17 ms·

An ad plugin was stealing revenue for a year and I didn't even notice

289 points by Kvirkvelia 5y ago

melissalobos 5y ago
At least the plugin guy was reasonable-ish. That does sounds like a really odd experience. It does pay to always check all of the dependencies you are using and their terms. When I was younger I got hit by limits when using a free tier of a service, but they just throttled us which lost us users.
- ceejayoz 5y ago
  The plugin guy can afford to be reasonable-ish. It reduces the likelihood of the scam being publicly disclosed, and I'd wager that 99% of people never notice the plugin is doing this.
  - teddyh 5y ago
    How is it a “scam” if the terms are clearly posted? EDIT: The percentage increase from 2% to 30% was not posted; I withdraw my opinion on that.
    - pavel_lishin 5y ago
      The "30% markup if our algorithm thinks you're doing something sneaky" was not disclosed.
      - teddyh 5y ago
        True, it was not. I concede this point.
    - ZetaZero 5y ago
      2% was clearly posted. Yet the plugin was taking 30%.
    - op00to 5y ago
      Huge red flag: they offer you some money back in hopes you don't turn them into the "authorities".
      - teddyh 5y ago
        Wouldn’t not offering any money back be an even bigger red flag?
      - gruez 5y ago
        That's how settlements work, yes.
        nrmitchi 5y ago
        Is it though? A settlement in a civil case is money in exchange for not pursuing further civil legal action. A situation of "we're giving you money so that you don't report a crime" (which is implied by "turning in to the authorities") is more like extortion/bribery than it is a settlement.
    - PeterisP 5y ago
      The terms are not clearly stated, the explicit LICENSE document https://github.com/floatinghotpot/cordova-admob-pro/blob/master/LICENSE https://github.com/floatinghotpot/cordova-admob-pro/blob/mas... offers a standard MIT license, unlike the wiki description.
      - remram 5y ago
        The license states how you may use the code, not what the code does.
  - NKosmatos 5y ago
    Oh come on, it's not a scam and he's not stealing anything. It's clearly mentioned on the license and it's up to the users to go through it (like any other open-source plugin or software they use). At the end of the day the plugin creator was polite, understanding and returned money back even though he was not obliged to do so. It's a win-win situation as they clearly describe it, but the OP wasn't satisfied with the high (30%) percentage.
    - ceejayoz 5y ago
      The plugin was secretly taking 15x what it claimed to. The ease with which a (substantial!) refund was offered makes me think it wasn't an isolated incident.
    - pavel_lishin 5y ago
      > the OP wasn't satisfied with the high (30%) percentage. The OP was never informed of the high percentage!
      - abofh 5y ago
    - kevingadd 5y ago
      How is hiding 2% in your wiki (instead of in LICENSE where it belongs), and then taking 30% instead of 2%, not a scam? If someone listed a price of $2 for a burrito and then charged you $30 at the register, you would not consider that OK.
      - abofh 5y ago
        They did consider it thousands of time, they just didn't supervise what their worker agreed to
  - ziml77 5y ago
    It looks to me that the plugin author isn't only trying to get the money he's owed from people who are trying to scam him. Which still isn't a great thing, especially since it can happen mistakenly, but it's at least a little more understandable.
- op00to 5y ago
  In any scam there's a part where you cool off the mark so as to not have them go squealing to the cops. Maybe you give 'em some money back, maybe you teach them the lesson of how to bounce back after a loss. Google "cooling the mark out" to read some academic research on this.
teddyh 5y ago
So he used code straight off GitHub, didn’t read the license terms, and then has the gall to call it “stealing” when the program does exactly as it says it would. Either learn to read licenses, or have a list of approved licenses (MIT, GPL, etc.) and only use software thus licensed. EDIT: What I mean above is the 2% which is specified in the “Licence Agreement” page – the article author is clearly considering this, too, to be “stealing”. Regarding the increase from 2% to 30%, that is way more questionable, and I do not defend it.
- libeclipse 5y ago
  The GitHub page said it would take 2% but actually took 30%. How is that "exactly as it says it would"?
  - teddyh 5y ago
    He called the 2% “stealing”, too. Sure, the slow increase to 30% was not documented, and I can see a good argument being made there.
    - op00to 5y ago
      The 2% is stealing because no reasonable person would expect to see such a clause in an open source software project. The 2% clause was hidden, all the way at the end of the doc. The plugin author is a conman.
      - teddyh 5y ago
        Why do you call it Open Source? The plugin itself does not call itself Open Source, and clearly links to another project for those people who want an Open Source program.
        InsomniacL 5y ago
        https://github.com/floatinghotpot/cordova-admob-pro/blob/master/LICENSE https://github.com/floatinghotpot/cordova-admob-pro/blob/mas... > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files
1_player 5y ago
AdMob indeed. It does what it says on the tin.
joshstrange 5y ago
I'm of two minds about this. "Stealing" does seem to be a little too harsh given the plugin did say it would take a percentage if you make more than $1K and didn't buy a license. The 30% seems underhand (only because it's not spelled out in the repo) but I do understand the plugin author's position. Open source work, especially something like Ionic/Cordova/Capacitor plugins, are hard to make any money on and I've seen the GH issues for many cordova plugins, it's /rough/. Also there are so many things you need to support and edge cases that I can't even imagine the patience of someone maintaining one of those plugins. I think it's clear the plugin author was/is happy to let the 2-30% stipulation fly under the radar and sit back and collect which doesn't sit great with me but also I kind of get it. I mean if you are going to take OS work and use it for your own gain (something I'm plenty guilty of myself I'll admit) then don't be surprised if not reading the license bites you in the butt. In a perfect world OS devs wouldn't need to these methods to make it worth their time but we don't live in a such a world, people rarely donate to OS projects and expect issues/features to be added quickly and for free. People need money to exist and they don't owe you anything. Honestly if this plugin author had called out the 30% in their license I would say this blog author has no leg to stand on. As-is I'm glad the app developer got their money back and the plugin author should either stop charging more than 2% or update their license accordingly. But "stealing"? Too harsh, especially since you got your money back.
- NKosmatos 5y ago
  Yes, a good point. He should update the license (https://github.com/floatinghotpot/cordova-admob-pro/wiki/License-Agreement https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic...) to state from 2% up to 30%.
- Beltalowda 5y ago
  I suspect the line of thinking behind the 30% seems to be something along the lines of "they're fiddling their numbers to reduce our 2% cut, so let's just take a bigger cut". I don't think this is entirely kosher for a bunch of reasons, but I'm willing to believe that it was a naïve person doing something naïve after being burned by someone cheating him out of his cut, or something along those lines. At any rate, since the author of this article was unaware of the 2%, it doesn't really matter if the 30% would have been mentioned or not. That they took any cut could have been clearer, perhaps – I don't know how it looked like before on that Ionic plugin site, but it's plenty clear now so that's a solved issue (if it was an issue to start with). That this was added after this exchange (and before it was published) without any pressure further demonstrates the plugin author is essentially acting in good faith.
high_derivative 5y ago
Stealing seems an almost libellous term for using a software with a revenue model the author did not bother checking out.
- pavel_lishin 5y ago
  The software says nothing about taking 30% under certain circumstances.
  - joshstrange 5y ago
    > Kindly reminder, do not use a fake license key or a license key from others, do not share your license key with others. Abuse of the license key may cause negative impact. [0] This is the closest it gets to calling out the the 30% but I agree, it should be clearer. [0] https://github.com/floatinghotpot/cordova-admob-pro/wiki/License-Agreement https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic...
    - op00to 5y ago
      It shouldn't be clearer - the plugin author should require an affirmative response from the developer that they accept those terms.
      - joshstrange 5y ago
        > It shouldn't be clearer - the plugin author should require an affirmative response from the developer that they accept those terms. Ehh, I disagree. We all know developers would click through any terms without reading anyway and the onerous is on us to read the license before we integrate 3rd party code, which we rarely do. I see this as /just deserts/, a sort of hat tip and "well played sir". The 30% that is not mentioned is the sticking point, the 2% is absolutely reasonable and I might even say I'd think 30% is reasonable IF it had been called out in the license.
      - kapp_in_life 5y ago
        The affirmative response is downloading and using the plugin.
jscheel 5y ago
I'm confused, where in the license does it give them the permission to randomly assign an ad-share percentage? This seems highly suspect, and probably illegal in most jurisdictions. In fact, reading the actual license agreement here https://github.com/floatinghotpot/cordova-admob-pro/wiki/License-Agreement https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic... seems to suggest that they will stop serving ads, not randomly start increasing ad share.
- contravariant 5y ago
  Yeah I'm not seeing it either. It's even weirder that the code itself is distributed with an MIT license, which suggests you're free to download and modify the code to disable the revenue sharing. This conflicts with some of their other statements though. In the readme they do outline the option to use it with a open source license (without any support), but they seem to contradict this in the following sentence in their readme: >If use in commercial project, please get a license, or, you have monetized more than $1000 using this plugin, you are also required to either get a commercial license ($20). As a commercial customer, you will be supported with high priority, via private email or even Skype chat. Which is nigh illegible. Does anyone know what happens when someone publishes conflicting licenses?
  - mannerheim 5y ago
    Since the Wiki part isn't a license itself, I would think there isn't legal relevance to it, but given that the author doesn't seem to be a native English speaker, a generous interpretation might be that a commercial user could still fork this; it's 'required' in the sense that you have to pay for the convenience of having it available on NPM, which the author disallows you from making trivial changes to and republishing on there. That's unlikely to be legally enforceable on NPM, but they might honour takedowns anyway.
  - abofh 5y ago
    You were free to give author money the moment you used his code, why are you worrying about the license - you can copy, modify and maintain a version that pays you. You just have to, you know, work
deleted 5y ago
[deleted]
op00to 5y ago
"If you have a high user traffic, please consider to get a license, it will be more cost-effective. Or else you might be unhappy someday." *"Or else you might be unhappy someday."* If that isn't a threat, I don't know what is. This guy's plugin should be removed immediately for such actions.
- Beltalowda 5y ago
  The author of this software is very clearly a non-native English speaker, and while more than skilled enough to communicate reasonably effective on technical matters, they're also not really skilled enough to fully grasp all the nuances of these types of things. I don't know what they intended with that exactly, but I'm sure not going to jump to conclusions.
- colinmhayes 5y ago
  I think that's just a fact. License is $20. This guy is clearly making more than $1000 on his site so the license is cheaper.
scarface74 5y ago
Alternate sort of off topic take: if you have a service that is valuable, charge people money for it instead of depending on ad revenue. I try my best to stay away from ad supported business models, if there is an app in the App Store for instance that has an in app purchase to turn off ads, I have no problem paying for it if it something I’m going to use.
- Aldo_MX 5y ago
  Piracy is a thing and in poorer countries people don't give a sh*t that they're suffocating you, so I'd rather support the ad industry than get suffocated by the people who is supposed to support me in the first place.
- colinmhayes 5y ago
  Sounds like OP is in Russia. I'm not sure people are as willing to pay for services there.
madarco 5y ago
How to get rich: 1) Create a nice plugin to serve ads 2) Bury a complex revenue sharing logic in the terms of use that nobody read anyway 3) Profit
- drran 5y ago
  If you are not obeying license, then you are a pirate. | ____ | | |o o| | | "" | | O O | | \ / | | X | | / \ | | O O |
new_guy 5y ago
That's what happens when you freeload. I think we're seeing more pushback now against people like this abusing free software from the developers who break their back to provide it. If you want to use it, PAY. FOR. IT.
- netr0ute 5y ago
  > PAY. FOR. IT. What about the Linux kernel and numerous other FOSS?
  - jtbayly 5y ago
    He was paying for it. 2%. Then the open source hero started taking 30%. Without warning or disclosure. Defending this is a great way to trash the reputation of open source.
    - Aldo_MX 5y ago
      The reputation of open source is already trashed. Companies like Amazon abused what started as a passion for many people, and that passion is now costing them their wellbeing so they're revolting. The real open source belongs inside the GPL bubble, where you are legally obligated to share back, and it was battle tested when closed platforms like iOS gained traction. Did people help pressure Apple to make licenses like GPL viable in their walled garden? Or did people dissed GPL-ed software because they couldn't use it in the Apple ecosystem? The moment we conceded with "LGPL with linking exception" marked the loss of the iOS battle. Remember that GNU exists because Stallman couldn't ahem install a printer. And guess what? People avoid the distros with ONLY FOSS components because "it's impractical". If a distro becomes popular is because it includes a collection of proprietary drivers. Our convenience is what made open source what it is today. And you know what? I accept my fault in the great scheme of things. I was burned by people profiting with work I made for free while I was struggling to survive during the 2008 crisis. I am already familiar with the feeling of betrayal by the people who was supposed to support my work. Open Source was not for me.
      - 5y ago
jmnicolas 5y ago
It's what's worrying with running WordPress plugins: you mean I'm downloading some PHP code written by somebody unknown and this code executes whatever it wants on my server???!!! It seems I'm the only one that is bothered by this. And no I don't at the time nor the skill to audit everything or to use a static site like Hugo.
- remram 5y ago
  Isn't that what WordPress is in the first place?
  - jmnicolas 5y ago
    Absolutely, but it's still scary nonetheless! The problem is that there's not many viable alternative to WP.
    - remram 5y ago
      Isn't any piece of software "some <lang> code written by somebody unknown and this code executes whatever it wants on your server"?
- csunbird 5y ago
  What is the difference between downloading a wordpress plugin and running it in your server and downloading a jar from maven/a js package from npm and running it?
  - marcus_holmes 5y ago
    Nothing. These are also very, very dangerous and expose your site to supply-chain attacks. The article linked to here [0] which is a must-read for everyone who feels that adding a dependency is safe. [0] https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://medium.com/hackernoon/im-harvesting-credit-card-numb...
  - jmnicolas 5y ago
ericholscher 5y ago
Just a reminder to folks who are looking for alternative's, we're building an open source ad network for developer-focused sites: https://www.ethicalads.io/ https://www.ethicalads.io/. We also take 30% of the revenue (which is around industry standard), but it's very well-defined in our Publisher Policy: https://www.ethicalads.io/publisher-policy/ https://www.ethicalads.io/publisher-policy/
lewich 5y ago
Author is typical parasite, uses open source projects and other people time and dare to say they are stealing. Read license agreement before usage.
- nmstoker 5y ago
  But even if you read it, you would have legitimate reason for concern when they started taking more than the 2% stated since there is no mention of taking more than 2% (except in the private email from the plug-in author, which isn't part of the terms)
- kevingadd 5y ago
  The repo's LICENSE is the MIT license. If you read it you would have no idea the project is going to steal 30% of your ad revenue.
  - deleted 5y ago
    [deleted]
    - deleted 5y ago
      [deleted]
InsomniacL 5y ago
How anyone can defend this type of behaviour is beyond me. It is theft, the hidden cost in the licence agreement* states 2%, taking that up to %30 for no reason and with no warning based on some arbitrary 'black list' is theft. * as shady as that is
- abofh 5y ago
  You.. Ran... Their.. Code.. How anyone can think they're entitled to assume how it should run is ignorance sufficient to shred what remains of my humanity. He didn't demand you give him money, he said if you ran his code, it will act as he intended. You ran his code. It worked as intended.
  - deleted 5y ago
    [deleted]
  - InsomniacL 5y ago
    > You.. Ran... Their.. Code.. I did not... > He didn't demand you give him money, he said if you ran his code, it will act as he intended. He did not... He said it would act one way, then it secretly acted another against the contract that was entered in to > It worked as intended. It did not... Even their staff admit they never intended to charge him 30%
    - abofh 5y ago
      - InsomniacL 5y ago
        1, I've never ran his code, that's a true statement. 2, The licence agreement states a 2% charge. Then proprietary code on their licence server, outside of the code in this repository increased that to 30%. refer to the email dated 13/04/2017 > "...and a random higher rate will be applied.." 3, Email dated 14/04/2017 > "You did not attempt to hack our server" Can you be more specific about which of my claims are un-true?
tlhunter 5y ago
That same plugin has bitten me in the past as well. I used it to display full screen interstitial ads. Despite the author raking in cash from users the plugin was rather broken when I used it. The biggest shortcoming is that it wouldn't properly differentiate ads that the user completely watched and ads that the user dismissed.
jtbayly 5y ago
The entire site is blocked by my ad blocker.
yessirwhatever 5y ago
Incredibly shady percentage and even more shady way of responding. With that being said, calling it stealing is a bit much. The blame is on you. Read the license of what you're using, and make sure what it's requesting in general. Triggering statement, so be warned: Ad Revenue supported products are generally ALL SHADY. So, I'm astonished he gave you back some money. Probably a useless attempt to have less hassle moving forward, yet you went ahead and shared it. At best, you're equally to blame. At worst, you just want stuff for free while you get paid for your work, the worst kind of entitlement.
- nextaccountic 5y ago
  > Read the license of what you're using Here's the license: https://github.com/floatinghotpot/cordova-admob-pro/blob/master/LICENSE https://github.com/floatinghotpot/cordova-admob-pro/blob/mas... It's MIT. Here's what they say "If you have used this plugin for FREE but monetized more than $1000, you are also required to get a license, or share us some Ad traffic as stated in win-win partnership model below" If the MIT license is correct, they are lying: people don't need to get a license. The users already have a license that covers absolutely everything and they even have the right to edit the plugin to remove the % cut altogether. Other things they are lying about, in their wiki https://github.com/floatinghotpot/cordova-admob-pro/wiki/License-Agreement https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic... "Reminder: copy the code, change a plugin name, without feature enhancement, then publish to npm, is not allowed." This is just false. The existing MIT license absolutely allows changing the name and republishing to npm. Perhaps they just don't understand what is open source about. Absolutely all open source licenses allow forks.
Hasz 5y ago
Ha, caveat emptor. Oh, wait, OP isn’t even a buyer and paid nothing for the code and blindly built it into the app. No reading, no understanding, just copying. OG plug-in author has a problem with people abusing license key system, builds in code to detect it. Disclaims it vaguely, OP gets bitten and has the gall to call it stealing. Author offers to help OP out, OP puts him on blast. Zero sympathy, even at 30%.
- deeviant 5y ago
  There is a huge divide between "oh hey you didn't read the license and missed the fact that this OS addon takes 2%" and "the license said 2%, but it's actually 30%, oops my friend!"
  - Hasz 5y ago
    I see zero difference. There is an explicit mention that bad things will happen if you subvert the license system. A license is $20, OP is just too lazy to read the terms of code he blindly incorporates. Op called 2% stealing, 30% is for basically triggering the anti cheat. OP should have paid paid the license and read the rules.
    - JulianWasTaken 5y ago
      What if someone is willing to pay 2% and not pay 30%? Do you think most people who are willing to pay more than 0% are willing to pay both numbers? Or are you punishing OP simply because they didn't know there was 2% involved? If so you don't really see zero difference, you just are exacting some punishment.
    - deeviant 5y ago
      The author didn't at first didn't even notice the addon was taking a cut, let alone attempted to "cheat" it. That is clearly the author's "oops", but what are you getting on about "cheating?" In the license, it clearly state that is perfectly acceptable to use the addon unlicensed, and if you go above a certain monetization level, it will take a cut. The explicitly calls out the cut as 2%. Except the license was a lie, it is not 2%, it's 30%. That is theft. If the addon took 2%, as the license explicitly states, it would have been completely legal. It was not 2% and it is theft. Is it really a good model for funding Open Source software to bake in clearly illegal landmines that steal from anybody using said OSS? If so, that feels way more like malware than OSS.
w0mbat 5y ago
I am a native Mac/iOS developer with a lot of experience. I did a contract where they wanted me to make some improvements to a large company's barnacle encrusted multi-platform Cordova app. I wouldn't normally touch that kind of thing with a bargepole but I was slated just to add some features to the Mac native app shell, beyond the scope of the embedded JavaScript app. Those Cordova apps over a certain age and complexity are terrifying. Random plugins, ancient Cocoa Pods, abandoned JavaScript libraries, several different build systems (somehow all being used), Node.js modules with version conflicts that can never be resolved, pulled from all over the internet and all over time. I am not surprised this guy had no idea what one 3rd party ad plugin was doing, if the app I saw was typical.
abofh 5y ago
You didn't pay your vendor for a year and they noticed
frankfrankfrank 5y ago
I feel there is a bigger issue here that I don't see anyone having brought up. Blogging dev was too cheap to just pay $20 for a license for code that would generate him money. THAT is really the bigger issue here, regardless of everything else, including the fact that he was in violation of the agreement, i.e., >$1,000 MRR. Here's a little pro tip for everyone, don't cheap out on paying someone $20 for the work they do, when it will be generating you significantly more income. Frankly, regardless of whether or not the plugin dev is sketchy or not, the blogger dev violated the terms of the agreement and seems rather ungrateful that he was given back what he should not have even gotten back.
- floatingatoll 5y ago
  “No one thinks anyone else deserves payment for creating good work, unless they’re the one who could be getting paid, in which case it’s a travesty that they’re not” is an ethical standpoint that’s widespread in Silicon Valley. For example, it’s why Facebook users don’t receive dividend payments for the investment of their harvested data. “We realized that we could profit from inattention|opensource, so of course that’s ethical, because Finders Keepers rules” is a bad look for both parties in this post — the plug-in author who takes a revenue share without providing a financial statement, and the site operator who can’t be bothered to pay $20 for a core revenue stream of their site.
arthur6667 5y ago
Based on the comments I should make a left-pad and put in a random file 'if you use this, you need to give me you house and first born child'. Because appearantly whatever you put down is legal and enforceable.. shm.. Taking reveneu without a contract smells like fraud to me.
- nemothekid 5y ago
  IBM wouldn't touch JSLint because there was a clause that said JSLint couldn't be used for evil. Some people do their homework and others don't.
- bruce343434 5y ago
  the license IS the contract. When was the last time you actually signed something when you used a SAAS?
- abofh 5y ago
  Anon wrote the code, op ran the code thousands and thousands of times. Yeah, anon is the enemy for wanting to get paid
Ansil849 5y ago
The responses here to this story defending the plugin author are appalling. They all seem to boil down to "you didn't read the fine print or the source code, so whatever the plugin does is defensible". What if instead of taking a percentage of the ad revenue, the plugin siphoned credentials or ran malware as a revenue generator, or did whatever else? And what if it openly explained in the fine print that it would be doing this?
- Hasz 5y ago
  You don’t read the contract, you pay the price. People just arbitrarily pulling in code from random people on the internet and expecting everything to be fine is hilarious. Your project, due the due diligence. To answer the hypothetical, the author is still at fault even if was malware.
  - Ansil849 5y ago
    > To answer the hypothetical, the author is still at fault even if was malware. Wow, that's as explicit victim blaming as you can get.
    - Aldo_MX 5y ago
      Dismissing something as "victim blaming" is the best way to say "I am not mature enough to accept that I have responsibilities, and I will play the role of a victim for as long as I can stay unaccountable for my actions".
      - Ansil849 5y ago
        I asked this question in another comment, but same thing: Just curious, is this your attitude towards other things as well? There used to be a very popular ebay scam, which had people sell large screen TVs and video game systems for very cheap. At the bottom of the auction description, in fine print, the auction also clearly stated that you were bidding/buying only a photo of the product, not the actual product. In other words, it was "spelled out", so no one was getting scammed according to your perspective here, right? It was on the fault of the buyers for not reading the license/auction description?
appleiigs 5y ago
> the drop was due to the Russian government blocking us in an attempt to monopolize the mobile electronic diary market. I’ll save this story for later I kinda want that story right now lol.
mirzap 5y ago
This is not a theft. You used the plugin from the github, didn’t even bother to check the license, used someone elses work with small fee. Guy even returned you the money. It’s probably some kind of dark pattern, but certainly not a theft. Pay the plugin and you’ll not have to pay the fee.
vlark 5y ago
jart 5y ago
Look at the GitHub profile. The eyes are dead. You can always tell a man by his eyes.

289 points by Kvirkvelia 5y ago

At least the plugin guy was reasonable-ish. That does sounds like a really odd experience. It does pay to always check all of the dependencies you are using and their terms. When I was younger I got hit by limits when using a free tier of a service, but they just throttled us which lost us users.

ceejayoz 5y ago
The plugin guy can afford to be reasonable-ish. It reduces the likelihood of the scam being publicly disclosed, and I'd wager that 99% of people never notice the plugin is doing this.
- teddyh 5y ago
  How is it a “scam” if the terms are clearly posted? EDIT: The percentage increase from 2% to 30% was not posted; I withdraw my opinion on that.
  - pavel_lishin 5y ago
    The "30% markup if our algorithm thinks you're doing something sneaky" was not disclosed.
    - teddyh 5y ago
      True, it was not. I concede this point.
  - ZetaZero 5y ago
    2% was clearly posted. Yet the plugin was taking 30%.
  - op00to 5y ago
    Huge red flag: they offer you some money back in hopes you don't turn them into the "authorities".
    - teddyh 5y ago
      Wouldn’t not offering any money back be an even bigger red flag?
    - gruez 5y ago
      That's how settlements work, yes.
      - nrmitchi 5y ago
        Is it though? A settlement in a civil case is money in exchange for not pursuing further civil legal action. A situation of "we're giving you money so that you don't report a crime" (which is implied by "turning in to the authorities") is more like extortion/bribery than it is a settlement.
  - PeterisP 5y ago
    The terms are not clearly stated, the explicit LICENSE document https://github.com/floatinghotpot/cordova-admob-pro/blob/master/LICENSE https://github.com/floatinghotpot/cordova-admob-pro/blob/mas... offers a standard MIT license, unlike the wiki description.
    - remram 5y ago
      The license states how you may use the code, not what the code does.
- NKosmatos 5y ago
  Oh come on, it's not a scam and he's not stealing anything. It's clearly mentioned on the license and it's up to the users to go through it (like any other open-source plugin or software they use). At the end of the day the plugin creator was polite, understanding and returned money back even though he was not obliged to do so. It's a win-win situation as they clearly describe it, but the OP wasn't satisfied with the high (30%) percentage.
  - ceejayoz 5y ago
    The plugin was secretly taking 15x what it claimed to. The ease with which a (substantial!) refund was offered makes me think it wasn't an isolated incident.
  - pavel_lishin 5y ago
    > the OP wasn't satisfied with the high (30%) percentage. The OP was never informed of the high percentage!
    - abofh 5y ago
  - kevingadd 5y ago
    How is hiding 2% in your wiki (instead of in LICENSE where it belongs), and then taking 30% instead of 2%, not a scam? If someone listed a price of $2 for a burrito and then charged you $30 at the register, you would not consider that OK.
    - abofh 5y ago
      They did consider it thousands of time, they just didn't supervise what their worker agreed to
- ziml77 5y ago
  It looks to me that the plugin author isn't only trying to get the money he's owed from people who are trying to scam him. Which still isn't a great thing, especially since it can happen mistakenly, but it's at least a little more understandable.
op00to 5y ago
In any scam there's a part where you cool off the mark so as to not have them go squealing to the cops. Maybe you give 'em some money back, maybe you teach them the lesson of how to bounce back after a loss. Google "cooling the mark out" to read some academic research on this.

teddyh 5y ago

So he used code straight off GitHub, didn’t read the license terms, and then has the gall to call it “stealing” when the program does exactly as it says it would. Either learn to read licenses, or have a list of approved licenses (MIT, GPL, etc.) and only use software thus licensed. EDIT: What I mean above is the 2% which is specified in the “Licence Agreement” page – the article author is clearly considering this, too, to be “stealing”. Regarding the increase from 2% to 30%, that is way more questionable, and I do not defend it.

libeclipse 5y ago
The GitHub page said it would take 2% but actually took 30%. How is that "exactly as it says it would"?
- teddyh 5y ago
  He called the 2% “stealing”, too. Sure, the slow increase to 30% was not documented, and I can see a good argument being made there.
  - op00to 5y ago
    The 2% is stealing because no reasonable person would expect to see such a clause in an open source software project. The 2% clause was hidden, all the way at the end of the doc. The plugin author is a conman.
    - teddyh 5y ago
      Why do you call it Open Source? The plugin itself does not call itself Open Source, and clearly links to another project for those people who want an Open Source program.
      - InsomniacL 5y ago
        https://github.com/floatinghotpot/cordova-admob-pro/blob/master/LICENSE https://github.com/floatinghotpot/cordova-admob-pro/blob/mas... > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files

1_player 5y ago

AdMob indeed. It does what it says on the tin.

joshstrange 5y ago

I'm of two minds about this. "Stealing" does seem to be a little too harsh given the plugin did say it would take a percentage if you make more than $1K and didn't buy a license. The 30% seems underhand (only because it's not spelled out in the repo) but I do understand the plugin author's position. Open source work, especially something like Ionic/Cordova/Capacitor plugins, are hard to make any money on and I've seen the GH issues for many cordova plugins, it's /rough/. Also there are so many things you need to support and edge cases that I can't even imagine the patience of someone maintaining one of those plugins. I think it's clear the plugin author was/is happy to let the 2-30% stipulation fly under the radar and sit back and collect which doesn't sit great with me but also I kind of get it. I mean if you are going to take OS work and use it for your own gain (something I'm plenty guilty of myself I'll admit) then don't be surprised if not reading the license bites you in the butt. In a perfect world OS devs wouldn't need to these methods to make it worth their time but we don't live in a such a world, people rarely donate to OS projects and expect issues/features to be added quickly and for free. People need money to exist and they don't owe you anything. Honestly if this plugin author had called out the 30% in their license I would say this blog author has no leg to stand on. As-is I'm glad the app developer got their money back and the plugin author should either stop charging more than 2% or update their license accordingly. But "stealing"? Too harsh, especially since you got your money back.

NKosmatos 5y ago
Yes, a good point. He should update the license (https://github.com/floatinghotpot/cordova-admob-pro/wiki/License-Agreement https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic...) to state from 2% up to 30%.
Beltalowda 5y ago
I suspect the line of thinking behind the 30% seems to be something along the lines of "they're fiddling their numbers to reduce our 2% cut, so let's just take a bigger cut". I don't think this is entirely kosher for a bunch of reasons, but I'm willing to believe that it was a naïve person doing something naïve after being burned by someone cheating him out of his cut, or something along those lines. At any rate, since the author of this article was unaware of the 2%, it doesn't really matter if the 30% would have been mentioned or not. That they took any cut could have been clearer, perhaps – I don't know how it looked like before on that Ionic plugin site, but it's plenty clear now so that's a solved issue (if it was an issue to start with). That this was added after this exchange (and before it was published) without any pressure further demonstrates the plugin author is essentially acting in good faith.

high_derivative 5y ago

Stealing seems an almost libellous term for using a software with a revenue model the author did not bother checking out.

pavel_lishin 5y ago
The software says nothing about taking 30% under certain circumstances.
- joshstrange 5y ago
  > Kindly reminder, do not use a fake license key or a license key from others, do not share your license key with others. Abuse of the license key may cause negative impact. [0] This is the closest it gets to calling out the the 30% but I agree, it should be clearer. [0] https://github.com/floatinghotpot/cordova-admob-pro/wiki/License-Agreement https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic...
  - op00to 5y ago
    It shouldn't be clearer - the plugin author should require an affirmative response from the developer that they accept those terms.
    - joshstrange 5y ago
      > It shouldn't be clearer - the plugin author should require an affirmative response from the developer that they accept those terms. Ehh, I disagree. We all know developers would click through any terms without reading anyway and the onerous is on us to read the license before we integrate 3rd party code, which we rarely do. I see this as /just deserts/, a sort of hat tip and "well played sir". The 30% that is not mentioned is the sticking point, the 2% is absolutely reasonable and I might even say I'd think 30% is reasonable IF it had been called out in the license.
    - kapp_in_life 5y ago
      The affirmative response is downloading and using the plugin.

jscheel 5y ago

I'm confused, where in the license does it give them the permission to randomly assign an ad-share percentage? This seems highly suspect, and probably illegal in most jurisdictions. In fact, reading the actual license agreement here https://github.com/floatinghotpot/cordova-admob-pro/wiki/License-Agreement https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic... seems to suggest that they will stop serving ads, not randomly start increasing ad share.

contravariant 5y ago
Yeah I'm not seeing it either. It's even weirder that the code itself is distributed with an MIT license, which suggests you're free to download and modify the code to disable the revenue sharing. This conflicts with some of their other statements though. In the readme they do outline the option to use it with a open source license (without any support), but they seem to contradict this in the following sentence in their readme: >If use in commercial project, please get a license, or, you have monetized more than $1000 using this plugin, you are also required to either get a commercial license ($20). As a commercial customer, you will be supported with high priority, via private email or even Skype chat. Which is nigh illegible. Does anyone know what happens when someone publishes conflicting licenses?
- mannerheim 5y ago
  Since the Wiki part isn't a license itself, I would think there isn't legal relevance to it, but given that the author doesn't seem to be a native English speaker, a generous interpretation might be that a commercial user could still fork this; it's 'required' in the sense that you have to pay for the convenience of having it available on NPM, which the author disallows you from making trivial changes to and republishing on there. That's unlikely to be legally enforceable on NPM, but they might honour takedowns anyway.
- abofh 5y ago
  You were free to give author money the moment you used his code, why are you worrying about the license - you can copy, modify and maintain a version that pays you. You just have to, you know, work

deleted 5y ago

[deleted]

op00to 5y ago

"If you have a high user traffic, please consider to get a license, it will be more cost-effective. Or else you might be unhappy someday." *"Or else you might be unhappy someday."* If that isn't a threat, I don't know what is. This guy's plugin should be removed immediately for such actions.

Beltalowda 5y ago
The author of this software is very clearly a non-native English speaker, and while more than skilled enough to communicate reasonably effective on technical matters, they're also not really skilled enough to fully grasp all the nuances of these types of things. I don't know what they intended with that exactly, but I'm sure not going to jump to conclusions.
colinmhayes 5y ago
I think that's just a fact. License is $20. This guy is clearly making more than $1000 on his site so the license is cheaper.

scarface74 5y ago

Alternate sort of off topic take: if you have a service that is valuable, charge people money for it instead of depending on ad revenue. I try my best to stay away from ad supported business models, if there is an app in the App Store for instance that has an in app purchase to turn off ads, I have no problem paying for it if it something I’m going to use.

Aldo_MX 5y ago
Piracy is a thing and in poorer countries people don't give a sh*t that they're suffocating you, so I'd rather support the ad industry than get suffocated by the people who is supposed to support me in the first place.
colinmhayes 5y ago
Sounds like OP is in Russia. I'm not sure people are as willing to pay for services there.

madarco 5y ago

How to get rich: 1) Create a nice plugin to serve ads 2) Bury a complex revenue sharing logic in the terms of use that nobody read anyway 3) Profit

drran 5y ago
If you are not obeying license, then you are a pirate. | ____ | | |o o| | | "" | | O O | | \ / | | X | | / \ | | O O |

new_guy 5y ago

That's what happens when you freeload. I think we're seeing more pushback now against people like this abusing free software from the developers who break their back to provide it. If you want to use it, PAY. FOR. IT.

netr0ute 5y ago
> PAY. FOR. IT. What about the Linux kernel and numerous other FOSS?
- jtbayly 5y ago
  He was paying for it. 2%. Then the open source hero started taking 30%. Without warning or disclosure. Defending this is a great way to trash the reputation of open source.
  - Aldo_MX 5y ago
    The reputation of open source is already trashed. Companies like Amazon abused what started as a passion for many people, and that passion is now costing them their wellbeing so they're revolting. The real open source belongs inside the GPL bubble, where you are legally obligated to share back, and it was battle tested when closed platforms like iOS gained traction. Did people help pressure Apple to make licenses like GPL viable in their walled garden? Or did people dissed GPL-ed software because they couldn't use it in the Apple ecosystem? The moment we conceded with "LGPL with linking exception" marked the loss of the iOS battle. Remember that GNU exists because Stallman couldn't ahem install a printer. And guess what? People avoid the distros with ONLY FOSS components because "it's impractical". If a distro becomes popular is because it includes a collection of proprietary drivers. Our convenience is what made open source what it is today. And you know what? I accept my fault in the great scheme of things. I was burned by people profiting with work I made for free while I was struggling to survive during the 2008 crisis. I am already familiar with the feeling of betrayal by the people who was supposed to support my work. Open Source was not for me.
    - 5y ago

jmnicolas 5y ago

It's what's worrying with running WordPress plugins: you mean I'm downloading some PHP code written by somebody unknown and this code executes whatever it wants on my server???!!! It seems I'm the only one that is bothered by this. And no I don't at the time nor the skill to audit everything or to use a static site like Hugo.

remram 5y ago
Isn't that what WordPress is in the first place?
- jmnicolas 5y ago
  Absolutely, but it's still scary nonetheless! The problem is that there's not many viable alternative to WP.
  - remram 5y ago
    Isn't any piece of software "some <lang> code written by somebody unknown and this code executes whatever it wants on your server"?
csunbird 5y ago
What is the difference between downloading a wordpress plugin and running it in your server and downloading a jar from maven/a js package from npm and running it?
- marcus_holmes 5y ago
  Nothing. These are also very, very dangerous and expose your site to supply-chain attacks. The article linked to here [0] which is a must-read for everyone who feels that adding a dependency is safe. [0] https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://medium.com/hackernoon/im-harvesting-credit-card-numb...
- jmnicolas 5y ago

ericholscher 5y ago

Just a reminder to folks who are looking for alternative's, we're building an open source ad network for developer-focused sites: https://www.ethicalads.io/ https://www.ethicalads.io/. We also take 30% of the revenue (which is around industry standard), but it's very well-defined in our Publisher Policy: https://www.ethicalads.io/publisher-policy/ https://www.ethicalads.io/publisher-policy/

lewich 5y ago

Author is typical parasite, uses open source projects and other people time and dare to say they are stealing. Read license agreement before usage.

nmstoker 5y ago
But even if you read it, you would have legitimate reason for concern when they started taking more than the 2% stated since there is no mention of taking more than 2% (except in the private email from the plug-in author, which isn't part of the terms)
kevingadd 5y ago
The repo's LICENSE is the MIT license. If you read it you would have no idea the project is going to steal 30% of your ad revenue.
- deleted 5y ago
  [deleted]
  - deleted 5y ago
    [deleted]

InsomniacL 5y ago

How anyone can defend this type of behaviour is beyond me. It is theft, the hidden cost in the licence agreement* states 2%, taking that up to %30 for no reason and with no warning based on some arbitrary 'black list' is theft. * as shady as that is

abofh 5y ago
You.. Ran... Their.. Code.. How anyone can think they're entitled to assume how it should run is ignorance sufficient to shred what remains of my humanity. He didn't demand you give him money, he said if you ran his code, it will act as he intended. You ran his code. It worked as intended.
- deleted 5y ago
  [deleted]
- InsomniacL 5y ago
  > You.. Ran... Their.. Code.. I did not... > He didn't demand you give him money, he said if you ran his code, it will act as he intended. He did not... He said it would act one way, then it secretly acted another against the contract that was entered in to > It worked as intended. It did not... Even their staff admit they never intended to charge him 30%
  - abofh 5y ago
    - InsomniacL 5y ago
      1, I've never ran his code, that's a true statement. 2, The licence agreement states a 2% charge. Then proprietary code on their licence server, outside of the code in this repository increased that to 30%. refer to the email dated 13/04/2017 > "...and a random higher rate will be applied.." 3, Email dated 14/04/2017 > "You did not attempt to hack our server" Can you be more specific about which of my claims are un-true?

tlhunter 5y ago

That same plugin has bitten me in the past as well. I used it to display full screen interstitial ads. Despite the author raking in cash from users the plugin was rather broken when I used it. The biggest shortcoming is that it wouldn't properly differentiate ads that the user completely watched and ads that the user dismissed.

jtbayly 5y ago

The entire site is blocked by my ad blocker.

yessirwhatever 5y ago

Incredibly shady percentage and even more shady way of responding. With that being said, calling it stealing is a bit much. The blame is on you. Read the license of what you're using, and make sure what it's requesting in general. Triggering statement, so be warned: Ad Revenue supported products are generally ALL SHADY. So, I'm astonished he gave you back some money. Probably a useless attempt to have less hassle moving forward, yet you went ahead and shared it. At best, you're equally to blame. At worst, you just want stuff for free while you get paid for your work, the worst kind of entitlement.

nextaccountic 5y ago
> Read the license of what you're using Here's the license: https://github.com/floatinghotpot/cordova-admob-pro/blob/master/LICENSE https://github.com/floatinghotpot/cordova-admob-pro/blob/mas... It's MIT. Here's what they say "If you have used this plugin for FREE but monetized more than $1000, you are also required to get a license, or share us some Ad traffic as stated in win-win partnership model below" If the MIT license is correct, they are lying: people don't need to get a license. The users already have a license that covers absolutely everything and they even have the right to edit the plugin to remove the % cut altogether. Other things they are lying about, in their wiki https://github.com/floatinghotpot/cordova-admob-pro/wiki/License-Agreement https://github.com/floatinghotpot/cordova-admob-pro/wiki/Lic... "Reminder: copy the code, change a plugin name, without feature enhancement, then publish to npm, is not allowed." This is just false. The existing MIT license absolutely allows changing the name and republishing to npm. Perhaps they just don't understand what is open source about. Absolutely all open source licenses allow forks.

Hasz 5y ago

Ha, caveat emptor. Oh, wait, OP isn’t even a buyer and paid nothing for the code and blindly built it into the app. No reading, no understanding, just copying. OG plug-in author has a problem with people abusing license key system, builds in code to detect it. Disclaims it vaguely, OP gets bitten and has the gall to call it stealing. Author offers to help OP out, OP puts him on blast. Zero sympathy, even at 30%.

deeviant 5y ago
There is a huge divide between "oh hey you didn't read the license and missed the fact that this OS addon takes 2%" and "the license said 2%, but it's actually 30%, oops my friend!"
- Hasz 5y ago
  I see zero difference. There is an explicit mention that bad things will happen if you subvert the license system. A license is $20, OP is just too lazy to read the terms of code he blindly incorporates. Op called 2% stealing, 30% is for basically triggering the anti cheat. OP should have paid paid the license and read the rules.
  - JulianWasTaken 5y ago
    What if someone is willing to pay 2% and not pay 30%? Do you think most people who are willing to pay more than 0% are willing to pay both numbers? Or are you punishing OP simply because they didn't know there was 2% involved? If so you don't really see zero difference, you just are exacting some punishment.
  - deeviant 5y ago
    The author didn't at first didn't even notice the addon was taking a cut, let alone attempted to "cheat" it. That is clearly the author's "oops", but what are you getting on about "cheating?" In the license, it clearly state that is perfectly acceptable to use the addon unlicensed, and if you go above a certain monetization level, it will take a cut. The explicitly calls out the cut as 2%. Except the license was a lie, it is not 2%, it's 30%. That is theft. If the addon took 2%, as the license explicitly states, it would have been completely legal. It was not 2% and it is theft. Is it really a good model for funding Open Source software to bake in clearly illegal landmines that steal from anybody using said OSS? If so, that feels way more like malware than OSS.

w0mbat 5y ago

I am a native Mac/iOS developer with a lot of experience. I did a contract where they wanted me to make some improvements to a large company's barnacle encrusted multi-platform Cordova app. I wouldn't normally touch that kind of thing with a bargepole but I was slated just to add some features to the Mac native app shell, beyond the scope of the embedded JavaScript app. Those Cordova apps over a certain age and complexity are terrifying. Random plugins, ancient Cocoa Pods, abandoned JavaScript libraries, several different build systems (somehow all being used), Node.js modules with version conflicts that can never be resolved, pulled from all over the internet and all over time. I am not surprised this guy had no idea what one 3rd party ad plugin was doing, if the app I saw was typical.

abofh 5y ago

You didn't pay your vendor for a year and they noticed

frankfrankfrank 5y ago

I feel there is a bigger issue here that I don't see anyone having brought up. Blogging dev was too cheap to just pay $20 for a license for code that would generate him money. THAT is really the bigger issue here, regardless of everything else, including the fact that he was in violation of the agreement, i.e., >$1,000 MRR. Here's a little pro tip for everyone, don't cheap out on paying someone $20 for the work they do, when it will be generating you significantly more income. Frankly, regardless of whether or not the plugin dev is sketchy or not, the blogger dev violated the terms of the agreement and seems rather ungrateful that he was given back what he should not have even gotten back.

floatingatoll 5y ago
“No one thinks anyone else deserves payment for creating good work, unless they’re the one who could be getting paid, in which case it’s a travesty that they’re not” is an ethical standpoint that’s widespread in Silicon Valley. For example, it’s why Facebook users don’t receive dividend payments for the investment of their harvested data. “We realized that we could profit from inattention|opensource, so of course that’s ethical, because Finders Keepers rules” is a bad look for both parties in this post — the plug-in author who takes a revenue share without providing a financial statement, and the site operator who can’t be bothered to pay $20 for a core revenue stream of their site.

arthur6667 5y ago

Based on the comments I should make a left-pad and put in a random file 'if you use this, you need to give me you house and first born child'. Because appearantly whatever you put down is legal and enforceable.. shm.. Taking reveneu without a contract smells like fraud to me.

nemothekid 5y ago
IBM wouldn't touch JSLint because there was a clause that said JSLint couldn't be used for evil. Some people do their homework and others don't.
bruce343434 5y ago
the license IS the contract. When was the last time you actually signed something when you used a SAAS?
abofh 5y ago
Anon wrote the code, op ran the code thousands and thousands of times. Yeah, anon is the enemy for wanting to get paid

Ansil849 5y ago

The responses here to this story defending the plugin author are appalling. They all seem to boil down to "you didn't read the fine print or the source code, so whatever the plugin does is defensible". What if instead of taking a percentage of the ad revenue, the plugin siphoned credentials or ran malware as a revenue generator, or did whatever else? And what if it openly explained in the fine print that it would be doing this?

Hasz 5y ago
You don’t read the contract, you pay the price. People just arbitrarily pulling in code from random people on the internet and expecting everything to be fine is hilarious. Your project, due the due diligence. To answer the hypothetical, the author is still at fault even if was malware.
- Ansil849 5y ago
  > To answer the hypothetical, the author is still at fault even if was malware. Wow, that's as explicit victim blaming as you can get.
  - Aldo_MX 5y ago
    Dismissing something as "victim blaming" is the best way to say "I am not mature enough to accept that I have responsibilities, and I will play the role of a victim for as long as I can stay unaccountable for my actions".
    - Ansil849 5y ago
      I asked this question in another comment, but same thing: Just curious, is this your attitude towards other things as well? There used to be a very popular ebay scam, which had people sell large screen TVs and video game systems for very cheap. At the bottom of the auction description, in fine print, the auction also clearly stated that you were bidding/buying only a photo of the product, not the actual product. In other words, it was "spelled out", so no one was getting scammed according to your perspective here, right? It was on the fault of the buyers for not reading the license/auction description?

appleiigs 5y ago

> the drop was due to the Russian government blocking us in an attempt to monopolize the mobile electronic diary market. I’ll save this story for later I kinda want that story right now lol.

mirzap 5y ago

This is not a theft. You used the plugin from the github, didn’t even bother to check the license, used someone elses work with small fee. Guy even returned you the money. It’s probably some kind of dark pattern, but certainly not a theft. Pay the plugin and you’ll not have to pay the fee.

vlark 5y ago

jart 5y ago

Look at the GitHub profile. The eyes are dead. You can always tell a man by his eyes.