8 ms·

> It is a regular occurrence to hear about open source developers selling their browser extensions, only for their users to be exploited later on by the new own

by geofft 7y ago

> It is a regular occurrence to hear about open source developers selling their browser extensions, only for their users to be exploited later on by the new owners. ... We are witnessing the failure of browser vendors to recognize the value of our labor and the important role it plays in a healthy browser ecosystem. So this is an interesting philosophical question - the market value of the extension is the value of "monetizing" it by stuffing ads, or worse, monitoring/tracking/exfiltration, into the extension. It's the market value of the trust of the extension's userbase. Is that the value of the extension developer's labor? I would argue not really. The value of a bank, for instance, is not the amount of money in all of the vaults. That money is held in trust for customers, and it is not for the owner of the bank to dispose of. Therefore, nobody who makes a fair offer for the bank should expect those resources in the transaction, so a fair market price for the bank is much less - such as the present value of the interest earned by the bank minus the interest returned to customers. In particular, the only reason the bank has customers is they expect to get their money back, generally with interest, at some point in the future. If they didn't, they'd put their money elsewhere. So if a bank is willing to sell the contents of the customer accounts, that indicates incomplete information in the market - customers didn't know the bank wasn't trustworthy. The true market value of the bank, in a perfect-information market, would be close to zero. It seems like the problem here is that we know two ways of compensating browser extension developers: "don't" and "breach your users' trust." Those point to wildly undervalued and wildly overvalued estimates of the fair market value of the developers' work. And we should come up with some fairer way to value their work (or, more fundamentally, to compensate them; we may not need to monetize the extension, necessarily) first, and I'm not totally sure it's the fault of browsers for not having had such a clever idea - it seems like we collectively need to figure that out.

paulgb 7y ago
As an extension developer who recently got one of these offers, your analysis is a good verbalization of my gut feeling on the matter. I turned it down, of course. While users may feel bad about extension developers not being compensated, I feel like the larger story here is that: - Companies are buying extensions for nefarious purposes, which presents a huge security risk. - Evidently, app stores are sufficiently bad at detecting this that it remains profitable.
- geofft 7y ago
  Yes, agree - detecting extensions that have changed hands into someone who wants to "monetize" it and preventing those updates from getting to users definitely seems like a thing that the browser manufacturers should be doing (even if - and perhaps especially if - it lowers the apparent market value of extensions) and that the onus is on browser manufacturers / extension store operators to do so.
  - kibwen 7y ago
    I'm not sure how one would automatically detect such a thing as a browser extension changing hands. If you require signing extensions to make a release, there's nothing stopping a developer from selling their keys. And even without changing hands, the threat to users remains the same if the company just goes from "we'll give you $10k for your extension" to "we'll give you $10k to link this library into your extension and not ask what it does" (one might counter that an ethical developer could accept the former option while rejecting the latter, but it's hard to believe any developer willing to sell their extension in the first place isn't fully aware of what that means for the future of their users).
    - NewsAware 7y ago
      It would not be about detecting the change of hands but about detecting the (malicious) monetization. Depending on the type of extension this might still be hard to do, but I could well imagine heuristics triggering a manual check from the extension store providers.
      - londons_explore 7y ago
        With many extensions having hundreds of thousands of lines of minified code, a manual check is unlikely to find anything nefarious if it's been well hidden.
        geofft 7y ago
        IMO, extension authors should not be allowed to submit minified code alone to the extension stores for review. (Options include having standard minifiers that the extension stores run themselves, allowing extension authors to provide a .travis.yml or something where the sources to the build pipeline are themselves auditable, etc.) I can see an argument for withholding source from end users for things like paid extensions or clients to proprietary services (to be clear, I wouldn't agree with such arguments but I can see them), but I don't see the argument for withholding source from the browser manufacturers themselves. Put another way, if the browser manufacturers run an extension store, they are (or ought to, at least) endorse the extensions in that store as reasonable to install. I don't see how they can do that without source. I think they could sort of make that endorsement without proactive auditing if they can remove extensions they discover are malicious, but if they can't even human-audit the source in response to a report of problems, I don't think there's any way they can responsibly offer extensions to their users.
hanniabu 7y ago
> the market value of the extension is the value of "monetizing" it by stuffing ads, or worse, monitoring/tracking/exfiltration, into the extension Of even worse, inserting malicious code such as a keylogger.
- cameronbrown 7y ago
  Even worse! A key-logger masquerading as a product! /s cough Grammarly https://techbeacon.com/security/grammarly-leaks-everything-youve-ever-typed-service-everything https://techbeacon.com/security/grammarly-leaks-everything-y...
  - propogandist 7y ago
    This isn't a secret by any means. Even Google Chrome's built in Spell Checker is constantly sending data back to Google and functions as a keylogger.
    - Thorrez 7y ago
      Do you mean the enhanced spell checker which is off by default? The regular spell checker is done locally. https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html
  - Semaphor 7y ago
    LanguageTool Plus [0] is an open source (optionally self hosted) replacement for Grammarly (a paid version is available but the free one already finds more mistakes than the free version of Grammarly did for me). Available for FF and that google browser ;) [0]: https://languagetoolplus.com/ https://languagetoolplus.com/
- geofft 7y ago
  Yup (I think I'm loosely counting that as exfiltration, because you can monetize an all-sites extension real effectively if you exfiltrate the browser cookies from online banking websites.... keyloggers only get you so far if they have 2FA, but a logged-in browser session is valuable.)
mushufasa 7y ago
What if Google/Mozilla just awarded a monthly prize to developers based on the popularity of an extension? Browser providers pay for ecosystem improvements -- a better product.
- brisance 7y ago
  Ad blocking probably would be #1. What does it mean if Google pays an extension developer for ad blocking? Would it be racketeering? Bribery?
  - mushufasa 7y ago
    More of a Mozilla opportunity then. This would not create a scenario for extension developers to get rich, but it would provide some support to keep going, which could justify turning down potentially harmful monetization alternatives. Hosting a conference or creating a fellowship for top extension developers could also work -- some measure of appreciation that helps developers earn a living, directly or indirectly.
  - propogandist 7y ago
    Google pays Adblock plus so they can get their ads through their "ad-blocking". The same org behind this is the one that bought the uBlock clone and the uBlock.org domain name. The upcoming changes to the Chrome browser, will limit the performance and capabilities of actual ad-blocking extensions like uBlock Origin. Google claims these changes are being done to protect users privacy.
asdfasgasdgasdg 7y ago
> Those point to wildly undervalued and wildly overvalued estimates of the fair market value of the developers' work. Hrm. I would say that it indicates that there are two different types of market. There is the market for free, ethical extensions. This market is full of products that have no value, either being freely given away by their author, or having insufficient reach or utility to garner commercial success. Then there is the black market for remote access to millions of end user machines. This market is likely illegal, but plausible deniability allows unethical devs to sell access to end users on this market. It should not surprise anyone that it's tough to get compensated when you don't charge anything for the product you sell. Despite the name "Chrome Web Store," I could not find any for-sale extensions on the featured page. It seems like it's not in the culture to pay for extensions, possible because most of them are low-effort and have little marginal utility. The only people who are making money ethically on the Chrome Web Store are folks who are selling a service to which their extension is a portal. And I don't really see how it will ever be otherwise.
- Nasrudith 7y ago
  What about donation models? They aren't lucrative or dependable but they technically can make money - still hard of course.
throwaway2048 7y ago
As always value is a separate thing from "money some hypothetical somebody will pay". Oxygenated air has next to zero price you could sell it for, but it has basically infinite value to somebody deprived of it. Browser extensions create a ton of value, but its likely very little of that can be turned into a paycheck for somebody without destroying the value they create.
mevile 7y ago
The value of an extension is whatever someone is willing to pay for it. The value of someone's ethics also has a price. It is a different price for everyone. It's silly to go into details about ethics, because maybe I donate half of the unethical income to buy mosquito nets and now I've traded saving lives with inconveniencing users or some other such very personal calculation/rationalization. You can browbeat developers with your ethics and ideals, but your approval doesn't feed anyone's children.
- geofft 7y ago
  This doesn't respond to my argument: if your users knew that your sense of ethics is that attacking their private browsing data to buy mosquito nets is justified, they wouldn't be your users. (That small subset of your users that thinks mosquito nets are a good use of money would either donate directly and ignore your extension, or voluntarily participate in a scheme to turn ad views into mosquito nets such that you gain no additional mosquito nets by selling.) So whether or not you are willing to sell, in a market with perfect information, the value of your extension would be close to zero. Therefore the only way that your extension has value is if you are intentionally withholding information from users about your willingness to sell. Which, even without getting into the ethics of deceiving your users, is at odds with the generally-accepted sense of the word "value" in economics. If a company is withholding information about it doing poorly and has a higher stock price than it would if it didn't, you generally say the company is "overvalued," that people are erring in attributing that value to it, not that it increased its actual value.
  - mevile 7y ago
    Ok, I understand now and I don't disagree. Makes sense.
TheSpiceIsLife 7y ago
There’s also a typical third way to compensate browser extension developers: Can’t. Take the developer of uBlock Origin and uMatrix, Raymond Hill, for example. He continues to refuse payment / donations.
- stuartd 7y ago
  Indeed: https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-donations%3F https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...
  - imhoguy 7y ago
    Excellent answer. "no donations = no expectations"
    - CobrastanJorji 7y ago
      Should he decide to terminate the project, I expect that he'll find that he's wildly underestimated human capabilities for entitlement. The upside is that he won't feel obligated to those people.
im3w1l 7y ago
The root cause of all this is autoupdating. I hope we will eventually move away from that paradigm. But currently its needed, since lack of updates is even less secure.
- josefx 7y ago
  We will get away from auto updating and security issues once we have a feature complete browser and a stable HTML specification. Given past trends I would expect this no earlier than the heat death of the universe.
  - im3w1l 7y ago
    I disagree. The key driver of the need for auto updates is security patches. Many people would accept missing out on new features. In fact, I suspect some would see that as a positive.
    - tremon 7y ago
      I think the reality is that more people would accept missing out on security patches than missing out on features, once those features gain traction on sites. For example, Netflix' use of in-browser DRM makes it a must-have for mainstream browsers.
  - dredmorbius 7y ago
    The crash of Western Civilisation may suffice. Unless we've created self-replicating, web-enabled, grey goo first.
AmericanChopper 7y ago
> Is that the value of the extension developer's labor? Labor itself has no intrinsic value at all. You don’t have to think very hard to come up with a list of things that would be laborious but not valuable. Economically speaking, the value of any product can only ever be what people are willing to pay for it. If your users aren’t willing to pay for your product in one way or another, then your only option is to sell access to your users, in one way or another.
hedora 7y ago
$10K’s doesn’t “wildly overvalue” the developer time that goes into a successful browser extension. At almost $200k/year, a starting google developer makes ~$4K a week (pre tax, but also ignoring health care, facilities, etc). The browser extension offers are comparable to months of developer time, but since they are made after an extension succeeds, they’re not accounting for the probability that a new extension won’t become wildly popular. Put another way, if the scammers could develop (or steal) extensions for less than they’re buying them for, I’m sure they would.
- geofft 7y ago
  Yeah, I did gloss over a bit the distinction between the value of the developer's labor and the value of the extension. I do think that $200K/year is a wild overestimate of the value of the extension, on the ground that Google and other similar companies assign very few new hires to write browser extensions. But yes, the amount of skill and time and focus that goes into the average extension and the average new hire project is at least within the same order of magnitude. We are generally bad at finding ways to compensate/monetize people for skilled labor that does useful things for the world but isn't directly profitable, so I think trying to tackle that for the case of extensions is a harder problem than is reasonable to demand.

by geofft 7y ago

paulgb 7y ago

As an extension developer who recently got one of these offers, your analysis is a good verbalization of my gut feeling on the matter. I turned it down, of course. While users may feel bad about extension developers not being compensated, I feel like the larger story here is that: - Companies are buying extensions for nefarious purposes, which presents a huge security risk. - Evidently, app stores are sufficiently bad at detecting this that it remains profitable.

geofft 7y ago
Yes, agree - detecting extensions that have changed hands into someone who wants to "monetize" it and preventing those updates from getting to users definitely seems like a thing that the browser manufacturers should be doing (even if - and perhaps especially if - it lowers the apparent market value of extensions) and that the onus is on browser manufacturers / extension store operators to do so.
- kibwen 7y ago
  I'm not sure how one would automatically detect such a thing as a browser extension changing hands. If you require signing extensions to make a release, there's nothing stopping a developer from selling their keys. And even without changing hands, the threat to users remains the same if the company just goes from "we'll give you $10k for your extension" to "we'll give you $10k to link this library into your extension and not ask what it does" (one might counter that an ethical developer could accept the former option while rejecting the latter, but it's hard to believe any developer willing to sell their extension in the first place isn't fully aware of what that means for the future of their users).
  - NewsAware 7y ago
    It would not be about detecting the change of hands but about detecting the (malicious) monetization. Depending on the type of extension this might still be hard to do, but I could well imagine heuristics triggering a manual check from the extension store providers.
    - londons_explore 7y ago
      With many extensions having hundreds of thousands of lines of minified code, a manual check is unlikely to find anything nefarious if it's been well hidden.
      - geofft 7y ago
        IMO, extension authors should not be allowed to submit minified code alone to the extension stores for review. (Options include having standard minifiers that the extension stores run themselves, allowing extension authors to provide a .travis.yml or something where the sources to the build pipeline are themselves auditable, etc.) I can see an argument for withholding source from end users for things like paid extensions or clients to proprietary services (to be clear, I wouldn't agree with such arguments but I can see them), but I don't see the argument for withholding source from the browser manufacturers themselves. Put another way, if the browser manufacturers run an extension store, they are (or ought to, at least) endorse the extensions in that store as reasonable to install. I don't see how they can do that without source. I think they could sort of make that endorsement without proactive auditing if they can remove extensions they discover are malicious, but if they can't even human-audit the source in response to a report of problems, I don't think there's any way they can responsibly offer extensions to their users.

hanniabu 7y ago

> the market value of the extension is the value of "monetizing" it by stuffing ads, or worse, monitoring/tracking/exfiltration, into the extension Of even worse, inserting malicious code such as a keylogger.

cameronbrown 7y ago
Even worse! A key-logger masquerading as a product! /s cough Grammarly https://techbeacon.com/security/grammarly-leaks-everything-youve-ever-typed-service-everything https://techbeacon.com/security/grammarly-leaks-everything-y...
- propogandist 7y ago
  This isn't a secret by any means. Even Google Chrome's built in Spell Checker is constantly sending data back to Google and functions as a keylogger.
  - Thorrez 7y ago
    Do you mean the enhanced spell checker which is off by default? The regular spell checker is done locally. https://www.google.com/chrome/privacy/whitepaper.html https://www.google.com/chrome/privacy/whitepaper.html
- Semaphor 7y ago
  LanguageTool Plus [0] is an open source (optionally self hosted) replacement for Grammarly (a paid version is available but the free one already finds more mistakes than the free version of Grammarly did for me). Available for FF and that google browser ;) [0]: https://languagetoolplus.com/ https://languagetoolplus.com/
geofft 7y ago
Yup (I think I'm loosely counting that as exfiltration, because you can monetize an all-sites extension real effectively if you exfiltrate the browser cookies from online banking websites.... keyloggers only get you so far if they have 2FA, but a logged-in browser session is valuable.)

mushufasa 7y ago

What if Google/Mozilla just awarded a monthly prize to developers based on the popularity of an extension? Browser providers pay for ecosystem improvements -- a better product.

brisance 7y ago
Ad blocking probably would be #1. What does it mean if Google pays an extension developer for ad blocking? Would it be racketeering? Bribery?
- mushufasa 7y ago
  More of a Mozilla opportunity then. This would not create a scenario for extension developers to get rich, but it would provide some support to keep going, which could justify turning down potentially harmful monetization alternatives. Hosting a conference or creating a fellowship for top extension developers could also work -- some measure of appreciation that helps developers earn a living, directly or indirectly.
- propogandist 7y ago
  Google pays Adblock plus so they can get their ads through their "ad-blocking". The same org behind this is the one that bought the uBlock clone and the uBlock.org domain name. The upcoming changes to the Chrome browser, will limit the performance and capabilities of actual ad-blocking extensions like uBlock Origin. Google claims these changes are being done to protect users privacy.

asdfasgasdgasdg 7y ago

> Those point to wildly undervalued and wildly overvalued estimates of the fair market value of the developers' work. Hrm. I would say that it indicates that there are two different types of market. There is the market for free, ethical extensions. This market is full of products that have no value, either being freely given away by their author, or having insufficient reach or utility to garner commercial success. Then there is the black market for remote access to millions of end user machines. This market is likely illegal, but plausible deniability allows unethical devs to sell access to end users on this market. It should not surprise anyone that it's tough to get compensated when you don't charge anything for the product you sell. Despite the name "Chrome Web Store," I could not find any for-sale extensions on the featured page. It seems like it's not in the culture to pay for extensions, possible because most of them are low-effort and have little marginal utility. The only people who are making money ethically on the Chrome Web Store are folks who are selling a service to which their extension is a portal. And I don't really see how it will ever be otherwise.

Nasrudith 7y ago
What about donation models? They aren't lucrative or dependable but they technically can make money - still hard of course.

throwaway2048 7y ago

As always value is a separate thing from "money some hypothetical somebody will pay". Oxygenated air has next to zero price you could sell it for, but it has basically infinite value to somebody deprived of it. Browser extensions create a ton of value, but its likely very little of that can be turned into a paycheck for somebody without destroying the value they create.

mevile 7y ago

The value of an extension is whatever someone is willing to pay for it. The value of someone's ethics also has a price. It is a different price for everyone. It's silly to go into details about ethics, because maybe I donate half of the unethical income to buy mosquito nets and now I've traded saving lives with inconveniencing users or some other such very personal calculation/rationalization. You can browbeat developers with your ethics and ideals, but your approval doesn't feed anyone's children.

geofft 7y ago
This doesn't respond to my argument: if your users knew that your sense of ethics is that attacking their private browsing data to buy mosquito nets is justified, they wouldn't be your users. (That small subset of your users that thinks mosquito nets are a good use of money would either donate directly and ignore your extension, or voluntarily participate in a scheme to turn ad views into mosquito nets such that you gain no additional mosquito nets by selling.) So whether or not you are willing to sell, in a market with perfect information, the value of your extension would be close to zero. Therefore the only way that your extension has value is if you are intentionally withholding information from users about your willingness to sell. Which, even without getting into the ethics of deceiving your users, is at odds with the generally-accepted sense of the word "value" in economics. If a company is withholding information about it doing poorly and has a higher stock price than it would if it didn't, you generally say the company is "overvalued," that people are erring in attributing that value to it, not that it increased its actual value.
- mevile 7y ago
  Ok, I understand now and I don't disagree. Makes sense.

TheSpiceIsLife 7y ago

There’s also a typical third way to compensate browser extension developers: Can’t. Take the developer of uBlock Origin and uMatrix, Raymond Hill, for example. He continues to refuse payment / donations.

stuartd 7y ago
Indeed: https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-donations%3F https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...
- imhoguy 7y ago
  Excellent answer. "no donations = no expectations"
  - CobrastanJorji 7y ago
    Should he decide to terminate the project, I expect that he'll find that he's wildly underestimated human capabilities for entitlement. The upside is that he won't feel obligated to those people.

im3w1l 7y ago

The root cause of all this is autoupdating. I hope we will eventually move away from that paradigm. But currently its needed, since lack of updates is even less secure.

josefx 7y ago
We will get away from auto updating and security issues once we have a feature complete browser and a stable HTML specification. Given past trends I would expect this no earlier than the heat death of the universe.
- im3w1l 7y ago
  I disagree. The key driver of the need for auto updates is security patches. Many people would accept missing out on new features. In fact, I suspect some would see that as a positive.
  - tremon 7y ago
    I think the reality is that more people would accept missing out on security patches than missing out on features, once those features gain traction on sites. For example, Netflix' use of in-browser DRM makes it a must-have for mainstream browsers.
- dredmorbius 7y ago
  The crash of Western Civilisation may suffice. Unless we've created self-replicating, web-enabled, grey goo first.

AmericanChopper 7y ago

> Is that the value of the extension developer's labor? Labor itself has no intrinsic value at all. You don’t have to think very hard to come up with a list of things that would be laborious but not valuable. Economically speaking, the value of any product can only ever be what people are willing to pay for it. If your users aren’t willing to pay for your product in one way or another, then your only option is to sell access to your users, in one way or another.

hedora 7y ago

$10K’s doesn’t “wildly overvalue” the developer time that goes into a successful browser extension. At almost $200k/year, a starting google developer makes ~$4K a week (pre tax, but also ignoring health care, facilities, etc). The browser extension offers are comparable to months of developer time, but since they are made after an extension succeeds, they’re not accounting for the probability that a new extension won’t become wildly popular. Put another way, if the scammers could develop (or steal) extensions for less than they’re buying them for, I’m sure they would.

geofft 7y ago
Yeah, I did gloss over a bit the distinction between the value of the developer's labor and the value of the extension. I do think that $200K/year is a wild overestimate of the value of the extension, on the ground that Google and other similar companies assign very few new hires to write browser extensions. But yes, the amount of skill and time and focus that goes into the average extension and the average new hire project is at least within the same order of magnitude. We are generally bad at finding ways to compensate/monetize people for skilled labor that does useful things for the world but isn't directly profitable, so I think trying to tackle that for the case of extensions is a harder problem than is reasonable to demand.