Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSON formatter Chrome plugin now closed and injecting adware

github.com

Post reply on HN
Print view View original

51–60 of 146 posts

Re: JSON formatter Chrome plugin now closed and injecting adware

#51

Post by tadfisher »

maxloh wrote: post #39
tadfisher wrote: post #7

WebExtension permissions are fucking broken if the set of permissions necessary to reformat and style JSON snippets is sufficient to inject network-capable Javascript code into any page. If basically any worthwhile extension can be silently updated to inject tags anywhere, then it's time to call this a failed experiment and move on. Bake UBlock and password-management APIs into the browser. Stop the madness.

To install a JSON formatter, you need to grant the following access: 1. Access to the page DOM to read the raw JSON content. 2. Permission to modify the DOM to display the formatted results. Unfortunately, these requirements necessitate broad host permissions, which allow an extension to inject ads or track user behaviors. There is no alternative way to define a strict security boundary that allows these specific per…

> There is no alternative way to define a strict security boundary that allows these specific permissions while preventing abuses.

Maybe you're right, and there isn't. Does it not follow that we should probably require extensive review and open-source reproducible builds before allowing any such extension on the browser extension stores?

Re: JSON formatter Chrome plugin now closed and injecting adware

#52

Post by jkl5xx »

fg137 wrote: post #15
jkl5xx wrote: post #2

Noticed a suspicious element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in the chrome inspector today. Turns out about a month ago, the popular open source [JSON Formatter chrome extension]( https://chromewebstore.google.com/detail/json-formatter/bcji... ) went closed source and started injecting adware into checkout pages. Also seems to be doing some geolocation tracking. I didn't see this come up on h…

How did you "notice" a suspicious element in the inspector? Do you routinely look at the DOM?

I did webdev for a long time, so yeah. If you want the story, I was looking into guix on asahi and ended up on https://www.asahi-guix.org/ which didn’t load anything, so I checked the page source and noticed the element.

Re: JSON formatter Chrome plugin now closed and injecting adware

#53

Post by mirekrusin »

arikrahman wrote: post #47
endofreach wrote: post #44

Earlier quoted context omitted.

Lol. I mean what the hell is this. I have this weird feeling this guy got tricked by an LLM into thinking this move is smart... "what you've built is not just a json formatter, it's the next big...". I mean good luck to that guy. Everyone should have a shot at turning his free work into something worth it. I think i've been using that extension as well. But yeah, i never cared enough to know if it was this one. But i…

I what feature can even be added to the product that won't be immediately replicated in a fork?

Nobody knows what but everybody knows they won't be replicated.

Chat with your json?

Facebook but for jsons?

Send json to blockchain?

It's so bad that it's exciting, can't wait for an update.

Re: JSON formatter Chrome plugin now closed and injecting adware

#54

Post by j1elo »

jkl5xx wrote: post #2

Noticed a suspicious element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in the chrome inspector today. Turns out about a month ago, the popular open source [JSON Formatter chrome extension]( https://chromewebstore.google.com/detail/json-formatter/bcji... ) went closed source and started injecting adware into checkout pages. Also seems to be doing some geolocation tracking. I didn't see this come up on h…

> went closed source and started injecting adware into checkout pages ... [and] geolocation tracking.

Maybe we should resort to blame and shame publicly this sort of actions. DDoS their servers, fill their inbox with spam, review-bomb anything they do. Public court justice a la 4chan trolling. Selling out is a lawful decision, of course, but there is no reason it shouldn't come with a price tag of becoming publicly hated. In fact, it might help people who are on the verge to stay on the ethical side of things (very ironically).

I'm just kinda joking (but wouldn't hate it if I was rugpulled and the person that did it got such treatment)

Re: JSON formatter Chrome plugin now closed and injecting adware

#55

Post by cyanydeez »

hamdingers wrote: post #34
brianmcnulty wrote: post #20

Earlier quoted context omitted.

I heard that JWTs are 5x the price of JSON tokens but only 3x if you have JSON ForULTRA+ (new) (for work or school).

Legally speaking that's for entertainment purposes only

You have to add the final "]" or "}" yourself but json strings are free!

Re: JSON formatter Chrome plugin now closed and injecting adware

#56

Post by pigpop »

j1elo wrote: post #54
jkl5xx wrote: post #2

Noticed a suspicious element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in the chrome inspector today. Turns out about a month ago, the popular open source [JSON Formatter chrome extension]( https://chromewebstore.google.com/detail/json-formatter/bcji... ) went closed source and started injecting adware into checkout pages. Also seems to be doing some geolocation tracking. I didn't see this come up on h…

> went closed source and started injecting adware into checkout pages ... [and] geolocation tracking. Maybe we should resort to blame and shame publicly this sort of actions. DDoS their servers, fill their inbox with spam, review-bomb anything they do. Public court justice a la 4chan trolling. Selling out is a lawful decision, of course, but there is no reason it shouldn't come with a price tag of becoming publicly h…

Calm down, just spreading the word that the extension is adware and having everyone uninstall it is sufficient to demonstrate that this move was a mistake. Trying to ruin someone's life is going completely overboard. Repercussions should be proportionate, you don't shoot people for stealing a candy bar.

Re: JSON formatter Chrome plugin now closed and injecting adware

#57

Post by henry2023 »

brianmcnulty wrote: post #20
panstromek wrote: post #14

Earlier quoted context omitted.

Depends on how many JSON tokens you need to format. I recommend getting JSON ForMAX+ with 200k tokens and 100k sign in bonus.

I heard that JWTs are 5x the price of JSON tokens but only 3x if you have JSON ForULTRA+ (new) (for work or school).

Fortunately, Microsoft C# Copilot 2 Pro is already bundled with JSON forULTRA+ for free. (Not to be confused with Microsoft C# Copilot Pro)

Re: JSON formatter Chrome plugin now closed and injecting adware

#60

Post by jimrandomh »

I think the main problem here is the ideology of software updating. Updates represent a tradeoff: On one hand there might be security vulnerabilities that need an update to fix, and developers don't want to receive bug reports or maintain server infrastructure for obsolete versions. On the other hand, the developer might make decisions users don't want, or turn even temporarily (as in a supply chain attack) or permanently (as in selling off control of a browser extension).

In the case of small browser extensions from individual developers, I think the tradeoff is such that you should basically never allow auto-updating. Unfortunately Google runs a Chrome extension marketplace that doesn't work that way, and worse, Google's other business gives them an ideology that doesn't let them recognize that turning into adware is a transgression that should lead to being kicked out of their store. I think that other than a small number of high-visibility long-established extensions, you should basically never install anything from there, and if you want a browser extension you should download its source code and install it locally as an unpacked extension.

(Firefox's extension marketplace is less bad, but tragically, Firefox doesn't allow you to bypass its marketplace and load extensions that you build from source yourself.)

Post reply on HN