Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

arstechnica.com

Post reply on HN
Print view View original

91–100 of 111 posts

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#91

Post by bzbarsky »

mjn wrote: post #43
ufmace wrote: post #5

This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If…

Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating but with some kind of human quality assurance. Two systems that manage to pull that off from very different cultural/economic starting points are Apple's app store, and Debian's software repository. The Google model of an auto-updating but un-QA'd app store doesn't work for me, because it combines two things I r…

This is what happens with AMO-hosted Firefox extensions. Whenever the extension author pushes out an update, it first has to go through review as described at https://addons.mozilla.org/en-US/developers/docs/policies/re...

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#92

Post by chronic25 »

unbeli wrote: post #87
dictum wrote: post #86

Earlier quoted context omitted.

What exactly are companies trying to achieve with very precise, self-healing tracking methods?

Serve you more relevant ads? I don't really know. Which companies do you mean anyway? And what are these self-healing tracking methods?

Companies like Google.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#93

Post by ChikkaChiChi »

How about a little 'Stranger Danger' prevention as well?

Don't run extensions from sources you don't trust in a browser profile you need to trust.

I have one profile for development and one for browsing. development browser can get any old extension but the normal browser gets extensions from known, trusted companies like Google and LastPass.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#94

Post by nikcub »

unbeli wrote: post #85
nikcub wrote: post #77

Earlier quoted context omitted.

I achieve this by having multiple users in Chrome. My main user is signed into my google account and has no extensions installed and all plugins disabled, I only access gmail and google services with it. My second user account is logged into basic services like HN, reddit, amazon and has only adblock and disconnect installed. A third user is not logged in anywhere and has adblock and a half-dozen other extensions ins…

What exactly are you trying to achieve with that, if I may ask?

security and privacy - separate rings of trust for different websites. to me the idea of trusting every website on the internet with all of your cookies, extensions and plugins is crazy.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#95

Post by aboodman »

hackinthebochs wrote: post #3

I was thinking about this just the other day. The movement towards auto-update-everything is a massive security breech. Browser extensions are a prime example. So much of what we do is centered around the browser, and yet we allow essentially random pieces of code complete access to all that activity. Even worse, this code is allowed to download and run new versions without any user interaction. Needless to say, the…

If a piece of software can connect to the internet, it can implement its own autoupdate. For extensions it would be trivial. People even commonly did it with Greasemonkey scripts.

The reason Chrome includes this functionality is because the hand-rolled solutions people come up with frequently have security problems.

Also, auto update gives good developers a way to fix their own security bugs when they are discovered.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#97

Post by esrauch »

hackinthebochs wrote: post #89
ufmace wrote: post #5

This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If…

I don't understand the appeal of updating software at all. Once a piece of code becomes feature complete for my purposes I don't ever want it to change. Change just means more things break, features disappear, or the app becomes bloated, and now apparently, may start injecting ads. I uninstalled noscript years ago when it started updating twice a week with apparently miniscule changes just to pop up its ad filled lan…

Every piece of software I use is broken in some way. Auto updates allow me to hope that they are a little less broken each day.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#98

Post by hackinthebochs »

esrauch wrote: post #97
hackinthebochs wrote: post #89

Earlier quoted context omitted.

I don't understand the appeal of updating software at all. Once a piece of code becomes feature complete for my purposes I don't ever want it to change. Change just means more things break, features disappear, or the app becomes bloated, and now apparently, may start injecting ads. I uninstalled noscript years ago when it started updating twice a week with apparently miniscule changes just to pop up its ad filled lan…

Every piece of software I use is broken in some way. Auto updates allow me to hope that they are a little less broken each day.

My philosophy is it's not broken if I don't notice it.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#99

Post by hackinthebochs »

aboodman wrote: post #95
hackinthebochs wrote: post #3

I was thinking about this just the other day. The movement towards auto-update-everything is a massive security breech. Browser extensions are a prime example. So much of what we do is centered around the browser, and yet we allow essentially random pieces of code complete access to all that activity. Even worse, this code is allowed to download and run new versions without any user interaction. Needless to say, the…

If a piece of software can connect to the internet, it can implement its own autoupdate. For extensions it would be trivial. People even commonly did it with Greasemonkey scripts. The reason Chrome includes this functionality is because the hand-rolled solutions people come up with frequently have security problems. Also, auto update gives good developers a way to fix their own security bugs when they are discovered.

We should be asking ourselves why we allow extensions with so much power and no meaningful security model. Auto update is a misfeature if I've ever seen one (again for anything but the most critical pieces of software).

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#100

Post by aboodman »

hackinthebochs wrote: post #99
aboodman wrote: post #95

Earlier quoted context omitted.

If a piece of software can connect to the internet, it can implement its own autoupdate. For extensions it would be trivial. People even commonly did it with Greasemonkey scripts. The reason Chrome includes this functionality is because the hand-rolled solutions people come up with frequently have security problems. Also, auto update gives good developers a way to fix their own security bugs when they are discovered.

We should be asking ourselves why we allow extensions with so much power and no meaningful security model. Auto update is a misfeature if I've ever seen one (again for anything but the most critical pieces of software).

Autoupdate is not a "feature", it's a consequence of Turing completeness combined with network access. Any platform that has these two properties has autoupdate, and there's no technical way to prevent it.

The autoupdate feature exposed to Chrome extensions is not there to make autoupdate possible, it's there to prevent developers from shooting themselves in the foot by implementing their own autoupdate insecurely. It's similar to a platform providing crypto libraries rather than letting developers implement crypto themselves.

The only way to try and prevent software from autoupdating is with manual review, which is what Apple does with iOS. However that has a whole other host of problems.

As for security model: I don't know how to measure "meaningful", but Chrome extensions have the most fine-grained security model of any extension platform. In fact, it is more fine-grained than most general purpose software platforms:

http://developer.chrome.com/extensions/permission_warnings.h...

The problem that started this thread is real, but it is not solved by disabling autoupdate (which is impossible) or adding more "security model" to the platform.

In fact the problem is very deep: How do you balance the desire to allow flexible software on your platform (adblocking, network stack interjection, manipulation of the user interface, etc), with the desire to limit the potential harm malicious actors can do? These two goals are in conflict. Existing best answers that humanity has come up with include some combination of "manual or automated review", "social signals" (stars, reviews from your network, etc), "blacklisting", "controlling access to the platform" (iOS apps can only be deployed in large numbers through the store), and "limit the power of the platform where possible with clever user interfaces" (the file upload button in HTML is a classic example).

Post reply on HN