27 ms·

The Great Suspender: New maintainer is probably malicious

389 points by AdamGibbins 6y ago

escape_goat 6y ago
The culpability of Dean Oemcke in this particular incident should not be understated. Hindsight is hindsight, of course, but the fact that the new owner of the platform distribution rights of this open-source project was (and apparently remains) anonymous seems like it ought to have been a huge red flag. The fact that these rights were paid for made it obvious that monetization was pending. The lack of transparency made it obvious that the form of that monetization would not be acceptable to the contributing community. There might be a way of contesting the rights to the project name but that would require legal activism and external funding. Basically the original project is dead insofar as the contributors are not comfortable with supporting a parasitic and probably malicious actor. I guess a fork is inevitable. Meanwhile the parasite will harvest the value of the 'brand', distribution rights, and existing codebase until it is drained by obsolescence. A really disgusting way to treat a community by both parties. One can only hope that Mr. Oemcke desperately needed the money for some vital purpose.
Lammy 6y ago
If anyone is looking for an alternative, I'm a big fan of Auto Tab Discard: https://add0n.com/tab-discard.html https://add0n.com/tab-discard.html https://addons.mozilla.org/en-US/firefox/addon/auto-tab-discard/ https://addons.mozilla.org/en-US/firefox/addon/auto-tab-disc... https://chrome.google.com/webstore/detail/auto-tab-discard/jhnleheckmknfcgijgkadoemagpecfol https://chrome.google.com/webstore/detail/auto-tab-discard/j...
hda111 6y ago
This is a problem with many package managers. Even if one downloads a package in Emacs from MELPA. How can one be sure it’s not containing malware? Read through all code every in every dependency after every update?
gcatalfamo 6y ago
TGS is absolutely critical for my everyday use: can someone confirm if everything is still as in the linked GitHub issue?
- ThePowerOfFuet 6y ago
  Why would things have suddenly reverted?
tonymet 6y ago
I stopped using Great Suspender a few years back when Chrome built this in https://developers.google.com/web/updates/2015/09/tab-discarding https://developers.google.com/web/updates/2015/09/tab-discar... I encourage people to disable all chrome extensions. They have unprecedented access to your data (they can read your bank credentials), and they are a big performance hit. e.g. using Chrome Devtools you can see that Lastpass doubles page load times. You can use SimpleExtManager (only has perms to turn on /off extensions) to turn everything off until you need them.
- sizzle 6y ago
  What about useful things like ghostery and uMatrix?
  - tonymet 6y ago
    I keep a “temp” browser profile (chrome —> settings —> add user profile) and install extensions there. That way you can use ghostery on specific sites and it has no access to your important data from your main profile
  - tonymet 6y ago
    They both have full access. some may say “do you trust these publishers” – but the way extensions are designed, there’s no way to trust them. You have to be extremely vigilant and inspect the code every time the extension updates, and you aren’t notified when there are updates. I wouldn’t install any extension permanently. I only keep Lastpass and it’s disabled until it’s needed for login.
    - sizzle 6y ago
      so we should accept website analytics/tracking scripts that potentially are recording every click and cursor movement under the guise of user research?
RandyRanderson 6y ago
This type of developer 'switch' is becoming so common that I now have to add my chrome extensions to google alerts so as to feel safe. As a user below comments: "We need to talk about how difficult it is to monetize browser extensions" b/c w/o this we will see this continue.
sheepdestroyer 6y ago
Three builds published to Chrome Webstore without corresponding commits published to GitHub. This Extension being GPLv2, is there a way to report this obvious license violation to Google/GitHub? Would they care?
blindm 6y ago
I am one of the few people that inspects the source-code of extensions. It's easy to do, for Firefox for example, just right-click and save-as in the extensions site, then rename your extension to a .zip file and extract e.g: addon.xpi --> addon.zip Then manually sift through the code looking for obvious malicious intent (or not so obvious malicious intent if the author is doing obfuscation). Note: obfuscation is a red flag! A simple scan for `https:// https://` / 'http:// http://' would usually yield interesting URLs where data is sent. I have actually spotted malicious addons in the wild this way and reported them to Mozilla. They were thankfully removed. Note: Obfuscation is NOT the same as minification, and I don't mean minification when using the word obfuscation!
- Triv888 6y ago
  Maybe Mozilla could list on the Addon's page a list of domains/IP addresses where data is being sent. A Bit like a table of Nutritional Facts for food, but for extensions.
  - blindm 6y ago
    > A Bit like a table of Nutritional Facts for food, but for extensions. Great idea!
  - gruez 6y ago
    So bad guys will route all traffic through a proxy instead? eg. this addon connects to: * https://484044b296.execute-api.us-east-1.amazonaws.com
    - Triv888 6y ago
      I always considered proxies, url shorteners, etc to be suspicious in the first place. Some more investigation would be required in some cases.
      - gruez 6y ago
        >I always considered proxies, url shorteners, etc to be suspicious in the first place It doesn't have to be as overt making it look like a proxy (eg. a endpoint that makes arbitrary http requests on behalf of the caller). It can be as simple as changing the endpoint for the spying service from https://evil.example.com/api/ https://evil.example.com/api/ to https://484044b296.execute-api.us-east-1.amazonaws.com/evil/api/ https://484044b296.execute-api.us-east-1.amazonaws.com/evil/... > Some more investigation would be required in some cases. The point is that the "nutrition facts label" doesn't really do anything because it's trivial to bypass. If it becomes widespread I guarantee every malicious addon maker would adopt this tactic.
tyingq 6y ago
Chrome extensions are an interesting study in trust. Even with their push for manifest v3, you can still run arbitrary JS on any url. Which, of course, allows arbitrary spying and manipulation. If they hobble that, though, a large portion of extensions become useless. I don't personally see any real middle ground. It's either a credible risk, or too complicated for practical use. The way manifest v3 hobbles practically required things like heuristics is a good example.
- Abishek_Muthian 6y ago
  I've had an extension which I downloaded for automatic tab reloading on chrome insert porn ads into YouTube, I think the extension was removed after reporting but considering Google does take payment for publishing extensions (Unlike Mozilla) and puts them through review; Why not do it right?
  - EdwardDiego 6y ago
    One of our testers had that addon installed, same issue with porn ads.
    - Abishek_Muthian 6y ago
      Interesting, I remember it being taken down immediately after my complaint it would have been really bad if it had resurfaced.
- corytheboyd 6y ago
  I know it would break many extensions but I am of the opinion the architecture is all wrong. There instead should be clear APIs for some access to page content (for example, right-click context menus, tab control without content access, etc). The idea will probably be met with opposition because I didn’t explain it well enough, but maybe someone will get the idea hah. I’ve worked on large chrome extensions that heavily rely on hacking UI on top of page content and it’s truly awful. Everything you do feels liked it will break at the setup of a feather, because it does. Sure, there are some ways of making that LESS painful, but at the end of the day it will always be dirty hacks.
EGreg 6y ago
In general, there is a huge problem with how we distribute software, and package managers are even worse. We basically only look at the top level of things, when instead, every branch in the tree should have a bunch of security people watching it, like editors watch every change to a Wikipedia article, before it goes out. Corporations using automation and technology have hijacked our "Free Speech" ideals, and caused us to think that it's a good thing when one party can push out a tweet to 5 million people at once, or a single corporation can buy up local stations and enforce talking points on journalism. That's not freedom of speech at all. That's just a preference for maintaining entrenched power because someone "amassed it voluntarily"... and this mentality extends recursively all the way down ... Take for example the first Twitter mega-celebrity. Ashton Kutcher himself amassed it voluntarily because he was chosen by TV and movie executives once upon a time, to be used in mass media, and their platforms were "voluntarily" built in the past, from the invention of the TV, and people subscribed "voluntarily", and Twitter was built "voluntarily" and funded by VCs voluntarily, and so on. And the end result is, some power (in this case, audience) is concentrated in the hands of a few people, who disproportionately act as kingmakers for various other people and ideas. That's also how we get "too big to fail" issues in telecoms, banks, and so on. In science, things work differently. Arxiv.org exists but peer review is a big thing. Wikipedia has multiple distrusting parties for each large article. So does Bitcoin (presumably, anyway). In general, the more value (votes, data, code, money) accumulates in one place, the more "checks and balances" you should have for each release. You can't just have someone push out something in the middle of the night and have everyone pull it into their codebase via npm and then "launder" the (malicious) bugs through more and more releases. You need it to go through "peer review", and not on the top level of an entire tree, but rather, for each subtree there need to be people who understand what's going on. THAT is a society that's far more secure, that can't be easily backdoored by some hackers paid by a state to find vulnerabilities. And the capitalistic system we have today is pushing the other way (closed source, centralized databases, extract rents reward early investors through information asymmetry, etc.) and the result is stuff like SolarWinds, Equifax hack, Yahoo hack, etc. etc. etc. We're finally starting to put a tax on storing data without an explicit purpose, hopefully that will make it expensive enough that people will be custodying their own data at least. But when it comes to "broadcasting" things, I'd rather have less "real time pushes" and instead slow things down until we can "run byzantine consensus" gradually releasing to the public via concentric circles. The full solution would involve Merkle trees where some security organizations and researchers / peers (anonymous or not, but with reputations) sign off on each changeset. Instead of just Apple or something. Git + Verified Claims can already support most of the infrastructure, btw.
ce4 6y ago
Reminds me of the uBlock vs uBlock origin story some years ago: https://news.ycombinator.com/item?id=9437182 https://news.ycombinator.com/item?id=9437182 https://news.ycombinator.com/item?id=9718625 https://news.ycombinator.com/item?id=9718625
- srtjstjsj 6y ago
  That story is still ongoing. "New" ublock is still scamming people
- antihero 6y ago
  Also Nano Blocker. I had to spend HOURS unliking bullshit posts on my Instagram because the idiot maintainer sold it to some quite obviously sleazy dudes who harvested our cookies to use as an Instagram bot.
  - ce4 6y ago
    What a low profile use for such a hack... And the idiot probably got away with 99% of those likes.
protoman3000 6y ago
I recently tried to find a health related tracking app on the Apple AppStore in order to conveniently track and manage my health but I noticed that I cannot trust any offered app anymore, regardless of paid or free. This can come either because the proliferation of *analytics, broad openness of supposedly sandboxed systems, needless availability of fingerprinting methods and lack of proof of privacy commitment by the vendors (and any published privacy policy is not enough), or because I just became too paranoid (or both?). Examples like these validate the suspicion that you can’t trust any app or plug-in anymore, with big vendors being in a inbetween position of “too big to lose trust”. I wonder when we will reach the point where there is no trusted web browser anymore, no trusted computer appliance. When will it be that you cannot even say a word to a person in-person anymore because it lands in a weakly secured cloud by the microphone inside their smartwatch that runs a weather app that is run by crooks. Or is that point reached already?
- strogonoff 6y ago
  > When will it be that you cannot even say a word to a person in-person anymore because it lands in a weakly secured cloud by the microphone inside their smartwatch that runs a weather app that is run by crooks. I believe it can already be the case with Google’s (and possibly Facebook’s) apps on Android—at least in case of Google I witnessed real-life tests showing how saying something in presence of the phone causes related ads and content to be shown in feeds—but it’s scarier with less scrupulous app maintainers. Disclaimer: I am not claiming that Android API grants all apps unauthorized access to always-on mic. The device in question was configured to enable continuous listening by the owner. I am not claiming voice recordings are stored or used in nefarious ways.
  - mdpye 6y ago
    Citations please. Not because I think you're definitely fear mongering, but because real evidence would be important to see.
    - strogonoff 6y ago
      An owner of a Google-branded Android phone demonstrated it to me last year, it worked remarkably fast. IIRC, the example chosen was Google News. I can’t see how this is fear mongering. Device was not acting against owner’s will: that person specifically does not tighten relevant privacy settings and enables always-on mic because they see useful content suggestions as a feature. It is different from my outlook (and I take it yours too), but I think that point of view deserves the right to exist. The issue is that now when I am talking to someone like that in real life, I know I may be implicitly agreeing that Google would pick up my speech as well. It’s a clash similar to one between a person (e.g., my mom) who grants messenger apps full access to their phone’s address book for convenience, and their contact (e.g., myself) who does not want their information to be shared with Facebook et al. Addendum: a cursory search confirms this experience. — https://www.vice.com/en/article/wjbzzy/your-phone-is-listening-and-its-not-paranoia https://www.vice.com/en/article/wjbzzy/your-phone-is-listeni... — https://www.makeuseof.com/tag/your-smartphone-listening-or-coincidence/ https://www.makeuseof.com/tag/your-smartphone-listening-or-c... (2019) — https://www.quora.com/Does-Google-listen-to-my-conversations-to-push-ads-to-me https://www.quora.com/Does-Google-listen-to-my-conversations... (the first answer does not mention ads, but others share similar experience to what I saw) — Counterpoint: https://www.bbc.co.uk/news/technology-49585682 https://www.bbc.co.uk/news/technology-49585682 “phones that secretly listen to us are a myth” (2019). Notably, with all my respect for BBC, this article lacks a lot of context (did they turn off voice activation before testing? what were their privacy settings?), and to test devices listening they played commercials in presence of the phone rather than using voice (I have relatively high confidence that modern devices can easily distinguish between speech nearby and sound from a commercial before recording leaves the phone). Some sources claim that as of last year Google is changing the way their apps work. Not sure if they stop listening or stop showing relevant content. (I don’t personally own an Android phone, and even if I did I would have turned off virtual assistants & disabled always-on mic just as I do with my iPhone, so I wouldn’t be able to present first-hand proof.)
fractionalhare 6y ago
Seems like another case where a successful Chrome extension was bought out so it could be used for either: 1. Mining the users' traffic and reselling it as market research, or 2. Using the users' computers as a pool for a residential proxy service, or 3. Replacing and inserting ads into users' browsers. This is unfortunately quite common.
- bhouston 6y ago
  Who are the main organizations doing that? It seems quite organized.
kyriakos 6y ago
Unrelated to the security implications, Microsoft Edge is doing tab suspension natively in the latest builds. https://www.windowslatest.com/2020/09/17/microsoft-edge-sleeping-tabs-feature/ https://www.windowslatest.com/2020/09/17/microsoft-edge-slee...
- geerlingguy 6y ago
  Safari has done this for a while now; one of the many reasons you can get tons more battery life running Safari than Chrome.
- Abishek_Muthian 6y ago
  Vivaldi also has hibernate feature for a while and Firefox too if I'm right. TGS caused issues resulting in loosing pinned tabs in Brave and Vivaldi and so I had to remove it there; Now I'm glad I had to do it.
supernova87a 6y ago
Isn't this a huge vulnerability that rises to the level of "Chrome team should police this"? I mean, just thinking potential threats (which now I'm removing the extension because of them): -- corporate web pages potentially sniffable if installed on work computer -- personal passwords, password manager traffic The potentially malicious actor is able to just scoop up any domain's encrypted traffic, isn't it? Or is there any practical assurance that they're only gathering domain names, high level traffic stats, etc?
- tonymet 6y ago
  In a word, yes. When you install and the extension says “has access to all the data on all web sites you visit” – this means all of your passwords, cookies can be recorded and sent to any other domain.
  - supernova87a 6y ago
    Would some agent be recording and transmitting the content of webpages in full, broadly? Or just capturing user-entered information?
    - tonymet 6y ago
      Yes, and definitely. Here's an example from the NanoBlock vs uBlock Origin controversy where cookies and private data were being harvested https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210 https://github.com/NanoAdblocker/NanoCore/issues/362#issueco... Assume that any time an app has privilege to access your data, they are going to do it either deliberately or accidentally.
- derwiki 6y ago
  At my company, our Macs are all managed with policies and we have a strict subset of Chrome extensions allowed for install. All of which have been vetted by our security team. Most* allowed are owned by large companies. As my company is not FAANG I would imagine this is common at many companies.
timhigins 6y ago
I'd just like to mention that if the community was determined enough we'd 1. Demand removal of analytics software 2. If no action, fork and re-publish. Obviously folks who aren't technical/didn't see these threads wouldn't get the benefit of an update. This is something where an explicitly pro-opensource and anti-tracking (or at least minimal tracking) policy by the browser extension stores would be valuable. The store itself could recommend the no-tracking community version instead. Of course this would have to happen on an individual basis and be carefully managed as so not to be abused.
- vadansky 6y ago
  They already did: https://github.com/aciidic/thegreatsuspender-notrack https://github.com/aciidic/thegreatsuspender-notrack Plus you can download the old 7.16 version which works fine and doesn't have the suspicious changes
  - Aradalf 6y ago
    > This work carries no guarantees only to the best of my ability in 2 hours using notepad2 & AstroGrep. I am not a developer and do not intend to spend much time keeping this extension updated.
paulgb 6y ago
I've been telling everyone who will listen[1][2][3] that as an extension developer, I'd love to be able to guarantee through the Chrome App Store that an extension matches a git commit (or auditable build pipeline artifact) exactly. It wouldn't fix everything (for example, you could still put a payload in an innocent-looking dependency), but it would at least fix the blatant problem that a maintainer can add code when uploading an extension even if the extension itself is open source and therefore (appears to be) auditable. [1] https://news.ycombinator.com/item?id=23265699 https://news.ycombinator.com/item?id=23265699 [2] https://news.ycombinator.com/item?id=16881343 https://news.ycombinator.com/item?id=16881343 [3] https://news.ycombinator.com/item?id=16317686 https://news.ycombinator.com/item?id=16317686
- arkadiyt 6y ago
  What's the difference between auditing an extension's code on github vs auditing the code from the Chrome store? It seems like anyone who is willing to do an audit can just as easily download the code directly. Sites like Duo's crxcavator [1] also do exactly that. [1]: https://crxcavator.io/ https://crxcavator.io/
  - wegs 6y ago
    (1) Practical. Many people look at git repos. No one audits with crxcavator. (2) Traceability. git has secure hashes, and things can't change when you're not looking. My experience is that Google cares deeply about its own security, but not much about the security of its users. This sort of change is reasonable, but completely outside of Google's psyche. Google will (1) Silently disable Android updates, leaving many running exploitable phones (2) Hold back security tools for Google Apps without a premium subscription. If your account was compromised, you have no way to do audits to understand what happened without $$$, which leads to many more attackers. (3) Expires Chromebooks rather quickly. Fortunately, unlike Android, it lets users know, but given the target market, many can't afford to upgrade. (4) Runs appstores full of malware. When malware is discovered, users have no way to know what it did. They're just notified malware existed. (5) Doesn't allow any sort of reasonable sandboxing of Android apps. If an app asks for filesystem, maps, and other permissions, you need to agree to run the app. I can't have Android give a dummy location or otherwise Given that the bulk of Google's business model is built on mass surveillance for advertising, with users-as-statistics, this isn't too surprising, but it's something to be aware of if you use Google. I firmly believe in civil liability for software companies which ship insecure products. They shouldn't be able to externalize costs like this. Follow good security practices, or your insurance premiums go up.
Cactus2018 6y ago
For anyone not clicking the link, TheMageKing opened this issue on Nov 3, 2020.
yodon 6y ago
Many comments in the GitHub issue mention Tabs Outliner as an alternative for the now-sketchy-looking The Great Suspender. Speaking as a long time paid user of the free/paid Tabs Outliner, I can't recommend it strongly enough. [0]https://chrome.google.com/webstore/detail/tabs-outliner/eggkanocgddhmamlbiijnphhppkpkmkl?hl=en https://chrome.google.com/webstore/detail/tabs-outliner/eggk...
- hs86 6y ago
  For me, it is also a superior alternative to Tree Style Tab on Firefox. It has better keyboard shortcuts, and drag and drop support of tabs or entire subtrees is more reliable than TST. Unloading entire subtrees and restoring them on other computers is also a nice feature that I don't want to miss anymore. The extension is closed source, and its dev sometimes needs a few weeks for important fixes, but it is still one of my most favorite browser extensions out there.
- nosianu 6y ago
  It does not seem to be open source though. The "Website" link only points back to the Chrome store and I found no mention of source code in the description. The Great Suspender at least was available as open source so one could go from there and a) notice that the release tags stopped, b) use the existing source there.
praptak 6y ago
What prevents bad actors from buying a popular extension and rolling out malicious code to everyone who uses the extension? I mean except the integrity of extension developers.
- mcjiggerlog 6y ago
  Nothing. I own a few extensions with users in the tens of thousands and receive so many emails from people/business trying to buy out the extensions for "monetization". This is a huge issue and Google is doing absolutely nothing to address it.
- bhouston 6y ago
  This is happening repeatedly. Each extension can possibly go bad at any time if the dev decides to cash out.
  - praptak 6y ago
    That's weird, I think this story is the second one ever that I read on this topic, so I assumed it's rare.
arusahni 6y ago
I wrote a browser extension that interacted with a password manager. I receive almost-weekly messages from folks offering to buy my extension.
dawnerd 6y ago
Wouldn’t be perfect but I’d like to see the ability to prevent extensions from making any web requests. I’d also like them to not silently update in the background.
crucialfelix 6y ago
Out of an abundance of paranoia, I always open all financial and secretive websites in Incognito mode, and I always disallow all extensions in Incognito mode. We should really have separate dedicated browsers just for doing transactions.
_qulr 6y ago
We need to talk about how difficult it is to monetize browser extensions. Most of these problems occur when a reputable extension gets sold to a less reputable owner, frequently for a relatively small amount of money (4-5 figures). Even very popular extensions have a hard time monetizing. Unfortunately, Chrome has recently made the situation worse by deprecating Chrome Web Store payments, and Firefox eliminated their paid extension store several years ago. If the only way to monetize an extension is to exploit its users for data, this kind of thing is going to keep happening. It's perfectly understandable how someone who is doing a lot of work for no pay will eventually get tired of it or have other priorities in life, which is what happened in this case. Perhaps we all need to stop taking it for granted that browser extensions ought to be free? Or maybe the browser vendors themselves can find ways of financially supporting extension authors. I feel that money is essential to both the problem and the solution. Of course, paid upfront software gets sold to new owners too. But if the software is paid upfront, the expectation is that the new owner will perhaps do a better job of maintaining and marketing the software, and that's why the new owner buys it. When the software is paid, the new owner has an opportunity to make money legitimately, without secretly exploiting the existing user base.
- Lammy 6y ago
  > We need to talk about how difficult it is to monetize browser extensions. Sounds like a feature to me :)
  - Aradalf 6y ago
    Yes, a feature that results in the user details of millions of innocent users getting harvested. Remind us your contact details again, so we can forward them to the FBI?
    - Lammy 6y ago
      I would much rather live in a world where people are aware of that possible problem than a world where paid extensions were the norm. e: If there were paid extensions there would be pirated extensions and this problem would be even more common imo :)
swiley 6y ago
Curated app stores are great at preventing malware because they prevent you from installing packages from anyone other than the official maintainer, including yourself.
yoloswagins 6y ago
I did the work of downloading a forked version [1] of the extension and disabling the mainline extension. In doing so, I lost about 60 suspended tabs, with no record in history as to what they were. In some ways, this is like a weight off my back. On the other hand, I was going to read those tabs, I swear! Oh well, time for me to search jstor for a history of copper mine consolidation, again. [1] https://github.com/aciidic/thegreatsuspender-notrack https://github.com/aciidic/thegreatsuspender-notrack

389 points by AdamGibbins 6y ago

The culpability of Dean Oemcke in this particular incident should not be understated. Hindsight is hindsight, of course, but the fact that the new owner of the platform distribution rights of this open-source project was (and apparently remains) anonymous seems like it ought to have been a huge red flag. The fact that these rights were paid for made it obvious that monetization was pending. The lack of transparency made it obvious that the form of that monetization would not be acceptable to the contributing community. There might be a way of contesting the rights to the project name but that would require legal activism and external funding. Basically the original project is dead insofar as the contributors are not comfortable with supporting a parasitic and probably malicious actor. I guess a fork is inevitable. Meanwhile the parasite will harvest the value of the 'brand', distribution rights, and existing codebase until it is drained by obsolescence. A really disgusting way to treat a community by both parties. One can only hope that Mr. Oemcke desperately needed the money for some vital purpose.

Lammy 6y ago

If anyone is looking for an alternative, I'm a big fan of Auto Tab Discard: https://add0n.com/tab-discard.html https://add0n.com/tab-discard.html https://addons.mozilla.org/en-US/firefox/addon/auto-tab-discard/ https://addons.mozilla.org/en-US/firefox/addon/auto-tab-disc... https://chrome.google.com/webstore/detail/auto-tab-discard/jhnleheckmknfcgijgkadoemagpecfol https://chrome.google.com/webstore/detail/auto-tab-discard/j...

hda111 6y ago

This is a problem with many package managers. Even if one downloads a package in Emacs from MELPA. How can one be sure it’s not containing malware? Read through all code every in every dependency after every update?

gcatalfamo 6y ago

TGS is absolutely critical for my everyday use: can someone confirm if everything is still as in the linked GitHub issue?

ThePowerOfFuet 6y ago
Why would things have suddenly reverted?

tonymet 6y ago

I stopped using Great Suspender a few years back when Chrome built this in https://developers.google.com/web/updates/2015/09/tab-discarding https://developers.google.com/web/updates/2015/09/tab-discar... I encourage people to disable all chrome extensions. They have unprecedented access to your data (they can read your bank credentials), and they are a big performance hit. e.g. using Chrome Devtools you can see that Lastpass doubles page load times. You can use SimpleExtManager (only has perms to turn on /off extensions) to turn everything off until you need them.

sizzle 6y ago
What about useful things like ghostery and uMatrix?
- tonymet 6y ago
  I keep a “temp” browser profile (chrome —> settings —> add user profile) and install extensions there. That way you can use ghostery on specific sites and it has no access to your important data from your main profile
- tonymet 6y ago
  They both have full access. some may say “do you trust these publishers” – but the way extensions are designed, there’s no way to trust them. You have to be extremely vigilant and inspect the code every time the extension updates, and you aren’t notified when there are updates. I wouldn’t install any extension permanently. I only keep Lastpass and it’s disabled until it’s needed for login.
  - sizzle 6y ago
    so we should accept website analytics/tracking scripts that potentially are recording every click and cursor movement under the guise of user research?

RandyRanderson 6y ago

This type of developer 'switch' is becoming so common that I now have to add my chrome extensions to google alerts so as to feel safe. As a user below comments: "We need to talk about how difficult it is to monetize browser extensions" b/c w/o this we will see this continue.

sheepdestroyer 6y ago

Three builds published to Chrome Webstore without corresponding commits published to GitHub. This Extension being GPLv2, is there a way to report this obvious license violation to Google/GitHub? Would they care?

blindm 6y ago

I am one of the few people that inspects the source-code of extensions. It's easy to do, for Firefox for example, just right-click and save-as in the extensions site, then rename your extension to a .zip file and extract e.g: addon.xpi --> addon.zip Then manually sift through the code looking for obvious malicious intent (or not so obvious malicious intent if the author is doing obfuscation). Note: obfuscation is a red flag! A simple scan for `https:// https://` / 'http:// http://' would usually yield interesting URLs where data is sent. I have actually spotted malicious addons in the wild this way and reported them to Mozilla. They were thankfully removed. Note: Obfuscation is NOT the same as minification, and I don't mean minification when using the word obfuscation!

Triv888 6y ago
Maybe Mozilla could list on the Addon's page a list of domains/IP addresses where data is being sent. A Bit like a table of Nutritional Facts for food, but for extensions.
- blindm 6y ago
  > A Bit like a table of Nutritional Facts for food, but for extensions. Great idea!
- gruez 6y ago
  So bad guys will route all traffic through a proxy instead? eg. this addon connects to: * https://484044b296.execute-api.us-east-1.amazonaws.com
  - Triv888 6y ago
    I always considered proxies, url shorteners, etc to be suspicious in the first place. Some more investigation would be required in some cases.
    - gruez 6y ago
      >I always considered proxies, url shorteners, etc to be suspicious in the first place It doesn't have to be as overt making it look like a proxy (eg. a endpoint that makes arbitrary http requests on behalf of the caller). It can be as simple as changing the endpoint for the spying service from https://evil.example.com/api/ https://evil.example.com/api/ to https://484044b296.execute-api.us-east-1.amazonaws.com/evil/api/ https://484044b296.execute-api.us-east-1.amazonaws.com/evil/... > Some more investigation would be required in some cases. The point is that the "nutrition facts label" doesn't really do anything because it's trivial to bypass. If it becomes widespread I guarantee every malicious addon maker would adopt this tactic.

tyingq 6y ago

Chrome extensions are an interesting study in trust. Even with their push for manifest v3, you can still run arbitrary JS on any url. Which, of course, allows arbitrary spying and manipulation. If they hobble that, though, a large portion of extensions become useless. I don't personally see any real middle ground. It's either a credible risk, or too complicated for practical use. The way manifest v3 hobbles practically required things like heuristics is a good example.

Abishek_Muthian 6y ago
I've had an extension which I downloaded for automatic tab reloading on chrome insert porn ads into YouTube, I think the extension was removed after reporting but considering Google does take payment for publishing extensions (Unlike Mozilla) and puts them through review; Why not do it right?
- EdwardDiego 6y ago
  One of our testers had that addon installed, same issue with porn ads.
  - Abishek_Muthian 6y ago
    Interesting, I remember it being taken down immediately after my complaint it would have been really bad if it had resurfaced.
corytheboyd 6y ago
I know it would break many extensions but I am of the opinion the architecture is all wrong. There instead should be clear APIs for some access to page content (for example, right-click context menus, tab control without content access, etc). The idea will probably be met with opposition because I didn’t explain it well enough, but maybe someone will get the idea hah. I’ve worked on large chrome extensions that heavily rely on hacking UI on top of page content and it’s truly awful. Everything you do feels liked it will break at the setup of a feather, because it does. Sure, there are some ways of making that LESS painful, but at the end of the day it will always be dirty hacks.

EGreg 6y ago

In general, there is a huge problem with how we distribute software, and package managers are even worse. We basically only look at the top level of things, when instead, every branch in the tree should have a bunch of security people watching it, like editors watch every change to a Wikipedia article, before it goes out. Corporations using automation and technology have hijacked our "Free Speech" ideals, and caused us to think that it's a good thing when one party can push out a tweet to 5 million people at once, or a single corporation can buy up local stations and enforce talking points on journalism. That's not freedom of speech at all. That's just a preference for maintaining entrenched power because someone "amassed it voluntarily"... and this mentality extends recursively all the way down ... Take for example the first Twitter mega-celebrity. Ashton Kutcher himself amassed it voluntarily because he was chosen by TV and movie executives once upon a time, to be used in mass media, and their platforms were "voluntarily" built in the past, from the invention of the TV, and people subscribed "voluntarily", and Twitter was built "voluntarily" and funded by VCs voluntarily, and so on. And the end result is, some power (in this case, audience) is concentrated in the hands of a few people, who disproportionately act as kingmakers for various other people and ideas. That's also how we get "too big to fail" issues in telecoms, banks, and so on. In science, things work differently. Arxiv.org exists but peer review is a big thing. Wikipedia has multiple distrusting parties for each large article. So does Bitcoin (presumably, anyway). In general, the more value (votes, data, code, money) accumulates in one place, the more "checks and balances" you should have for each release. You can't just have someone push out something in the middle of the night and have everyone pull it into their codebase via npm and then "launder" the (malicious) bugs through more and more releases. You need it to go through "peer review", and not on the top level of an entire tree, but rather, for each subtree there need to be people who understand what's going on. THAT is a society that's far more secure, that can't be easily backdoored by some hackers paid by a state to find vulnerabilities. And the capitalistic system we have today is pushing the other way (closed source, centralized databases, extract rents reward early investors through information asymmetry, etc.) and the result is stuff like SolarWinds, Equifax hack, Yahoo hack, etc. etc. etc. We're finally starting to put a tax on storing data without an explicit purpose, hopefully that will make it expensive enough that people will be custodying their own data at least. But when it comes to "broadcasting" things, I'd rather have less "real time pushes" and instead slow things down until we can "run byzantine consensus" gradually releasing to the public via concentric circles. The full solution would involve Merkle trees where some security organizations and researchers / peers (anonymous or not, but with reputations) sign off on each changeset. Instead of just Apple or something. Git + Verified Claims can already support most of the infrastructure, btw.

ce4 6y ago

Reminds me of the uBlock vs uBlock origin story some years ago: https://news.ycombinator.com/item?id=9437182 https://news.ycombinator.com/item?id=9437182 https://news.ycombinator.com/item?id=9718625 https://news.ycombinator.com/item?id=9718625

srtjstjsj 6y ago
That story is still ongoing. "New" ublock is still scamming people
antihero 6y ago
Also Nano Blocker. I had to spend HOURS unliking bullshit posts on my Instagram because the idiot maintainer sold it to some quite obviously sleazy dudes who harvested our cookies to use as an Instagram bot.
- ce4 6y ago
  What a low profile use for such a hack... And the idiot probably got away with 99% of those likes.

protoman3000 6y ago

I recently tried to find a health related tracking app on the Apple AppStore in order to conveniently track and manage my health but I noticed that I cannot trust any offered app anymore, regardless of paid or free. This can come either because the proliferation of *analytics, broad openness of supposedly sandboxed systems, needless availability of fingerprinting methods and lack of proof of privacy commitment by the vendors (and any published privacy policy is not enough), or because I just became too paranoid (or both?). Examples like these validate the suspicion that you can’t trust any app or plug-in anymore, with big vendors being in a inbetween position of “too big to lose trust”. I wonder when we will reach the point where there is no trusted web browser anymore, no trusted computer appliance. When will it be that you cannot even say a word to a person in-person anymore because it lands in a weakly secured cloud by the microphone inside their smartwatch that runs a weather app that is run by crooks. Or is that point reached already?

strogonoff 6y ago
> When will it be that you cannot even say a word to a person in-person anymore because it lands in a weakly secured cloud by the microphone inside their smartwatch that runs a weather app that is run by crooks. I believe it can already be the case with Google’s (and possibly Facebook’s) apps on Android—at least in case of Google I witnessed real-life tests showing how saying something in presence of the phone causes related ads and content to be shown in feeds—but it’s scarier with less scrupulous app maintainers. Disclaimer: I am not claiming that Android API grants all apps unauthorized access to always-on mic. The device in question was configured to enable continuous listening by the owner. I am not claiming voice recordings are stored or used in nefarious ways.
- mdpye 6y ago
  Citations please. Not because I think you're definitely fear mongering, but because real evidence would be important to see.
  - strogonoff 6y ago
    An owner of a Google-branded Android phone demonstrated it to me last year, it worked remarkably fast. IIRC, the example chosen was Google News. I can’t see how this is fear mongering. Device was not acting against owner’s will: that person specifically does not tighten relevant privacy settings and enables always-on mic because they see useful content suggestions as a feature. It is different from my outlook (and I take it yours too), but I think that point of view deserves the right to exist. The issue is that now when I am talking to someone like that in real life, I know I may be implicitly agreeing that Google would pick up my speech as well. It’s a clash similar to one between a person (e.g., my mom) who grants messenger apps full access to their phone’s address book for convenience, and their contact (e.g., myself) who does not want their information to be shared with Facebook et al. Addendum: a cursory search confirms this experience. — https://www.vice.com/en/article/wjbzzy/your-phone-is-listening-and-its-not-paranoia https://www.vice.com/en/article/wjbzzy/your-phone-is-listeni... — https://www.makeuseof.com/tag/your-smartphone-listening-or-coincidence/ https://www.makeuseof.com/tag/your-smartphone-listening-or-c... (2019) — https://www.quora.com/Does-Google-listen-to-my-conversations-to-push-ads-to-me https://www.quora.com/Does-Google-listen-to-my-conversations... (the first answer does not mention ads, but others share similar experience to what I saw) — Counterpoint: https://www.bbc.co.uk/news/technology-49585682 https://www.bbc.co.uk/news/technology-49585682 “phones that secretly listen to us are a myth” (2019). Notably, with all my respect for BBC, this article lacks a lot of context (did they turn off voice activation before testing? what were their privacy settings?), and to test devices listening they played commercials in presence of the phone rather than using voice (I have relatively high confidence that modern devices can easily distinguish between speech nearby and sound from a commercial before recording leaves the phone). Some sources claim that as of last year Google is changing the way their apps work. Not sure if they stop listening or stop showing relevant content. (I don’t personally own an Android phone, and even if I did I would have turned off virtual assistants & disabled always-on mic just as I do with my iPhone, so I wouldn’t be able to present first-hand proof.)

fractionalhare 6y ago

Seems like another case where a successful Chrome extension was bought out so it could be used for either: 1. Mining the users' traffic and reselling it as market research, or 2. Using the users' computers as a pool for a residential proxy service, or 3. Replacing and inserting ads into users' browsers. This is unfortunately quite common.

bhouston 6y ago
Who are the main organizations doing that? It seems quite organized.

kyriakos 6y ago

Unrelated to the security implications, Microsoft Edge is doing tab suspension natively in the latest builds. https://www.windowslatest.com/2020/09/17/microsoft-edge-sleeping-tabs-feature/ https://www.windowslatest.com/2020/09/17/microsoft-edge-slee...

geerlingguy 6y ago
Safari has done this for a while now; one of the many reasons you can get tons more battery life running Safari than Chrome.
Abishek_Muthian 6y ago
Vivaldi also has hibernate feature for a while and Firefox too if I'm right. TGS caused issues resulting in loosing pinned tabs in Brave and Vivaldi and so I had to remove it there; Now I'm glad I had to do it.

supernova87a 6y ago

Isn't this a huge vulnerability that rises to the level of "Chrome team should police this"? I mean, just thinking potential threats (which now I'm removing the extension because of them): -- corporate web pages potentially sniffable if installed on work computer -- personal passwords, password manager traffic The potentially malicious actor is able to just scoop up any domain's encrypted traffic, isn't it? Or is there any practical assurance that they're only gathering domain names, high level traffic stats, etc?

tonymet 6y ago
In a word, yes. When you install and the extension says “has access to all the data on all web sites you visit” – this means all of your passwords, cookies can be recorded and sent to any other domain.
- supernova87a 6y ago
  Would some agent be recording and transmitting the content of webpages in full, broadly? Or just capturing user-entered information?
  - tonymet 6y ago
    Yes, and definitely. Here's an example from the NanoBlock vs uBlock Origin controversy where cookies and private data were being harvested https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210 https://github.com/NanoAdblocker/NanoCore/issues/362#issueco... Assume that any time an app has privilege to access your data, they are going to do it either deliberately or accidentally.
derwiki 6y ago
At my company, our Macs are all managed with policies and we have a strict subset of Chrome extensions allowed for install. All of which have been vetted by our security team. Most* allowed are owned by large companies. As my company is not FAANG I would imagine this is common at many companies.

timhigins 6y ago

I'd just like to mention that if the community was determined enough we'd 1. Demand removal of analytics software 2. If no action, fork and re-publish. Obviously folks who aren't technical/didn't see these threads wouldn't get the benefit of an update. This is something where an explicitly pro-opensource and anti-tracking (or at least minimal tracking) policy by the browser extension stores would be valuable. The store itself could recommend the no-tracking community version instead. Of course this would have to happen on an individual basis and be carefully managed as so not to be abused.

vadansky 6y ago
They already did: https://github.com/aciidic/thegreatsuspender-notrack https://github.com/aciidic/thegreatsuspender-notrack Plus you can download the old 7.16 version which works fine and doesn't have the suspicious changes
- Aradalf 6y ago
  > This work carries no guarantees only to the best of my ability in 2 hours using notepad2 & AstroGrep. I am not a developer and do not intend to spend much time keeping this extension updated.

paulgb 6y ago

I've been telling everyone who will listen[1][2][3] that as an extension developer, I'd love to be able to guarantee through the Chrome App Store that an extension matches a git commit (or auditable build pipeline artifact) exactly. It wouldn't fix everything (for example, you could still put a payload in an innocent-looking dependency), but it would at least fix the blatant problem that a maintainer can add code when uploading an extension even if the extension itself is open source and therefore (appears to be) auditable. [1] https://news.ycombinator.com/item?id=23265699 https://news.ycombinator.com/item?id=23265699 [2] https://news.ycombinator.com/item?id=16881343 https://news.ycombinator.com/item?id=16881343 [3] https://news.ycombinator.com/item?id=16317686 https://news.ycombinator.com/item?id=16317686

arkadiyt 6y ago
What's the difference between auditing an extension's code on github vs auditing the code from the Chrome store? It seems like anyone who is willing to do an audit can just as easily download the code directly. Sites like Duo's crxcavator [1] also do exactly that. [1]: https://crxcavator.io/ https://crxcavator.io/
- wegs 6y ago
  (1) Practical. Many people look at git repos. No one audits with crxcavator. (2) Traceability. git has secure hashes, and things can't change when you're not looking. My experience is that Google cares deeply about its own security, but not much about the security of its users. This sort of change is reasonable, but completely outside of Google's psyche. Google will (1) Silently disable Android updates, leaving many running exploitable phones (2) Hold back security tools for Google Apps without a premium subscription. If your account was compromised, you have no way to do audits to understand what happened without $$$, which leads to many more attackers. (3) Expires Chromebooks rather quickly. Fortunately, unlike Android, it lets users know, but given the target market, many can't afford to upgrade. (4) Runs appstores full of malware. When malware is discovered, users have no way to know what it did. They're just notified malware existed. (5) Doesn't allow any sort of reasonable sandboxing of Android apps. If an app asks for filesystem, maps, and other permissions, you need to agree to run the app. I can't have Android give a dummy location or otherwise Given that the bulk of Google's business model is built on mass surveillance for advertising, with users-as-statistics, this isn't too surprising, but it's something to be aware of if you use Google. I firmly believe in civil liability for software companies which ship insecure products. They shouldn't be able to externalize costs like this. Follow good security practices, or your insurance premiums go up.

Cactus2018 6y ago

For anyone not clicking the link, TheMageKing opened this issue on Nov 3, 2020.

yodon 6y ago

Many comments in the GitHub issue mention Tabs Outliner as an alternative for the now-sketchy-looking The Great Suspender. Speaking as a long time paid user of the free/paid Tabs Outliner, I can't recommend it strongly enough. [0]https://chrome.google.com/webstore/detail/tabs-outliner/eggkanocgddhmamlbiijnphhppkpkmkl?hl=en https://chrome.google.com/webstore/detail/tabs-outliner/eggk...

hs86 6y ago
For me, it is also a superior alternative to Tree Style Tab on Firefox. It has better keyboard shortcuts, and drag and drop support of tabs or entire subtrees is more reliable than TST. Unloading entire subtrees and restoring them on other computers is also a nice feature that I don't want to miss anymore. The extension is closed source, and its dev sometimes needs a few weeks for important fixes, but it is still one of my most favorite browser extensions out there.
nosianu 6y ago
It does not seem to be open source though. The "Website" link only points back to the Chrome store and I found no mention of source code in the description. The Great Suspender at least was available as open source so one could go from there and a) notice that the release tags stopped, b) use the existing source there.

praptak 6y ago

What prevents bad actors from buying a popular extension and rolling out malicious code to everyone who uses the extension? I mean except the integrity of extension developers.

mcjiggerlog 6y ago
Nothing. I own a few extensions with users in the tens of thousands and receive so many emails from people/business trying to buy out the extensions for "monetization". This is a huge issue and Google is doing absolutely nothing to address it.
bhouston 6y ago
This is happening repeatedly. Each extension can possibly go bad at any time if the dev decides to cash out.
- praptak 6y ago
  That's weird, I think this story is the second one ever that I read on this topic, so I assumed it's rare.

arusahni 6y ago

I wrote a browser extension that interacted with a password manager. I receive almost-weekly messages from folks offering to buy my extension.

dawnerd 6y ago

Wouldn’t be perfect but I’d like to see the ability to prevent extensions from making any web requests. I’d also like them to not silently update in the background.

crucialfelix 6y ago

Out of an abundance of paranoia, I always open all financial and secretive websites in Incognito mode, and I always disallow all extensions in Incognito mode. We should really have separate dedicated browsers just for doing transactions.

_qulr 6y ago

We need to talk about how difficult it is to monetize browser extensions. Most of these problems occur when a reputable extension gets sold to a less reputable owner, frequently for a relatively small amount of money (4-5 figures). Even very popular extensions have a hard time monetizing. Unfortunately, Chrome has recently made the situation worse by deprecating Chrome Web Store payments, and Firefox eliminated their paid extension store several years ago. If the only way to monetize an extension is to exploit its users for data, this kind of thing is going to keep happening. It's perfectly understandable how someone who is doing a lot of work for no pay will eventually get tired of it or have other priorities in life, which is what happened in this case. Perhaps we all need to stop taking it for granted that browser extensions ought to be free? Or maybe the browser vendors themselves can find ways of financially supporting extension authors. I feel that money is essential to both the problem and the solution. Of course, paid upfront software gets sold to new owners too. But if the software is paid upfront, the expectation is that the new owner will perhaps do a better job of maintaining and marketing the software, and that's why the new owner buys it. When the software is paid, the new owner has an opportunity to make money legitimately, without secretly exploiting the existing user base.

Lammy 6y ago
> We need to talk about how difficult it is to monetize browser extensions. Sounds like a feature to me :)
- Aradalf 6y ago
  Yes, a feature that results in the user details of millions of innocent users getting harvested. Remind us your contact details again, so we can forward them to the FBI?
  - Lammy 6y ago
    I would much rather live in a world where people are aware of that possible problem than a world where paid extensions were the norm. e: If there were paid extensions there would be pirated extensions and this problem would be even more common imo :)

swiley 6y ago

Curated app stores are great at preventing malware because they prevent you from installing packages from anyone other than the official maintainer, including yourself.

yoloswagins 6y ago

I did the work of downloading a forked version [1] of the extension and disabling the mainline extension. In doing so, I lost about 60 suspended tabs, with no record in history as to what they were. In some ways, this is like a weight off my back. On the other hand, I was going to read those tabs, I swear! Oh well, time for me to search jstor for a history of copper mine consolidation, again. [1] https://github.com/aciidic/thegreatsuspender-notrack https://github.com/aciidic/thegreatsuspender-notrack