This probably isn't a popular view for the HN crowd but at this point I'm convinced that for 90% of users, browser extensions are an anti-feature doing way more harm than good.
Google purges bad extensions from Chrome
81–90 of 93 posts
Re: Google purges bad extensions from Chrome
#82Earlier quoted context omitted.
Could you give some examples of malware that you reported that are still there? What conditions do you use to classify extensions as malware?
A good example of Vosteran New Tab. Almost two million users, none or near none of which are consensual users. Nobody I've ever uninstalled that from ever intended to install it. It hijacks your new tab page and search. Interestingly enough, Vosteran also produces a rogue fork of Chrome which makes Vosteran's own search/ad platform built-in and unavoidable. Said rogue fork is also installed without users' permission.…
Hm, let's take a look at Vosteran. From Wikipedia[1]: "Vosteran is a browser hijacker that changes a browser's home page and default search provider to vosteran.com. This infection is essentially distributed bundled with other third-party applications. Vosteran carries the PUP virus. The identity of Vosteran is protected by privacyprotect.org from Australia."
Okay, so it's malware. Let's check out their webpage[2]! Hm, they give a physical address at 28 Lilienbulm St. in Tel Aviv... as an image, to avoid search engines. Let's look at their "how-to-get-rid-of-this-crap-I-don't-want" process[3], which "shouldn't take more than 10 minutes": so they basically put their tentacles into any crevice they can find, and make it annoying to pry them out.
Let's see if it's easy to see who runs this bit of evil... nope. They're amoral scum.
[1] https://en.wikipedia.org/wiki/Browser_hijacking#Vosteran
Re: Google purges bad extensions from Chrome
#83This probably isn't a popular view for the HN crowd but at this point I'm convinced that for 90% of users, browser extensions are an anti-feature doing way more harm than good.
For almost 100% of users, the "modern web" is an anti-feature doing way more harm than good. It's a giant pile of tracking scripts and animated "punch-the-monkey" graphics wasting users' power and bandwidth while stealing their personal data and providing nothing of value. Web browsers are creaking piles of bloat trying (badly) to support this disaster while pretending to be shinier than their competitors, or than last month's version of themselves.
Browser extensions offer a whole new host of evils, along with a marginally effective way to fight back against the rising tsunami of web horrors. The web is mostly about harming users, so I can hardly blame them for grasping at whatever chance they have to defend themselves.
Re: Google purges bad extensions from Chrome
#84"This extension will have access to your browsing history and private data on all websites". Which is usually accompanied by the developer apologising and explaining they have to declare this in order to provide the extension's core functionality. Users then learn to ignore these warnings, malicious extensions ensue. I'm glad Google is taking malicious extensions seriously, but purging is a difficult semi-manual effo…
Unfortunately it's hard to access /any/ information on a page without accessing /all/ information on a page. Unless the page can expose the data itself (say, through an API) an extension will need to access the DOM. Accessing the DOM means data leakage from that page to potentially any server.
Re: Google purges bad extensions from Chrome
#85> "You would expect that an extension that injects or replaces advertisements is malicious, but then you have AdBlock that creates an ad-free browsing experience and is technically very similar." AdBlock is very clear in what it does and users install it because they want to block ads, whereas users are usually not aware when an extension injects ads. As a note, the Awesome Screenshot extension for Firefox asks you i…
Yeah, but ABP also has white listed ads: http://techcrunch.com/2013/07/06/google-and-others-reportedl... Ghostery has a bit of a different model, but they're no saints: http://www.technologyreview.com/news/516156/a-popular-ad-blo... I guess the lure of selling use data is just too great for any commercial entity to control the source of these as blockers. uBlock and PrivacyBadger are still clean AFAIK.
The whitelisted ads are configurable and to tell you the truth this is what I miss now that I'm using uBlock. Personally I understand that ads are a business model that many websites and services need to survive and I've got nothing against websites showing ads tastefully.
Re: Google purges bad extensions from Chrome
#86This only addresses part of the problem. Chrome extensions are ONE method of injecting into a page. What about more advanced methods including code hooks, Proxy, LSP, TDI, WFP, etc... What is Chrome going to do about those?
Re: Google purges bad extensions from Chrome
#87This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…
Agh, damn. Just removed Awesome Screenshot due to your comment and I liked it as an extension too. Not enough to leak information to third parties though..
[deleted]
Re: Google purges bad extensions from Chrome
#88This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…
Agh, damn. Just removed Awesome Screenshot due to your comment and I liked it as an extension too. Not enough to leak information to third parties though..
Try using Greenshot
Re: Google purges bad extensions from Chrome
#89This probably isn't a popular view for the HN crowd but at this point I'm convinced that for 90% of users, browser extensions are an anti-feature doing way more harm than good.
Much like toolbars back in the day. I still think that browsers should just let extensions be fully disabled by default so only the power users who know what they are doing can enable them poking in settings.
Re: Google purges bad extensions from Chrome
#90Earlier quoted context omitted.
No. Google uninstalling things from your computer without your permission? Now that would be news.
Actually I think the answer is yes. Or at least they're disabled. I forget the name but I had one that allowed for a custom new tab page. It had opt-out ads, but I otherwise loved it. It kept getting disabled after each fresh start of Chrome. Debated forking it but haven't yet. It might matter that I do have my extensions sync between machines. Extension is eventually disabled on the others as well. EDIT: "This exten…
Hmm, disabling with a notice is not a bad middle-ground actually. For the worst offenders.