Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSON formatter Chrome plugin now closed and injecting adware

github.com

Post reply on HN
Print view View original

111–120 of 146 posts

Re: JSON formatter Chrome plugin now closed and injecting adware

#111

Post by mjmas »

The author's response to one of the reviews:

https://chromewebstore.google.com/review-reply/b4a787df-64e5...

> Give Freely is not spyware/adware or any kind of 'scam'. It's an optional donation appeal that asks you (if you happen to visit a retailer which happens to be a Give Freely partner) to click a button to donate unclaimed affiliate fees, with most of the money going to Code.org or another charity of your choice. I've met the Give Freely team and trust them. It does not collect any PII or browsing activity, and it doesn't overwrite other affiliate/voucher codes so it never costs you anything. If you find the donation popup too intrusive/annoying you can disable it forever in the extension options, or in the donation popup itself.

> Code.org is a good cause that's relevant to a lot of the same people who use this extension regularly, and clicking a Give Freely donate button is a genuinely free and anonymous way to show your support for both, if you want to. If you don't like it you can turn it off, or if it makes you more comfortable you can switch to JSON Formatter Classic, which has no Give Freely code and corresponds with the v0.8 branch in my archived json-formatter GitHub repo. Or try one of the many forks or alternatives available on the store.

> JSON Formatter Classic: https://chromewebstore.google.com/detail/json-formatter-clas...

Re: JSON formatter Chrome plugin now closed and injecting adware

#112

Post by jkl5xx »

mjmas wrote: post #111

The author's response to one of the reviews: https://chromewebstore.google.com/review-reply/b4a787df-64e5... > Give Freely is not spyware/adware or any kind of 'scam'. It's an optional donation appeal that asks you (if you happen to visit a retailer which happens to be a Give Freely partner) to click a button to donate unclaimed affiliate fees, with most of the money going to Code.org or another charity of your choic…

Regardless of the intent, it was poorly executed and highlights security gaps inherent in the distribution model of browser extensions.

Re: JSON formatter Chrome plugin now closed and injecting adware

#113

Post by armadyl »

teruakohatu wrote: post #71
Aurornis wrote: post #63

Earlier quoted context omitted.

Several of the top Chrome extensions on their charts are ad blockers: https://chromewebstore.google.com/top-charts/popular?hl=en They have an API basically dedicated to this: https://developer.chrome.com/docs/extensions/reference/api/d... I think you may have been confused about the Manifest V3 API changes, which were controversial because they didn't support every feature of the old API. The mainstream ad blockers a…

It is widely known that Manifest V3 reduces extensions ability to perform SoTA ad blocking. It limits heuristic based filtering, under a guise of privacy.

It was more of a security related change. MV3 overall objectively is far better for browser security than MV2. MV2 was essentially giving extensions a full on free RCE pathway. MV3 is what it should’ve been from the start imo.

Re: JSON formatter Chrome plugin now closed and injecting adware

#114

Post by userbinator »

efskap wrote: post #91
jimrandomh wrote: post #60

I think the main problem here is the ideology of software updating. Updates represent a tradeoff: On one hand there might be security vulnerabilities that need an update to fix, and developers don't want to receive bug reports or maintain server infrastructure for obsolete versions. On the other hand, the developer might make decisions users don't want, or turn even temporarily (as in a supply chain attack) or perman…

>Firefox doesn't allow you to bypass its marketplace and load extensions that you build from source yourself It's less than ideal but you can 1) load extensions temporarily in about:debugging, 2) turn off xpinstall.signatures.required in nightly or dev edition to install them for good or 3) sign on addons.mozilla.org without publishing to the marketplace.

Or 4) patch the checks out yourself. As they say, "Firefox is open-source for a reason."

Re: JSON formatter Chrome plugin now closed and injecting adware

#115

Post by dgb23 »

madeofpalk wrote: post #27
fg137 wrote: post #15

Earlier quoted context omitted.

How did you "notice" a suspicious element in the inspector? Do you routinely look at the DOM?

I do. Then again, I’m a web developer so looking at the DOM is my day job.

I just imagined that this was an exclusive statement.

„What do you do all day?“

„Looking at the DOM. Currently there are too many divs, but the situation seems fine.“

Re: JSON formatter Chrome plugin now closed and injecting adware

#116

Post by ozim »

userbinator wrote: post #114
efskap wrote: post #91

Earlier quoted context omitted.

>Firefox doesn't allow you to bypass its marketplace and load extensions that you build from source yourself It's less than ideal but you can 1) load extensions temporarily in about:debugging, 2) turn off xpinstall.signatures.required in nightly or dev edition to install them for good or 3) sign on addons.mozilla.org without publishing to the marketplace.

Or 4) patch the checks out yourself. As they say, "Firefox is open-source for a reason."

It might actually be something I would do especially as I could probably vibe code and vibe build it.

Will see if I get time to do so.

Re: JSON formatter Chrome plugin now closed and injecting adware

#117

Post by lofaszvanitt »

oefrha wrote: post #107
lofaszvanitt wrote: post #105

Earlier quoted context omitted.

That was the sales pitch. And it worked. Well, all the big tech corps done the same. Nothing to see here. OSS needs proper funding infrastructure. Which all the big players shit on. So, I can't judge him on that. His work, his time.

I’ve made quite popular FOSS dev tools and FOSS gaming companion tools. I don’t nag for donations in any case. Rather ironically, I found that dev tools generated close to zero donations while gaming companion tools generated decent donations (still nowhere close to time I put in if I go by consulting rate, but that wasn’t the goal). Devs just take other devs’ free work for granted. And bitch the most when you try to…

Exactly. The cultists are the loudest and at the same time wonder why Linux UI/UX and its apps is still subpar and why MacOS, where asking money for stuff is normal, has quite decent tooling that make your life much easier.

At the end of the day the small amounts are the real thank you and biggest driver for the work you put into something.

Re: JSON formatter Chrome plugin now closed and injecting adware

#118

Post by babuskov »

jimrandomh wrote: post #60

I think the main problem here is the ideology of software updating. Updates represent a tradeoff: On one hand there might be security vulnerabilities that need an update to fix, and developers don't want to receive bug reports or maintain server infrastructure for obsolete versions. On the other hand, the developer might make decisions users don't want, or turn even temporarily (as in a supply chain attack) or perman…

If the extension does something that isn't changing, like JSON Formatting, I guess it's best to disable updates right after you install it.

I just did this for all extensions I have in Firefox. Not sure about extensions like uBlock though? Doesn't it fetch new lists of sites to block or something like that? Or is that done separately from updates?

Re: JSON formatter Chrome plugin now closed and injecting adware

#119

Post by panstromek »

brianmcnulty wrote: post #20
panstromek wrote: post #14

Earlier quoted context omitted.

Depends on how many JSON tokens you need to format. I recommend getting JSON ForMAX+ with 200k tokens and 100k sign in bonus.

I heard that JWTs are 5x the price of JSON tokens but only 3x if you have JSON ForULTRA+ (new) (for work or school).

That makes sense, because JWT is base64 encoded, and those base64 tokens are bigger and more expensive. JWT has 3 parts, so it's 3x more expensive, obviously.

Re: JSON formatter Chrome plugin now closed and injecting adware

#120

Post by Ygg2 »

Legend2440 wrote: post #48
Animats wrote: post #43

Earlier quoted context omitted.

Google's "Manifest 3" rules, vs. ad blocking, in Ars Technica.[1] Did the JSON formatter with ads get kicked out of the extension store yet? [1] https://arstechnica.com/gadgets/2024/08/chromes-manifest-v3-...

Everybody freaked out about Manifest v3, but I'm running Chrome + uBlock and still not seeing any ads. Seems like a nothingburger to me.

Water is merely 49C, said the frog. It's not even 100C. I'll stay.

Google really is slow boiling Internet until everyone forgets you can have stuff without ads.

Post reply on HN