JSON formatter Chrome plugin now closed and injecting adware • Hacker News Board

Re: JSON formatter Chrome plugin now closed and injecting adware

#131

Post by duskdozer » Sat, Apr 11, 2026, 1:58 PM UTC

grishka wrote: post #103

jimrandomh wrote: post #60

I think the main problem here is the ideology of software updating. Updates represent a tradeoff: On one hand there might be security vulnerabilities that need an update to fix, and developers don't want to receive bug reports or maintain server infrastructure for obsolete versions. On the other hand, the developer might make decisions users don't want, or turn even temporarily (as in a supply chain attack) or perman…

For me, the solution is simple: anything you download and run locally should not auto-update ever, period. Installing an update (or refusing one) should always be a conscious user action. Otherwise it's just a socially-accepted RCE backdoor.

Even without that, I can't afford to deal with the constant churn of UI changes and feature deprecation

Re: JSON formatter Chrome plugin now closed and injecting adware

#132

Post by duskdozer » Sat, Apr 11, 2026, 2:23 PM UTC

binaryturtle wrote: post #18

I guess you really need to unpack each and every extensions before installation and carefully inspect the code manually to see if it only would be doing what the extensions is advertising. Darn… and I thought that the JSLibCache extension was forcing every site into UTF-8 mode (even those that need to run with a legacy codepage) was a critical issue. A problem I encountered yesterday… took me a while to figure out to…

A lot of extensions are simple enough you can write your own *monkey user js

Re: JSON formatter Chrome plugin now closed and injecting adware

#133

Post by montroser » Sat, Apr 11, 2026, 2:42 PM UTC

drunkendog wrote: post #67

From the author on HN a couple years ago: > FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash o…

> I sometimes wish I had never put my name on it so I could just take the money without harming my reputation, but I did, so I’m stuck with being honourable.

This distills down to: "I don't want to be honourable." They signaled right from the beginning.

Re: JSON formatter Chrome plugin now closed and injecting adware

#134

Post by matheusmoreira » Sat, Apr 11, 2026, 3:15 PM UTC

lofaszvanitt wrote: post #117

oefrha wrote: post #107

Earlier quoted context omitted.

I’ve made quite popular FOSS dev tools and FOSS gaming companion tools. I don’t nag for donations in any case. Rather ironically, I found that dev tools generated close to zero donations while gaming companion tools generated decent donations (still nowhere close to time I put in if I go by consulting rate, but that wasn’t the goal). Devs just take other devs’ free work for granted. And bitch the most when you try to…

Exactly. The cultists are the loudest and at the same time wonder why Linux UI/UX and its apps is still subpar and why MacOS, where asking money for stuff is normal, has quite decent tooling that make your life much easier. At the end of the day the small amounts are the real thank you and biggest driver for the work you put into something.

> At the end of the day the small amounts are the real thank you and biggest driver for the work you put into something.

I wouldn't say it's the biggest driver but it did have an unexpectedly big effect.

Once upon a time, I decided to set up sponsorship on my GitHub repositories just because I had nothing to lose by doing so. Went about doing my thing, then someone posted it here and suddenly I had a sponsor.

It's not even close to paying my bills, and looking up the top projects in sponsorship revenue quickly disabused me of any notions of sponsored full time work. It still felt really nice that someone out there cared enough about my work to send me money.

Re: JSON formatter Chrome plugin now closed and injecting adware

#135

Post by MyUltiDev » Sat, Apr 11, 2026, 4:24 PM UTC

The thing that bothers me most about this story is that the binary on the Chrome Web Store and the public source on the repo have no enforced relationship at all. The store accepts a packaged extension and trusts the developer to say it matches the public code. I tried to reproduce the published build for a few extensions I actually depend on, and in most cases I could not, even when the maintainer was clearly acting in good faith. Firefox AMO at least asks for source and runs a diff against a clean build before they let it through, Chrome does not. If reproducible builds plus a signed attestation tying a store version to a commit are not the right answer here, what would actually catch the silent pivot from benign to malicious before users start getting injected ads?

Re: JSON formatter Chrome plugin now closed and injecting adware

#136

Post by andrei_says_ » Sat, Apr 11, 2026, 6:19 PM UTC

I wonder if there’s a central repository of now exploited chrome extensions?

The chrome team does not seem to see security as a high enough priority.

Re: JSON formatter Chrome plugin now closed and injecting adware

#137

Post by smrtinsert » Sat, Apr 11, 2026, 6:40 PM UTC

drunkendog wrote: post #67

From the author on HN a couple years ago: > FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash o…

The cost of building your own tool here is practically 0 these days. Why even bother trusting another party at all.

Re: JSON formatter Chrome plugin now closed and injecting adware

#138

Post by gaythread » Sat, Apr 11, 2026, 7:30 PM UTC

drunkendog wrote: post #67

From the author on HN a couple years ago: > FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash o…

[flagged]

Re: JSON formatter Chrome plugin now closed and injecting adware

#139

Post by SV_BubbleTime » Sat, Apr 11, 2026, 8:09 PM UTC

henry2023 wrote: post #57

brianmcnulty wrote: post #20

Earlier quoted context omitted.

I heard that JWTs are 5x the price of JSON tokens but only 3x if you have JSON ForULTRA+ (new) (for work or school).

Fortunately, Microsoft C# Copilot 2 Pro is already bundled with JSON forULTRA+ for free. (Not to be confused with Microsoft C# Copilot Pro)

Are you talking about the Copilot 2 Legacy But Also Preview version? Because my TPM module’s circuit board orientation doesn’t support that yet.

Re: JSON formatter Chrome plugin now closed and injecting adware

#140

Post by pfg_ » Sat, Apr 11, 2026, 8:10 PM UTC

armadyl wrote: post #113

teruakohatu wrote: post #71

Earlier quoted context omitted.

It is widely known that Manifest V3 reduces extensions ability to perform SoTA ad blocking. It limits heuristic based filtering, under a guise of privacy.

It was more of a security related change. MV3 overall objectively is far better for browser security than MV2. MV2 was essentially giving extensions a full on free RCE pathway. MV3 is what it should’ve been from the start imo.

MV3 still allows you to run content scripts, which can inject any javascript into any webpage. From there, you can do anything you want. You can steal passwords, tokens, show popups, redirect, ... etc. Preventing extensions from dynamically modifying network requests doesn't change that.