5 ms·

It's not awkward to violate people's privacy, it's wrong. Maybe you didn't know that before, but you still don't seem to get it.

jdormit 9y ago
It's not a violation if there is consent. I'll grant that I didn't think through the consent process for the extension very well, though.
- staunch 9y ago
  You did not get consent. You did violate people's privacy. Your extension got removed by Google and Mozilla.
bluejekyll 9y ago
Person posts cool tool they wrote, that they find useful. Shows it to the community, this community, which many may really appreciate. Then gets ripped for not thinking through the complex privacy issues with said tool. Not everything is malicious. It would be better to give constructive criticism, like: This is a really cool tool! I might even choose to use it, but I have a few concerns: 1) it sends too much data unfiltered to the algolia search servers. Could you instead make it a button that only then triggers the request or opens another browser window? 2) the analytics are also a concern. In general, you should always make these opt-in; better, ask the user through a dialogue to enable them; even better, request feedback through some other system (github for example). Let’s try and be nice here and give people the benefit of the doubt.
- jdormit 9y ago
  Heh, thanks bluejekyll. I appreciate this. FWIW, I am taking the privacy and security concerns raised in this thread seriously. In fact, this type of candid feedback is one of the best things about HN. I anticipate it will take me a few days to choose and implement some of the fixes suggested here.
- staunch 9y ago
  I agree with the sentiment but not this example. Sharing people's browsing data with third-parties can threaten their lives in some circumstances. There's no excuse for a developer creating browser extensions not to take this threat seriously in 2018. It's negligent.
  - bluejekyll 9y ago
    I did read your comment (and I didn’t downvote you b/c I agreed with you). The reason I wrote this response was because your comment read as being very aggressive in response to an honest attempt at explaining an issue the dev was having. What your comment lacked was any additional information about better approaches. I get the concern and share it, but your comment only said that what they did was wrong. It didn’t offer any ideas of how to fix it. Telling someone they’re on the wrong road but not telling them how to get to the correct one leaves them just as lost.
    - staunch 9y ago
      What the developer didn't seem to understand in this case was the gravity of the issue. I don't think your explanation would have conveyed it as well.
      - jklinger410 9y ago
        Take care of yourself.
        staunch 9y ago
        Thank you! And let's all try not to get the users of our software imprisoned or killed: https://boingboing.net/2018/01/28/30000-accused.html https://boingboing.net/2018/01/28/30000-accused.html
        deleted 9y ago
        [deleted]
stevenh 9y ago
Anyone who takes security/privacy seriously shouldn't install any Chrome extension under any circumstances. Many extensions secretly do terrible things that take months or years for anyone to uncover, or the extension is simply sold to a new owner who slips in a malicious payload which is automatically distributed to all users of the extension. I find it strange how everyone used to be concerned about XSS exploits (including Google themselves who painstakingly implemented reflective XSS prevention, nonce support, and support for XSS-blocking HTTP headers in Chrome) and now they all love XSS as long as it has decent marketing and a clean presentation as an "extension".

jdormit 9y ago

It's not a violation if there is consent. I'll grant that I didn't think through the consent process for the extension very well, though.

staunch 9y ago
You did not get consent. You did violate people's privacy. Your extension got removed by Google and Mozilla.

bluejekyll 9y ago

Person posts cool tool they wrote, that they find useful. Shows it to the community, this community, which many may really appreciate. Then gets ripped for not thinking through the complex privacy issues with said tool. Not everything is malicious. It would be better to give constructive criticism, like: This is a really cool tool! I might even choose to use it, but I have a few concerns: 1) it sends too much data unfiltered to the algolia search servers. Could you instead make it a button that only then triggers the request or opens another browser window? 2) the analytics are also a concern. In general, you should always make these opt-in; better, ask the user through a dialogue to enable them; even better, request feedback through some other system (github for example). Let’s try and be nice here and give people the benefit of the doubt.

jdormit 9y ago
Heh, thanks bluejekyll. I appreciate this. FWIW, I am taking the privacy and security concerns raised in this thread seriously. In fact, this type of candid feedback is one of the best things about HN. I anticipate it will take me a few days to choose and implement some of the fixes suggested here.
staunch 9y ago
I agree with the sentiment but not this example. Sharing people's browsing data with third-parties can threaten their lives in some circumstances. There's no excuse for a developer creating browser extensions not to take this threat seriously in 2018. It's negligent.
- bluejekyll 9y ago
  I did read your comment (and I didn’t downvote you b/c I agreed with you). The reason I wrote this response was because your comment read as being very aggressive in response to an honest attempt at explaining an issue the dev was having. What your comment lacked was any additional information about better approaches. I get the concern and share it, but your comment only said that what they did was wrong. It didn’t offer any ideas of how to fix it. Telling someone they’re on the wrong road but not telling them how to get to the correct one leaves them just as lost.
  - staunch 9y ago
    What the developer didn't seem to understand in this case was the gravity of the issue. I don't think your explanation would have conveyed it as well.
    - jklinger410 9y ago
      Take care of yourself.
      - staunch 9y ago
        Thank you! And let's all try not to get the users of our software imprisoned or killed: https://boingboing.net/2018/01/28/30000-accused.html https://boingboing.net/2018/01/28/30000-accused.html
        deleted 9y ago
        [deleted]

stevenh 9y ago

Anyone who takes security/privacy seriously shouldn't install any Chrome extension under any circumstances. Many extensions secretly do terrible things that take months or years for anyone to uncover, or the extension is simply sold to a new owner who slips in a malicious payload which is automatically distributed to all users of the extension. I find it strange how everyone used to be concerned about XSS exploits (including Google themselves who painstakingly implemented reflective XSS prevention, nonce support, and support for XSS-blocking HTTP headers in Chrome) and now they all love XSS as long as it has decent marketing and a clean presentation as an "extension".