4 ms·

I recommend avoiding all browser extensions unless they come from well-known developers (eg 1Password) and they’re downloaded and installed through official cha

I recommend avoiding all browser extensions unless they come from well-known developers (eg 1Password) and they’re downloaded and installed through official channels. Browser extensions have a lot of access to your browsing activity and can phone home as well. One of the reasons this extension was sent a C&D was that it was sending some data home to the author’s server. That might be what the install instructions above are hinting at with the warning to examine the JS and remove any phone-home code. The original author defended the data collection as just enough to make sure the plug-in was working, except for study participants who apparently submitted much more information through the plug-in. Either way, I wouldn’t rush to install a plug-in that was caught sending any of my social media data to a 3rd-party server. I certainly would not install a browser extension from an unknown 3rd-party website just to spite Facebook, regardless the claimed origin of the code.

cryptoegorophy 5y ago
One of the reasons I stopped using chrome was “extensions” I had 2-3 popular extensions like Adblock and something else. They were leaking information for every page I visited! I contacted the “source” where I saw my information leak but there was no reply and nothing. Either chrome itself leaks that info or one of the popular extensions.
- mmahemoff 5y ago
  Sure, the extensions ecosystem is a cesspool, but you know you can use Chrome without extensions? If you see bad behaviour from an extension, I would flag it on Chrome store.
  - jordwest 5y ago
    As an extension developer, yes please do this. I get constant offers to "purchase" my extension from shady marketing companies, and it's obviously quite lucrative for them based on some of the offers they're making. If extensions were shut down quickly for shady behavior there wouldn't be a market for it.
1vuio0pswjnm7 5y ago
No extension is needed. (I never use extensions for anything.) Unfollowing all friends is not complicated and can be done in a couple of lines of shell script, or using whatever programming language or HTTP client one chooses. Obviously, curl would work. There are a hundreds of ways to send HTTP requests. It is a very simple protocol. No POST requests are even necessary, only GET. 1. Log in to Facebook 2. Open "Developer Tools" (F12), select the "Network" tab, locate "Request Headers", Alt-click on "Cookie:" and select "Copy value". Use this in each HTTP request. Do not log out yet. The URL for the Friends list is https://mbasic.facebook.com/friends/center/friends/?ppk=1 where 1 is the page number. Using m.facebook.com as the domain will also work. There 10 friends per page. 3. Extract the UID for each friend from the HTML and create the new "unfollow" URLs. grep -o "uid=[^&]*" 1.html|sed 's>uid=/https://mbasic.facebook.com/a/subscriptions/remove?subject_id=>' 4. Log out. Done.
- deleted 5y ago
  [deleted]
- 1vuio0pswjnm7 5y ago
  Correction Unfortunately we need a GFID in addition to the UID, so more steps are required 3. Extract and GET hovercard URLs. grep -o "/friends/hovercard/mbasic/?uid=[^\"]*" 1.htm|sed 's/%3D/=/g;s/%3A/:/;s>%2F>/>g;s/&/\&/g;s/%26/\&/g;s/%3F/?/;s>^>https://mbasic.facebook.com>' 4. Extract and GET profile URLs. grep -o "href=./[^*\"]*" 2.htm|sed '/?/d;/data\/manifest/d;s>href=.>https://mbasic.facebook.com>' 5. Extract and GET "unfollow" URLs NB Making too many requests for profiles too close together may draw a temporary, limited block. grep -o "href=.[^\"]*" 3.htm|sed -n '/subscriptions/s>href=.>https://mbasic.facebook.com>p' 6. Log out. Done. The five Facebook cookies needed are: c_user xs fr sb datr Further reading: https://techexpertise.medium.com/facebook-cookies-analysis-e1cf6ffbdf8a https://techexpertise.medium.com/facebook-cookies-analysis-e... https://cookiedatabase.org/cookie/facebook/ https://cookiedatabase.org/cookie/facebook/ https://www.facebook.com/policy/cookies/ https://www.facebook.com/policy/cookies/
  - jraph 5y ago
    Guess who is going to be banned from Facebook ;-)
3np 5y ago
Quite a few extensions have source available; you could survey the code and build it locally and load it from zip (Firefox) or crx (Chromium)
- MertsA 5y ago
  And yet on this thread no one seems to have taken a look at some of the... interesting things in the extension in question.
nvr219 5y ago
The instructions I linked to have examining the javascript and removing all phone home stuff as step one. Considering this is hn I didn't feel like I had to point that out again.

cryptoegorophy 5y ago

One of the reasons I stopped using chrome was “extensions” I had 2-3 popular extensions like Adblock and something else. They were leaking information for every page I visited! I contacted the “source” where I saw my information leak but there was no reply and nothing. Either chrome itself leaks that info or one of the popular extensions.

mmahemoff 5y ago
Sure, the extensions ecosystem is a cesspool, but you know you can use Chrome without extensions? If you see bad behaviour from an extension, I would flag it on Chrome store.
- jordwest 5y ago
  As an extension developer, yes please do this. I get constant offers to "purchase" my extension from shady marketing companies, and it's obviously quite lucrative for them based on some of the offers they're making. If extensions were shut down quickly for shady behavior there wouldn't be a market for it.

1vuio0pswjnm7 5y ago

No extension is needed. (I never use extensions for anything.) Unfollowing all friends is not complicated and can be done in a couple of lines of shell script, or using whatever programming language or HTTP client one chooses. Obviously, curl would work. There are a hundreds of ways to send HTTP requests. It is a very simple protocol. No POST requests are even necessary, only GET. 1. Log in to Facebook 2. Open "Developer Tools" (F12), select the "Network" tab, locate "Request Headers", Alt-click on "Cookie:" and select "Copy value". Use this in each HTTP request. Do not log out yet. The URL for the Friends list is https://mbasic.facebook.com/friends/center/friends/?ppk=1 where 1 is the page number. Using m.facebook.com as the domain will also work. There 10 friends per page. 3. Extract the UID for each friend from the HTML and create the new "unfollow" URLs. grep -o "uid=[^&]*" 1.html|sed 's>uid=/https://mbasic.facebook.com/a/subscriptions/remove?subject_id=>' 4. Log out. Done.

deleted 5y ago
[deleted]
1vuio0pswjnm7 5y ago
Correction Unfortunately we need a GFID in addition to the UID, so more steps are required 3. Extract and GET hovercard URLs. grep -o "/friends/hovercard/mbasic/?uid=[^\"]*" 1.htm|sed 's/%3D/=/g;s/%3A/:/;s>%2F>/>g;s/&/\&/g;s/%26/\&/g;s/%3F/?/;s>^>https://mbasic.facebook.com>' 4. Extract and GET profile URLs. grep -o "href=./[^*\"]*" 2.htm|sed '/?/d;/data\/manifest/d;s>href=.>https://mbasic.facebook.com>' 5. Extract and GET "unfollow" URLs NB Making too many requests for profiles too close together may draw a temporary, limited block. grep -o "href=.[^\"]*" 3.htm|sed -n '/subscriptions/s>href=.>https://mbasic.facebook.com>p' 6. Log out. Done. The five Facebook cookies needed are: c_user xs fr sb datr Further reading: https://techexpertise.medium.com/facebook-cookies-analysis-e1cf6ffbdf8a https://techexpertise.medium.com/facebook-cookies-analysis-e... https://cookiedatabase.org/cookie/facebook/ https://cookiedatabase.org/cookie/facebook/ https://www.facebook.com/policy/cookies/ https://www.facebook.com/policy/cookies/
- jraph 5y ago
  Guess who is going to be banned from Facebook ;-)

3np 5y ago

Quite a few extensions have source available; you could survey the code and build it locally and load it from zip (Firefox) or crx (Chromium)

MertsA 5y ago
And yet on this thread no one seems to have taken a look at some of the... interesting things in the extension in question.

nvr219 5y ago

The instructions I linked to have examining the javascript and removing all phone home stuff as step one. Considering this is hn I didn't feel like I had to point that out again.