wrote: post #13

Guy talks about switching to the "Classic" version if > you just want a simple, open source, local-only JSON-formatting extension that won't receive updates. Wow that sounds like a tough choice. JSON formatting is moving at such a fast pase that I don't know if I should pay a JSON formatting SaaS a monthly subscription, or if I really can live without updates.

Lol. I mean what the hell is this. I have this weird feeling this guy got tricked by an LLM into thinking this move is smart... "what you've built is not just a json formatter, it's the next big...". I mean good luck to that guy. Everyone should have a shot at turning his free work into something worth it. I think i've been using that extension as well. But yeah, i never cared enough to know if it was this one. But i…

I what feature can even be added to the product that won't be immediately replicated in a fork?

Re: JSON formatter Chrome plugin now closed and injecting adware

#48

Post by Legend2440 »

Animats wrote: post #43
Legend2440 wrote: post #41

Earlier quoted context omitted.

Well no, actually. Both halves of that statement are false. Injecting ads will get you removed from the extension store if caught, while adblockers are advertised on the front page of the store.

Google's "Manifest 3" rules, vs. ad blocking, in Ars Technica.[1] Did the JSON formatter with ads get kicked out of the extension store yet? [1] https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-...

Everybody freaked out about Manifest v3, but I'm running Chrome + uBlock and still not seeing any ads. Seems like a nothingburger to me.

Re: JSON formatter Chrome plugin now closed and injecting adware

#49

Post by SquareWheel »

michaelt wrote: post #8
tadfisher wrote: post #7

WebExtension permissions are fucking broken if the set of permissions necessary to reformat and style JSON snippets is sufficient to inject network-capable Javascript code into any page. If basically any worthwhile extension can be silently updated to inject tags anywhere, then it's time to call this a failed experiment and move on. Bake UBlock and password-management APIs into the browser. Stop the madness.

Given that the worlds biggest browser is made by the worlds biggest ad company, the chances it’ll ever bake in a working ad blocker are approximately zero.

Chromium does include an ad blocker for "intrusive ads". ie. Those using many resources, flashing, auto-playing sounds, or otherwise behaving badly.

https://support.google.com/chrome/answer/7632919

Re: JSON formatter Chrome plugin now closed and injecting adware

#50

Post by maxloh »

strictnein wrote: post #25
tadfisher wrote: post #7

WebExtension permissions are fucking broken if the set of permissions necessary to reformat and style JSON snippets is sufficient to inject network-capable Javascript code into any page. If basically any worthwhile extension can be silently updated to inject tags anywhere, then it's time to call this a failed experiment and move on. Bake UBlock and password-management APIs into the browser. Stop the madness.

Been researching extensions for a while now at the day job and I'm preparing some disclosures to the major browser vendors. The amount of absolute clusterfuckery in browser extensions is endless. One of the biggest issues is with how extensions define their permissions and capabilities in their manfiest.json files. I've reviewed thousands of these now, and probably only 5-10% of extensions actually get it right. Ther…

For context, the latest version of extension spec (Manifest V3) is just 1.5 years old. It isn't something old or legacy.
Post reply on HN