Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An ad plugin was stealing revenue for a year and I didn't even notice

kvirkvelia.com

Post reply on HN
Print view View original

71–80 of 195 posts

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#71

Post by addingnumbers »

teddyh wrote: post #52
new_guy wrote: post #42

That's what happens when you freeload. I think we're seeing more pushback now against people like this abusing free software from the developers who break their back to provide it. If you want to use it, PAY. FOR. IT.

That software is never claimed to be free software, and explicitly disclaims being Open Source.

"never claimed to be free software" and "explicitly disclaims being Open Source" don't cancel out that he published it with an open-source MIT license.

https://github.com/floatinghotpot/cordova-admob-pro/blob/mas...

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#73

Post by mannerheim »

contravariant wrote: post #65
jscheel wrote: post #19

I'm confused, where in the license does it give them the permission to randomly assign an ad-share percentage? This seems highly suspect, and probably illegal in most jurisdictions. In fact, reading the actual license agreement here https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic... seems to suggest that they will stop serving ads, not randomly start increasing ad share.

Yeah I'm not seeing it either. It's even weirder that the code itself is distributed with an MIT license, which suggests you're free to download and modify the code to disable the revenue sharing. This conflicts with some of their other statements though. In the readme they do outline the option to use it with a open source license (without any support), but they seem to contradict this in the following sentence in t…

Since the Wiki part isn't a license itself, I would think there isn't legal relevance to it, but given that the author doesn't seem to be a native English speaker, a generous interpretation might be that a commercial user could still fork this; it's 'required' in the sense that you have to pay for the convenience of having it available on NPM, which the author disallows you from making trivial changes to and republishing on there.

That's unlikely to be legally enforceable on NPM, but they might honour takedowns anyway.

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#74

Post by yessirwhatever »

Incredibly shady percentage and even more shady way of responding. With that being said, calling it stealing is a bit much.

The blame is on you. Read the license of what you're using, and make sure what it's requesting in general. Triggering statement, so be warned: Ad Revenue supported products are generally ALL SHADY.

So, I'm astonished he gave you back some money. Probably a useless attempt to have less hassle moving forward, yet you went ahead and shared it.

At best, you're equally to blame. At worst, you just want stuff for free while you get paid for your work, the worst kind of entitlement.

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#75

Post by jtbayly »

netr0ute wrote: post #49
new_guy wrote: post #42

That's what happens when you freeload. I think we're seeing more pushback now against people like this abusing free software from the developers who break their back to provide it. If you want to use it, PAY. FOR. IT.

> PAY. FOR. IT. What about the Linux kernel and numerous other FOSS?

He was paying for it. 2%. Then the open source hero started taking 30%. Without warning or disclosure.

Defending this is a great way to trash the reputation of open source.

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#76

Post by yesimahuman »

Beltalowda wrote: post #54
joshstrange wrote: post #9

I'm of two minds about this. "Stealing" does seem to be a little too harsh given the plugin did say it would take a percentage if you make more than $1K and didn't buy a license. The 30% seems underhand (only because it's not spelled out in the repo) but I do understand the plugin author's position. Open source work, especially something like Ionic/Cordova/Capacitor plugins, are hard to make any money on and I've see…

I suspect the line of thinking behind the 30% seems to be something along the lines of "they're fiddling their numbers to reduce our 2% cut, so let's just take a bigger cut". I don't think this is entirely kosher for a bunch of reasons, but I'm willing to believe that it was a naïve person doing something naïve after being burned by someone cheating him out of his cut, or something along those lines. At any rate, sin…

(Ionic CEO here) I think regardless, it's something developers don't expect so we're removing it from our site right now to avoid confusion and surprises (we’re going to be changing the whole design of this list soon anyways so it’s moot). The plugin description came from another project we support and trust plugin authors to write their own descriptions but we're realizing we need to scrutinize those more closely. I have no qualms with a plugin stating they are going to have this kind of revenue share but it doesn't belong on our site and seen as “official” which is confusing, so we're fixing that right now.

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#77

Post by colinmhayes »

op00to wrote: post #31

"If you have a high user traffic, please consider to get a license, it will be more cost-effective. Or else you might be unhappy someday." *"Or else you might be unhappy someday."* If that isn't a threat, I don't know what is. This guy's plugin should be removed immediately for such actions.

I think that's just a fact. License is $20. This guy is clearly making more than $1000 on his site so the license is cheaper.

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#78

Post by ziml77 »

ceejayoz wrote: post #3
melissalobos wrote: post #2

At least the plugin guy was reasonable-ish. That does sounds like a really odd experience. It does pay to always check all of the dependencies you are using and their terms. When I was younger I got hit by limits when using a free tier of a service, but they just throttled us which lost us users.

The plugin guy can afford to be reasonable-ish. It reduces the likelihood of the scam being publicly disclosed, and I'd wager that 99% of people never notice the plugin is doing this.

It looks to me that the plugin author isn't only trying to get the money he's owed from people who are trying to scam him. Which still isn't a great thing, especially since it can happen mistakenly, but it's at least a little more understandable.

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#79

Post by nrmitchi »

gruez wrote: post #60
op00to wrote: post #25

Earlier quoted context omitted.

Huge red flag: they offer you some money back in hopes you don't turn them into the "authorities".

That's how settlements work, yes.

Is it though? A settlement in a civil case is money in exchange for not pursuing further civil legal action.

A situation of "we're giving you money so that you don't report a crime" (which is implied by "turning in to the authorities") is more like extortion/bribery than it is a settlement.

Re: An ad plugin was stealing revenue for a year and I didn't even notice

#80

Post by marcus_holmes »

csunbird wrote: post #56
jmnicolas wrote: post #46

It's what's worrying with running WordPress plugins: you mean I'm downloading some PHP code written by somebody unknown and this code executes whatever it wants on my server???!!! It seems I'm the only one that is bothered by this. And no I don't at the time nor the skill to audit everything or to use a static site like Hugo.

What is the difference between downloading a wordpress plugin and running it in your server and downloading a jar from maven/a js package from npm and running it?

Nothing. These are also very, very dangerous and expose your site to supply-chain attacks.

The article linked to here [0] which is a must-read for everyone who feels that adding a dependency is safe.

[0] https://medium.com/hackernoon/im-harvesting-credit-card-numb...

Post reply on HN