10 ms·

Malware in open-source web extensions

235 points by chmaynard 6y ago

Lammy 6y ago
Terrible headline makes it sound like the open-source-ness made the attack possible to occur instead of possible to be discovered. "Of course, as the vast majority of the users of The Great Suspender were not interested in its open-source nature, few of them noticed until October, when the new maintainer made a perfectly ordinary release on the Chrome Web Store. Well, perfectly ordinary except for the minor details that the release did not match the contents of the Git repository, was not tagged on GitHub, and lacked a changelog."
- tga_d 6y ago
  I think it would only be interpreted that way if you don't know what LWN is?
panpanna 6y ago
The article is about The Great Suspender. Kinda off-topic: with enough eyes all bugs are shallow, but does that really help when Google prefers playing whack-a-mole to doing the right thing?
- paulryanrogers 6y ago
  What do you think Google should be doing? Human review?
  - panpanna 6y ago
    I would actually be happy with some well planned machine review and some clean rules that are actually enforced. A man can dream, I guess.
    - weaksauce 6y ago
      That was what mozilla did when they had resources to do so... now I think they have a different tactic but if you obfuscate it they require a full unadulterated source code link. google operate(d/s?) on the permissive model where you pay for a small membership and then they let you put it up unrestricted and if it gets too many reports it gets pulled. I think mozilla has the slight edge personally but either way i'd be wary of installing extensions willy nilly.
      - dblohm7 6y ago
        "Recommended Extensions" on addons.mozilla.org still get the full human-reviewed treatment.
        calumapplepie 6y ago
        And those they don't recommend are clearly noted as unverified and possibly containing malware. It's almost like they WANT to protect users....
        weaksauce 6y ago
        Yeah it's kinda a big dichotomy though... they only review very few extensions after doing their automated testing on them. my extension is marked as unverified and there doesn't seem to be a way to change that other than getting some unknown critical mass of users where they are interested in doing a manual review. oh well... not a big deal I guess and the extension is more for my own usefulness.
    - deleted 6y ago
      [deleted]
  - mschuster91 6y ago
    Providing some sort of customer service that reacts at least when the press comes knocking? Use their considerable financial and legal firepower to sue whoever pushed the malwarized version of Great Suspender into the ground? Enforce that Chrome extensions be built on Google infrastructure from public source code repositories to prevent silent takeovers, at least for extensions with 10k+ subscriptions? Alert people that they should rotate their passwords? The last one is so crucial. Had I not read that LWN post, I would never have noticed that the extension didn't just run adware fraud but also snooped passwords. Seriously, fuck Google and their disgusting zero communication attitude.
  - bzb6 6y ago
    Considering you have to pay a yearly fee to keep your extension published, that seems reasonable.
  - zozbot234 6y ago
    F-Droid builds all of their apps from the publicly released source code. There's no reason why Google couldn't do the same, at least for apps hosted on well-known coding/review platforms like GitHub.
    - brigandish 6y ago
      That's a good point. Is there some kind of time lag between the builds and the repo updates? If there's not time for anyone to check the code then the door is still slightly open for malicious code to enter the store without scrutiny.
  - SilverRed 6y ago
    The whole idea of extensions is fundamentally broken. You are letting an unknown person who you have no way to trust or hold accountable access all of your web data. It can't be fixed without crippling the system. You can't sandbox permissions because the most basic and useful tools require full access to every website. The only way I can think of is having all extension developers required to have their identity verified and from a country that follows some common law so that google can take legal action against malware developers.
    - mjevans 6y ago
      JavaScript served by the sites; exact same issue. I shouldn't be forced to run someone else's code to look at a publication. That's the entire point behind using something as ugly as XML (or it's simplified child, HTML) to begin with: this is supposed to be a document markup language. A method of annotating what an author would _like_ to have happen when rendering the data. I seriously loath the fetish of creating pixel perfect displays which treat the end user as an actively hostile element; a passive consumer, rather than someone empowered to use the data for their own enlightenment in the manor their preferences prefer. (Font size, screen reader, dark / light mode, etc)
      - daveoc64 6y ago
        > JavaScript served by the sites; exact same issue. It's not really the same issue. If you are visiting a site that uses its own JavaScript, you can probably assume that if it's run by someone trustworthy, the script isn't going to try stealing your passwords or credit card number. There shouldn't be any reason for the web page to have access to anything that you're not providing it with anyway. A browser extension (like an ad blocker) can access the content on every page you visit. That could be your bank, email account, social media - anything. If you have a malicious browser extension, it can see everything you do.
  - Jach 6y ago
    Making it so extensions don't auto-update themselves would be a helpful step in the right direction, it would cut down on the impact of when these things happen. Unfortunately I think we'll sooner see Firefox aping Chrome on this than the other way around.
    - paulryanrogers 6y ago
      But this goes against other security advice: stay up to date.
      - Jach 6y ago
        The real security advice is: keep up to date with security patches. Staying up to date just because is not good advice. Gentoo has a nice system, "Gentoo Linux Security Advisories", where you can periodically run a program called glsa-check which lets you know if you have packages installed that have security problems, what the problems are, and points to more info (like CVEs). You can even have it upgrade stuff on its own if you don't want to think about it. Something like this would be a nice feature for browser extensions.
Jakobeha 6y ago
Shoutout to people like the author who look at various open-source apps to spot malicious activity. Open-source libraries are a great contribution to software, but it can also be dangerous if malicious code is sneaked into a library used by safety-critical software. And web extensions are safety-critical software.
FloatArtifact 6y ago
Part of the issue is the github version did not match the distribution version?
- weaksauce 6y ago
  That and they inserted random javascript from a website that can change at any moment, created a shady domain name mascaraing as affiliated with a different analytics to funnel analytics to (and who knows what else but i think passwords and logins were pilfered). they also gave themselves webrequest permissions for no reason which alters the threat profile too.
dang 6y ago
Recent and related: https://news.ycombinator.com/item?id=25622015 https://news.ycombinator.com/item?id=25622015 https://news.ycombinator.com/item?id=25846504 https://news.ycombinator.com/item?id=25846504 https://news.ycombinator.com/item?id=26028085 https://news.ycombinator.com/item?id=26028085 (a bit) https://news.ycombinator.com/item?id=26029844 https://news.ycombinator.com/item?id=26029844 (a bit) Others?
jeromenerf 6y ago
As if supply chain attacks, ransomwares and all the zero click wormable vulnerabilities we receive every other day were not enough. I like gardening my small personal home server, services and backups but there is no reason debian packages could not be subject to the same supply chain "evil maid" or upstream "evil new maintainer". Everything being done in the open and reviewed makes it less probable, but not impossible. Sigh. As a company, "risk" is mostly insurance. As an individual, it’s anxiety.
- laurent92 6y ago
  Every package manage is a horrible vulnerability (along with being a useful tool). When you package a webapp: - Debian - Maven - NPM - On the dev machines: Brew, Chrome extensions... Aren’t they very easy to exploit, for a mildly dedicated actor? I don’t see any decent solution to this. Any line could contain a wget | bash...
  - franklampard 6y ago
    Deno addresses this problem by not giving module’s permission by default I think
    - oauea 6y ago
      No, that's per process. Not very useful and can already be done with selinux etc
  - Kalium 6y ago
    You can always just accept the risk. Or you can not, and work to control your supply chain. Host the artifacts yourself and choose carefully which ones you use. There is no magic bullet, just boring and painful risk-control processes. But they do help.
    - SilverRed 6y ago
      The future is sandboxed apps with flatpak. Who cares if Spotify is malware when it can't access anything. Wayland, SELinux, Flatpak, PipeWire. These will save us or at least reduce the problem of evil maintainers. This model has been tried and proven for over a decade on mobile. What we call malware on mobile is simply the app doing bad things with what you enter in to the app itself and not the desktop class "steals all your data and then encrypts it"
neolog 6y ago
Google could have some automated checks with the results shown in the Chrome Web Store. Does this update add new network requests, for example.
- gruez 6y ago
  >Does this update add new network requests, for example. this is fundamentally impossible to do because you can smuggle data out by injecting content scripts to a given page and make requests in that context.
gildas 6y ago
> To prevent these issues from occurring again in the future, Google has been pushing a "Manifest V3", which (among other, more controversial requirements) bans the practice of executing any JavaScript loaded from a remote server It's a bit ironic that this security issue doesn't exist in Firefox [1] when they actually implement features promoted by Google in the Manifest V3. Why doesn't Chrome already block remote scripts? [1] https://blog.mozilla.org/addons/2019/12/12/test-the-new-csp-for-content-scripts/ https://blog.mozilla.org/addons/2019/12/12/test-the-new-csp-...
- nugget 6y ago
  Wouldn’t this neuter the most useful Chrome extensions? Cash back/coupons, adblock, etc.
  - gildas 6y ago
    These extensions don't need to run remote scripts to work properly, and they work perfectly in Firefox. Typically, "legitimate" extensions use remote scripts to dynamically insert trackers or ads.
  - SilverRed 6y ago
    You can still return text data, you don't need to execute it.
- sneak 6y ago
  I really wish we could get something like this for local, desktop apps. I'm super tired of most every new desktop "app" being just an electron runtime (which, of course, can read and write all over my filesystem) that runs now-unsandboxed js both from its own bundle, as well as downloaded willy-nilly from the internet.
  - tadfisher 6y ago
    Let's give engineers more credit, here. The majority of desktop applications have the same capabilities, including writing all over your filesystem and executing code from remote sources. Electron gives those same capabilities to apps written in JavaScript.
deleted 6y ago
[deleted]
gorhill 6y ago
I want to clarify a few points in the article re. uBlock Origin, they might be seen as minor details but to me they matter. > Raymond Hill, after (you guessed it) he transferred ownership of uBlock to a new, untrustworthy maintainer Only the GitHub repo was transferred, I never transferred the extension in the Chrome Store, and Opera Store.[1] The Firefox version was published by a contributor, and he chose to stay with the new maintainer, and as a result I created a new publication for uBlock Origin in Firefox store. All this was nearly 6 years ago. > Aljoudi began reducing blocking features, eventually choosing to permit certain ads via the "acceptable ads" program "Acceptable Ads" was added to "uBlock" in February 2019 by the new owner, BetaFish Inc. (maker of AdBlock).[2] BetaFish Inc. was itself sold circa October 2015 to an (still) anonymous buyer.[3] > Hill created a fork, now called uBlock Origin, which reverted the changes I didn't revert any change, I forked while I was still controlling the GitHub repo.[4] If you look at the project timeline, it shows that I have been in charge since the first commit in June 2014.[5] > Nano Defender and its 200,000+ users, upon their recent acquisition, immediately began having their personal data mined. Note that the malware did not require the blocking ability of the webRequest API to collect the data, it needed only the observational ability, which is not deprecated by Manifest v3.[6] ** [1] https://github.com/gorhill/uBlock/issues/57 https://github.com/gorhill/uBlock/issues/57 [2] https://github.com/uBlock-LLC/uBlock/releases/tag/0.9.5.13 https://github.com/uBlock-LLC/uBlock/releases/tag/0.9.5.13 [3] https://news.ycombinator.com/item?id=10318200 https://news.ycombinator.com/item?id=10318200 [4] This was the first release following the split, nothing had to be reverted: https://github.com/gorhill/uBlock/releases/tag/0.9.3.0 https://github.com/gorhill/uBlock/releases/tag/0.9.3.0 [5] https://github.com/gorhill/uBlock/graphs/contributors https://github.com/gorhill/uBlock/graphs/contributors [6] https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210 https://github.com/NanoAdblocker/NanoCore/issues/362#issueco...
- chrismiller 6y ago
  I really want to thank you for your work on uBlock. No other software that has contributed so much to my overall happiness, productivity and well-being. I just double checked the repo but couldn’t find a way to support your work. Is there any way I can donate or send something your way?
timemachine 6y ago
The whole idea of me reviewing software before I install it breaks when I can’t easily install it from the source I reviewed. This reminds me of why GitHub should create it’s own App Store (yup, I’m gonna beat this drum): I can navigate the source ask questions about parts that make me suspicious, and then install a prebuilt binary with confidence that the binary was the sum of what I reviewed.
- yjftsjthsd-h 6y ago
  To be explicit: This depends on the app store only allowing CI builds, since otherwise you can't trust that the binaries match the source.
  - swiley 6y ago
    Or allowing local builds with including custom patches. Giving people agency over the machines that run their lives is way too radical to be popular though.
  - JackeJR 6y ago
    This is the approach of fdroid which is what imo makes it trustworthy.
neya 6y ago
>He transferred the GitHub repository and the Web Store rights, announcing the change in a GitHub issue that said nothing about the identity of the new maintainer. The announcement even made a concerning mention of a purchase, which raises the question of who would pay money for a free extension, and why. Wow, this is clearly the fault of the maintainer. Too much power in one hands. He literally had the lives of so many people at stake and he sold them out for whatever it was worth. I feel that although there's another angle of maintainers getting paid for their work, this is totally not in line with ethics of how open source should be done.
thitcanh 6y ago
If you have a minimally-popular extension with minimally-interesting permissions you can expect an email with offer to buy or even a stream of emails. With money on the line, you have to be either unaware of the risks or lack conscience.
scottmcdot 6y ago
I've wondered about whether something like this could happen to the "Bypass Paywalls" Chrome extension [1]. However what makes me feel more comfortable (and please correct me if I'm wrong) is that in order to use the extension, you need to save a copy of it locally and then drag that over to Chrome to install it. If I delete the local version of the extension then it no longer works. Assuming that there were no malware at the time of downloading the extension from GitHub, does this mean that no one can "push" malware code to my local version of the extension or "push" anything to GitHub that could interact with my local version in a malicious way? [1] https://github.com/iamadamdev/bypass-paywalls-chrome https://github.com/iamadamdev/bypass-paywalls-chrome
- calumapplepie 6y ago
  That understanding is correct. In fact, that type of technique is one of those recommended to use Great Suspender safely. I should note that the manifest can specify an 'update url' that would enable auto-updating behavior: and it does, in fact, appear that this extension does. If you remove that line from the manifest, that behavior will cease.
  - scottmcdot 6y ago
    Thanks, I actually just noticed the GitHub page says "The Firefox version supports automatic updates" so I guess it's safe to say that the Chrome extension won't automatically update?

235 points by chmaynard 6y ago

Terrible headline makes it sound like the open-source-ness made the attack possible to occur instead of possible to be discovered. "Of course, as the vast majority of the users of The Great Suspender were not interested in its open-source nature, few of them noticed until October, when the new maintainer made a perfectly ordinary release on the Chrome Web Store. Well, perfectly ordinary except for the minor details that the release did not match the contents of the Git repository, was not tagged on GitHub, and lacked a changelog."

tga_d 6y ago
I think it would only be interpreted that way if you don't know what LWN is?

panpanna 6y ago

The article is about The Great Suspender. Kinda off-topic: with enough eyes all bugs are shallow, but does that really help when Google prefers playing whack-a-mole to doing the right thing?

paulryanrogers 6y ago
What do you think Google should be doing? Human review?
- panpanna 6y ago
  I would actually be happy with some well planned machine review and some clean rules that are actually enforced. A man can dream, I guess.
  - weaksauce 6y ago
    That was what mozilla did when they had resources to do so... now I think they have a different tactic but if you obfuscate it they require a full unadulterated source code link. google operate(d/s?) on the permissive model where you pay for a small membership and then they let you put it up unrestricted and if it gets too many reports it gets pulled. I think mozilla has the slight edge personally but either way i'd be wary of installing extensions willy nilly.
    - dblohm7 6y ago
      "Recommended Extensions" on addons.mozilla.org still get the full human-reviewed treatment.
      - calumapplepie 6y ago
        And those they don't recommend are clearly noted as unverified and possibly containing malware. It's almost like they WANT to protect users....
        weaksauce 6y ago
        Yeah it's kinda a big dichotomy though... they only review very few extensions after doing their automated testing on them. my extension is marked as unverified and there doesn't seem to be a way to change that other than getting some unknown critical mass of users where they are interested in doing a manual review. oh well... not a big deal I guess and the extension is more for my own usefulness.
  - deleted 6y ago
    [deleted]
- mschuster91 6y ago
  Providing some sort of customer service that reacts at least when the press comes knocking? Use their considerable financial and legal firepower to sue whoever pushed the malwarized version of Great Suspender into the ground? Enforce that Chrome extensions be built on Google infrastructure from public source code repositories to prevent silent takeovers, at least for extensions with 10k+ subscriptions? Alert people that they should rotate their passwords? The last one is so crucial. Had I not read that LWN post, I would never have noticed that the extension didn't just run adware fraud but also snooped passwords. Seriously, fuck Google and their disgusting zero communication attitude.
- bzb6 6y ago
  Considering you have to pay a yearly fee to keep your extension published, that seems reasonable.
- zozbot234 6y ago
  F-Droid builds all of their apps from the publicly released source code. There's no reason why Google couldn't do the same, at least for apps hosted on well-known coding/review platforms like GitHub.
  - brigandish 6y ago
    That's a good point. Is there some kind of time lag between the builds and the repo updates? If there's not time for anyone to check the code then the door is still slightly open for malicious code to enter the store without scrutiny.
- SilverRed 6y ago
  The whole idea of extensions is fundamentally broken. You are letting an unknown person who you have no way to trust or hold accountable access all of your web data. It can't be fixed without crippling the system. You can't sandbox permissions because the most basic and useful tools require full access to every website. The only way I can think of is having all extension developers required to have their identity verified and from a country that follows some common law so that google can take legal action against malware developers.
  - mjevans 6y ago
    JavaScript served by the sites; exact same issue. I shouldn't be forced to run someone else's code to look at a publication. That's the entire point behind using something as ugly as XML (or it's simplified child, HTML) to begin with: this is supposed to be a document markup language. A method of annotating what an author would _like_ to have happen when rendering the data. I seriously loath the fetish of creating pixel perfect displays which treat the end user as an actively hostile element; a passive consumer, rather than someone empowered to use the data for their own enlightenment in the manor their preferences prefer. (Font size, screen reader, dark / light mode, etc)
    - daveoc64 6y ago
      > JavaScript served by the sites; exact same issue. It's not really the same issue. If you are visiting a site that uses its own JavaScript, you can probably assume that if it's run by someone trustworthy, the script isn't going to try stealing your passwords or credit card number. There shouldn't be any reason for the web page to have access to anything that you're not providing it with anyway. A browser extension (like an ad blocker) can access the content on every page you visit. That could be your bank, email account, social media - anything. If you have a malicious browser extension, it can see everything you do.
- Jach 6y ago
  Making it so extensions don't auto-update themselves would be a helpful step in the right direction, it would cut down on the impact of when these things happen. Unfortunately I think we'll sooner see Firefox aping Chrome on this than the other way around.
  - paulryanrogers 6y ago
    But this goes against other security advice: stay up to date.
    - Jach 6y ago
      The real security advice is: keep up to date with security patches. Staying up to date just because is not good advice. Gentoo has a nice system, "Gentoo Linux Security Advisories", where you can periodically run a program called glsa-check which lets you know if you have packages installed that have security problems, what the problems are, and points to more info (like CVEs). You can even have it upgrade stuff on its own if you don't want to think about it. Something like this would be a nice feature for browser extensions.

Jakobeha 6y ago

Shoutout to people like the author who look at various open-source apps to spot malicious activity. Open-source libraries are a great contribution to software, but it can also be dangerous if malicious code is sneaked into a library used by safety-critical software. And web extensions are safety-critical software.

FloatArtifact 6y ago

Part of the issue is the github version did not match the distribution version?

weaksauce 6y ago
That and they inserted random javascript from a website that can change at any moment, created a shady domain name mascaraing as affiliated with a different analytics to funnel analytics to (and who knows what else but i think passwords and logins were pilfered). they also gave themselves webrequest permissions for no reason which alters the threat profile too.

dang 6y ago

Recent and related: https://news.ycombinator.com/item?id=25622015 https://news.ycombinator.com/item?id=25622015 https://news.ycombinator.com/item?id=25846504 https://news.ycombinator.com/item?id=25846504 https://news.ycombinator.com/item?id=26028085 https://news.ycombinator.com/item?id=26028085 (a bit) https://news.ycombinator.com/item?id=26029844 https://news.ycombinator.com/item?id=26029844 (a bit) Others?

jeromenerf 6y ago

As if supply chain attacks, ransomwares and all the zero click wormable vulnerabilities we receive every other day were not enough. I like gardening my small personal home server, services and backups but there is no reason debian packages could not be subject to the same supply chain "evil maid" or upstream "evil new maintainer". Everything being done in the open and reviewed makes it less probable, but not impossible. Sigh. As a company, "risk" is mostly insurance. As an individual, it’s anxiety.

laurent92 6y ago
Every package manage is a horrible vulnerability (along with being a useful tool). When you package a webapp: - Debian - Maven - NPM - On the dev machines: Brew, Chrome extensions... Aren’t they very easy to exploit, for a mildly dedicated actor? I don’t see any decent solution to this. Any line could contain a wget | bash...
- franklampard 6y ago
  Deno addresses this problem by not giving module’s permission by default I think
  - oauea 6y ago
    No, that's per process. Not very useful and can already be done with selinux etc
- Kalium 6y ago
  You can always just accept the risk. Or you can not, and work to control your supply chain. Host the artifacts yourself and choose carefully which ones you use. There is no magic bullet, just boring and painful risk-control processes. But they do help.
  - SilverRed 6y ago
    The future is sandboxed apps with flatpak. Who cares if Spotify is malware when it can't access anything. Wayland, SELinux, Flatpak, PipeWire. These will save us or at least reduce the problem of evil maintainers. This model has been tried and proven for over a decade on mobile. What we call malware on mobile is simply the app doing bad things with what you enter in to the app itself and not the desktop class "steals all your data and then encrypts it"

neolog 6y ago

Google could have some automated checks with the results shown in the Chrome Web Store. Does this update add new network requests, for example.

gruez 6y ago
>Does this update add new network requests, for example. this is fundamentally impossible to do because you can smuggle data out by injecting content scripts to a given page and make requests in that context.

gildas 6y ago

> To prevent these issues from occurring again in the future, Google has been pushing a "Manifest V3", which (among other, more controversial requirements) bans the practice of executing any JavaScript loaded from a remote server It's a bit ironic that this security issue doesn't exist in Firefox [1] when they actually implement features promoted by Google in the Manifest V3. Why doesn't Chrome already block remote scripts? [1] https://blog.mozilla.org/addons/2019/12/12/test-the-new-csp-for-content-scripts/ https://blog.mozilla.org/addons/2019/12/12/test-the-new-csp-...

nugget 6y ago
Wouldn’t this neuter the most useful Chrome extensions? Cash back/coupons, adblock, etc.
- gildas 6y ago
  These extensions don't need to run remote scripts to work properly, and they work perfectly in Firefox. Typically, "legitimate" extensions use remote scripts to dynamically insert trackers or ads.
- SilverRed 6y ago
  You can still return text data, you don't need to execute it.
sneak 6y ago
I really wish we could get something like this for local, desktop apps. I'm super tired of most every new desktop "app" being just an electron runtime (which, of course, can read and write all over my filesystem) that runs now-unsandboxed js both from its own bundle, as well as downloaded willy-nilly from the internet.
- tadfisher 6y ago
  Let's give engineers more credit, here. The majority of desktop applications have the same capabilities, including writing all over your filesystem and executing code from remote sources. Electron gives those same capabilities to apps written in JavaScript.

deleted 6y ago

[deleted]

gorhill 6y ago

I want to clarify a few points in the article re. uBlock Origin, they might be seen as minor details but to me they matter. > Raymond Hill, after (you guessed it) he transferred ownership of uBlock to a new, untrustworthy maintainer Only the GitHub repo was transferred, I never transferred the extension in the Chrome Store, and Opera Store.[1] The Firefox version was published by a contributor, and he chose to stay with the new maintainer, and as a result I created a new publication for uBlock Origin in Firefox store. All this was nearly 6 years ago. > Aljoudi began reducing blocking features, eventually choosing to permit certain ads via the "acceptable ads" program "Acceptable Ads" was added to "uBlock" in February 2019 by the new owner, BetaFish Inc. (maker of AdBlock).[2] BetaFish Inc. was itself sold circa October 2015 to an (still) anonymous buyer.[3] > Hill created a fork, now called uBlock Origin, which reverted the changes I didn't revert any change, I forked while I was still controlling the GitHub repo.[4] If you look at the project timeline, it shows that I have been in charge since the first commit in June 2014.[5] > Nano Defender and its 200,000+ users, upon their recent acquisition, immediately began having their personal data mined. Note that the malware did not require the blocking ability of the webRequest API to collect the data, it needed only the observational ability, which is not deprecated by Manifest v3.[6] ** [1] https://github.com/gorhill/uBlock/issues/57 https://github.com/gorhill/uBlock/issues/57 [2] https://github.com/uBlock-LLC/uBlock/releases/tag/0.9.5.13 https://github.com/uBlock-LLC/uBlock/releases/tag/0.9.5.13 [3] https://news.ycombinator.com/item?id=10318200 https://news.ycombinator.com/item?id=10318200 [4] This was the first release following the split, nothing had to be reverted: https://github.com/gorhill/uBlock/releases/tag/0.9.3.0 https://github.com/gorhill/uBlock/releases/tag/0.9.3.0 [5] https://github.com/gorhill/uBlock/graphs/contributors https://github.com/gorhill/uBlock/graphs/contributors [6] https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210 https://github.com/NanoAdblocker/NanoCore/issues/362#issueco...

chrismiller 6y ago
I really want to thank you for your work on uBlock. No other software that has contributed so much to my overall happiness, productivity and well-being. I just double checked the repo but couldn’t find a way to support your work. Is there any way I can donate or send something your way?

timemachine 6y ago

The whole idea of me reviewing software before I install it breaks when I can’t easily install it from the source I reviewed. This reminds me of why GitHub should create it’s own App Store (yup, I’m gonna beat this drum): I can navigate the source ask questions about parts that make me suspicious, and then install a prebuilt binary with confidence that the binary was the sum of what I reviewed.

yjftsjthsd-h 6y ago
To be explicit: This depends on the app store only allowing CI builds, since otherwise you can't trust that the binaries match the source.
- swiley 6y ago
  Or allowing local builds with including custom patches. Giving people agency over the machines that run their lives is way too radical to be popular though.
- JackeJR 6y ago
  This is the approach of fdroid which is what imo makes it trustworthy.

neya 6y ago

>He transferred the GitHub repository and the Web Store rights, announcing the change in a GitHub issue that said nothing about the identity of the new maintainer. The announcement even made a concerning mention of a purchase, which raises the question of who would pay money for a free extension, and why. Wow, this is clearly the fault of the maintainer. Too much power in one hands. He literally had the lives of so many people at stake and he sold them out for whatever it was worth. I feel that although there's another angle of maintainers getting paid for their work, this is totally not in line with ethics of how open source should be done.

thitcanh 6y ago

If you have a minimally-popular extension with minimally-interesting permissions you can expect an email with offer to buy or even a stream of emails. With money on the line, you have to be either unaware of the risks or lack conscience.

scottmcdot 6y ago

I've wondered about whether something like this could happen to the "Bypass Paywalls" Chrome extension [1]. However what makes me feel more comfortable (and please correct me if I'm wrong) is that in order to use the extension, you need to save a copy of it locally and then drag that over to Chrome to install it. If I delete the local version of the extension then it no longer works. Assuming that there were no malware at the time of downloading the extension from GitHub, does this mean that no one can "push" malware code to my local version of the extension or "push" anything to GitHub that could interact with my local version in a malicious way? [1] https://github.com/iamadamdev/bypass-paywalls-chrome https://github.com/iamadamdev/bypass-paywalls-chrome

calumapplepie 6y ago
That understanding is correct. In fact, that type of technique is one of those recommended to use Great Suspender safely. I should note that the manifest can specify an 'update url' that would enable auto-updating behavior: and it does, in fact, appear that this extension does. If you remove that line from the manifest, that behavior will cease.
- scottmcdot 6y ago
  Thanks, I actually just noticed the GitHub page says "The Firefox version supports automatic updates" so I guess it's safe to say that the Chrome extension won't automatically update?