7 ms·
Adware vendors buy Chrome Extensions to send ad- and malware-filled updates
- jackvalentine 9y agoFrom the article: > "Update: Google got back to us, and stated that Chrome's extension policy is due to change in June 2014. The new policy will require extensions to serve a single purpose."
- voltagex_ 9y ago(2014)
- codedokode 9y agoThat is why I never install browser extensions.
- abecedarius 9y agoDo you live without adblock?
- astebbin 9y agoNot OP, but I live without adblock. In Chrome, I disable Javascript on all sites by default. Rarely do I need to unblock a new site. I have a paid subscription to the Washington Post (which grants access to articles, but doesn't actually hide the ads...), and the ads on other sites I visit aren't too oppressive. More than anything else, over nearly twenty years on the Internet I've developed the mental reflex to "tune out" and automatically ignore any Internet ad, anywhere, unless it's literally shoved in my face to the exclusion of all other content. I've previously used adblock extensions, but my reasons for going without mirror the link author's. I simply can't trust Google/Chrome not to autoinstall a new, broken, malware-infested version of my favorite extension. I don't feel I should have to mess with directory permissions or application sandboxing in order to achieve some half-measure of extension security, so instead I eschew them completely.
- yareally 9y agoHost blocking at the OS level. No need for extensions.
- dest 9y agoSometimes you need to temporary disable filters or edit them. How do you manage that? Is it user-friendly?
- yareally 9y agoNever ran into a problem really. Maybe a couple times a year I'll manually open the host file and ctrl+f a host I need to comment out temporarily after seeing it's causing an issue via the browser's network tools.
- hackinthebochs 9y agoI adblock then disable extension updates. The only extension I add.
- rasz 9y agohow do you disable extension updates in chrome?
- hackinthebochs 9y agoBlocking updates on chrome is harder than I remember. A couple of ways here: https://stackoverflow.com/questions/27657617/how-to-disable-google-chrome-extension-autoupdate https://stackoverflow.com/questions/27657617/how-to-disable-... Another way is to enable developer mode on the extension page then install an unpacked version of the extensions you want.
- rasz 9y agomanually installing unpacked extensions is the only way that currently works, update_url doesnt work for more than a year, Chrome just calls home on hardcoded IPs.
- DyslexicAtheist 9y agoyou can do it quite effectively outside the browser using a host block[1] list or pi-hole. my uBlock now only fires sporadically for cases I don't catch with the /etc/hosts approach (e.g. disallowing e.g. remote fonts) [1] https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- codedokode 9y agoMany years ago Opera had a blacklist for URLs with wildcard support that was implemented in a native code, not HTML/JS. I used to use it then.
- jmiserez 9y agoInstall the version from Github instead of the store, and you can avoid the problem. Instructions for Chrome/Firefox here: https://github.com/gorhill/uBlock/blob/master/dist/README.md https://github.com/gorhill/uBlock/blob/master/dist/README.md Other browsers see the overview here: https://github.com/gorhill/uBlock/blob/master/README.md#chromium https://github.com/gorhill/uBlock/blob/master/README.md#chro...
- codedokode 9y agoYes, but I have JS disabled on most sites. Regarding adblock, there were posts that it slows the browser down, injects huge CSS rules into every iframe etc.
- radioo7555 9y agoHow do you selectively disable has without an extension?
- codedokode 9y agoChromium can do that. You can disable JS globally in the settings and then there will be a script icon in the address bar to enable it on a specific site.
- tdb7893 9y agoIt's pretty easy going without adblock. There are a lot of websites without obtrusive ads and it's pretty easy to start to recognize which sites I just don't want to go to anymore.
- drdaeman 9y agoI'm not sure about Chrome but on Firefox for a time being one still can install extensions the classic "old school" software installation way - by placing the files on disk.
- youseecomrade 9y agoNot even Firefox manually review extensions anymore. Sad, happened twice for me (one was a cryptominer) so now I have like 2 extensions installed.
- dblohm7 9y agoNot true. Extensions are still subject to manual review, however they are permitted to be posted publically as soon as they pass a suite of automated checks.
- youseecomrade 9y agoYou know what I mean. It's like checking for poison after you eat the entire pie.
- bradknowles 9y agoIt’s a good point to be aware of and to raise from.time to time, but the subject line should be amended to indicate that this article was written in 2014.
- ChrisAntaki 9y agoYeah, I have a Firefox extension with around 50k installs, and get emails every so often from people offering to monetize it. Here's an excerpt from a recent one, from Nick at NJB Brands Sales: > We offer .50 CTR (per 1,000) traffic and can use each unique IP up to 10 times a day. There is no limitation to what we will purchase other than the cap per unique IP. We offer flexible payment options via PayPal, Bitcoin, WesternUnion or Check. Payment can be done every 1 day, 7 days or 30 days.
- erikrothoff 9y agoHa! We got the exact same message. Really weird getting a glimpse of that part of the internet.
- tux 9y agoUse uBlock Origin [1] and uMatrix [2] instead. Also using Inox [2] browser helps too. [1] https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/ [2] https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix [3] https://github.com/gcarq/inox-patchset/releases https://github.com/gcarq/inox-patchset/releases
- jwilk 9y agoInstead of what?
- posnet 9y agoI have a relatively popular novelty extension and I get approached by ad companies to buy/monetize it regularly. I refuse, because I despise advertising and I don't need the money. But I suspect I am in the minority and that many extension owners probably just decide it is easier to sell it and not think about it.
- rogem002 9y agoI switched my chrome extension to a paid model (one off payments). Most the offers from these shady people, work out as approximately 1 year worth of sales.
- tobyhinloopen 9y agoHow much did they offer?
- oneeyedpigeon 9y agoAnd for what reach?
- posnet 9y agoAnywhere from $2-25k. But most don't give a price upfront and I just send it to my spam folder.
- blendergeek 9y agoThis is why RMS calls auto-updates "universal backdoors".
- cpach 9y agoMost people would be screwed without auto-updates.
- krsdcbl 9y agoIt appears to be an easy way to at least weaken this practice: Why doesn't chrome prompt it's user / demands a confirmation of permissions when an extention changes ownership, before updating it again? It could at least impact the rentability of this buying up of extentions, but definitely help alert users of such things
- RobLach 9y agoHow would they know it changed ownership?
- a012 9y agoBut it couldn't/won't guarantee anything, say Chrome could notify user the change ownership of an extension then the new owner state that they won't be evil, blah blah blah, but 1 or 3 months later they changed their minds and send ads to users. What next?
- rasz 9y agobefore that - why doesnt Chrome let you DISABLE updates?
- TazeTSchnitzel 9y ago(2014)
- dotmanish 9y agoStill a large risk, even though this was authored in 2014. I would be surprised if extensions that "read and change content on all websites you visit" haven't yet been used in some wide-scale account/identity compromise without making much noise.