22 ms·
Tell HN: "I don't care about cookies” extension bought by Avast, users jump ship
- Ajnasz 3y agoThis whole "I accept these cookies" is broken from the beginning. First of all, why they want to use any of those cookies which are not needed? Use a session cookie, so I can be logged in and I can access to the data and page, but the others are nonsense. Also, I would accept one cookie, which stores that I don't accept other cookies.
- dlqx 3y agoTime to move on to the fork at https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies
- biql 3y agoThere should be a standard way for all browsers to tell sites whether they accept cookies or not. There is no reason every user should deal with this banner manually for all sites.
- kzrdude 3y agoI've been using Consent-O-Matic instead. It takes your preferences and tries to opt out of tracking everywhere possible.
- popcalc 3y agoCommunity maintained fork: https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=search https://addons.mozilla.org/en-US/firefox/addon/istilldontcar...
- stavros 3y agoRepo: https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies
- woodruffw 3y agoThis is very disappointing, and points to a weakness in these kinds of platforms: I can be a passive user of an excellent extension for years, and wake up one morning to discover that my browser has (silently!) upgraded the extension to one controlled by an entity that I don't necessarily trust. I think it would behoove Firefox and Chrome to change their policies around automatic extension upgrades in these scenarios: if an extension discloses a change in ownership, then upgrades should require user approval. If an extension fails to disclose a change in ownership, then users should be able to report it as malicious.
- treffer 3y agoExcept.... Companies regularly switch their legal entities around. Which can be annoying. So you might wake up one day seeing ownership was transfered from <X> to <X>. Still, it could be not disclosing it in such cases and live with it in a gray zone.
- tekno45 3y agocause: late-stage capitalism
- JohnFen 3y agoThis isn't just a problem with extensions, though. It's a problem with everything. Always has been and always will be. This is why people should be extremely cautious about becoming too attached to (or, worse, dependent on) any particular product or service. It can change ownership (and therefore policies) at any time.
- sneak 3y agoThis is why people should be extremely cautious against self-modifying software (ie unattended autoupdate) - it grants remote code execution on your computer to remote parties.
- throwaway292939 3y agoAt the risk of pointing out the obvious, this is mostly referring to Internet enabled goods and services. As other commenters have pointed out, it doesn't apply as much to actual physical products. So this leads to reason, should any of this be accepted as the norm?
- uoaei 3y agoI wasn't informed of this sale before it occurred, and Avast has a history of stealing and selling user data. I did not produce informed consent for this add-on to continue operating under those conditions. I reported it to Mozilla when I uninstalled the old add-on as stealing user data and I encourage everyone to do the same.
- bmarquez 3y agoPrevious discussion (from 8 months ago): https://news.ycombinator.com/item?id=32850799 https://news.ycombinator.com/item?id=32850799
- taspeotis 3y ago[flagged]
- rektide 3y agoI'm sort of surprised these users would care. They literally went to go download an extension to let anyone track/survellied them however they wanted. But oh no, now there's a big corp that owns the extension! And they might be survellied!
- JohnFen 3y agoI think the issue isn't just that it's a big corp. It's that it's Avast, specifically.
- yazzku 3y agoNot really. Cookie banners are irrelevant and do not preclude tracking, they just take up space and give a false sense of privacy. These users installed the extension because they'd rather not see the pop-up to begin with. And then Avast bought the extension.
- mynameishere 3y agoYeah, that never made any sense. Is there any add-on that basically...forces websites to adhere to the browser-configured cookie settings? And if any popups contain the word "cookie" to basically just remove the element? If it renders websites inoperable, I'm okay with that.
- tomrod 3y agoI browse mobile with Javascript defaulting to blocked. Not sure how it happened, truth be told, Brave just started blocking it one day. Most of the experience is unaffected.
- dmw_ng 3y agoRandom aside: this extension had absolutely the worst internals of any I've ever looked at. Love the functionality, but really wish I'd never seen the spaghetti behind the illusion (source files below). It feels like approaching it as a text classification problem might produce a clean general solution https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies/blob/master/src/data/rules.js https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies/... https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies/blob/master/src/data/js/6_cookieHandler.js https://github.com/OhMyGuus/I-Still-Dont-Care-About-Cookies/...
- paddw 3y agoThere is nothing wrong with these internals. Hard-coded rules are not necessarily "spaghetti code". I sincerely doubt there is any reliable way to come up with a general solution without relying on hard coded rules (at least without using AI).
- dmw_ng 3y agoIt doesn't seem like an overly difficult problem: try to find a text fragment (e.g. DOM mutation observer) requesting consent in some container that has some other element with an onclick handler (maybe optionally trying to figure out if image filenames / labels of that element look sensible). Maybe an approach like this will only work 70% of the time, but that seems likely to be a better strategy than embedding a giant list of every relevant site on the Internet
- arp242 3y agoEven a single false positive would be too many, as it would probably break the entire site.
- geysersam 3y agoIsn't it just a lot of data? Not sure what's bad about the code. I mean, the variable names could be more enlightening, and there are no comments, but I don't think it qualifies as "spaghetti".
- 3y ago
- ruined 3y agothere are cookie dialog lists for ublock origin and other adblockers, btw
- sphars 3y agoIn uBO, it's under Settings > Filter lists > Annoyances > enable EasyList Cookies Notices and AdGuard – Cookie Notices to hide cookie banners.
- londons_explore 3y agoFor many sites, just hiding them isn't enough - if you want the website to work properly and not randomly log you out immediately after logging in, then you need to either accept or decline cookies.
- codewiz 3y agoVery odd, uBlock Origin for Chrome has "EasyList Cookies Notices", but "AdGuard – Cookie Notices" is missing. The Firefox extension has both lists. The version is the same: uBlock Origin 1.49.2. Does this have anything to do with Chrome's new extension API nerfing ad blockers?
- deleted 3y ago[deleted]
- sphars 3y agoI'm not sure. I'm in Firefox, but I did have to refresh the sources in the uBO settings and more showed up.
- deleted 3y ago[deleted]
- debacle 3y agoI remember 20 years ago when Avast were the good guys. It's interesting how brand perception changes over time.
- deleted 3y ago[deleted]
- nyanpasu64 3y agoI miss old Avast, the brushed metal UI, the radioactive virus dialogs with the siren sound (https://www.youtube.com/watch?v=ycs92N_rph8 https://www.youtube.com/watch?v=ycs92N_rph8).
- scohesc 3y agoI remember leaving my computer on overnight in my room and being startled awake by a really loud pig squeal when Avast detected a virus on my PC. Just looked up what Avast looked like in the 2000's. The aftermarket car stereo GUI[1] just brought back memories I forgot about :P [1]http://assets.oldversion.s3.amazonaws.com/images/avast-free-antivirus-4-8-1368-screen-49.jpg http://assets.oldversion.s3.amazonaws.com/images/avast-free-...
- cubefox 3y agoThat looks like WinAmp.
- itronitron 3y agoI remember when SourceForge were the good guys. That should be a cautionary tale for many companies but they got dropped so hard and fast that now no one has heard of them.
- b215826 3y agoNorton and McAfee were the bogeymen those days.
- yomlica8 3y agoAt least you can still rely on some things to not change.
- loloquwowndueo 3y agoSomeone here in HN recommended Consent-O-Matic instead of I don’t care about cookies. Said “I do t care about cookies is the extension advertisers want you to install” :) apparently it just says yes to everything. Consent-O-Matic specifically configures things to share the least amount of information possible.
- mcmcmc 3y agoWith a name like "I don't care about cookies" it does kind of make sense that it would just auto-accept everything. After all, they don't care about cookies
- londons_explore 3y agoSites work much better if you just say yes to everything. Devs never test the 'no' path as well, and half the time you'll find embedded videos/maps/tweets won't display or are buggy. Since I care about a fast efficient web experience far more than I care about leaving digital footprints around, I choose the extension that says yes to everything.
- bmacho 3y agoI don't think I've ever seen a website that broke when I clicked "decline", or "disable all+save". (Yes, I manually click or click click for every website. Also I don't think that EU "broke the internet", rather they made me painfully aware that every f.in website uses cookies and other tracking methods just to give my browsing history to ~300 total random company for no reason.)
- rossjudson 3y agoI'm more or less in your camp. I really don't care about "saying no to cookies" because I don't believe that sites will implement no properly anyway. I'd much rather be relying on the clear (hopefully!) lines being drawn by my browser and its settings. Asking me if I'd like to allow various cookies is by far the least important part of the problem. Relying in the cooperative efforts of site owners? Really?
- AdmiralAsshat 3y agoDid they actually do anything yet, or is it just assumption that they will because why buy a popular extension these days if that's not the goal?
- gnicholas 3y agoThis is a fair question. Everyone is piling on here, sort of without regard to whether anything bad has actually happened. Of course, even if they don't change anything, the extension is now funneling whatever data it collected to Avast, a company that many hold in low regard (myself included). But it would be appropriate to have a discussion about what they're doing now that's bad, aside from not telling anyone about the acquisition.
- moonshinefe 3y agoA bit of that, and the fact Avast got caught just a few years ago massively spying on all their users and selling their data both in their browser extension and free anti-virus apps.
- bandrami 3y agoBetween GDPR warnings and ubiquitous site notification pop-ups (side question: has anyone ever intentionally clicked "yes" to a site notifications request? can the browsers just admit this was a horrible idea and move on?) out-of-the-box browsers are basically unusable on just about every website. Leading to extensions and situations like this.
- pndy 3y agoI still believe that cookies consent should be handled by the browser and not by sites. Because all these cookies preferences are temporary in nature and disappear when user decides to clear cache or it gets removed automatically. Not mention that this control via modals applies for device currently in use and doesn't get carried around (not sure if browser synchronization changes anything) Having this within browser in theory should solve the issue of consent but I frankly doubt that such permanent solution would agree with Microsoft or Google goals. Mozilla - perhaps would roll this but I wouldn't have any big hopes. And yes, I did intentionally clicked "yes" thinking no 3rd-party cookies will be saved but that was in the early days of GDPR. There are sites that allow users to disable 3rd-party "legitimate interests" cookies under modal submenus and some only show em in enabled state without any options.
- scq 3y ago> has anyone ever intentionally clicked "yes" to a site notifications request? Yes, for Google Calendar and Slack.
- geysersam 3y agoStill thousand times better than the walled garden app stores. If we want complicated apps to be available on the web we need complicated browsers. The competition situation is troublesome but nothing compared to the complete monopolies Apple and Play store has.
- technion 3y agoAn org wide policy to disable browser push notifications visibly changed helpdesk load and security incident reports over night. Non technical, average users hit "yes" in nearly every case, usually ending with opt in to fake tech support popups and porn spam.
- thih9 3y agoWhy is this a problem? I can imagine a number of scenarios, but I'm unfamiliar with this particular case. Could someone elaborate on what actually happened or what is the danger?
- phendrenad2 3y agoA company doesn't acquire something for no reason, and people are suffering FUD over what that reason could be. Maybe they'll put in annoying popups ads for their other products. Maybe they just want market research data. Or maybe they just thought being the provider of this service would garner goodwill somehow.
- itronitron 3y agoWhat are the scenarios that you can imagine?
- papichulo2023 3y agoCharging companies to exclude them(adblock way)
- notatoad 3y agocompanies have to provide the cookie prompt as a legal requirement - it's not something they want to do or get any benefit from. what this extension does is blindly accept the cookie prompts. it's not something any company would want to be exempted from. companies like this.
- bluGill 3y agoCompanies only need that if they place nonessential cookies.
- weird-eye-issue 3y agoIrrelevant in this thread
- deleted 3y ago[deleted]
- sysadm1n 3y agoI still have a copy of this addon, before it got acquired by Avast. I turned off automatic updates for extensions in Firefox, since I don't want weird / malicious code being pushed into my browser. I do this since I audit some extensions for malicious code, and want to keep the good / last-known-good version, before a tainted/malicious one arrives in my browser in an update. It's broken though, and messes up YouTube by persisting the cookie interstitial in an invisible overlay, making the interface unusable. This is why these types of addons have so many new versions: they have to constantly watch for changes in the JS/CSS of cookie banners. Thank god we have community maintained alternative forks[0] [0] https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies https://addons.mozilla.org/en-US/firefox/addon/istilldontcar...
- cdme 3y agoDoes this impact the community version? https://addons.mozilla.org/en-US/firefox/addon/istilldontcareaboutcookies/ https://addons.mozilla.org/en-US/firefox/addon/istilldontcar...
- subarctic 3y agoI think that was created back when this was announced last september, so probably not (see previous discussion here: https://news.ycombinator.com/item?id=32850799 https://news.ycombinator.com/item?id=32850799)
- phendrenad2 3y agoWhy exactly can't browsers provide this functionality themselves? Is this prohibited by some questionably-well-meaning-but-nonetheless-harmful law?
- slondr 3y agoThey are, and Firefox does (Beta currently, hitting stable in July)
- rossjudson 3y agoOne of the better uses of my time last year was just writing my own ad blocking extension. Of course it doesn't get everything -- that was never my intent. I just wanted to get rid of the most egregious crap, like Taboola and the variously spawned similar demons. It's quite good at doing that. Sounds like I might need to investigate consent as well...but the "pain identification" isn't going to work the same way. With the consent management, I'll probably end up having to do a lot of per-site work...which kind of defeats the purpose. Sigh. Guess I'll find out, on a sufficiently annoyed weekend.
- sureglymop 3y agoI did the same! Just wrote my own extensions for features I wanted and it was super easy and straight forward (albeit a little limited in firefox). Wrote one for pinning tabs on the right and wrote one to search through all open tabs with ctrl+f. Quite nice how accessible this is!
- clumsysmurf 3y agoI was under the impression this was obsolete using Firefox 114 "Cookie Banner Reduction" feature.
- codewiz 3y agoThat feature slipped to Firefox 115: https://9to5linux.com/firefox-115-beta-brings-cookie-banner-reduction-quick-actions-in-address-bar https://9to5linux.com/firefox-115-beta-brings-cookie-banner-...
- clumsysmurf 3y agoI turned it on in FF 114 with about:config flag: cookiebanners.ui.desktop.enabled = true It will appear in Settings / Privacy / Cookie Banner Reduction
- cubefox 3y agoIn some weird double irony this website showed me two different cookie overlays on top of each other. Never seen that before.
- handsclean 3y agoWe need to stop writing “X buys Y”, and start writing “Y sold to X”. Big co’s aren’t some boogeyman that can buy whatever they want, individuals and small companies are selling out, and by pretending they’re blameless we normalize it. This extension wasn’t taken over, it sold out. Like LastPass, Private Internet Access, WhatsApp, Figma, Dark Sky, Wunderlist, the list goes on. All decided that, actually, they care less about their mission, users’ experience, and users’ trust than they do a pile of cash. And that’s not necessarily horrible or even wrong, but what is wrong is for us to not even withdraw our trust from people who have sold it. Or for us to withdraw equally from those who don’t.
- ThunderSizzle 3y agoThere's a lot of sell outs, not just someone who sells their app. Many people work for places and sell their soul to them, accepting the evil they push - e.g. Google It's not unique to solo devs. Unless you work for a morally sound employer, and only interact with morally sound companies, throwing shade like that just means the boot will fit on you too.
- account42 3y agoAnd? The proper action here is to improve yoursef not to let others get away with immoral behavior.
- legitster 3y agoNearly every startup I worked at had a slide deck as early as day one that included "get bought" as their primary exit strategy.
- bluGill 3y agoThe only startup as was in didn't. They ran short of money and laid me off, but 20 years later the company is still around doing the same thing they always have and I assume making money. Just before they laid me off they rejected a buy out offer from a big company. I think that is actually normal overall, but the real fast riches are of course in the big buyout.
- JimWestergren 3y agoInstead of this, just activate the filter in uBlock Origin: Filter Lists -> Annoyances -> EasyList Cookie
- reportgunner 3y agoAlso block 3rd party scripts.
- bertman 3y agoI don't think the behavior is strictly equivalent. From this extension's description: When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do).
- michaelgiba 3y agoNext up: “I don’t care about cookies but care when an extension tracks the fact I don’t care about cookies”
- recursive 3y ago"I don't care about cookies" is just the name of the extension. In actual fact, it indicates that the user doesn't care if the server sends cookies. The user agent is still in control of what it does with them, and whether it includes them in subsequent responses.
- valcron1000 3y agoHow much did Avast paid for the extension?
- tararara 3y ago[dead]
- MickyTheMouse 3y agoI still don't care about cookies & Cookie AutoDelete is a powerful combo
- Semaphor 3y ago"I don’t care about tracking" gets bought by a tracking company. I guess that makes sense.
- berniedurfee 3y agoCapitalist supply-chain attack
- NoZebra120vClip 3y agoI used Avast! anti-virus in Windows for a while, and for a short period on my Android device as well. I found it to be pretty usable and friendly, but most functions including anti-malware seemed superfluous or dubious. But it was nice and comforting to scan and find nothing. I had a subscription to the premium service because it had perks, like more devices and features and stuff. I gradually found that the remote features in the vein of "Find my Device" were trash and never worked. I could never contact my Android tablet with the website, or make any meaningful GPS search for it. I didn't once try factory-wiping it, but I basically assumed that it would fail in the very moment I needed it most. Fortunately, I never did require these features, and they stayed resolutely broken. Avast! changed something about the service and I decided it was totally not worth having anymore, so I canceled and uninstalled, then they charged me again (Google Play Store). I was able to go after them and procure a refund, but I was not happy about the casual consumer abuse after a malfunctioning product. Avast! is HQ'd in the Czech Republic, and I have mixed feelings about my cybersecurity entrusted to such a faraway foreign land that's close to the whole Eastern Bloc, so good riddance, and I guess I'll use Malwarebytes next time.
- zoul 3y agoPractically speaking, none of the security risks involved have anything to do with the Czech Republic – it’s a safe, modern European democracy with data protection laws better than US.
- NoZebra120vClip 3y agoI believe you, I really do, but they are still a foreign nation thousands of km away, and the laws are different and largely unknown to Americans. In their HQ and datacenters, they would also be subjected to a rather different mélange of threat actors, and so an adversary that would have no chance in these United States, might have an opening to use Avast! as a vector, or at least exploit the juicy, juicy log data and telemetry they are able to collect with their root-privileged apps.
- reportgunner 3y ago
- leke 3y agoOne comment: > It is very wrong for the extension to change ownership without warning the user about it. I trusted the original developer of this extension, but i do not trust Avast. I don't see the logic here. Unless Avast had threatened him, I wouldn't trust neither of the parties. How do you trust someone that sells their extension to someone you don't trust and still trust them?
- leke 3y agoSo the word on the street is to use "I still don't care about cookies", which is a fork of the original. So Avast bought an open source code base that can be forked? Is this a good business decision? I wonder how much they paid for it?
- gnicholas 3y agoIt's a good business decision if the vast majority of users never find out, and keep blithely using the original version.
- yasuocidal 3y agoI see a lot of " i didnt get notified about the change" in the reviews, but personally i got 3 of them. 1 was just out of the blue and the other 2 were when i installed the extension ( i formated my PCs ). I know that the move is bad dont get me wrong, but a notification was present, most people just close the "New Tab" that open from an extension that's maybe how they missed it. Anyway, there is a community one "i still dont care about cookies" and i will be moving to that one.
- huksley 3y agoIt is a wide spread problem with extensions and much more common that you would think. Also developers completely change extension to be something else and you only discover it when it asks for more permissions or by going to the extension page. Notable examples: - Resolution test (allowed to change browser size so you can make perfect screenshots and videos), now needs full tab content access because "Facebook upload functionality" - [1] - Awesome screenshots (it was perfect extension which allowed to take screenshots and videos), now it is called "Awesome ChatGPT Screenshot & Screen Recorder" - [1] https://chrome.google.com/webstore/detail/resolution-test/idhfcdbheobinplaamokffboaccidbal https://chrome.google.com/webstore/detail/resolution-test/id... - [2] https://chrome.google.com/webstore/detail/awesome-chatgpt-screensho/nlipoenfbbikpbjkfpfillcgkoblgpmj https://chrome.google.com/webstore/detail/awesome-chatgpt-sc...