Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSON formatter Chrome plugin now closed and injecting adware

github.com

Post reply on HN
Print view View original

91–100 of 146 posts

Re: JSON formatter Chrome plugin now closed and injecting adware

#91

Post by efskap »

jimrandomh wrote: post #60

I think the main problem here is the ideology of software updating. Updates represent a tradeoff: On one hand there might be security vulnerabilities that need an update to fix, and developers don't want to receive bug reports or maintain server infrastructure for obsolete versions. On the other hand, the developer might make decisions users don't want, or turn even temporarily (as in a supply chain attack) or perman…

>Firefox doesn't allow you to bypass its marketplace and load extensions that you build from source yourself

It's less than ideal but you can 1) load extensions temporarily in about:debugging, 2) turn off xpinstall.signatures.required in nightly or dev edition to install them for good or 3) sign on addons.mozilla.org without publishing to the marketplace.

Re: JSON formatter Chrome plugin now closed and injecting adware

#92

Post by leptons »

fg137 wrote: post #66
jkl5xx wrote: post #52

Earlier quoted context omitted.

I did webdev for a long time, so yeah. If you want the story, I was looking into guix on asahi and ended up on https://www.asahi-guix.org/ which didn’t load anything, so I checked the page source and noticed the element.

Thanks. Not sure what's with the downvotes. That was a genuine question. (I used to do a lot of web development and probably know dev tools better than most people here. However I almost never look at the DOM of a webpage I don't own)

I frequently look at the DOM of webpages, so that I can bend them to my will.

There's always some things about practically all websites are frustrating. I fix that with custom CSS and/or Javascript that runs when I load specific sites that I use frequently. I can turn a cluttered site into a streamlined site for my needs. I also block a lot of ads, popups and other annoyances this way.

Re: JSON formatter Chrome plugin now closed and injecting adware

#94

Post by eviks »

FergusArgyll wrote: post #68
Animats wrote: post #43

Earlier quoted context omitted.

Google's "Manifest 3" rules, vs. ad blocking, in Ars Technica.[1] Did the JSON formatter with ads get kicked out of the extension store yet? [1] https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-...

ublock origin light is featured in the chrome web store.

But it isn't as featureful!

Re: JSON formatter Chrome plugin now closed and injecting adware

#96

Post by eviks »

munificent wrote: post #17
jkl5xx wrote: post #2

Noticed a suspicious element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in the chrome inspector today. Turns out about a month ago, the popular open source [JSON Formatter chrome extension]( https://chromewebstore.google.com/detail/json-formatter/bcji... ) went closed source and started injecting adware into checkout pages. Also seems to be doing some geolocation tracking. I didn't see this come up on h…

> I feel like browser extension marketplaces are a failed experiment. People rightly criticize all of the problems around vendor-lock-in and rent-seeking with platform app stores, but this is a good example that they do indeed provide some value in terms of filtering out malware. The degree to which they are successful at that and add enough value to overcome the downsides is an open question. But it's clear that in…

> that have auto-update functionality built in

The vendors are the ones who built it in!

Re: JSON formatter Chrome plugin now closed and injecting adware

#97

Post by eviks »

hybirdss wrote: post #72

just went through all my github actions and pinned them to commit SHAs after reading this. same problem — if someone pushes to @main your CI blindly runs it. auto-update anything is basically handing someone a key to your house and hoping they stay nice forever

Fyi you can add zizmor that warns about things like this and add a repo config that futures shas so that a mistake can't happen in the future (but not sure if you can have the setting globally)

Re: JSON formatter Chrome plugin now closed and injecting adware

#98

Post by [deleted] »

jimrandomh wrote: post #60

I think the main problem here is the ideology of software updating. Updates represent a tradeoff: On one hand there might be security vulnerabilities that need an update to fix, and developers don't want to receive bug reports or maintain server infrastructure for obsolete versions. On the other hand, the developer might make decisions users don't want, or turn even temporarily (as in a supply chain attack) or perman…

[deleted]

Re: JSON formatter Chrome plugin now closed and injecting adware

#100

Post by benatkin »

This should be hurting the reputation of Chrome Web Store more than it is hurting the reputation of Open Source browser extensions. It's impossible to keep tabs on all Open Source developers, so a highly trusted platform like Fedora or installing and updating things one by one is needed.

It's far from ideal, but I've been meaning to start using one personal meta-extension so I can have ctrl-d on Grok delete the next character, do my own custom readability overlays, and other stuff that comes to mind. It would have a clear association between sites and customizations, and possibly sandboxed code (e. g. WebAssembly).

Post reply on HN