7 ms·

This is very disappointing, and points to a weakness in these kinds of platforms: I can be a passive user of an excellent extension for years, and wake up one m

This is very disappointing, and points to a weakness in these kinds of platforms: I can be a passive user of an excellent extension for years, and wake up one morning to discover that my browser has (silently!) upgraded the extension to one controlled by an entity that I don't necessarily trust. I think it would behoove Firefox and Chrome to change their policies around automatic extension upgrades in these scenarios: if an extension discloses a change in ownership, then upgrades should require user approval. If an extension fails to disclose a change in ownership, then users should be able to report it as malicious.

treffer 3y ago
Except.... Companies regularly switch their legal entities around. Which can be annoying. So you might wake up one day seeing ownership was transfered from <X> to <X>. Still, it could be not disclosing it in such cases and live with it in a gray zone.
tekno45 3y ago
cause: late-stage capitalism
JohnFen 3y ago
This isn't just a problem with extensions, though. It's a problem with everything. Always has been and always will be. This is why people should be extremely cautious about becoming too attached to (or, worse, dependent on) any particular product or service. It can change ownership (and therefore policies) at any time.
- sneak 3y ago
  This is why people should be extremely cautious against self-modifying software (ie unattended autoupdate) - it grants remote code execution on your computer to remote parties.
- throwaway292939 3y ago
  At the risk of pointing out the obvious, this is mostly referring to Internet enabled goods and services. As other commenters have pointed out, it doesn't apply as much to actual physical products. So this leads to reason, should any of this be accepted as the norm?
- anonymousab 3y ago
  It's another prime example of why users should be wary of always choosing automatic software updates, and particularly wary of any company that uses security and "we know what's best for our dumb users" as an excuse for trying to stop users from using only a manual update process.
  - willcipriano 3y ago
    Ben Franklin on automatic updates: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
    - sockaddr 3y ago
      This quote never made sense to me. My decision to prefer one of these over the other doesn't mean I don't deserve either. It's a decision I make with my own unique economic and threat parameters. Being "deserving" plays no role here.
      - qohen 3y ago
        The quote actually meant something rather different than people think and has been taken out of context. Here's a discussion about it[0]. First, here's the TL;DR: SIEGEL: So far from being a pro-privacy quotation, if anything, it's a pro-taxation and pro-defense spending quotation. WITTES: It is a quotation that defends the authority of a legislature to govern in the interests of collective security. It means, in context, not quite the opposite of what it's almost always quoted as saying but much closer to the opposite than to the thing that people think it means. And here's the detail, discussed just before the TL;DR (I put in some paragraph breaks): SIEGEL: And what was the context of this remark? WITTES: He was writing about a tax dispute between the Pennsylvania General Assembly and the family of the Penns, the proprietary family of the Pennsylvania colony who ruled it from afar. And the legislature was trying to tax the Penn family lands to pay for frontier defense during the French and Indian War. And the Penn family kept instructing the governor to veto. Franklin felt that this was a great affront to the ability of the legislature to govern. And so he actually meant purchase a little temporary safety very literally. The Penn family was trying to give a lump sum of money in exchange for the General Assembly's acknowledging that it did not have the authority to tax it. [0] https://www.npr.org/2015/03/02/390245038/ben-franklins-famous-liberty-safety-quote-lost-its-context-in-21st-century https://www.npr.org/2015/03/02/390245038/ben-franklins-famou...
- nazgulsenpai 3y ago
  Case in point -- I mortgaged my home with a local bank then without me knowing or being asked I became a Wells Fargo customer. At least you can uninstall the extensions :)
  - JohnFen 3y ago
    I strongly believe that selling ongoing loans to other companies should just be flat out illegal. You entered into a contract with your local bank, not Wells Fargo. It should not be legal any party in the contract to unilaterally rope the others into a contractual relationship with someone who was not involved.
    - ceejayoz 3y ago
      I certainly don't remember all the terms of my mortgage, but surely there's a "we can resell your mortgage" provision in the terms that we bilaterally agreed to.
      - pixl97 3y ago
        If you don't have the ability to strike that clause is it really bilateral?
        ceejayoz 3y ago
        You are under no obligation to sign. They are under no obligation to accept a modified contract. Both sides can walk away. Both sides will be bummed, but the bank is likely to care a lot less.
        CatWChainsaw 3y ago
        These kind of libertarian explanations always conveniently neglect to mention any power imbalances between the parties. When called on it the response is usually just a less polite version of "oh well".
    - 3y ago
- fhd2 3y ago
  I think it's a particular problems with extensions because: 1. They usually mostly work in the background, don't need much interaction. It's almost like a built-in browser feature changing owners. 2. They are pretty difficult to find a business model for - as opposed to SaaS stuff and mobile apps, which people pay for rather commonly. So the choice is to a) Make no money b) Ask for donations (seems to only work if it's somewhat obnoxious) c) Make money in some creative (often shady) way d) Sell the thing.
- HWR_14 3y ago
  That's a different issue. I can still run many old versions of software even if new versions are put out by some evil entity I no longer trust. Unless the software auto-updates. In which case I no longer have the old version. AFAIK, it is not easy (or maybe not possible) to opt out of extensions updates.
- jxramos 3y ago
  I was thinking about this is the food and personal products space. I dreamed up something like requiring some kind of notation to denote how many steps you are away from a parent company. Direct private companies with no parent would have no notation, once a parent company buys the company and its brands put a dot for every parent company above the company of the product you're now purchasing. Something to make this transfer visible.
  - jxramos 3y ago
    come to think of it this would hide transfers between similar ranking networks where companies swapped things out.
    - joveian 3y ago
      I think the thing to do there is to require that the controlling owner of the brand be mentioned in non-tiny print near the most prominent mention of the brand.
      - account42 3y ago
        Better yet, make it so each independent company only gets one trademark and companies owned by another get none. The entire purpose of trademarks is to protect consumers. Being able to use them to mislead consumers is the opposite of that.
- asdff 3y ago
  This is why tools are always better than products or services. Your hammer in the drawer isn't going to one day update itself and change. Neither is some of the bash tooling that's been around for decades. And should these things change, you always have your old versions of these tools in your drawers and storage drives.
- woodruffw 3y ago
  I agree. I also don't think this is something that's formally solvable in the general case, at least not in a way that's practical for distracted and non-technical users. Instead, this is the kind of thing that needs to be solved on the policy level: Google and Mozilla have an interest in maintaining high-quality extension ecosystems, and ought to take a dim view of these kinds of ownership transfers.
- wongarsu 3y ago
  This wasn't a big problem with software just 20 years ago. Sure, the software you used could be bought by someone else, but that just meant you might choose not to get the next version. Software didn't automatically update, and licenses were eternal and mostly tied to physical tokens, like a disk or a fancy sticker. At some point your beloved software might become obsolete, but that was because it was outpaced in improvements by other better software, not because yours got any worse.
  - askvictor 3y ago
    But the barriers to releasing and distributing software were much higher, as you had to work out to get it to people, and incremental release were basically impossible. So software was controlled by a handful of big companies.
    - JohnFen 3y ago
      > So software was controlled by a handful of big companies. Not really, no. The software space was much, much richer and you could get along extremely well without using much software from the big guys.
    - ipaddr 3y ago
      The industry had more smaller players compared to today and a better chance to sell. The barriers were higher but expectations lower. Plus you had a fragmentation of computers and high margins. Trade shows and flea markets, magazines, shareware and asking store owners directly were accessible ways. Today we have the illusion of speaking globally but have been gatekept out by a handful of companies.
  - JohnFen 3y ago
    And, to be honest, it doesn't even really have to be a problem now. I use almost entirely FSF or Open Source software. Of the proprietary software I use, it's still software that I have an installable copy of and I'll be able to keep using it for as long as I have a machine that can run it. I don't do automatic updates and actively prevent that from happening. Automatic updates are a plague that means you can't rely on the software anymore, if for no other reason than an update may (and likely will, eventually) remove or otherwise bork the very aspect that made it valuable to you. But I'm a weirdo and take care to ensure that I actually own and control the software I use. I see people getting burned because they're at the mercy of a company all too often.
- msla 3y ago
  This is much less of a problem with open source software, although, admittedly, not completely unknown.
- grishka 3y ago
  The problem is with automatic updates.
- rlpb 3y ago
  It's not a problem with everything. Distributions tend to add editorial input here and try to do something they consider reasonable for their users, staking their own reputation on that without trying to pass it off to the component publisher. For example, I doubt that Debian would would take an update from an upstream that is detrimental to their users. They would follow a friendlier fork first. Debian maintainers follow their users' interests first. (I'm a Debian Developer) Edit: and that means you can generally trust automatic updates on Debian.
  - account42 3y ago
    This is why the push towards application sandboxing and distribution by the developers themselvs is IMO misguided. I'd much rather have my applications run unrestricted but vetted and if neccessary patched by a trusted third party (the distro) than lock whatever dark patters and anti-features developers come up with into a box ... where it still has access to all interactions with that box. In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro.
    - rlpb 3y ago
      > In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro. But in the case of something like Firefox, distros are barely vetting anything, and are reluctant to patch because such patching rapidly becomes unmaintainable. Most dependencies don't end up unbundled, either. So distribution Firefox packages are really external packages in distribution package clothing, more so than any other package, really. This is why I want sandboxing anyway - because I understand the limits of what is practical. And sandboxing and limiting interaction through well-defined interfaces is better for security anyway, because security vulnerabilities happen regardless, and sandboxing does provide some level of mitigation. Finally, the distribution packaging model is insufficient for many users. Even if you are fine with it, most users want something newer than their distribution release, and we can see that they are prepared to give up security and system stability for it. This is a real need for these users, and sandboxed third party packaging mechanisms provide a real solution for them, even if you can manage without.
- hedora 3y ago
  As a corollary, any private information that a publicly owned company has is for sale (since the company could be bought or merge), and any information any company has can be force-sold during bankruptcy proceedings. Any time a company has physical access to your data, and says they will not sell it, they are lying (unless it is privately held, and never takes on debt / pays after delivery). In particular, EULAs and other contracts do not protect your information in the above situations, since debt and shareholder obligations generally come before customer obligations, and the data is considered an asset.
- leke 3y ago
  I'm beginning to think Richard Stallman was correct about everything.
bastardoperator 3y ago
Everything about this is sad. Sad that I have to install an extension to get rid of stupid messages forced upon me just for visiting a website, sad that an untrusted company is trying to buy trust, sad that users have to waste time switching away.
deleted 3y ago
[deleted]
londons_explore 3y ago
> If an extension fails to disclose a change in ownership, They would just change ownership and keep that a secret from the world. Avast would 'hire' the dev of this extension, and provide him with more engineers and ideas of features to implement.
that_guy_iain 3y ago
This can also happen with any SaaS and many services. They get bought and sold quite a lot.
ChrisMarshallNY 3y ago
That's also an issue with app stores. I have received a few solicitations to sell apps that had not been updated in a while (they were still good, but hadn't required an update). I suspect the buyer would repackage the app with some "extra spices," either advertising, or malware, and would count on the auto-update to force it onto users' devices. I declined. I remove moribund apps. I've written over 20 but only have a few on the store.
tectonic 3y ago
A decade ago I wrote an extension called SelectorGadget (https://selectorgadget.com/ https://selectorgadget.com/). It's effectively unmaintained, but it still works and people still use it. I make no money from it and never have. Every few months someone tries to buy it from me, and I ignore them because I don't want to f** over my users. But there are a lot of extensions out there and maybe their owners care less, or find themselves in a moment of financial hardship and they sell.
- bombcar 3y ago
  Apparently this is a known and open “business” to buy up used but old addons and convert them to advertising malware. Good on you!
2h 3y ago
Firefox: 1. Open application menu 2. Add-ons 3. Extensions 4. click gear 5. uncheck Update add-ons automatically
- bombcar 3y ago
  I wish you could indicate some addons to update automatically, but after six months of no update that addon switches to manual.
- woodruffw 3y ago
  I know how to disable automatic updates. The point was that there's a substantial shift in trust when the underlying identity that controls an extension changes.
  - 2h 3y ago
    > I know how to disable automatic updates doesn't seem like it: > I can be a passive user of an excellent extension for years, and wake up one morning to discover that my browser has (silently!) upgraded the extension you want to roll the dice with automatic updates, you have only yourself to blame when they break something you care about. people always scream BUT MUH SECURITY, and at the same time ignore every other awful change that is rammed through automatic updates. pick your poison.
    - woodruffw 3y ago
      Please read charitably. I don’t want to “roll the dice.” There is a significant difference in user model between trusting a single identity to provide updates automatically, and naively trusting updates that come from a new identity. In the context of web extensions, not auto-updating is frequently not an option: web extensions are part of an arms race between users and websites, with the extensions continually playing catch-up.
      - 2h 3y ago
        it is an option. just because you might find one choice extremely distasteful, doesn't mean the option ceases to exist. so I will say again, pick your poison. you opt in, or fail to opt out of automatic updates, then you accept anything that might happen because of that.
deleted 3y ago
[deleted]
crazygringo 3y ago
Change of ownership is easily gamed though. The change can be hidden or the extension can be "leased for 99 years" or whatever. It really makes me wonder if there's a way to formalize a system of verification, trust, vouching, etc. not just for extensions but for source-viewable software in general, version by version, diff by diff. Volunteers actually inspect an extension's JavaScript to check for anything potentially malicious (is it reporting on user activity etc.), they vouch for each other, and you select some core single individual or group to trust (or majority-vote or something), and then only allow software on your system that is vouched for. Nothing ever gets upgraded until it passes.
- woodruffw 3y ago
  These types of problems roughly map onto the distributed identity problem: there's no known way to distribute `K` authority identities to `M` trusting identities without some kind of trusted intermediate. "Vouching" can form that kind of trusted intermediate, but probably not without grinding an ordinary speedy update process to a near halt. That's probably a worse outcome than just having the pre-existing authority (i.e., Mozilla or Google) establish an enforceable policy around what constitutes an acceptable (or acceptably transparent) update.
chaxor 3y ago
This problem is more far reaching than just extension, and further reaching than what entity is in charge of something. For instance, the worst company imaginable may be in charge of software that was once FOSS, and they may change absolutely nothing about it, so it should be fine. However, if a small update is added that does something bad, you should know about it immediately. The solution seems to be much more clearly in the realm of things like crev: https://github.com/crev-dev/cargo-crev/ https://github.com/crev-dev/cargo-crev/ Wherein users can get a clear picture of what dependencies are used in the full chain, and how they have been independently reviewed for security and privacy. That's the real solution for the future. A quick score that is available upon display everytime you upgrade, with large warnings for anything above a certain threshold.
mozman 3y ago
The real problem is with browser extension permission models. It should have far less privileges.
- marcthe12 3y ago
  Technically that is what chrome MV3 is. The issue with that is they also heavily restricted any kind of content blocker by removing most APIs with a declarative api
  - ThunderSizzle 3y ago
    The permissions granted should be more granular and controlled by the user, not less granular and controlled by Google. MV3 is the reason I switched back hesitantly to Firefox.
npteljes 3y ago
I mean, I have been the user of my body for some time and things just stop working as they used to. Change just happens, you need to be on top of it, to not miss things like this. This isn't going to have a technological solution.
TheRealPomax 3y ago
This is why you have the power to turn off auto-updates on anything that has auto-updates. And you should exercise that power. That way you'll wake up to the news of a horrible change, not the reality of already being part of it.
leke 3y ago
Just went to the extension page. A couple of interesting things I noticed. 1. There is a "Write a review" button, but you cannot leave a review. 2. There is no owner listed on the extension page. Only the text "Featured", and some kind of rosette certificate badge. https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...
5350-uiop-1130 3y ago
I can't recall the last time a software update had a noticeable improvement for me but many cases where it made things worse. So I just refuse and skip all updates, but yeah that's not an option with extensions afaik.
nextlevelwizard 3y ago
Whole extension business is very shady. I have couple extensions I've made. Most have couple hundred weekly users, but one has few thousand and I have gotten emails about adding ad and search redirect code for some money. If I was in bad financial situation or just didn't care, I could have just added the code without anyone really knowing.

treffer 3y ago

Except.... Companies regularly switch their legal entities around. Which can be annoying. So you might wake up one day seeing ownership was transfered from <X> to <X>. Still, it could be not disclosing it in such cases and live with it in a gray zone.

tekno45 3y ago

cause: late-stage capitalism

JohnFen 3y ago

This isn't just a problem with extensions, though. It's a problem with everything. Always has been and always will be. This is why people should be extremely cautious about becoming too attached to (or, worse, dependent on) any particular product or service. It can change ownership (and therefore policies) at any time.

sneak 3y ago
This is why people should be extremely cautious against self-modifying software (ie unattended autoupdate) - it grants remote code execution on your computer to remote parties.
throwaway292939 3y ago
At the risk of pointing out the obvious, this is mostly referring to Internet enabled goods and services. As other commenters have pointed out, it doesn't apply as much to actual physical products. So this leads to reason, should any of this be accepted as the norm?
anonymousab 3y ago
It's another prime example of why users should be wary of always choosing automatic software updates, and particularly wary of any company that uses security and "we know what's best for our dumb users" as an excuse for trying to stop users from using only a manual update process.
- willcipriano 3y ago
  Ben Franklin on automatic updates: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
  - sockaddr 3y ago
    This quote never made sense to me. My decision to prefer one of these over the other doesn't mean I don't deserve either. It's a decision I make with my own unique economic and threat parameters. Being "deserving" plays no role here.
    - qohen 3y ago
      The quote actually meant something rather different than people think and has been taken out of context. Here's a discussion about it[0]. First, here's the TL;DR: SIEGEL: So far from being a pro-privacy quotation, if anything, it's a pro-taxation and pro-defense spending quotation. WITTES: It is a quotation that defends the authority of a legislature to govern in the interests of collective security. It means, in context, not quite the opposite of what it's almost always quoted as saying but much closer to the opposite than to the thing that people think it means. And here's the detail, discussed just before the TL;DR (I put in some paragraph breaks): SIEGEL: And what was the context of this remark? WITTES: He was writing about a tax dispute between the Pennsylvania General Assembly and the family of the Penns, the proprietary family of the Pennsylvania colony who ruled it from afar. And the legislature was trying to tax the Penn family lands to pay for frontier defense during the French and Indian War. And the Penn family kept instructing the governor to veto. Franklin felt that this was a great affront to the ability of the legislature to govern. And so he actually meant purchase a little temporary safety very literally. The Penn family was trying to give a lump sum of money in exchange for the General Assembly's acknowledging that it did not have the authority to tax it. [0] https://www.npr.org/2015/03/02/390245038/ben-franklins-famous-liberty-safety-quote-lost-its-context-in-21st-century https://www.npr.org/2015/03/02/390245038/ben-franklins-famou...
nazgulsenpai 3y ago
Case in point -- I mortgaged my home with a local bank then without me knowing or being asked I became a Wells Fargo customer. At least you can uninstall the extensions :)
- JohnFen 3y ago
  I strongly believe that selling ongoing loans to other companies should just be flat out illegal. You entered into a contract with your local bank, not Wells Fargo. It should not be legal any party in the contract to unilaterally rope the others into a contractual relationship with someone who was not involved.
  - ceejayoz 3y ago
    I certainly don't remember all the terms of my mortgage, but surely there's a "we can resell your mortgage" provision in the terms that we bilaterally agreed to.
    - pixl97 3y ago
      If you don't have the ability to strike that clause is it really bilateral?
      - ceejayoz 3y ago
        You are under no obligation to sign. They are under no obligation to accept a modified contract. Both sides can walk away. Both sides will be bummed, but the bank is likely to care a lot less.
        CatWChainsaw 3y ago
        These kind of libertarian explanations always conveniently neglect to mention any power imbalances between the parties. When called on it the response is usually just a less polite version of "oh well".
  - 3y ago
fhd2 3y ago
I think it's a particular problems with extensions because: 1. They usually mostly work in the background, don't need much interaction. It's almost like a built-in browser feature changing owners. 2. They are pretty difficult to find a business model for - as opposed to SaaS stuff and mobile apps, which people pay for rather commonly. So the choice is to a) Make no money b) Ask for donations (seems to only work if it's somewhat obnoxious) c) Make money in some creative (often shady) way d) Sell the thing.
HWR_14 3y ago
That's a different issue. I can still run many old versions of software even if new versions are put out by some evil entity I no longer trust. Unless the software auto-updates. In which case I no longer have the old version. AFAIK, it is not easy (or maybe not possible) to opt out of extensions updates.
jxramos 3y ago
I was thinking about this is the food and personal products space. I dreamed up something like requiring some kind of notation to denote how many steps you are away from a parent company. Direct private companies with no parent would have no notation, once a parent company buys the company and its brands put a dot for every parent company above the company of the product you're now purchasing. Something to make this transfer visible.
- jxramos 3y ago
  come to think of it this would hide transfers between similar ranking networks where companies swapped things out.
  - joveian 3y ago
    I think the thing to do there is to require that the controlling owner of the brand be mentioned in non-tiny print near the most prominent mention of the brand.
    - account42 3y ago
      Better yet, make it so each independent company only gets one trademark and companies owned by another get none. The entire purpose of trademarks is to protect consumers. Being able to use them to mislead consumers is the opposite of that.
asdff 3y ago
This is why tools are always better than products or services. Your hammer in the drawer isn't going to one day update itself and change. Neither is some of the bash tooling that's been around for decades. And should these things change, you always have your old versions of these tools in your drawers and storage drives.
woodruffw 3y ago
I agree. I also don't think this is something that's formally solvable in the general case, at least not in a way that's practical for distracted and non-technical users. Instead, this is the kind of thing that needs to be solved on the policy level: Google and Mozilla have an interest in maintaining high-quality extension ecosystems, and ought to take a dim view of these kinds of ownership transfers.
wongarsu 3y ago
This wasn't a big problem with software just 20 years ago. Sure, the software you used could be bought by someone else, but that just meant you might choose not to get the next version. Software didn't automatically update, and licenses were eternal and mostly tied to physical tokens, like a disk or a fancy sticker. At some point your beloved software might become obsolete, but that was because it was outpaced in improvements by other better software, not because yours got any worse.
- askvictor 3y ago
  But the barriers to releasing and distributing software were much higher, as you had to work out to get it to people, and incremental release were basically impossible. So software was controlled by a handful of big companies.
  - JohnFen 3y ago
    > So software was controlled by a handful of big companies. Not really, no. The software space was much, much richer and you could get along extremely well without using much software from the big guys.
  - ipaddr 3y ago
    The industry had more smaller players compared to today and a better chance to sell. The barriers were higher but expectations lower. Plus you had a fragmentation of computers and high margins. Trade shows and flea markets, magazines, shareware and asking store owners directly were accessible ways. Today we have the illusion of speaking globally but have been gatekept out by a handful of companies.
- JohnFen 3y ago
  And, to be honest, it doesn't even really have to be a problem now. I use almost entirely FSF or Open Source software. Of the proprietary software I use, it's still software that I have an installable copy of and I'll be able to keep using it for as long as I have a machine that can run it. I don't do automatic updates and actively prevent that from happening. Automatic updates are a plague that means you can't rely on the software anymore, if for no other reason than an update may (and likely will, eventually) remove or otherwise bork the very aspect that made it valuable to you. But I'm a weirdo and take care to ensure that I actually own and control the software I use. I see people getting burned because they're at the mercy of a company all too often.
msla 3y ago
This is much less of a problem with open source software, although, admittedly, not completely unknown.
grishka 3y ago
The problem is with automatic updates.
rlpb 3y ago
It's not a problem with everything. Distributions tend to add editorial input here and try to do something they consider reasonable for their users, staking their own reputation on that without trying to pass it off to the component publisher. For example, I doubt that Debian would would take an update from an upstream that is detrimental to their users. They would follow a friendlier fork first. Debian maintainers follow their users' interests first. (I'm a Debian Developer) Edit: and that means you can generally trust automatic updates on Debian.
- account42 3y ago
  This is why the push towards application sandboxing and distribution by the developers themselvs is IMO misguided. I'd much rather have my applications run unrestricted but vetted and if neccessary patched by a trusted third party (the distro) than lock whatever dark patters and anti-features developers come up with into a box ... where it still has access to all interactions with that box. In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro.
  - rlpb 3y ago
    > In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro. But in the case of something like Firefox, distros are barely vetting anything, and are reluctant to patch because such patching rapidly becomes unmaintainable. Most dependencies don't end up unbundled, either. So distribution Firefox packages are really external packages in distribution package clothing, more so than any other package, really. This is why I want sandboxing anyway - because I understand the limits of what is practical. And sandboxing and limiting interaction through well-defined interfaces is better for security anyway, because security vulnerabilities happen regardless, and sandboxing does provide some level of mitigation. Finally, the distribution packaging model is insufficient for many users. Even if you are fine with it, most users want something newer than their distribution release, and we can see that they are prepared to give up security and system stability for it. This is a real need for these users, and sandboxed third party packaging mechanisms provide a real solution for them, even if you can manage without.
hedora 3y ago
As a corollary, any private information that a publicly owned company has is for sale (since the company could be bought or merge), and any information any company has can be force-sold during bankruptcy proceedings. Any time a company has physical access to your data, and says they will not sell it, they are lying (unless it is privately held, and never takes on debt / pays after delivery). In particular, EULAs and other contracts do not protect your information in the above situations, since debt and shareholder obligations generally come before customer obligations, and the data is considered an asset.
leke 3y ago
I'm beginning to think Richard Stallman was correct about everything.

bastardoperator 3y ago

Everything about this is sad. Sad that I have to install an extension to get rid of stupid messages forced upon me just for visiting a website, sad that an untrusted company is trying to buy trust, sad that users have to waste time switching away.

deleted 3y ago

[deleted]

londons_explore 3y ago

> If an extension fails to disclose a change in ownership, They would just change ownership and keep that a secret from the world. Avast would 'hire' the dev of this extension, and provide him with more engineers and ideas of features to implement.

that_guy_iain 3y ago

This can also happen with any SaaS and many services. They get bought and sold quite a lot.

ChrisMarshallNY 3y ago

That's also an issue with app stores. I have received a few solicitations to sell apps that had not been updated in a while (they were still good, but hadn't required an update). I suspect the buyer would repackage the app with some "extra spices," either advertising, or malware, and would count on the auto-update to force it onto users' devices. I declined. I remove moribund apps. I've written over 20 but only have a few on the store.

tectonic 3y ago

A decade ago I wrote an extension called SelectorGadget (https://selectorgadget.com/ https://selectorgadget.com/). It's effectively unmaintained, but it still works and people still use it. I make no money from it and never have. Every few months someone tries to buy it from me, and I ignore them because I don't want to f** over my users. But there are a lot of extensions out there and maybe their owners care less, or find themselves in a moment of financial hardship and they sell.

bombcar 3y ago
Apparently this is a known and open “business” to buy up used but old addons and convert them to advertising malware. Good on you!

2h 3y ago

Firefox: 1. Open application menu 2. Add-ons 3. Extensions 4. click gear 5. uncheck Update add-ons automatically

bombcar 3y ago
I wish you could indicate some addons to update automatically, but after six months of no update that addon switches to manual.
woodruffw 3y ago
I know how to disable automatic updates. The point was that there's a substantial shift in trust when the underlying identity that controls an extension changes.
- 2h 3y ago
  > I know how to disable automatic updates doesn't seem like it: > I can be a passive user of an excellent extension for years, and wake up one morning to discover that my browser has (silently!) upgraded the extension you want to roll the dice with automatic updates, you have only yourself to blame when they break something you care about. people always scream BUT MUH SECURITY, and at the same time ignore every other awful change that is rammed through automatic updates. pick your poison.
  - woodruffw 3y ago
    Please read charitably. I don’t want to “roll the dice.” There is a significant difference in user model between trusting a single identity to provide updates automatically, and naively trusting updates that come from a new identity. In the context of web extensions, not auto-updating is frequently not an option: web extensions are part of an arms race between users and websites, with the extensions continually playing catch-up.
    - 2h 3y ago
      it is an option. just because you might find one choice extremely distasteful, doesn't mean the option ceases to exist. so I will say again, pick your poison. you opt in, or fail to opt out of automatic updates, then you accept anything that might happen because of that.

deleted 3y ago

[deleted]

crazygringo 3y ago

Change of ownership is easily gamed though. The change can be hidden or the extension can be "leased for 99 years" or whatever. It really makes me wonder if there's a way to formalize a system of verification, trust, vouching, etc. not just for extensions but for source-viewable software in general, version by version, diff by diff. Volunteers actually inspect an extension's JavaScript to check for anything potentially malicious (is it reporting on user activity etc.), they vouch for each other, and you select some core single individual or group to trust (or majority-vote or something), and then only allow software on your system that is vouched for. Nothing ever gets upgraded until it passes.

woodruffw 3y ago
These types of problems roughly map onto the distributed identity problem: there's no known way to distribute `K` authority identities to `M` trusting identities without some kind of trusted intermediate. "Vouching" can form that kind of trusted intermediate, but probably not without grinding an ordinary speedy update process to a near halt. That's probably a worse outcome than just having the pre-existing authority (i.e., Mozilla or Google) establish an enforceable policy around what constitutes an acceptable (or acceptably transparent) update.

chaxor 3y ago

This problem is more far reaching than just extension, and further reaching than what entity is in charge of something. For instance, the worst company imaginable may be in charge of software that was once FOSS, and they may change absolutely nothing about it, so it should be fine. However, if a small update is added that does something bad, you should know about it immediately. The solution seems to be much more clearly in the realm of things like crev: https://github.com/crev-dev/cargo-crev/ https://github.com/crev-dev/cargo-crev/ Wherein users can get a clear picture of what dependencies are used in the full chain, and how they have been independently reviewed for security and privacy. That's the real solution for the future. A quick score that is available upon display everytime you upgrade, with large warnings for anything above a certain threshold.

mozman 3y ago

The real problem is with browser extension permission models. It should have far less privileges.

marcthe12 3y ago
Technically that is what chrome MV3 is. The issue with that is they also heavily restricted any kind of content blocker by removing most APIs with a declarative api
- ThunderSizzle 3y ago
  The permissions granted should be more granular and controlled by the user, not less granular and controlled by Google. MV3 is the reason I switched back hesitantly to Firefox.

npteljes 3y ago

I mean, I have been the user of my body for some time and things just stop working as they used to. Change just happens, you need to be on top of it, to not miss things like this. This isn't going to have a technological solution.

TheRealPomax 3y ago

This is why you have the power to turn off auto-updates on anything that has auto-updates. And you should exercise that power. That way you'll wake up to the news of a horrible change, not the reality of already being part of it.

leke 3y ago

Just went to the extension page. A couple of interesting things I noticed. 1. There is a "Write a review" button, but you cannot leave a review. 2. There is no owner listed on the extension page. Only the text "Featured", and some kind of rosette certificate badge. https://chrome.google.com/webstore/detail/i-dont-care-about-cookies/fihnjjcciajhdojfnbdddfaoknhalnja https://chrome.google.com/webstore/detail/i-dont-care-about-...

5350-uiop-1130 3y ago

I can't recall the last time a software update had a noticeable improvement for me but many cases where it made things worse. So I just refuse and skip all updates, but yeah that's not an option with extensions afaik.

nextlevelwizard 3y ago

Whole extension business is very shady. I have couple extensions I've made. Most have couple hundred weekly users, but one has few thousand and I have gotten emails about adding ad and search redirect code for some money. If I was in bad financial situation or just didn't care, I could have just added the code without anyone really knowing.