28 ms·

I no longer trust The Great Suspender

889 points by davidfstr 6y ago

tra3 6y ago
A reddit link, from the blog post [0] has all the details for those who don't use chrome. TLDR: A popular extension was quietly sold off to an unknown party that subsequently added tracking/analytics. Not specifically malware, but not trustworthy either. Did I miss anything? [0]: https://www.reddit.com/r/KyleTaylor/comments/jowlt2/open_source_development_the_great_suspender_saga/ https://www.reddit.com/r/KyleTaylor/comments/jowlt2/open_sou...
peanut_worm 6y ago
Why do people keep 100s of tabs open at a time? I get irritated if I have more than 8 open.
- eznzt 6y ago
  Because they have not found the bookmarks feature yet.
  - edeion 6y ago
    That brings me to the problem with links as well as with e-books: you don't usually see them. When you have an open tab, you see it all day long until you get rid of it. When you have a printed book, you bump in it on a daily basis (unless you hide it in more books).
    - hungryforcodes 6y ago
      Also bookmarks don't save page context. If I'm doing something -- even something simple like scrolling down a page -- and get interrupted, it's just easier to leave it open.
      - superkuh 6y ago
        Yep. Tab history is important. How I got to some page is almost as important as the page itself. I've been using large tab sessions ever since Opera 5 in the early 2000s. Back then I'd have 20-50 tabs or so. These days I have sessions of 500 active tabs and 500 suspended. It's great. I have full text tab search, and since my sessions last years, I know the general location of all important tabs. ALso, since I use a single process brower and NoScript, all those 500+ tabs take under <3 GB of ram. It's matter of taste, but it's no new trend. Tabs, and tab users, have been around for 20 years now.
  - ortusdux 6y ago
    When I have 100 tabs open, 90 of them are one time use pages. I need to compile bits of information from each page, and then I never need those pages again. Why would I use bookmarks? For example, last week I was shopping for a very specific, very expensive ceramic thrust bearing. I had 20+ pages open from 10+ suppliers and documentation sources. I needed those open all week while we decided on which one to buy. This was a minor background task, so I also had 60 other tabs open for my normal work flow. Just because people use a tool differently than you doesn't make them wrong.
  - gmiller123456 6y ago
    It'd be great if someone invented a method of working with bookmarks that worked as easily and seamlessly as tabs. Back in the days of social bookmarks (like del.icio.us) pretty much everyone had a "toread" folder. The main problem is that you have to remember to delete them after reading them. That's not really a problem for good articles you remember reading, but the crap articles you don't remember, or quit reading are easy to forget to delete from the bookmarks. So, you end up reading the same crap articles several times. With a tab, you close the window and you're done. With bookmarks, you have to close the window, go through your bookmarks, find the one that was crap that you have already forgotten and delete it. There's several other advantages to tabs too: Like the fact that they're naturally organized by window based on the task you're doing. You'll see them more often, and thus be reminded more often. They save context, like forwards and back history, and information you may have typed in, or a UI you may have manipulated.
- sixothree 6y ago
  Why do people not understand why I have 100s of tabs open? I get irritated when asked this question.
  - nousermane 6y ago
    Why indeed. Is that because bookmarks are too clumsy to use, and don't save your scroll position and other user input?
    - redwall_hp 6y ago
      Any time I'm working on something, I inevitably end up with 20-30 tabs with different things I'm referencing. Especially documentation. I think I have around 6-8 open when I'm not doing anything, since I pin some web apps (e.g. Facebook Messenger) or dashboards. It's also the best way to browse image galleries: middle click everything into new tabs, navigate them with the keyboard, and close them as you go. Beats clunky JavaScript lightboxes.
- blinding-streak 6y ago
  Tabs are my lazy man's to-do list. Leaving them open saves all the context I need. Closing them means I have to spend effort to get them back.
- ortusdux 6y ago
  Try the extension 'Session Buddy'. You can view all open tabs and windows, group them as needed, and then save, close, and reopen sessions and groups. I routinely research several related topics for a project, and I will need 10-30 tabs per topic open at once. Surprisingly, chrome manages to handle 100+ tabs on my system with out issue.
- angelbar 6y ago
  Please dont have more than 8 tabs open... problem solved. Other persons have other treshold... and use cases. Some user support need many searches that will help if be documented later... if I bookmark all of them I will never do that.
- jrockway 6y ago
  https://xkcd.com/1172/ https://xkcd.com/1172/
- dbbk 6y ago
  I'm a software developer and am always hovering around this mark. It's usually from digging through documentation, having multiple tabs with different areas of the app you're working on open, productivity tabs like Slack and Gmail, then personal tabs like Reddit and YouTube
- rbanffy 6y ago
  I multitask. A lot. It's my job. You should see my desktop
Centigonal 6y ago
More discussion on GitHub: https://github.com/greatsuspender/thegreatsuspender/issues/1263 https://github.com/greatsuspender/thegreatsuspender/issues/1... Quite similar to what happened to Nano Adblocker/Defender a few months ago.
- gruez 6y ago
  previous discussion: https://news.ycombinator.com/item?id=25622015 https://news.ycombinator.com/item?id=25622015
- deleted 6y ago
  [deleted]
mkj 6y ago
It seems auto-updating browser extensions are riskier than leaving them non-updated?
- netsharc 6y ago
  It'll be a "great" day when someone manages to do big damage with code that Google hosted and delivered to the victims... IMO it's just a matter of time.
- SiteRelEnby 6y ago
  Blindly letting anything auto-update.
  - mkj 6y ago
    I think the difference with browser extensions is the anonymity and speed of changing owners. There's more momentum to notice big companies going downhill (+- stuff like sourceforge)
  - AQXt 6y ago
    ...which happens all the time in the free software world, when you type `apt-get|yum|brew update`. What are the odds of one dependency being taken over by a shady anonymous entity?
    - mad182 6y ago
      Packages in the default repos for some large Linux distro are usually reviewed and tested by many people until they make it into updates for current stable version, so while it's probably not entirely impossible for some malicious code to get in, it seems pretty unlikely. Unlike browser extensions, where the current owner can upload anything they want and it's pushed to the users without them even knowing.
      - AQXt 6y ago
        How about `npm`, `pip`, `cpan`?... We have seen bad updates breaking the entire Javascript ecosystem, but they were not intentional. All it takes to inject a bad dependency is a burned out developer willing to delegate his free project to someone else...
bijant 6y ago
This is really Google's fault. They make it impossible to turn off automatic updates for Chrome extensions from their store. That would be kind-of-ok if they actually had a rigorous approval process. But they don't. The Chrome Web Store has become one of the prime Vectors for malware. The only way to be safe is to exclusively download releases from the extensions github repo and to manually install them.
- metalliqaz 6y ago
  The fact that Google has not addressed this gaping security hole in Chrome is borderline criminal.
  - stevenhuang 6y ago
    You can do better to voice your displeasure by not stretching credulity.
    - metalliqaz 6y ago
      It's hyperbole. Welcome to the Internet.
- AlexandrB 6y ago
  In general, taking control away from users sets up all kind of bad incentives. For example, automatic updates with no way to downgrade save vendors from having to compete with their own older versions. This means regressions in functionality or design can be pushed out with little recourse for users other than complaining online. This is compounded by ecosystem lock-in and lack of data portability. The software industry as a whole is heading towards treating users more and more paternalistically.
  - iamben 6y ago
    Conversely, before automatic updates web developers were stuck supporting Internet Explorer for the best part of twenty years. Many of the people using it had neither reason or knowledge to update it, and it became the reason my parent's computers got riddled with malware. There's a sensible middle ground here. Take the paternalistic approach that (generally) protects people like my mum. Add settings that allow people like you and me to turn off updates or roll backwards. Push the people controlling the updates (like the Chrome store) to better protect their users.
SiteRelEnby 6y ago
Either the second or third time it lost all my tabs was when I stopped trusting it.
EGreg 6y ago
And this is why we need to rethink how we do software distribution. Package managers are nice for the lazy, but then we get stuff like this: https://qz.com/646467/how-one-programmer-broke-the-internet-by-deleting-a-tiny-piece-of-code/amp/ https://qz.com/646467/how-one-programmer-broke-the-internet-... Actually you might be pulling a bunch of malicious updates in 2-3 modules deep in your dependency tree anytime. As a society we should be moving away from a culture of “immediate” updates eg on Twitter etc. And go towards more “peer review” like in science. Otherwise we are putting responsibility on every individual to verify all sides of the story and get informed. They don’t and society gets more and more dicided. Imagine if a scientist tweeted at 3am and half their followers instantly believed them. Or if an open source contributor’s pull request was instantly accepted and pulled overnight by everyone. That’s why USA and other countries are now so divided politically. Individual responsibility of 100% of the downstream nodes is strange to outsource responsibility to. I wrote about this back in 2012 predicting what would happen: https://magarshak.com/blog/?p=114 https://magarshak.com/blog/?p=114
- Mediterraneo10 6y ago
  Recently I wanted to build one of Signal’s libraries so that I could use it with signal-cli. It astonished me that building this secure messenger requires automatically downloading a whole host of third-party dependencies through wget from some disparate repositories, which presumably had received little vetting. What happened to the notion of using stable, centralized package repositories like Debian’s or Red Hat’s in order to build one’s software? I did a lot of Free Software development in the early millennium, then was away from the scene for a few years, and when I came back this desire for convenience above all else really baffles me.
  - EGreg 6y ago
    At Qbix, we have built everything in-house and the few dependencies that we do pull in, we vetted and pinned the versions. People have criticized us for that in the past but if we are ever to get past trusting large, centralized entities for our server back ends, we need to make sure to kick the open source movement to the next level: https://qbix.com/blog/2021/01/15/open-source-communities/ https://qbix.com/blog/2021/01/15/open-source-communities/ https://qbix.com/blog/2018/01/17/modern-security-practices-for-web-developers/ https://qbix.com/blog/2018/01/17/modern-security-practices-f...
alyandon 6y ago
The MS Edge dev channel has a basic form of tab suspending built into it now. Based on my non-rigorous testing it seems to actually save more memory than TGS ever did so I just removed the extension entirely. It is really a shame that basic functionality like this isn't built into more browsers and we have to rely on extensions to fill the gaps just to keep memory usage under control for tab-a-holics like myself. :(
- shawnz 6y ago
  In fact tab suspending/discarding has been built into Chrome for some time now and Great Suspender does optionally make use of the built-in functionality. I still sometimes use extensions like Great Suspender to give more control over the process (e.g. to suspend more aggressively on RAM-constrained machines or where the user uses a lot of tabs). Since this news came out I have switched to "Auto Tab Discard".
- jannes 6y ago
  Chromium-based browsers and Firefox have discarding built-in. chrome://discards/ has some advanced options (in Chromium-based browsers). Funnily enough, Google mentions The Great Suspender as inspiration for this feature in the August 2015 changelog: https://developers.google.com/web/updates/2015/09/tab-discarding https://developers.google.com/web/updates/2015/09/tab-discar... > We actually had a great chat with the author of the Great Suspender extension while developing tab discarding and they're glad to see us natively tackling this problem in ways that are more efficient than an extension might be able to, such as losing the state of your user inactions.
- dbbk 6y ago
  The functionality is built-into Chrome, the native tab discarding just happens when it thinks memory pressure is too high. Extensions like this give you extra granularity to set it to happen after a timer.
- davidfstr 6y ago
  > It is really a shame that basic functionality like this isn't built into more browsers and we have to rely on extensions to fill the gaps just to keep memory usage under control for tab-a-holics like myself. :( The way I see it, extension developers get to come up with innovative new features first, and then the first-party vendors like Apple, Google, and Microsoft take note and eventually do just that: Integrate it into their own products. For example: The Great Suspender → Sleeping Tabs [experimental] (Microsoft/Edge); Flux → Night Shift (Apple/iOS); Growl → macOS Notifications (Apple/macOS); Swype → iOS Built-in Keyboard (Apple/iOS); etc Edit: Fix formatting.
Aardwolf 6y ago
Doesn't chrome already suspend background tabs without plugin? At least I'm unable to properly have browser games running unless they're in a visible tab.
- rolfvandekrol 6y ago
  Browser games, implemented in Javascript, usually depend on requestAnimationFrame, which is not executed in background tabs. See https://developer.mozilla.org/en-US/docs/Web/API/window/requestAnimationFrame https://developer.mozilla.org/en-US/docs/Web/API/window/requ... for more info.
nakodari 6y ago
Thanks for this! I've been using this extension for a long time and just removed it today. Honestly, with Macbook Air M1 there is no need for suspending tabs any more because the battery life is amazing, so that also helps.
imedadel 6y ago
I recently switched to Auto Tab Discard.[1] It uses the browser's built-in tab suspending. It doesn't have all the features of TGS, though. Edit: OneTab[2] is also pretty good when you have lots of tabs open for research or work. [1]: https://github.com/rNeomy/auto-tab-discard https://github.com/rNeomy/auto-tab-discard [2]: https://www.one-tab.com/ https://www.one-tab.com/
- anotheryou 6y ago
  perfect! I was looking for [1] the other day. Plays nicely with sideberry which uses the same api but can't do "unload all other tabs".
- Debug_Overload 6y ago
  I've been using it for the last few weeks, and it's been pretty good so far. It doesn't suspend music tabs when they're not playing (which TGS did automatically), but nothing much to complain about.
- BlueGh0st 6y ago
  I personally use OneTab but it's worth noting that in the GH issue on TheGreatSuspender there's some ongoing (and mostly unsubstantiated, in this thread) concerns about OneTab's data collection and management[0]. [0] https://github.com/greatsuspender/thegreatsuspender/issues/1175#issuecomment-754828434 https://github.com/greatsuspender/thegreatsuspender/issues/1...
  - DavideNL 6y ago
    I wouldn't say it is "unsubstantiated". Sharing bookmarks, is not the same as "sharing it with anyone in the world" - without any notification.
    - BlueGh0st 6y ago
      It is "mostly unsubstantiated" because the thread makes multiple claims without proof. The bookmark pages on Google provide some evidence for one of the claims but it is, by no means, proof of the claim's validity.
AlphaWeaver 6y ago
Quick note about the workaround mentioned in this article - the suggestion to download the last known good version of the extension and sideload it is a good one, but it has some problems on Chrome. Chrome has features to dissuade users from installing extensions from outside the Chrome Web Store. If you load an unpacked extension, Chrome will issue an ominous warning (something like “this extension is untrusted, click here to uninstall”) on every launch. One could argue this is for security, but this change was implemented around the same time that Google disabled the ability to self-host extensions that install into Chrome. Really this is a mechanism to shut out independent extension developers from any potential plausible third-party distribution method that doesn’t rely on the Chrome Web Store (which Google controls and aggressively moderates.) Use Firefox.
- TedDoesntTalk 6y ago
  > Use Firefox. Firefox has similar restrictions... you have to side load through Developer Options. If you’re not a developer, you will be questioning why you’re doing this and the less-technically inclined will simply never do it (like my wife) And it is not entirely nefarious as you suggest. It limits the damage that sideloaded extensions did roughly 2010 and earlier. The WebExtension API was another assault on extensions. These days, chrome and Firefox have essentially closed a huge attack vector even though extensions are a shadow of their former selves. I was a skeptic for a long time (why should power users pay for the faults of everyone else?) but no more. Kudos.
  - Karunamon 6y ago
    Kudos? Availability is part of security, and the most secure system is disconnected from the internet and powered off. Why are we cheering our software becoming less useful in the name of safety? The switch to WebExtensions was a monstrous loss of functionality!
  - AlphaWeaver 6y ago
    Chrome sideloads extensions through a similarly obscure menu - My main quarrel is the prompt where the default option is to uninstall that appears on every launch. Firefox doesn't have that. Firefox also permits self-hosting extensions signed through their store, providing more freedom for extension developers.
albertgoeswoof 6y ago
Or you can use https://www.one-tab.com/ https://www.one-tab.com/ or https://tab.bz https://tab.bz for a similar-ish use case
asadkn 6y ago
I have always used The Great Discarder instead [1] It's by the same dev too but it uses Chrome's Native Tab Discarding feature and I found it way more efficient (at the time I started using it a few years ago - haven't compared recently). [1] https://chrome.google.com/webstore/detail/the-great-discarder/jlipbpadkjcklpeiajndiijbeieicbdh?hl=en https://chrome.google.com/webstore/detail/the-great-discarde...
- monkpit 6y ago
  I like the idea of using the discard mechanism, but if it’s from the same developer, wouldn’t it be at risk of having the same thing happen?
  - asadkn 6y ago
    True that's possible if it were to get popular. But since this wasn't the popular extension, it'd seem it wasn't sold off.
- shawnz 6y ago
  Great Suspender eventually added functionality to use Chrome's native tab discarding as well and so they stopped updating Great Discarder.
deleted 6y ago
[deleted]
skrowl 6y ago
Just sent him this email: Saw your article via HN. As an easier permanent fix, just uninstall The Great Suspender and install Auto Tab Discard (https://add0n.com/tab-discard.html https://add0n.com/tab-discard.html). It does the same thing. It's available on: Firefox - Auto Tab Discard – Get this Extension for Firefox (en-US)(https://addons.mozilla.org/en-US/firefox/addon/auto-tab-discard/ https://addons.mozilla.org/en-US/firefox/addon/auto-tab-disc...) Edge - Auto Tab Discard - Microsoft Edge Addons (https://microsoftedge.microsoft.com/addons/detail/auto-tab-discard/nfkkljlcjnkngcmdpcammanncbhkndfe https://microsoftedge.microsoft.com/addons/detail/auto-tab-d...) or even if you're still using Chrome - Auto Tab Discard - Chrome Web Store (https://chrome.google.com/webstore/detail/auto-tab-discard/jhnleheckmknfcgijgkadoemagpecfol https://chrome.google.com/webstore/detail/auto-tab-discard/j...)
- jschuur 6y ago
  Discarding inactive tabs is not what I use The Great Suspender for. I use it to... suspend tabs. Auto Tab Discard doesn't seem to do that.
  - loceng 6y ago
    Ah damn, I was about to try it to see if it actually discarded or suspended tabs.
  - fudged71 6y ago
    What is the difference? From the website it sounds like the favicon is changed. So the tab doesn’t go away it’s just on pause Google: “ a discarded tab doesn't go anywhere. We kill it but it's still visible on the Chrome tab strip. If you navigate back to a tab that's been discarded, it'll reload when clicked. Form content, scroll position and so on are saved and restored the same way they would be during forward/backward tab navigation.” In the future this will be updated to also use a serializer for discarded tabs.
  - shawnz 6y ago
    Discarding the tab is superior to what Great Suspender used to do. Why would you want the old behaviour? Tab discarding is just a more efficient, native implementation of what Great Suspender aimed to do in the first place.
tyingq 6y ago
I'm now curious how much money the original developer was paid to hand it over. I imagine he/she knew what the buyer's plan was.
- probably_wrong 6y ago
  According to the homepage of a company that buys apps, and as a first approximation, that would be "anywhere between 8x - 36x monthly revenue for apps. In most cases this is well above the standard market value of 6-12x". Whether they are lowballing candidates with that offer, I can't say.
cwwc 6y ago
Lifesaver. Much obliged, davidfstr.
otterpro 6y ago
Wow, this is why just recently my Macbook pro was registering high CPU usage even when all tabs were asleep using Great Suspender. For some reason, Chrome was registering high CPU usage, and I thought it was some Chrome bug.
- michaelcampbell 6y ago
  You lost me. What's this "this" in "this is why", exactly?
istorical 6y ago
anyone able to compare Tiny Suspender and Auto Tab Discard?
vmception 6y ago
Uninstalled and reported.
AQXt 6y ago
> Apparently recent versions of this extension have been taken over by a shady anonymous entity... That's something that worries me, whenever I install a software with trusted privileges. Software companies can sell their products -- and user base -- to other companies without notice. And it can be even worse in the free software world: think about all the updates that happen when you type `apt-get|yum|brew|npm|pip update`. What are the odds of a single dependency being taken over by a shady anonymous entity?
- deleted 6y ago
  [deleted]
deleted 6y ago
[deleted]
wintermutestwin 6y ago
At this point, I would gladly pay good money for a browser that prevented ads and tracking, provided most of the standard plugin functionality oob and vetted the rest. This whole mess is a massive time suck.
- deleted 6y ago
  [deleted]
- abecedarius 6y ago
  I'm using Brave. Not sure it exactly matches what you want, but it's the closest I've found.
nojito 6y ago
Sleeping Tabs is a feature on MS Edge. https://www.windowscentral.com/microsoft-edge-canary-can-put-your-tabs-sleep-save-memory https://www.windowscentral.com/microsoft-edge-canary-can-put...
kburman 6y ago
Here's list of other extensions which have been recently flagged by community for similar behaviour - Auto Refresh Premium, static.trckljanalytic.com - Stream Video Downloader, static.trckpath.com - Custom Feed for Facebook, api.trackized.com - Notifications for Instagram, pc.findanalytic.com - Flash Video Downloader, static.trackivation.com - Ratings Preview for YouTube, cdn.webtraanalytica.com Copied from https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-760600299 https://github.com/greatsuspender/thegreatsuspender/issues/1...
- sn_master 6y ago
  I wonder how many of those tracking websites or even the extensions themselves are owned by the same entity. That's a pretty common practice.
- rplnt 6y ago
  Is there an extension that can track my extensions?
  - jhloa2 6y ago
    I was just thinking about something similar. It would be nice if at a minimum, we could put together a list of compromised extensions. I feel like I've seen quite a few of these reports recently
    - pault 6y ago
      It should be possible to look at the source code of known compromised extensions and put together a list of heuristics that could automate part of the process. Minifiers make it more difficult though.
  - Bayart 6y ago
    You should be able to do some of that at the debug console level. But otherwise you're stuck tracking traffic at page level, at least as far as I know.
- 6y ago
TheRealPomax 6y ago
Is there a reason this extension still exists, given that tabs get heavily deprioritized when not in focus, and have been for many, many versions now?
- spiffytech 6y ago
  Chrome throttles tab CPU activities when backgrounded, but doesn't clear memory for the tab. For users like me who usually have 50-800 tabs open across all my browser windows, that really adds up. I also appreciate (err... appreciated) The Great Suspender because I didn't want all of those tabs active every time I opened a browser, so I'd have scores of tabs that never even got loaded, but were ready to go the moment I wanted to return to them.
  - shawnz 6y ago
    Chrome does discard the memory of tabs that haven't been used recently and Great Suspender can be configured to make use of that functionality.
- dbbk 6y ago
  They get throttled but still kept in memory. This drops them from memory.
  - TheRealPomax 6y ago
    I'm genuinely curious why that would matter: modern operating systems (heck, even not so modern ones) already move stale data from active memory to virtual memory in order to service active processes/threads, so if you're the kind of person who keeps hundreds of tabs open (and memory isn't the real problem if you do) then the OS is already keeping all that content on disk, not in memory...
orliesaurus 6y ago
Lifehack: export your suspended tabs as a flat file through the interface, uninstall the add on, then follow the downgrade as the blog suggests, at the end reimport your tabs from the flat file
jancsika 6y ago
> Disable analytics tracking by opening the extension options for The Great Suspender and checking the box “Automatic deactivation of any kind of tracking”. > Pray that the shady developer doesn’t issue a malicious update to The Great Suspender later. (There’s no sensible way to disable updates of an individual extension.) Does Debian ship packages for individual browser extensions? I mean, if they do I'm sure it's not scalable and-- after spending time reading debuild manual-- a giant, archaic pain in the ass. On the other hand, all these app delivery systems are so damned pernicious and require constant vigilance. We may have arrived at a moment in time where this is actually a difficult decision: * pay somebody a living wage to burrow down into Debian's WoT bureaucracy and add at least a selection of this functionality without phoning home * continue playing the most tedious game of whackamole with a whackamole game that mines all our data in order to learn how best to beat all users at whackamole
- deleted 6y ago
  [deleted]
- vaduz 6y ago
  > Does Debian ship packages for individual browser extensions? They do, for a couple of more notable ones (HTTPS Everywhere, uBlock Origin, Proxy Switcher, etc.) [0] > I mean, if they do I'm sure it's not scalable and-- after spending time reading debuild manual-- a giant, archaic pain in the ass. The biggest problem is to find a person to be a maintainer that is willing to keep up with the upstream development. [0] https://packages.debian.org/search?keywords=webext-&searchon=names&suite=all&section=all https://packages.debian.org/search?keywords=webext-&searchon...
  - jancsika 6y ago
    Thanks, that's good to know. > The biggest problem is to find a person to be a maintainer that is willing to keep up with the upstream development. That sounds like the kind of job someone does in return for money.
deleted 6y ago
[deleted]
iamspoilt 6y ago
Uninstalled. Period.
fancy_pantser 6y ago
As the developer of a pretty popular "utility" browser extension, I've been shocked by the volume of email I get every week about it. On a daily basis, I will get requests to sell the extension. Once or twice a week, I will receive an offer to add "a couple lines of code" to my extension which are always generously described as "allowed in the Chrome Web Store" by little fly-by-night organizations that only even have a landing page half the time and usually have throwaway-looking gmail accounts. Out of curiosity, I've asked a few what their code does and they never fully describe it, but it either collects analytics to ship home (my extension runs on all sites, so it's appetizing to them!) or places paid results at the top of any search results, for which I can make "thousands of dollars a month based on the number of North American users I have". Here is an example email I received yesterday. It's a good example of how they call it "an SDK" and looks like one of the more legit ones (they registered a domain to send email from, at least). We at [redacted] are considering purchasing the complete license and ownership of the extensions which have 50K+ active users, may I know if you would be interested in selling? If so, - what is your estimated price? Regarding the SDK monetization which we discussed earlier, as it is not distractive and is compatible with any other monetization. We have straightforward terms and provide support for your users agreement. Our partners generate 3-20 K USD monthly with our solution for the browser extensions. As a kind reminder, we are [redacted] — a reputable global peer-to-peer ethical proxy network. All our clients are big reputable companies, we authorize their business before providing any proxy plans. Look forward to your further feedback and discussing further details of our financial proposal for your Software in a short Zoom call or here by emails. Finally, I am also hounded by teams at Microsoft and Apple, who want me to port the extension to their new plugin ecosystems so it can be featured/showcased. I worked with Apple on one similar thing for an extension and it caused such a huge jump in support and feature requests from users that I was overwhelmed, so I am not keen to do it again until I have more free time. They can't understand why I don't want to grow by tens of thousands of users a week, but I'm just one person and don't make money from it whatsoever.
- nitrogen 6y ago
  Do extensions require any permissions to make requests? It seems like a strict sandbox that prevents data from flowing out of a page via an extension would help, if the extension is something like a JSON renderer.
mendelmaleh 6y ago
I expected this to be about Jack Dorsey/twitter xD
mtoddsmith 6y ago
Seems there should be an extension which checks other extensions for nefarious activity or notifies you of the events that are mentioned in the article.
qwerty456127 6y ago
By the way, is there an extension (I'm interested in both Firefox and Chrome) which would force all the new (background) tabs to be created in the suspended state (like if you had opened them in background and then restarted the browser) and only start loading after you actually open them?
- kchr 6y ago
  Same here!
- gneray 6y ago
  Ditto
- philtar 6y ago
  Auto Tab Discard adds an option to your right click menu "Open in Discarded Tab"
  - qwerty456127 6y ago
    Thank you very much! Not really a perfect solution (you still have to make many clicks, I just use MiddleClick or Ctrl+LeftCLick to open a background tab normally) but a really great extension nevertheless. I'm very happy to discover it.
Androider 6y ago
In Chrome, make sure you set your less frequently used extensions to run "On click" instead of "On all sites". Extensions -> extension details -> Site access. For dev tools and such, I set a whitelist of the sites they're allowed to run on, using that same extension details page. There's no need for your JSON formatter etc. to run on every single page you visit. Also speeds up browsing.
weakboi 6y ago
Ironically, I tracked the real world identity of someone using stolen credit cards in my ecom site BECAUSE he posted a tutorial/how-to on YouTube showing the vulnerability tool (script kiddie), under his real name. SMH. This won't stop this information from being disseminated, but it may save some idiots from themselves.
AlexCoventry 6y ago
Is there a tool which will automatically reload all your extensions from disk, as described in the OP? Seems like a sensible default, from a security perspective.
ext_dev 6y ago
Was once approached by a company who had software that would allow me to install affiliate links on Google Searches results by installing a third party on my extension. Had about 50k active users at the time and was making around €1.8k a month.[1] To be honest, users were informed on the install flow and most people didn't care what I was doing. Probably how Hola unblocker still has 8M. Google understandably told me to remove it. Donations inside extensions offer near nothing. Doesn't feel like a extension that can offer a paid tier. It's a dirty but effective way to generate an income stream relatively quickly. Even more so, if you wash your hands from it and walk away. I'm surprised Google hasn't taken it down completely, as it breaks the single use policy. [1] https://i.imgur.com/M4CD9CB.png https://i.imgur.com/M4CD9CB.png
dr-detroit 6y ago
You've heard of first world problems this is Martian problems like seriously you cant manage chrome tabs yourself
frob 6y ago
Google Chrome now has tab grouping. In Beta, you can click on the group name and collapse the tabs. Based on their reload times, it seems chrome suspends the tabs in the background when you collapse the group.
- katsura 6y ago
  Oh, this is awesome. I'm on Linux so I've been using Chromium, where this is already available. Pretty neat. Edit: looks like it works in Chrome as well.
- nottheonion 6y ago
  This looks promising. To activate the suspend on collapse feature enter "chrome://flags/" into the address bar and make sure these experimental features are "enabled": #tab-groups, #tab-groups-collapse, #tab-groups-collapse-freezing. I also enabled: #tab-groups-auto-create.
aitchnyu 6y ago
Why didnt browsers start warning users when an extension updated after changing owners?
- davidfstr 6y ago
  <nope>The owner in the extension metadata on The Great Suspender hasn't been updated (to my understanding) so the Chrome Web Store doesn't even know that the owner has been changed.</nope> Actually it does appear that the owner was changed from "deanoemcke" to "thegreatsuspender" (the new mystery owner) on the Chrome Web Store page. I agree that warning when updating an extension if the stated owner has changed would be valuable.
bugfix 6y ago
Wow, my Chrome RAM usage went from about 2GB to 8GB after removing TGS.
tus88 6y ago
"Shady" take-over of plugins/apps is just a big a suspicious fail as allowing apps to gain access to all contacts on mobile phones. Google never really cared about user privacy at all.
twunde 6y ago
For those interested in understanding the security of Chrome extensions, duo introduced CRXcavator (https://crxcavator.io/ https://crxcavator.io/) a while back, which does some risk scoring around permissions. It is chrome-only, and it doesn't protect against this type of attack specifically, although you can look at the Potential External Communication section for possible issues.
jeromeparadis 6y ago
There's a reason why I don't install any extension except a password manager.
jakobpb 6y ago
Uh, just use Firefox. Problem solved for both functionality and security.
brundolf 6y ago
Among other things, this is why when people say "HN doesn't need a dark mode, just use an extension", that isn't a valid solution. For years now I've refused to install any extensions that aren't too-big-to-compromise (which in practice - for me - means AdBlock Plus and maybe React Dev Tools), and that should be everyone's policy. Any extension whose compromise wouldn't damage the reputation of a billion-dollar organization is simply too juicy of an attack vector.
- raunakdag 6y ago
  It's funny you mention AdBlock Plus but not uBlock Origin in this situation. I'd say the latter is much, much better than the former.
  - brundolf 6y ago
    But is it better known? That's the determining factor here. The Great Suspender was well-regarded in certain circles, and even fairly well-known (I've never used it but I've heard of it). But even it apparently wasn't above compromise. To be reasonably safe, an extension has to either be a) so well-known that they'd never be able to get away with silently adding malware (because someone would notice, which to be fair is what happened here), or b) tied to a major brand that wouldn't want to sell out to some shady firm, on PR grounds alone.
    - albedoa 6y ago
      I see the distinction you are making, but there are many people (here especially) whose definition of "compromised" is not limited to malware (or whose definition of "malware" is not limited to what is happening with TGS).
- bsimpson 6y ago
  I agree that extension security isn't considered nearly as often as it should be, though my barrier isn't quite yours. For me, it comes down to developer trust and permissions. If someone I trust wrote a small, feature-targeted extension, I would probably be comfortable installing it. Similarly, if the permissions an extension has are tightly scoped to its use case, I'm more comfortable installing it. Now that I write that, I'm not sure how permissions and upgrades go together. If an extension that had tight permissions relaxes them I'd get notified before they took effect, right?
Paul-ish 6y ago
I keep most of my extensions disabled most of the time. A lot of the extensions have particular uses and don't always need to be active.
acdha 6y ago
This is why I stopped using extensions in any browser years ago unless it came from a trusted company I pay directly (i.e. 1Password). The broken economic model means that the developers always have pressure to cash in on a popular extension and Google has set things up to make abuse fast and easy with automatic silent updates and their usual skimping on human review. By the time the news about TGS came out most users already had the next release installed.
- jeffbee 6y ago
  Indeed. There was never a basis for trusting The Great Suspender in the first place. "Read and change all your data" is a permission that should be reserved for code you wrote yourself.
- lathiat 6y ago
  I also got rid of quite a few browser extensions that were handy but I just couldn't bring myself to spend time trusting them. It would be an interesting exercise to try and build an open source organisation around developing and publishing extensions in the open.
  - acdha 6y ago
    It’d also be interesting to see how much further you could go with permissions restricting access. For example, my 1Password usage needs to be able to read/write DOM element values but you could potentially say no network access or ability to create script or style elements. I’m not sure how much further sandboxing could practically be taken but it really seems like the all data, all sites permission needs to be much rarer than it currently is.
    - lathiat 6y ago
      Except 1password can’t sync your database without network access :)
      - acdha 6y ago
StellarTabi 6y ago
The lack of user control, lock files, granularity of controls over browser extensions has gone too far.
dstick 6y ago
More detailed information can be found here: https://github.com/greatsuspender/thegreatsuspender/issues/1263 https://github.com/greatsuspender/thegreatsuspender/issues/1...
MacroChip 6y ago
Does this extension add functionality beyond Chrome's existing tab suspension?
pjmlp 6y ago
I just don't use extensions, so no need to worry about such scenarios.
angryasian 6y ago
there really needs to be a better bookmarking solution.
facorreia 6y ago
That's why I don't trust Chrome extensions. There have been too many instances of a popular instance being taken over to run malware. I don't think Google's handling of these security issues has been adequate.
lanius 6y ago
I'm glad I decided to go with 32 GB of RAM for my current PC build. No longer need to close any tabs!
jonas_kgomo 6y ago
I've been using Sidekick,it has done a lot for me in terms of substituting extensions like TGS, It has its own tool for tab grouping and sessions, plus adblock. It has been good for productivity
bogomipz 6y ago
Did anyone Download the latest good version of The Great Suspender7.1.6) from GitHub and load it as an unpacked extension per the article? Are there any potential downsides to this? I was also curious how does loading this format avoid updates?
asgrdz 6y ago
I disable automatic updates for all extensions, as well as personally reviewing the source of every extension before installation. The review doesn't take much time. What I look for: 1. The manifest for what network endpoints the extension is allowed to call. 2. Any URL in the code that is external to the extension. 3. Any remote network function (fetch/XHR/links) and traceback to the call sites. 4. Whether there is any obfuscated code or not. If anything found in those spots seems fishy / unclear, I don't install the extension. Takes a few minutes, but catches most of the threat vectors. Skimming the code also gives me a sense of what sort of developer is behind the extension. Some code clearly shows a developer cares about privacy and / or security, which unconsciously adds karma for that dev in my book. Like others above, I don't use many extensions, but those I use I have to trust.
MarioMan 6y ago
There was a recent paper published at ACM CCS 2020 that attempts to identify malicious changes to extension updates. Might be worth a read. You’ve Changed: Detecting Malicious Browser Extensions through their Update Deltas https://dl.acm.org/doi/10.1145/3372297.3423343 https://dl.acm.org/doi/10.1145/3372297.3423343
mikhailfranco 6y ago
Looks like the 'last known good' version 7.1.6 is now blocked by the TGS server. Workaround to reopen a page is just to cut'n'paste the original URL from a parameter at the end of the TGS URL.
- mikhailfranco 6y ago
  It appears 'Back' may also work in restoring the page.

889 points by davidfstr 6y ago

tra3 6y ago

A reddit link, from the blog post [0] has all the details for those who don't use chrome. TLDR: A popular extension was quietly sold off to an unknown party that subsequently added tracking/analytics. Not specifically malware, but not trustworthy either. Did I miss anything? [0]: https://www.reddit.com/r/KyleTaylor/comments/jowlt2/open_source_development_the_great_suspender_saga/ https://www.reddit.com/r/KyleTaylor/comments/jowlt2/open_sou...

peanut_worm 6y ago

Why do people keep 100s of tabs open at a time? I get irritated if I have more than 8 open.

eznzt 6y ago
Because they have not found the bookmarks feature yet.
- edeion 6y ago
  That brings me to the problem with links as well as with e-books: you don't usually see them. When you have an open tab, you see it all day long until you get rid of it. When you have a printed book, you bump in it on a daily basis (unless you hide it in more books).
  - hungryforcodes 6y ago
    Also bookmarks don't save page context. If I'm doing something -- even something simple like scrolling down a page -- and get interrupted, it's just easier to leave it open.
    - superkuh 6y ago
      Yep. Tab history is important. How I got to some page is almost as important as the page itself. I've been using large tab sessions ever since Opera 5 in the early 2000s. Back then I'd have 20-50 tabs or so. These days I have sessions of 500 active tabs and 500 suspended. It's great. I have full text tab search, and since my sessions last years, I know the general location of all important tabs. ALso, since I use a single process brower and NoScript, all those 500+ tabs take under <3 GB of ram. It's matter of taste, but it's no new trend. Tabs, and tab users, have been around for 20 years now.
- ortusdux 6y ago
  When I have 100 tabs open, 90 of them are one time use pages. I need to compile bits of information from each page, and then I never need those pages again. Why would I use bookmarks? For example, last week I was shopping for a very specific, very expensive ceramic thrust bearing. I had 20+ pages open from 10+ suppliers and documentation sources. I needed those open all week while we decided on which one to buy. This was a minor background task, so I also had 60 other tabs open for my normal work flow. Just because people use a tool differently than you doesn't make them wrong.
- gmiller123456 6y ago
  It'd be great if someone invented a method of working with bookmarks that worked as easily and seamlessly as tabs. Back in the days of social bookmarks (like del.icio.us) pretty much everyone had a "toread" folder. The main problem is that you have to remember to delete them after reading them. That's not really a problem for good articles you remember reading, but the crap articles you don't remember, or quit reading are easy to forget to delete from the bookmarks. So, you end up reading the same crap articles several times. With a tab, you close the window and you're done. With bookmarks, you have to close the window, go through your bookmarks, find the one that was crap that you have already forgotten and delete it. There's several other advantages to tabs too: Like the fact that they're naturally organized by window based on the task you're doing. You'll see them more often, and thus be reminded more often. They save context, like forwards and back history, and information you may have typed in, or a UI you may have manipulated.
sixothree 6y ago
Why do people not understand why I have 100s of tabs open? I get irritated when asked this question.
- nousermane 6y ago
  Why indeed. Is that because bookmarks are too clumsy to use, and don't save your scroll position and other user input?
  - redwall_hp 6y ago
    Any time I'm working on something, I inevitably end up with 20-30 tabs with different things I'm referencing. Especially documentation. I think I have around 6-8 open when I'm not doing anything, since I pin some web apps (e.g. Facebook Messenger) or dashboards. It's also the best way to browse image galleries: middle click everything into new tabs, navigate them with the keyboard, and close them as you go. Beats clunky JavaScript lightboxes.
blinding-streak 6y ago
Tabs are my lazy man's to-do list. Leaving them open saves all the context I need. Closing them means I have to spend effort to get them back.
ortusdux 6y ago
Try the extension 'Session Buddy'. You can view all open tabs and windows, group them as needed, and then save, close, and reopen sessions and groups. I routinely research several related topics for a project, and I will need 10-30 tabs per topic open at once. Surprisingly, chrome manages to handle 100+ tabs on my system with out issue.
angelbar 6y ago
Please dont have more than 8 tabs open... problem solved. Other persons have other treshold... and use cases. Some user support need many searches that will help if be documented later... if I bookmark all of them I will never do that.
jrockway 6y ago
https://xkcd.com/1172/ https://xkcd.com/1172/
dbbk 6y ago
I'm a software developer and am always hovering around this mark. It's usually from digging through documentation, having multiple tabs with different areas of the app you're working on open, productivity tabs like Slack and Gmail, then personal tabs like Reddit and YouTube
rbanffy 6y ago
I multitask. A lot. It's my job. You should see my desktop

Centigonal 6y ago

More discussion on GitHub: https://github.com/greatsuspender/thegreatsuspender/issues/1263 https://github.com/greatsuspender/thegreatsuspender/issues/1... Quite similar to what happened to Nano Adblocker/Defender a few months ago.

gruez 6y ago
previous discussion: https://news.ycombinator.com/item?id=25622015 https://news.ycombinator.com/item?id=25622015
deleted 6y ago
[deleted]

mkj 6y ago

It seems auto-updating browser extensions are riskier than leaving them non-updated?

netsharc 6y ago
It'll be a "great" day when someone manages to do big damage with code that Google hosted and delivered to the victims... IMO it's just a matter of time.
SiteRelEnby 6y ago
Blindly letting anything auto-update.
- mkj 6y ago
  I think the difference with browser extensions is the anonymity and speed of changing owners. There's more momentum to notice big companies going downhill (+- stuff like sourceforge)
- AQXt 6y ago
  ...which happens all the time in the free software world, when you type `apt-get|yum|brew update`. What are the odds of one dependency being taken over by a shady anonymous entity?
  - mad182 6y ago
    Packages in the default repos for some large Linux distro are usually reviewed and tested by many people until they make it into updates for current stable version, so while it's probably not entirely impossible for some malicious code to get in, it seems pretty unlikely. Unlike browser extensions, where the current owner can upload anything they want and it's pushed to the users without them even knowing.
    - AQXt 6y ago
      How about `npm`, `pip`, `cpan`?... We have seen bad updates breaking the entire Javascript ecosystem, but they were not intentional. All it takes to inject a bad dependency is a burned out developer willing to delegate his free project to someone else...

bijant 6y ago

This is really Google's fault. They make it impossible to turn off automatic updates for Chrome extensions from their store. That would be kind-of-ok if they actually had a rigorous approval process. But they don't. The Chrome Web Store has become one of the prime Vectors for malware. The only way to be safe is to exclusively download releases from the extensions github repo and to manually install them.

metalliqaz 6y ago
The fact that Google has not addressed this gaping security hole in Chrome is borderline criminal.
- stevenhuang 6y ago
  You can do better to voice your displeasure by not stretching credulity.
  - metalliqaz 6y ago
    It's hyperbole. Welcome to the Internet.
AlexandrB 6y ago
In general, taking control away from users sets up all kind of bad incentives. For example, automatic updates with no way to downgrade save vendors from having to compete with their own older versions. This means regressions in functionality or design can be pushed out with little recourse for users other than complaining online. This is compounded by ecosystem lock-in and lack of data portability. The software industry as a whole is heading towards treating users more and more paternalistically.
- iamben 6y ago
  Conversely, before automatic updates web developers were stuck supporting Internet Explorer for the best part of twenty years. Many of the people using it had neither reason or knowledge to update it, and it became the reason my parent's computers got riddled with malware. There's a sensible middle ground here. Take the paternalistic approach that (generally) protects people like my mum. Add settings that allow people like you and me to turn off updates or roll backwards. Push the people controlling the updates (like the Chrome store) to better protect their users.

SiteRelEnby 6y ago

Either the second or third time it lost all my tabs was when I stopped trusting it.

EGreg 6y ago

And this is why we need to rethink how we do software distribution. Package managers are nice for the lazy, but then we get stuff like this: https://qz.com/646467/how-one-programmer-broke-the-internet-by-deleting-a-tiny-piece-of-code/amp/ https://qz.com/646467/how-one-programmer-broke-the-internet-... Actually you might be pulling a bunch of malicious updates in 2-3 modules deep in your dependency tree anytime. As a society we should be moving away from a culture of “immediate” updates eg on Twitter etc. And go towards more “peer review” like in science. Otherwise we are putting responsibility on every individual to verify all sides of the story and get informed. They don’t and society gets more and more dicided. Imagine if a scientist tweeted at 3am and half their followers instantly believed them. Or if an open source contributor’s pull request was instantly accepted and pulled overnight by everyone. That’s why USA and other countries are now so divided politically. Individual responsibility of 100% of the downstream nodes is strange to outsource responsibility to. I wrote about this back in 2012 predicting what would happen: https://magarshak.com/blog/?p=114 https://magarshak.com/blog/?p=114

Mediterraneo10 6y ago
Recently I wanted to build one of Signal’s libraries so that I could use it with signal-cli. It astonished me that building this secure messenger requires automatically downloading a whole host of third-party dependencies through wget from some disparate repositories, which presumably had received little vetting. What happened to the notion of using stable, centralized package repositories like Debian’s or Red Hat’s in order to build one’s software? I did a lot of Free Software development in the early millennium, then was away from the scene for a few years, and when I came back this desire for convenience above all else really baffles me.
- EGreg 6y ago
  At Qbix, we have built everything in-house and the few dependencies that we do pull in, we vetted and pinned the versions. People have criticized us for that in the past but if we are ever to get past trusting large, centralized entities for our server back ends, we need to make sure to kick the open source movement to the next level: https://qbix.com/blog/2021/01/15/open-source-communities/ https://qbix.com/blog/2021/01/15/open-source-communities/ https://qbix.com/blog/2018/01/17/modern-security-practices-for-web-developers/ https://qbix.com/blog/2018/01/17/modern-security-practices-f...

alyandon 6y ago

The MS Edge dev channel has a basic form of tab suspending built into it now. Based on my non-rigorous testing it seems to actually save more memory than TGS ever did so I just removed the extension entirely. It is really a shame that basic functionality like this isn't built into more browsers and we have to rely on extensions to fill the gaps just to keep memory usage under control for tab-a-holics like myself. :(

shawnz 6y ago
In fact tab suspending/discarding has been built into Chrome for some time now and Great Suspender does optionally make use of the built-in functionality. I still sometimes use extensions like Great Suspender to give more control over the process (e.g. to suspend more aggressively on RAM-constrained machines or where the user uses a lot of tabs). Since this news came out I have switched to "Auto Tab Discard".
jannes 6y ago
Chromium-based browsers and Firefox have discarding built-in. chrome://discards/ has some advanced options (in Chromium-based browsers). Funnily enough, Google mentions The Great Suspender as inspiration for this feature in the August 2015 changelog: https://developers.google.com/web/updates/2015/09/tab-discarding https://developers.google.com/web/updates/2015/09/tab-discar... > We actually had a great chat with the author of the Great Suspender extension while developing tab discarding and they're glad to see us natively tackling this problem in ways that are more efficient than an extension might be able to, such as losing the state of your user inactions.
dbbk 6y ago
The functionality is built-into Chrome, the native tab discarding just happens when it thinks memory pressure is too high. Extensions like this give you extra granularity to set it to happen after a timer.
davidfstr 6y ago
> It is really a shame that basic functionality like this isn't built into more browsers and we have to rely on extensions to fill the gaps just to keep memory usage under control for tab-a-holics like myself. :( The way I see it, extension developers get to come up with innovative new features first, and then the first-party vendors like Apple, Google, and Microsoft take note and eventually do just that: Integrate it into their own products. For example: The Great Suspender → Sleeping Tabs [experimental] (Microsoft/Edge); Flux → Night Shift (Apple/iOS); Growl → macOS Notifications (Apple/macOS); Swype → iOS Built-in Keyboard (Apple/iOS); etc Edit: Fix formatting.

Aardwolf 6y ago

Doesn't chrome already suspend background tabs without plugin? At least I'm unable to properly have browser games running unless they're in a visible tab.

rolfvandekrol 6y ago
Browser games, implemented in Javascript, usually depend on requestAnimationFrame, which is not executed in background tabs. See https://developer.mozilla.org/en-US/docs/Web/API/window/requestAnimationFrame https://developer.mozilla.org/en-US/docs/Web/API/window/requ... for more info.

nakodari 6y ago

Thanks for this! I've been using this extension for a long time and just removed it today. Honestly, with Macbook Air M1 there is no need for suspending tabs any more because the battery life is amazing, so that also helps.

imedadel 6y ago

I recently switched to Auto Tab Discard.[1] It uses the browser's built-in tab suspending. It doesn't have all the features of TGS, though. Edit: OneTab[2] is also pretty good when you have lots of tabs open for research or work. [1]: https://github.com/rNeomy/auto-tab-discard https://github.com/rNeomy/auto-tab-discard [2]: https://www.one-tab.com/ https://www.one-tab.com/

anotheryou 6y ago
perfect! I was looking for [1] the other day. Plays nicely with sideberry which uses the same api but can't do "unload all other tabs".
Debug_Overload 6y ago
I've been using it for the last few weeks, and it's been pretty good so far. It doesn't suspend music tabs when they're not playing (which TGS did automatically), but nothing much to complain about.
BlueGh0st 6y ago
I personally use OneTab but it's worth noting that in the GH issue on TheGreatSuspender there's some ongoing (and mostly unsubstantiated, in this thread) concerns about OneTab's data collection and management[0]. [0] https://github.com/greatsuspender/thegreatsuspender/issues/1175#issuecomment-754828434 https://github.com/greatsuspender/thegreatsuspender/issues/1...
- DavideNL 6y ago
  I wouldn't say it is "unsubstantiated". Sharing bookmarks, is not the same as "sharing it with anyone in the world" - without any notification.
  - BlueGh0st 6y ago
    It is "mostly unsubstantiated" because the thread makes multiple claims without proof. The bookmark pages on Google provide some evidence for one of the claims but it is, by no means, proof of the claim's validity.

AlphaWeaver 6y ago

Quick note about the workaround mentioned in this article - the suggestion to download the last known good version of the extension and sideload it is a good one, but it has some problems on Chrome. Chrome has features to dissuade users from installing extensions from outside the Chrome Web Store. If you load an unpacked extension, Chrome will issue an ominous warning (something like “this extension is untrusted, click here to uninstall”) on every launch. One could argue this is for security, but this change was implemented around the same time that Google disabled the ability to self-host extensions that install into Chrome. Really this is a mechanism to shut out independent extension developers from any potential plausible third-party distribution method that doesn’t rely on the Chrome Web Store (which Google controls and aggressively moderates.) Use Firefox.

TedDoesntTalk 6y ago
> Use Firefox. Firefox has similar restrictions... you have to side load through Developer Options. If you’re not a developer, you will be questioning why you’re doing this and the less-technically inclined will simply never do it (like my wife) And it is not entirely nefarious as you suggest. It limits the damage that sideloaded extensions did roughly 2010 and earlier. The WebExtension API was another assault on extensions. These days, chrome and Firefox have essentially closed a huge attack vector even though extensions are a shadow of their former selves. I was a skeptic for a long time (why should power users pay for the faults of everyone else?) but no more. Kudos.
- Karunamon 6y ago
  Kudos? Availability is part of security, and the most secure system is disconnected from the internet and powered off. Why are we cheering our software becoming less useful in the name of safety? The switch to WebExtensions was a monstrous loss of functionality!
- AlphaWeaver 6y ago
  Chrome sideloads extensions through a similarly obscure menu - My main quarrel is the prompt where the default option is to uninstall that appears on every launch. Firefox doesn't have that. Firefox also permits self-hosting extensions signed through their store, providing more freedom for extension developers.

albertgoeswoof 6y ago

Or you can use https://www.one-tab.com/ https://www.one-tab.com/ or https://tab.bz https://tab.bz for a similar-ish use case

asadkn 6y ago

I have always used The Great Discarder instead [1] It's by the same dev too but it uses Chrome's Native Tab Discarding feature and I found it way more efficient (at the time I started using it a few years ago - haven't compared recently). [1] https://chrome.google.com/webstore/detail/the-great-discarder/jlipbpadkjcklpeiajndiijbeieicbdh?hl=en https://chrome.google.com/webstore/detail/the-great-discarde...

monkpit 6y ago
I like the idea of using the discard mechanism, but if it’s from the same developer, wouldn’t it be at risk of having the same thing happen?
- asadkn 6y ago
  True that's possible if it were to get popular. But since this wasn't the popular extension, it'd seem it wasn't sold off.
shawnz 6y ago
Great Suspender eventually added functionality to use Chrome's native tab discarding as well and so they stopped updating Great Discarder.

deleted 6y ago

[deleted]

skrowl 6y ago

Just sent him this email: Saw your article via HN. As an easier permanent fix, just uninstall The Great Suspender and install Auto Tab Discard (https://add0n.com/tab-discard.html https://add0n.com/tab-discard.html). It does the same thing. It's available on: Firefox - Auto Tab Discard – Get this Extension for Firefox (en-US)(https://addons.mozilla.org/en-US/firefox/addon/auto-tab-discard/ https://addons.mozilla.org/en-US/firefox/addon/auto-tab-disc...) Edge - Auto Tab Discard - Microsoft Edge Addons (https://microsoftedge.microsoft.com/addons/detail/auto-tab-discard/nfkkljlcjnkngcmdpcammanncbhkndfe https://microsoftedge.microsoft.com/addons/detail/auto-tab-d...) or even if you're still using Chrome - Auto Tab Discard - Chrome Web Store (https://chrome.google.com/webstore/detail/auto-tab-discard/jhnleheckmknfcgijgkadoemagpecfol https://chrome.google.com/webstore/detail/auto-tab-discard/j...)

jschuur 6y ago
Discarding inactive tabs is not what I use The Great Suspender for. I use it to... suspend tabs. Auto Tab Discard doesn't seem to do that.
- loceng 6y ago
  Ah damn, I was about to try it to see if it actually discarded or suspended tabs.
- fudged71 6y ago
  What is the difference? From the website it sounds like the favicon is changed. So the tab doesn’t go away it’s just on pause Google: “ a discarded tab doesn't go anywhere. We kill it but it's still visible on the Chrome tab strip. If you navigate back to a tab that's been discarded, it'll reload when clicked. Form content, scroll position and so on are saved and restored the same way they would be during forward/backward tab navigation.” In the future this will be updated to also use a serializer for discarded tabs.
- shawnz 6y ago
  Discarding the tab is superior to what Great Suspender used to do. Why would you want the old behaviour? Tab discarding is just a more efficient, native implementation of what Great Suspender aimed to do in the first place.

tyingq 6y ago

I'm now curious how much money the original developer was paid to hand it over. I imagine he/she knew what the buyer's plan was.

probably_wrong 6y ago
According to the homepage of a company that buys apps, and as a first approximation, that would be "anywhere between 8x - 36x monthly revenue for apps. In most cases this is well above the standard market value of 6-12x". Whether they are lowballing candidates with that offer, I can't say.

cwwc 6y ago

Lifesaver. Much obliged, davidfstr.

otterpro 6y ago

Wow, this is why just recently my Macbook pro was registering high CPU usage even when all tabs were asleep using Great Suspender. For some reason, Chrome was registering high CPU usage, and I thought it was some Chrome bug.

michaelcampbell 6y ago
You lost me. What's this "this" in "this is why", exactly?

istorical 6y ago

anyone able to compare Tiny Suspender and Auto Tab Discard?

vmception 6y ago

Uninstalled and reported.

AQXt 6y ago

> Apparently recent versions of this extension have been taken over by a shady anonymous entity... That's something that worries me, whenever I install a software with trusted privileges. Software companies can sell their products -- and user base -- to other companies without notice. And it can be even worse in the free software world: think about all the updates that happen when you type `apt-get|yum|brew|npm|pip update`. What are the odds of a single dependency being taken over by a shady anonymous entity?

deleted 6y ago
[deleted]

deleted 6y ago

[deleted]

wintermutestwin 6y ago

At this point, I would gladly pay good money for a browser that prevented ads and tracking, provided most of the standard plugin functionality oob and vetted the rest. This whole mess is a massive time suck.

deleted 6y ago
[deleted]
abecedarius 6y ago
I'm using Brave. Not sure it exactly matches what you want, but it's the closest I've found.

nojito 6y ago

Sleeping Tabs is a feature on MS Edge. https://www.windowscentral.com/microsoft-edge-canary-can-put-your-tabs-sleep-save-memory https://www.windowscentral.com/microsoft-edge-canary-can-put...

kburman 6y ago

Here's list of other extensions which have been recently flagged by community for similar behaviour - Auto Refresh Premium, static.trckljanalytic.com - Stream Video Downloader, static.trckpath.com - Custom Feed for Facebook, api.trackized.com - Notifications for Instagram, pc.findanalytic.com - Flash Video Downloader, static.trackivation.com - Ratings Preview for YouTube, cdn.webtraanalytica.com Copied from https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-760600299 https://github.com/greatsuspender/thegreatsuspender/issues/1...

sn_master 6y ago
I wonder how many of those tracking websites or even the extensions themselves are owned by the same entity. That's a pretty common practice.
rplnt 6y ago
Is there an extension that can track my extensions?
- jhloa2 6y ago
  I was just thinking about something similar. It would be nice if at a minimum, we could put together a list of compromised extensions. I feel like I've seen quite a few of these reports recently
  - pault 6y ago
    It should be possible to look at the source code of known compromised extensions and put together a list of heuristics that could automate part of the process. Minifiers make it more difficult though.
- Bayart 6y ago
  You should be able to do some of that at the debug console level. But otherwise you're stuck tracking traffic at page level, at least as far as I know.
6y ago

TheRealPomax 6y ago

Is there a reason this extension still exists, given that tabs get heavily deprioritized when not in focus, and have been for many, many versions now?

spiffytech 6y ago
Chrome throttles tab CPU activities when backgrounded, but doesn't clear memory for the tab. For users like me who usually have 50-800 tabs open across all my browser windows, that really adds up. I also appreciate (err... appreciated) The Great Suspender because I didn't want all of those tabs active every time I opened a browser, so I'd have scores of tabs that never even got loaded, but were ready to go the moment I wanted to return to them.
- shawnz 6y ago
  Chrome does discard the memory of tabs that haven't been used recently and Great Suspender can be configured to make use of that functionality.
dbbk 6y ago
They get throttled but still kept in memory. This drops them from memory.
- TheRealPomax 6y ago
  I'm genuinely curious why that would matter: modern operating systems (heck, even not so modern ones) already move stale data from active memory to virtual memory in order to service active processes/threads, so if you're the kind of person who keeps hundreds of tabs open (and memory isn't the real problem if you do) then the OS is already keeping all that content on disk, not in memory...

orliesaurus 6y ago

Lifehack: export your suspended tabs as a flat file through the interface, uninstall the add on, then follow the downgrade as the blog suggests, at the end reimport your tabs from the flat file

jancsika 6y ago

> Disable analytics tracking by opening the extension options for The Great Suspender and checking the box “Automatic deactivation of any kind of tracking”. > Pray that the shady developer doesn’t issue a malicious update to The Great Suspender later. (There’s no sensible way to disable updates of an individual extension.) Does Debian ship packages for individual browser extensions? I mean, if they do I'm sure it's not scalable and-- after spending time reading debuild manual-- a giant, archaic pain in the ass. On the other hand, all these app delivery systems are so damned pernicious and require constant vigilance. We may have arrived at a moment in time where this is actually a difficult decision: * pay somebody a living wage to burrow down into Debian's WoT bureaucracy and add at least a selection of this functionality without phoning home * continue playing the most tedious game of whackamole with a whackamole game that mines all our data in order to learn how best to beat all users at whackamole

deleted 6y ago
[deleted]
vaduz 6y ago
> Does Debian ship packages for individual browser extensions? They do, for a couple of more notable ones (HTTPS Everywhere, uBlock Origin, Proxy Switcher, etc.) [0] > I mean, if they do I'm sure it's not scalable and-- after spending time reading debuild manual-- a giant, archaic pain in the ass. The biggest problem is to find a person to be a maintainer that is willing to keep up with the upstream development. [0] https://packages.debian.org/search?keywords=webext-&searchon=names&suite=all&section=all https://packages.debian.org/search?keywords=webext-&searchon...
- jancsika 6y ago
  Thanks, that's good to know. > The biggest problem is to find a person to be a maintainer that is willing to keep up with the upstream development. That sounds like the kind of job someone does in return for money.

deleted 6y ago

[deleted]

iamspoilt 6y ago

Uninstalled. Period.

fancy_pantser 6y ago

As the developer of a pretty popular "utility" browser extension, I've been shocked by the volume of email I get every week about it. On a daily basis, I will get requests to sell the extension. Once or twice a week, I will receive an offer to add "a couple lines of code" to my extension which are always generously described as "allowed in the Chrome Web Store" by little fly-by-night organizations that only even have a landing page half the time and usually have throwaway-looking gmail accounts. Out of curiosity, I've asked a few what their code does and they never fully describe it, but it either collects analytics to ship home (my extension runs on all sites, so it's appetizing to them!) or places paid results at the top of any search results, for which I can make "thousands of dollars a month based on the number of North American users I have". Here is an example email I received yesterday. It's a good example of how they call it "an SDK" and looks like one of the more legit ones (they registered a domain to send email from, at least). We at [redacted] are considering purchasing the complete license and ownership of the extensions which have 50K+ active users, may I know if you would be interested in selling? If so, - what is your estimated price? Regarding the SDK monetization which we discussed earlier, as it is not distractive and is compatible with any other monetization. We have straightforward terms and provide support for your users agreement. Our partners generate 3-20 K USD monthly with our solution for the browser extensions. As a kind reminder, we are [redacted] — a reputable global peer-to-peer ethical proxy network. All our clients are big reputable companies, we authorize their business before providing any proxy plans. Look forward to your further feedback and discussing further details of our financial proposal for your Software in a short Zoom call or here by emails. Finally, I am also hounded by teams at Microsoft and Apple, who want me to port the extension to their new plugin ecosystems so it can be featured/showcased. I worked with Apple on one similar thing for an extension and it caused such a huge jump in support and feature requests from users that I was overwhelmed, so I am not keen to do it again until I have more free time. They can't understand why I don't want to grow by tens of thousands of users a week, but I'm just one person and don't make money from it whatsoever.

nitrogen 6y ago
Do extensions require any permissions to make requests? It seems like a strict sandbox that prevents data from flowing out of a page via an extension would help, if the extension is something like a JSON renderer.

mendelmaleh 6y ago

I expected this to be about Jack Dorsey/twitter xD

mtoddsmith 6y ago

Seems there should be an extension which checks other extensions for nefarious activity or notifies you of the events that are mentioned in the article.

qwerty456127 6y ago

By the way, is there an extension (I'm interested in both Firefox and Chrome) which would force all the new (background) tabs to be created in the suspended state (like if you had opened them in background and then restarted the browser) and only start loading after you actually open them?

kchr 6y ago
Same here!
gneray 6y ago
Ditto
philtar 6y ago
Auto Tab Discard adds an option to your right click menu "Open in Discarded Tab"
- qwerty456127 6y ago
  Thank you very much! Not really a perfect solution (you still have to make many clicks, I just use MiddleClick or Ctrl+LeftCLick to open a background tab normally) but a really great extension nevertheless. I'm very happy to discover it.

Androider 6y ago

In Chrome, make sure you set your less frequently used extensions to run "On click" instead of "On all sites". Extensions -> extension details -> Site access. For dev tools and such, I set a whitelist of the sites they're allowed to run on, using that same extension details page. There's no need for your JSON formatter etc. to run on every single page you visit. Also speeds up browsing.

weakboi 6y ago

Ironically, I tracked the real world identity of someone using stolen credit cards in my ecom site BECAUSE he posted a tutorial/how-to on YouTube showing the vulnerability tool (script kiddie), under his real name. SMH. This won't stop this information from being disseminated, but it may save some idiots from themselves.

AlexCoventry 6y ago

Is there a tool which will automatically reload all your extensions from disk, as described in the OP? Seems like a sensible default, from a security perspective.

ext_dev 6y ago

Was once approached by a company who had software that would allow me to install affiliate links on Google Searches results by installing a third party on my extension. Had about 50k active users at the time and was making around €1.8k a month.[1] To be honest, users were informed on the install flow and most people didn't care what I was doing. Probably how Hola unblocker still has 8M. Google understandably told me to remove it. Donations inside extensions offer near nothing. Doesn't feel like a extension that can offer a paid tier. It's a dirty but effective way to generate an income stream relatively quickly. Even more so, if you wash your hands from it and walk away. I'm surprised Google hasn't taken it down completely, as it breaks the single use policy. [1] https://i.imgur.com/M4CD9CB.png https://i.imgur.com/M4CD9CB.png

dr-detroit 6y ago

You've heard of first world problems this is Martian problems like seriously you cant manage chrome tabs yourself

frob 6y ago

Google Chrome now has tab grouping. In Beta, you can click on the group name and collapse the tabs. Based on their reload times, it seems chrome suspends the tabs in the background when you collapse the group.

katsura 6y ago
Oh, this is awesome. I'm on Linux so I've been using Chromium, where this is already available. Pretty neat. Edit: looks like it works in Chrome as well.
nottheonion 6y ago
This looks promising. To activate the suspend on collapse feature enter "chrome://flags/" into the address bar and make sure these experimental features are "enabled": #tab-groups, #tab-groups-collapse, #tab-groups-collapse-freezing. I also enabled: #tab-groups-auto-create.

aitchnyu 6y ago

Why didnt browsers start warning users when an extension updated after changing owners?

davidfstr 6y ago
<nope>The owner in the extension metadata on The Great Suspender hasn't been updated (to my understanding) so the Chrome Web Store doesn't even know that the owner has been changed.</nope> Actually it does appear that the owner was changed from "deanoemcke" to "thegreatsuspender" (the new mystery owner) on the Chrome Web Store page. I agree that warning when updating an extension if the stated owner has changed would be valuable.

bugfix 6y ago

Wow, my Chrome RAM usage went from about 2GB to 8GB after removing TGS.

tus88 6y ago

"Shady" take-over of plugins/apps is just a big a suspicious fail as allowing apps to gain access to all contacts on mobile phones. Google never really cared about user privacy at all.

twunde 6y ago

For those interested in understanding the security of Chrome extensions, duo introduced CRXcavator (https://crxcavator.io/ https://crxcavator.io/) a while back, which does some risk scoring around permissions. It is chrome-only, and it doesn't protect against this type of attack specifically, although you can look at the Potential External Communication section for possible issues.

jeromeparadis 6y ago

There's a reason why I don't install any extension except a password manager.

jakobpb 6y ago

Uh, just use Firefox. Problem solved for both functionality and security.

brundolf 6y ago

Among other things, this is why when people say "HN doesn't need a dark mode, just use an extension", that isn't a valid solution. For years now I've refused to install any extensions that aren't too-big-to-compromise (which in practice - for me - means AdBlock Plus and maybe React Dev Tools), and that should be everyone's policy. Any extension whose compromise wouldn't damage the reputation of a billion-dollar organization is simply too juicy of an attack vector.

raunakdag 6y ago
It's funny you mention AdBlock Plus but not uBlock Origin in this situation. I'd say the latter is much, much better than the former.
- brundolf 6y ago
  But is it better known? That's the determining factor here. The Great Suspender was well-regarded in certain circles, and even fairly well-known (I've never used it but I've heard of it). But even it apparently wasn't above compromise. To be reasonably safe, an extension has to either be a) so well-known that they'd never be able to get away with silently adding malware (because someone would notice, which to be fair is what happened here), or b) tied to a major brand that wouldn't want to sell out to some shady firm, on PR grounds alone.
  - albedoa 6y ago
    I see the distinction you are making, but there are many people (here especially) whose definition of "compromised" is not limited to malware (or whose definition of "malware" is not limited to what is happening with TGS).
bsimpson 6y ago
I agree that extension security isn't considered nearly as often as it should be, though my barrier isn't quite yours. For me, it comes down to developer trust and permissions. If someone I trust wrote a small, feature-targeted extension, I would probably be comfortable installing it. Similarly, if the permissions an extension has are tightly scoped to its use case, I'm more comfortable installing it. Now that I write that, I'm not sure how permissions and upgrades go together. If an extension that had tight permissions relaxes them I'd get notified before they took effect, right?

Paul-ish 6y ago

I keep most of my extensions disabled most of the time. A lot of the extensions have particular uses and don't always need to be active.

acdha 6y ago

This is why I stopped using extensions in any browser years ago unless it came from a trusted company I pay directly (i.e. 1Password). The broken economic model means that the developers always have pressure to cash in on a popular extension and Google has set things up to make abuse fast and easy with automatic silent updates and their usual skimping on human review. By the time the news about TGS came out most users already had the next release installed.

jeffbee 6y ago
Indeed. There was never a basis for trusting The Great Suspender in the first place. "Read and change all your data" is a permission that should be reserved for code you wrote yourself.
lathiat 6y ago
I also got rid of quite a few browser extensions that were handy but I just couldn't bring myself to spend time trusting them. It would be an interesting exercise to try and build an open source organisation around developing and publishing extensions in the open.
- acdha 6y ago
  It’d also be interesting to see how much further you could go with permissions restricting access. For example, my 1Password usage needs to be able to read/write DOM element values but you could potentially say no network access or ability to create script or style elements. I’m not sure how much further sandboxing could practically be taken but it really seems like the all data, all sites permission needs to be much rarer than it currently is.
  - lathiat 6y ago
    Except 1password can’t sync your database without network access :)
    - acdha 6y ago

StellarTabi 6y ago

The lack of user control, lock files, granularity of controls over browser extensions has gone too far.

dstick 6y ago

More detailed information can be found here: https://github.com/greatsuspender/thegreatsuspender/issues/1263 https://github.com/greatsuspender/thegreatsuspender/issues/1...

MacroChip 6y ago

Does this extension add functionality beyond Chrome's existing tab suspension?

pjmlp 6y ago

I just don't use extensions, so no need to worry about such scenarios.

angryasian 6y ago

there really needs to be a better bookmarking solution.

facorreia 6y ago

That's why I don't trust Chrome extensions. There have been too many instances of a popular instance being taken over to run malware. I don't think Google's handling of these security issues has been adequate.

lanius 6y ago

I'm glad I decided to go with 32 GB of RAM for my current PC build. No longer need to close any tabs!

jonas_kgomo 6y ago

I've been using Sidekick,it has done a lot for me in terms of substituting extensions like TGS, It has its own tool for tab grouping and sessions, plus adblock. It has been good for productivity

bogomipz 6y ago

Did anyone Download the latest good version of The Great Suspender7.1.6) from GitHub and load it as an unpacked extension per the article? Are there any potential downsides to this? I was also curious how does loading this format avoid updates?

asgrdz 6y ago

I disable automatic updates for all extensions, as well as personally reviewing the source of every extension before installation. The review doesn't take much time. What I look for: 1. The manifest for what network endpoints the extension is allowed to call. 2. Any URL in the code that is external to the extension. 3. Any remote network function (fetch/XHR/links) and traceback to the call sites. 4. Whether there is any obfuscated code or not. If anything found in those spots seems fishy / unclear, I don't install the extension. Takes a few minutes, but catches most of the threat vectors. Skimming the code also gives me a sense of what sort of developer is behind the extension. Some code clearly shows a developer cares about privacy and / or security, which unconsciously adds karma for that dev in my book. Like others above, I don't use many extensions, but those I use I have to trust.

MarioMan 6y ago

There was a recent paper published at ACM CCS 2020 that attempts to identify malicious changes to extension updates. Might be worth a read. You’ve Changed: Detecting Malicious Browser Extensions through their Update Deltas https://dl.acm.org/doi/10.1145/3372297.3423343 https://dl.acm.org/doi/10.1145/3372297.3423343

mikhailfranco 6y ago

Looks like the 'last known good' version 7.1.6 is now blocked by the TGS server. Workaround to reopen a page is just to cut'n'paste the original URL from a parameter at the end of the TGS URL.

mikhailfranco 6y ago
It appears 'Back' may also work in restoring the page.