23 ms·

Temptations of an open-source Chrome extension developer (2021)

1123 points by hk__2 3y ago

amadeuspagel 3y ago
The root problem here is that there's no legitimate way to monetize browser extensions. Extensions are meant to be simple, so it's hard to sell premium features. Extensions usually don't "own" any space to embed ads in.
- 6DM 3y ago
  I think the only way is to treat access like we do web apps, then enable/disable features accordingly. That's kinda lame because now you have to have a backend setup, just so you can charge for some features.
  - Chabsff 3y ago
    The issue with that is that "Gets to read and/or write the DOM" happens to be the only permissions a nefarious extension needs while also being those that a vast number of useful extensions require.
    - 6DM 3y ago
      I think you're thinking from the browser level. I was thinking from the standpoint of what I could do as an extension developer. If we approach it from that angle, then your extension can only restrict access to it's features via a round trip to your own servers to validate access and/or show a checkout view to purchase access.
    - jcparkyn 3y ago
      That's why it'd be nice to have a general "access the internet" permission, since DOM reads are usually harmless if they can't get any data back.
      - danShumway 3y ago
        I suspect it would be a very hard permission to implement. There are a lot of ways to exfiltrate data from a website if you have DOM access. But yeah, agreed. Some of the difficulty around securing extensions boils down to the fact that Javascript permissions could be better. Websites do a decent job of sandboxing the website, but sandboxing within websites (without relying on iframes) is much more difficult. Per-site permissions and click-to-activate are also really useful features here. It's easy to forget how recent they are. But it would be good to go further if possible and having barriers in front of exfiltration would be a big part of that -- there are many browser permissions that would become less dangerous if you could know for sure that the data they generate can't get off your device. I just think it would be really difficult to try and build browser permissions around that in a user-legible way.
- sorokod 3y ago
  Do you believe that if there was a way to monetize extentions devs would not be approached by data thives?
  - 6DM 3y ago
    Not sure if sarcasm but will respond as if it's not. There are lots of business models to choose from - subscription - affiliate links - sponsors - one time charge, this one is tricky as restricting access requires a back-end that needs ongoing maintenance and server costs [edit: formatting, spelling]
    - sorokod 3y ago
      It is not clear what problem you are solving. Extension devs know the rules of the game up front and have no expectation of profit.
      - 6DM 3y ago
        I may have misunderstood your prior comment so please excuse me if I got it wrong. The problem I was solving was how to make money from an extension that I publish. I was outlining different business models where you could give the user access to the extension, and make money without having to accept this arrangement with data thieves.
        sorokod 3y ago
        I don't see this as problem that needs to be solved. It is freeware from the start. It's wonderful that people are willing to share their knowledge and time for free - why not let it be the way it is?
        bavarianbob 3y ago
        I believe problem isn't the right word. I think OP is challenging your assumption that it's inherently freeware. There are methods for monetizing an extension and they're infrequently used or associated with a much larger experience (e.g. my BitWarden extension is critical for using BitWarden, but I pay for BitWarden's subscription elsewhere).
- burkaman 3y ago
  An extension user could theoretically be willing to pay for the value the extension provides them. The malicious actors sending these emails are willing to pay for the value that a user's data provides them. These two numbers are not related in any way, and the value of user data will often be much higher than the value of the extension's functionality. There is no way for monetization to solve this, because the two potential customers are not purchasing the same product.
  - hot_gril 3y ago
    Yeah. We've already seen user data win over paid software in other spaces. Someone charitable or just not-so-bad has to buy it out instead.
- brucethemoose2 3y ago
  The root problem is that extensions are such a good platform for ads/tracking. If monetization was better, it would just end up like Google Play, with adtech spam crowding out the "legitimately" monetized apps. Dracionian restrictions on web access (like requiring a prompt whenever an extension wants to upload/download data) might help a little.
- butz 3y ago
  Google could easily find a way to display ads for all extensions: pre-roll ads before extension launches, mid-roll ads when user is using extension for some period of time; not sure what is stopping them.
- jaredsohn 3y ago
  There used to be. https://developer.chrome.com/docs/webstore/money/ https://developer.chrome.com/docs/webstore/money/ "The web has come a long way in the 11 years since we launched the Chrome Web Store. Back then, we wanted to provide a way for developers to monetize their Web Store items. But in the years since, the ecosystem has grown and developers now have many payment-handling options available to them."
  - arcticfox 3y ago
    Another failed Google product...of course every company has huge back catalogs of deprecated products but the sheer % of fails by Google is almost unbelievable.
  - lapcat 3y ago
    This is the reason I removed my extension from the Chrome Web Store.
  - grubbyboy 3y ago
    Just want to put a plug in for https://extensionpay.com/ https://extensionpay.com/ - I've used it in extensions in the past. It takes away the headache of setting up a backend for payment. They do take an extra 5%, but it's worth it especially. for smaller projects
- ezekg 3y ago
  I don't think this is necessarily true. I run a software licensing API with quite a handful of customers running browser extensions with respectable user bases. So there are monetization opportunities, just like any other distribution channel.
- jshier 3y ago
  You can easily monetize Safari extensions by selling them through the App Store.
  - lapcat 3y ago
    I wouldn't say "easily", but you can.
- hot_gril 3y ago
  Might at least make these attacks harder if users could disable extension updates, or had to opt into them. Most of these extensions are simple and don't really need to be updated, yet the update mechanism is silent full auto bada bing bada boom no rollbacks. I can't think of any updates more aggressive, not even Steam.
  - danShumway 3y ago
    Yet another opportunity to recommend Firefox to readers. I'm not sure I advise doing it, but you can go to about:addons and hit the gear icon and you can uncheck "Update Addons Automatically". Even better, click on an extension and under the "details" tab there's an option per-addon to set whether you want automatic updates or not, so you can disable updates just for the one addon you don't trust (or enable updates just for the one addon you do trust). Also, want to run older version of an extension? The Mozilla Addons page for each extension has a list of every release and you can download each version independently as a signed XPI file if you want to sideload it. The big thing I wish Mozilla would add is self-compiled releases like F-Droid does, especially since their ill-advised signing process means it's hard for users to compile an extension from source -- it's way too easy for a submitted extension to deviate from its source code. But that (admittedly large) issue aside, Firefox offers a lot of control for users who want to manage their own extension versions. Forced automatic updates are a Chrome problem.
    - hot_gril 3y ago
      Yeah, that's very nice. The only reason I'm even aware of how Chrome does it is because we're forced to use Chrome at work. We're allowed to use some vetted internal extensions with it, and I do, but someone pushed an update that broke an extension by accident. Then I was like, why is this a thing.
    - variadix 3y ago
      Thanks for mentioning this
danjc 3y ago
Unbelievable how persistent redacted were over the years.
- tomjen3 3y ago
  Oh, it didn't occour to me before but you could have so much for naming your child redacted.
- kojiromike 3y ago
  "And how do you spell your name, sir?" "It's lowercase-italics 'r', lowercase-italics 'e', lowercase-italics 'd', lowercase-italics 'a', lowercase-italics 'c', lowercase-italics 't', lowercase-italics 'e', lowercase-italics 'd'" "Ha, ha, your name is 'redacted'?" "No"
gochi 3y ago
To see this many aggressive offers over an extension with ~300k users, it makes you wonder how intense the offers are for the likes that reach in the millions. The incentives seem entirely misaligned in the extension space.
headline 3y ago
Hell I have gotten offers like this on a Discord bot, even. Wherever user data can be found, there are those who'd like to have their finger on the pulse
odensc 3y ago
Can confirm. A couple years ago, I had a Chrome extension with ~100k users; I was receiving these types of emails every week. One of them straight up offered $10k, whether that was a real offer or not I don't know because I never replied to any of them. I've since taken down the extension as I'm no longer maintaining it, but weirdly I still get these emails, albeit less frequently.
- dieulot 3y ago
  I had a legit $13k offer for 180k users recently (even though it looked super shady, and the result for end-users would probably have been gross).
deleted 3y ago
[deleted]
mfrisbie 3y ago
ChatGPT for Google was #1 on HN earlier this year. Check out the GitHub repo now: that person sold the extension. I had a small side project extension, ~25,000 installs & free to use. I got enough inbound interest trying to "help me monetize" that I thought it would be worth cataloguing all the different unsavory avenues: https://mattfrisbie.substack.com/p/the-ugly-business-of-monetizing-browser https://mattfrisbie.substack.com/p/the-ugly-business-of-mone...
- ericd 3y ago
  The most galling offer we saw on the mobile app side was something that would turn on the user's microphone, and listen for ads on tvs around them to track what they'd been exposed to offline. Adtech is such a thoroughly gross field.
  - uhtred 3y ago
    so this really does happen then? Because I used to be convinced it wasn't a coincidence when I saw ads online for some niche uncommon topic I had recently talked out loud about.
    - gregschlom 3y ago
      This matches the audio signature of the TV ad - basically, it's like Shazam, but for TV ads. It's currently not economically possible to listen to user's conversations, transcribe them to text, and serve ads based on that. It would cost orders of magnitude more in processing power than you could get from the extra sales. This might change in the future, of course
      - jabradoodle 3y ago
        Wouldn't cost that much if the transcribing is done on device
        camdat 3y ago
kotaKat 3y ago
I have an extension I wrote that is literally for a single regional website to do some extra blocking to get around a paywall. There are under 10 installs total. For some reason, the most recent monetization email I got thought it was 10,000. > I'm reaching out to discuss a unique monetization opportunity for your extension, <name>, through our exclusive Premium Bing Hosted Product. > I'm thrilled to let you know that this invitation-only product offers the chance to earn as much as $500 per month for every 1000 users. Given that your extension has a user base of 10K, you stand to make up to $5000 monthly just by integrating the search functionality into your extension. This could be a significant source of passive income, and I truly believe it's an opportunity you won't want to pass up. I... I... I know the 10 installs are all basically /my devices/...
- hamburglar 3y ago
  You should counter by offering to sell them the whole thing for a flat price and then have all your users (you) switch to a new extension that does the same thing under a new name. :)
  - tysam_and 3y ago
    Okay, even better, to follow on another user's idea and up the ante: Fake extensions created under burner dev accounts (w/ fake identities), astroturf the installs like crazy. Use ChatGPT to write the code, pump it out like chocolate out of Willy Wonka's Fudge Sludgefest. Sell to scammers/info scalpers for a flat fee via a non-refundable route under a semi-reputable escrow, rinse and repeat. The one downside is if you do that to somebody bad, and you've left any personal info out by accident.... Additionally, it's highly unethical. Don't do this. But it seems like 'easy money', the whole 'curse of maybe getting doxxed and XYZ from a sufficiently-motivated data thief' aside.
- ConorSheehan1 3y ago
  I got this too! For an extension that doesn't even work anymore after manifest v3
- quickthrower2 3y ago
sergiotapia 3y ago
Hard to turn down $20k/month for doing basically nothing. Props to the author.
- riskable 3y ago
  This assumes the offer is legit. I seriously doubt even the most nefarious extension nonsense is actually going to bring in $20k/month. Even if there's millions of users.
  - plorkyeran 3y ago
    Yeah, I've received plenty of similar offers over the years and I'd have been a lot more tempted if I actually believed any of the numbers.
  - ajross 3y ago
    That's exactly it. The "extension monetization" field is a product area fundamentally designed to scam its users. Clearly they're not going to shy away from scamming their suppliers. They just need to fool the authors into giving them control before taking payment, then they move on to the next mark.
- p1mrx 3y ago
  It's only $20k/month if (1) their number is truthful, and (2) Google doesn't ban your extension for serving malware.
- extesy 3y ago
  It wouldn't be a long-term income anyways. Most likely Google would block the extension within weeks. So it's more like $20k total, not per month.
- quickthrower2 3y ago
  That is nothing. I turned down the opportunity to inherit a Saudi Prince’s fortune for doing nothing (well just needed to pay his sons bail bond or something)
deleted 3y ago
[deleted]
sdflhasjd 3y ago
And if you run a website you get constant emails like this: Hey There, I wanted to reach out and see if <website.com> accepts guest post contributions or link insertion in existing posts? If so, I'd love to hear more about your guidelines and any specific topics of interest. Thank you for your time, and I'm looking forward to your response. Best Regards, These ones are definitely spammed out en-masse, my site doesn't even have a blog. My site also has some Windows software downloads on it, and I occasionally get emails for bundling dodgy installers. Most of these tend to be "residential proxy" services looking to sell access to users' internet connections.
- mschuster91 3y ago
  > My site also has some Windows software downloads on it, and I occasionally get emails for bundling dodgy installers. Most of these tend to be "residential proxy" services looking to sell access to users' internet connections. I wonder what these people are thinking? Like, TOR operators know the risks with connection sharing - most particularly: pedos using their service to share CSAM. But everyday people?! They have no idea until one day they get v&.
  - kccqzy 3y ago
    Prey on users who don't know the difference. Sell the residential proxy service to scammers who use high-reputation residential IPs to commit crime or fraud or other shady things.
  - bornfreddy 3y ago
    I think these services are used mainly for scraping sites which try to hide their data (think LinkedIn). They don't offer any protection to those that are breaking the law, afaik. So I would expect that there isn't much risk of putting their victims ("endpoints") in trouble with the law. Not condoning it of course, it is still an ugly practice.
    - sdflhasjd 3y ago
      I've read through some of Brian Krebs' articles on some of these proxies, the ones I get these email offers from seem a little less slimy than that and more above board like you say. It's still not an acceptible thing to be seeling your users out to though.
jsnell 3y ago
I wonder whether there exists a cottage industry of fake extension writers pumping up their numbers with fake installs, all with the goal to sell the fake extensions to these scammers.
- Buttons840 3y ago
  You make the extension. I'll use bots to inflate the stats and make it look used. You pretend to not notice and sell-out. We split the profits. Fraud as easy as 1-2-3.
- hot_gril 3y ago
  I also wonder how they make these sales. Is there an escrow for this? Are Chrome extension transfers non-reversible? Can't imagine such a shady deal is safe for either party.
david422 3y ago
If you put something out on the web that gets somewhat popular, you are going to get all sorts of scummy people contacting you. The first one that happened to me: I have a domain name and someone emailed me to let me know, as a courtesy, that someone was buying similar Chinese domain names and did I want to get them first. I thought that was nice that they were notifying me ... oh wait, they're just trying to get me to buy their domain names. People contact me about redesigning my website, buying my website, exchanging links, straight up spamming my website. It's really strange.
- aembleton 3y ago
  Android apps too. Always getting offers to have some code added.
- quickthrower2 3y ago
  I used to reply, with the same offer “i can help complete YOUR set”
ZephyrBlu 3y ago
This one is interesting because it seems harmless, if not even helpful (Monitoring DNS errors). What am I missing here? "I’m sure you get business proposals all the time, so I’ll get straight to the point. I hope what I’m proposing is a little different and might actually interest you. I like Hover Zoom+ as a great alternative to it’s bigger brother Hover Zoom that lost its glamour over the last couple of months. We're conducting a DNS error research and we’re interested in small amounts of anonymous data that you might be able to provide via your Chrome extension. Our research has been going on for years and Google has never had the slightest problem with it. - Compatible with Google’s strict policies - No personal user data - No ads, no malware The data we’re interested in are basically just DNS errors: - NXD – Non Existent Domain - the domain that a user entered that resulted in a DNS error. - A time stamp – when it happened. - GEO – where it happened (USA, UK, RU etc.). - A unique randomly generated user ID (can be hashed, not traceable back to the user). Please, don’t confuse this with the user IP address. And that’s all. You can either use our script or collect the data on your own and send it to us via an FTP server, API etc. There’s a lot of different ways we can do this. We pay on a monthly basis. The payments depend on user GEOs, but it would be in thousands of dollars per year. Is this worth at least a brief discussion? Looking forward to hearing from you. A while back I reached out to you regarding a DNS error research our company conducts. Hover Zoom+ would be an ideal medium for our research. In return, this could become a solid new revenue stream for you. Our method has been going on for years and we’ve never had the slightest problem with Google. We pay regularly on a monthly basis. For you it would be in tens of thousands of dollars per year - the amount depends on your users base and data quality. If you’re concerned about including third party scripts, there’s still a lot of ways we can make this work. Please let me know if this is worth a brief discussion to you."
- threecoins 3y ago
  Typo squatting research. See what users frequently mistype and receive NX reply so that they can register it and serve ads or do phishing or such.
- js2 3y ago
  Probably looking for domains that are commonly typo'd that they can purchase and run ads on.
fancy_pantser 3y ago
I have had this exact experience for years now, which I described previously on HN: https://news.ycombinator.com/item?id=25848333 https://news.ycombinator.com/item?id=25848333 Some good discussion in that thread too :)
donatj 3y ago
Oh, hey! I just got my first one of those for my extension a couple days ago. I just marked it as spam and moved on with my life. Shameless self promotion - Open source chrome tab search way more powerful than the newish built in search (supports quotes, negative searches, things like host:example.com, etc). https://chrome.google.com/webstore/detail/tabasco/apnefdpgaignkblccanndkelkjabjgjh https://chrome.google.com/webstore/detail/tabasco/apnefdpgai...
butz 3y ago
Nuking all extensions that use any of the listed "monetization platforms" would make Chrome extension store a safer place for everyone.
- theandrewbailey 3y ago
  They will just rename everything and operate under a new shell company. Then everything will be back to the status quo.
  - butz 3y ago
    Google could launch a honeypot extension to get offers from those new companies and keep removing offending extensions.
thallavajhula 3y ago
This is so true. I receive these emails every week. I've even had offers about acquisition that I had to turn down. Having a "Featured" chrome extension does seem to attract a lot of these offers. The more emails/offers I receive, the more I'm convinced that I shouldn't give up the extension. For those curious, here's the GitHub repo of my extension: https://github.com/mohnish/rearrange-tabs https://github.com/mohnish/rearrange-tabs
rplatimer 3y ago
I built an extension called Repibox that pulls the recipe out of any website that has instructions/ingredients in the meta data and displays it immediately. First time I got an acquisition email was exciting, but then I realized any acquisition would do a disservice to my friends/family who use my extension.
collaborative 3y ago
I don't know what the solution to this is, but I know a few trusted/legitimate companies that sell their user data for around £20/year even after having monetized their users with actual money I will never do this because violating privacy goes against the core of my beliefs, but there is a conflict I can't seem to work out. On the one hand, I KNOW that the vast majority of users prefer to sell their privacy than pay a single penny. They would gladly click on a "sell my data" over a "pay money" button any day of the week. I know this because I have interacted with enough users to know these things. Many users will suffer a fit when things are not free but won't lose any sleep over giving away their personal details. Again, I speak of the majority and in general terms On the other hand, I want the internet to be a place where unscroupulous actors don't flourish. Most people don't expect to get things for free in the real world, why should the internet be any different? Why does everyone (myself included) always look for free stuff on the internet? The worst bit of it all is that in the end, the only people interested in spending money online are data thieves and advertisers. Everyone else is giving their soul. Developers are somehow expected to work for free so that this entire edifice can stand
- yukIttEft 3y ago
  Name the companies!
- thwarted 3y ago
  The Internet has no easy to use fully-anonymous cash equivalent. If you pay for something, you're giving away your identity information anyway. The value exchange is definitely lopsided, but if I have to share my identity AND pay to get X, I'm out money AND shared my identity info. If I share my identity info and get X for free, at least I'm not out the money.
  - jlnho 3y ago
    Can you hear that? It's the sound of a distant crypto-bro stampede coming your way!
  - kmeisthax 3y ago
    Extensions are centrally distributed on platforms that could at least nominally handle payment. The problem is that $0.01 is infinitely more expensive than free. In order for me to pay you, I at a minimum have to do some amount of mental gymnastics to convince myself that it's worth it for me to pay you. This has a perceived cost even if the money spent is trivial. This is why people who take money in small increments - i.e. mobile games, arcade operators, casinos, and so on[0] have you buy a large amount of some scrip that they control, and then make it so easy to spend it that you might accidentally do so. Nobody is thinking "I'd buy this, but only if I can leave no record of ownership[1]", they're thinking, "is it actually worth buying". Identity and privacy isn't a thing that people actually account for when making purchases - mostly because it's never actually mentioned[2] in the terms of purchase. It's snuck in. So the choice is just "the free one" and "the $2 one", where the value of the $2 extension can never hope to overcome the mental transaction costs. [0] Nintendo and Microsoft used to do this around the Wii and 360 eras. While on the Wii it was 1 point equals 1 penny/yen, Xbox did something nasty and made it 80 points equals 1 dollar. [1] That would mean that setting up a new computer or browser profile loses you all your existing extensions that you paid for. [2] I do not consider legal disclaimers to be adequate notice, and neither should you. Dropping a clause in a EULA is the equivalent of dropping rohypnol in your drink.
GeekyBear 3y ago
Things have gotten bad enough that I've stopped using extensions that haven't been through a code vetting process. > Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-... If your browser doesn't have a code vetting process for extensions, I'm not interested in your browser.
- c7DJTLrn 3y ago
  What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily malicious code could slip through. I'm surprised there hasn't been a mass cookie stealing attack yet.
  - GeekyBear 3y ago
    > What does that mean in reality? It means taking malware seriously, even if that means you have to pay human beings to vet code manually. I realize that Google wants to avoid paying human beings at all costs, but too bad.
  - sfink 3y ago
    That's why AMO requires extensions to be uploaded with their source code and disallows obfuscation. They do allow minification for compression, and I don't know what stops someone from uploading different source code from the shipped addon.
  - kevingadd 3y ago
    CWS doesn't review every extension submission, at best they do some % of them along with anything that sets off red flags. Out of hundreds of times I pushed updates to my extension (~100k monthly users by the end) it was delayed for human review maybe... twice?
deleted 3y ago
[deleted]
shadowgovt 3y ago
Stuff like this is why Google is pushing manifest v3.
- mthoms 3y ago
  How does manifest v3 combat this?
  - shadowgovt 3y ago
    Without the additional constraints manifest v3 puts on what code an extension can run at runtime, an extension author can just slip some "grab some code from a server I control and eval it" logic into their extension, which Google can't vet. That makes it possible for an extension that was fine yesterday go to "harvesting your PII to send to a company that is building an AI based on your click frequency" today with no change indicated; just a silent "Oops I'm malicious now" shift. All cards on the table: Google does a not-great job of protecting against intentional malicious changes last I checked, i.e. they'll pass through a lot of new extensions and extension updates that do shady stuff behind the scenes. But without some lockdown on arbitrary code execution (which Mv3 provides), the problem is theoretically impossible to solve.
    - bensecure 3y ago
      Detect if the extension downloads and executes arbitrary code, and ban it if it does. That should be just as easy to detect as detecting that the code does something bad directly. In fact, the way extension policing works is (afaik) completely reactive: if someone reports that an extension is doing something bad, then the extension/the developer thereof is banned. No/minimal policing is done at the time of publishing. The exact same policy applies unchanged to extensions that download malicious code instead of packaging it directly: wait until someone complains about the malicious code, ban the extension for having malicious code.
      - shadowgovt 3y ago
        In manifest v2, downloading and executing arbitrary code is a feature. What you're describing is the migration path from v2 to v3. "Detect if the extension downloads and executes arbitrary code, and ban it if it does" is isomorphic to "deprecate the eval arbitrary code permission, cease supporting it in the store, and provide an alternative declarative model to get some of the behavior back;" it's what Google is trying to do.
s-xyz 3y ago
I don’t see the harm of monetizing something great. You could also say that its a way to reward the good work.
- Meta4245 3y ago
  This is data collection, not monetization
  - Dulat_Akan 3y ago
    good work keep going
extesy 3y ago
Maintainer here. My extension is pretty much unmonetizable so any offer I receive would require some degree of a moral sacrifice. The least intrusive offer I've seen so far is to put a reciprocal link to somebody else's extension inside of mine, kind of like DarkReader is doing on their website. Even though it won't compromise any of my users data, the reason I'm not doing this is because it indirectly endorses that other extension and I don't control what they do with their users data.
- justsid 3y ago
  I really appreciate the transparency from you. I don't use Chrome anymore, but back in the day I absolutely loved Hover Zoom+ and my wife is still loving it to this day. It's a great extension and having read your comment and the linked Github issue, I feel even better about it. Thanks for your hard work.
  - extesy 3y ago
    Thank you for the kind words. I actually publish hoverzoom+ to Firefox and Edge as well (links are in the repo's readme) so you can use it there too.
    - justsid 3y ago
      Wow! This just made my day, thanks so much. I don’t know why I never bothered to check if there was a Firefox version. Thank you!
- imoreno 3y ago
  You're doing a very admirable thing, and this helps dispel the little voiced but commonly held perception that "everybody sells out" when they get big.
  - btown 3y ago
    uBlock Origin is also an incredible success story here!
cal85 3y ago
FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash offers from shady people who presumably want to steal everyone’s data or worse. I sometimes wish I had never put my name on it so I could just take the money without harming my reputation, but I did, so I’m stuck with being honourable. On the plus side I will always be able to say that I never sold out. [0] https://chrome.google.com/webstore/detail/json-formatter/bcjindcccaagfpapjjmafapmmgkkhgoa https://chrome.google.com/webstore/detail/json-formatter/bcj... [1] low effort tbh
- Y_Y 3y ago
  What size cash offers? Not that I want some of it, but then I do think there could be an industry re-scamming these people and want to know how much we're talking about.
  - cal85 3y ago
    Convincing offers to buy it for $10-40K. One offer said $250K but I doubt that one was serious, more likely just a straight up scam. I have often emailed them back feigning interest to see if I can get them to state what they plan to do with it, since I cannot see anything that could possibly be ethical, but they always just start talking mumbo jumbo about their innovative monetisation strategy. Recently I’ve had a serious sounding offer to inject an ad, i.e. a one-off ad would open in a new tab when the extension updates, for $3K a pop, which I just ignored, then he emailed again saying $4K, then just yesterday he emailed again with a bunch of emoji and said what about $8K. It’s tempting, but it would still be selling out my users, who may be ungrateful little brats but I could never do that to them, I value their approval too much.
    - Y_Y 3y ago
      Thank you very much for the very informative response. As with any offer I think it's crucial to know what's at stake. You're very admirable for turning down tens of thousands, but if it had been tens of millions I'd have been questioning your judgement, as morally odious as the buyer might be. See also: https://news.ycombinator.com/item?id=14808881 https://news.ycombinator.com/item?id=14808881
jjcm 3y ago
Of all of these, I appreciated the one from 05/11/2016 the most. It felt the least shady because they were very up front with the scope and the data collected (which was narrowly focused), and left the implementation up to the developer (along with an optional script they could use). They also provided several options for sending the data, just to guarantee that the extension couldn't be compromised by their code. This one stood out from the rest for me. Curious though if I'm missing some way that this could be used for nefarious purposes though. Full text of the proposal below: ------ I’m sure you get business proposals all the time, so I’ll get straight to the point. I hope what I’m proposing is a little different and might actually interest you. I like Hover Zoom+ as a great alternative to it’s bigger brother Hover Zoom that lost its glamour over the last couple of months. We're conducting a DNS error research and we’re interested in small amounts of anonymous data that you might be able to provide via your Chrome extension. Our research has been going on for years and Google has never had the slightest problem with it. Compatible with Google’s strict policies No personal user data No ads, no malware The data we’re interested in are basically just DNS errors: NXD – Non Existent Domain - the domain that a user entered that resulted in a DNS error. A time stamp – when it happened. GEO – where it happened (USA, UK, RU etc.). A unique randomly generated user ID (can be hashed, not traceable back to the user). Please, don’t confuse this with the user IP address. And that’s all. You can either use our script or collect the data on your own and send it to us via an FTP server, API etc. There’s a lot of different ways we can do this. We pay on a monthly basis. The payments depend on user GEOs, but it would be in thousands of dollars per year. Is this worth at least a brief discussion? Looking forward to hearing from you. A while back I reached out to you regarding a DNS error research our company conducts. Hover Zoom+ would be an ideal medium for our research. In return, this could become a solid new revenue stream for you. Our method has been going on for years and we’ve never had the slightest problem with Google. We pay regularly on a monthly basis. For you it would be in tens of thousands of dollars per year - the amount depends on your users base and data quality. If you’re concerned about including third party scripts, there’s still a lot of ways we can make this work. Please let me know if this is worth a brief discussion to you.
- bensecure 3y ago
  non existent domains are the ones that are most likely to be somehow personal to the user, because they weren't trying to enter a domain at all but it got interpreted as one accidentally. Eg a password they meant to type into a password field but the url bar was highlighted. If they were interested in statistics regarding popular domains, like google or facebook, then it would actually be less of a privacy intrusion, because it would only end up telling you about populations, not individual users. I don't know what they actually intended to use this data for, but its telling that they don't mention that in their proposal.
hot_gril 3y ago
This reminds me of a dirty plan I had as a kid in middle school. 1. Make a legitimately useful Minecraft Bukkit plugin. 2. Wait for lots of installs. 3. Add a well-hidden backdoor that makes me "op" (admin) on any server I choose. 4. Surprise some mean op on a public server by suddenly banning him. I got through step 2 then decided to stop there.
- Tijdreiziger 3y ago
  Targeted Minecraft server backdoors do happen every now and then.
- doix 3y ago
  Minecraft Bukkit plugins are basically the wildwest. It's really hard to tell if something is intentional or not. I remember many years ago trying to find a motd (message of the day) plugin that would just display a message when you joined the server. I found one that was simple enough, but it would ping home to check if there were any updates as well. Now it could have been just the developer trying to add a useful feature, but the cynic in me believes it's so that they could get IP addresses of the servers running the plugin. It also had a debug command that wasn't authenticated that let you print the contents of any motd file in a folder. Except it didn't escape strings properly, so you could `../...` to escape out of that directory and print any file. I have no idea if the author actually exploited this, or if they were a naive 14 year old writing their first plugin. If they were trying to exploit, I don't know which file they were going to print the contents of, but it definitely made me very suspicious.
  - hot_gril 3y ago
    > It also had a debug command that wasn't authenticated that let you print the contents of any motd file in a folder. Except it didn't escape strings properly, so you could `../...` to escape out of that directory and print any file. That's hilarious and showcases how un-sandboxed those plugins are.
- kmeisthax 3y ago
  2b2t got backdoored several times this way. Several people had access to WorldEdit, creative mode, admin commands, etc. Beyond ancient anarchy servers, right now the Minecraft mod community has been dealing with several supply chain attacks, deserialization vulnerabilities, and so on.
jdthedisciple 3y ago
What's wrong with selling data if it's truly anonymized?
- extesy 3y ago
  It would require collecting this data in the first place. Since it's not related to the primary functionality of the extension, it would require me to declare it in the privacy policy and extension stores. Probably needs additional access permissions as well. It's much easier to just not collect anything at all.
- xboxnolifes 3y ago
  If it was up-front and clear in scope and intent, I would have much fewer problems with it. But, I don't think I've ever some across software that clearly and explicit listed the scope of what will be tracked (and how), clearly stated that it was intended to be sold, and gathered clear and explicit consent from the user.
- ptx 3y ago
  It will inevitably turn out later, when the data has already leaked, that due to an unfortunate oversight or bug or misconfiguration it wasn't truly anonymized after all.
imoreno 3y ago
>Monetizing anonymous user data is happening on almost every website we visit - you may be leaving alot of money on the table by not monetizing your anonymous user data. Try dowloading Ghostry to see for yourself. Some people have no shame at all. It's like the caricature of the Devil from a Sunday Morning cartoon, offering you riches and power untold for the low, low price of your soul. Like dude, how do you know what Ghostery is and don't get why people use it?
latchkey 3y ago
If you do anything with web3 crypto or even money, always use different browser profiles. The profiles that you use for Metamask, don't install any extensions into those beyond MM.
- quickthrower2 3y ago
  Extensions that you activate when needed on a per tab basis would be good. Also treat it as an opt in on a per site basis
NelsonMinar 3y ago
So much sleaze with extensions, it's nice to see it documented. Have to be honest the name "HoverZoom" was spoiled for me because it was one of the first fraud extensions I was a victim of. Nice to see this open source fork with an author concerned about the problem. These days I pretty much only install open source extensions. Ironically I was using Imagus, just switched to HoverZoom+ thanks to this post.
- sphars 3y ago
  I too was a heavy user of imagus, until it stopped receiving updates and the owner went silent. I know there's a subreddit with some people picking it back up, but I've moved on to HZ+ now. And it's for reasons like the maintainer of HZ+ standing up morally being one of the reasons.
- mickelsen 3y ago
  I discovered Imagus yesterday thanks to another thread in here about extensions, and today I read this.
iza 3y ago
Yep, I've been getting these emails since 2014, around 200 in total. My extension has had between 30,000 and 100,000 active users. They often quote up to $500 a month per 1000 users, which sounds too good to be true.
huksley 3y ago
…«The WHOLE WORLD (WW) is monetized.»…
jallasprit 3y ago
I found it interesting to see ChatGPT being used on the later requests.
karaterobot 3y ago
This is terrifying. I'm glad the developer of Hover Zoom+ is both ethical and has a backbone. He demures, but I know that having a decent job has not kept other people from taking the money when presented with similar offers. I see that he's in this thread, so: hats off to you. What I'd like to know is, how many different entities are represented in this compilation? Since everything is redacted, it's not easy to tell. I was surprised that there are so many offers by, seemingly, so many different scumbags. I mean people.
kmeisthax 3y ago
Ruffle's official e-mail inbox is chock full of these. The sums of money being offered for a free and Free extension are so high that I can only assume the buyers are looking to load it up with whatever malware won't immediately get it banned by Google or Mozilla[0]. My personal opinion is that you shouldn't be allowed to transfer an extension between owners without prior approval and vetting of the new ownership structure. This should deliberately be harder than just setting up a new extension, because new listings won't have reviews or trust associated with it. I'm saying this as the person who occasionally gets caught on the business end of some of these policies[1] and knows how much of a pain it is to navigate bureaucracy. The underground extension sales marketplace is incredibly sketchy and plays fast and loose with user trust. [0] Joke's on them, our AMO listing is already flagged for machine-generated code (because we use Rust/WASM), so our extension submissions only get approved if Mozilla is able to reproduce our builds byte-for-byte. [1] https://ruffle.rs/blog/2023/04/23/mozilla-extension-postmortem.html https://ruffle.rs/blog/2023/04/23/mozilla-extension-postmort...
karlzt 3y ago
This submission comes from this comment 23 hours ago: https://news.ycombinator.com/item?id=37056613 https://news.ycombinator.com/item?id=37056613
mickelsen 3y ago
Keeping track of which extension goes rogue or what eventually breaks if not maintained gets really tiring. After dealing with this so many times, some strategies have stuck: 0. Prefer extensions that work locally, no data sent out anywhere. 1. Keep an extension audit profile, meant for testing them a bit. 2. Use different extensions for my main daily driver profile, shopping comparison profile, etc. 2. The audit profile also has bookmarks of the extensions I'm using and others for later review, or looking back, helps me declutter the main profile a bit. 3. Use https://chrome-stats.com/ https://chrome-stats.com/ to check the extensions' pedigree, they have a trust meter based on the amount of permissions asked, how long has the developer been around, etc. 4. Do your own review on what goes out with developer tools on requests, especially if the extension needs permission to a control domain. Many will tell you in the Privacy Policy that they don't collect anything PERSONAL, but need to process your data somehow, and from an initial look you can't really tell it's a service or the extension itself doing it. Lack of clear wording is key here. 5. Some mask the control domain using a subdomain of a cloud platform to host the app, so it looks more trustable, and tell they only send telemetry data there. 6. Prefer stuff that's also on github, but don't trust blindly: some developers have just posted a boilerplate hello world there. Two related anecdotes: 1. The Glarity extension (AI GPT autocomplete stuff) is open source, you can find it on github too, it explicitly said it worked only with your OpenAI API key only, yet when installing it, it just worked and I was getting GPT-powered summaries. They have their own service, where they relay all your input, but there is no documentation of it anywhere. I didn't double check if those requests stopped once you added your own API key. That was months ago, now just checked before posting, still no news from them on that functionality. While I can ascribe this to just general sloppiness, there've been some repos with serious accusations of stolen keys (lencx/nofwl) 2. I've had login data leaked with a shopping extension, where Chrome alerted me and disabled it. That was in 2021. It was pulled from the store. Months later I start getting login notifications in my email to some websites I use with my 'shopping/price compare' profile. They were attempts from Russia. The websites alerted to my email yet let session go through, since I don't use 2fa. It seems they were scanning for some saved credit card or something.
acarabott 3y ago
Another extension creator here, I've been getting more and more of these emails recently. I just checked, and my extension [1] now has a "Featured" badge, which I guess explains this uptick. No intention of "monetizing" as there is no non-shady way to monetize this feature. I perhaps don't maintain it as much as I could (sorry Windows and Linux users), but on the upside it is so little work that I'm never tempted. [1] https://chrome.google.com/webstore/detail/tab-to-windowpopup-keyboa/adbkphmimfcaeonicpmamfddbbnphikh https://chrome.google.com/webstore/detail/tab-to-windowpopup...
deleted 3y ago
[deleted]
Method5440 3y ago
I really like Hover Zoom+. I’d be willing to pay $7,000 to $8,500 USD for each kidney you’d be willing to sell. Once we know the size/functioning we can determine exact figures. Happy to buy both if you no longer need them, you probably barely use them anyway.
dieulot 3y ago
The catch with those enticing monthly offers (versus selling the extension) is that you are taking the risk to get your extension taken down, while the offerors can at any time switch to another partner/victim. Blog post from an ex-Chrome extension DevRel: https://dotproto.com/2023/06/06/a-warning-about.html https://dotproto.com/2023/06/06/a-warning-about.html
popol12 3y ago
Wow, thanks for sharing, I’d never have guessed the harassment level was this high It’s pretty concerning, does someone here know an extension that would block or signal other extension’s misbehavior? Any chances ublock does it already ?
MrPatan 3y ago
Extensions are too risky
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
uwagar 3y ago
redacted is such a capitalist pig.
seru 3y ago
Glad to see the precommitments here. Archive link to improve credibility of such since HN comments can be edited - I see multiple others in the past day as well: https://web.archive.org/web/20230810111519/https://news.ycombinator.com/item?id=37066680 https://web.archive.org/web/20230810111519/https://news.ycom...
delfinom 3y ago
(2021) in the title is not needed since the author has been keeping it up to date ;)
cactusplant7374 3y ago
How much money could they have made?
no_wizard 3y ago
There was a rumor I heard on some forums awhile back that at one point, ad tech companies wanted to kill uBlock Origin so bad that they were willing to offer a few million dollars to take it over, and gorhill stood tall. If this is true (and its a huge if, again, I heard it in the context of a rumor), just makes them more of a stand up developer!
unhammer 3y ago
Not that one should have to, but for Firefox you can cd .mozilla/firefox/$profile git init git add extensions git commit -am init echo '*.xpi diff=zip' >>.gitattributes echo '[diff "zip"]' >>.git/config echo ' textconv = unzip -c -a' >>.git/config which at least lets you take a peek at what kind of nefarious updates you're getting.
waynesonfire 3y ago
this is why we can't have nice things.
WhyNotHugo 3y ago
Extremely relevant: https://news.ycombinator.com/item?id=37052508 https://news.ycombinator.com/item?id=37052508 A rather popular app for macOS got purchased by some shady company and they updated it to include a botnet SDK. I'm guessing a lot of the potential buyers here have similar intents.
dougseismic 3y ago
If anyone's around here and isn't adverse to actually being paid for developing extensions in a non-shitty way, I built https://github.com/dougwithseismic/monetize-this https://github.com/dougwithseismic/monetize-this and use it in my own extensions. I get that it's noble to hold a position of 'no way, I will never monetize, I am a shining white knight' but lets be real, we all gotta eat. If you choose not to then that's great, Im glad but please; monetization !== shady shit. There's just an overlap.

1123 points by hk__2 3y ago

The root problem here is that there's no legitimate way to monetize browser extensions. Extensions are meant to be simple, so it's hard to sell premium features. Extensions usually don't "own" any space to embed ads in.

6DM 3y ago
I think the only way is to treat access like we do web apps, then enable/disable features accordingly. That's kinda lame because now you have to have a backend setup, just so you can charge for some features.
- Chabsff 3y ago
  The issue with that is that "Gets to read and/or write the DOM" happens to be the only permissions a nefarious extension needs while also being those that a vast number of useful extensions require.
  - 6DM 3y ago
    I think you're thinking from the browser level. I was thinking from the standpoint of what I could do as an extension developer. If we approach it from that angle, then your extension can only restrict access to it's features via a round trip to your own servers to validate access and/or show a checkout view to purchase access.
  - jcparkyn 3y ago
    That's why it'd be nice to have a general "access the internet" permission, since DOM reads are usually harmless if they can't get any data back.
    - danShumway 3y ago
      I suspect it would be a very hard permission to implement. There are a lot of ways to exfiltrate data from a website if you have DOM access. But yeah, agreed. Some of the difficulty around securing extensions boils down to the fact that Javascript permissions could be better. Websites do a decent job of sandboxing the website, but sandboxing within websites (without relying on iframes) is much more difficult. Per-site permissions and click-to-activate are also really useful features here. It's easy to forget how recent they are. But it would be good to go further if possible and having barriers in front of exfiltration would be a big part of that -- there are many browser permissions that would become less dangerous if you could know for sure that the data they generate can't get off your device. I just think it would be really difficult to try and build browser permissions around that in a user-legible way.
sorokod 3y ago
Do you believe that if there was a way to monetize extentions devs would not be approached by data thives?
- 6DM 3y ago
  Not sure if sarcasm but will respond as if it's not. There are lots of business models to choose from - subscription - affiliate links - sponsors - one time charge, this one is tricky as restricting access requires a back-end that needs ongoing maintenance and server costs [edit: formatting, spelling]
  - sorokod 3y ago
    It is not clear what problem you are solving. Extension devs know the rules of the game up front and have no expectation of profit.
    - 6DM 3y ago
      I may have misunderstood your prior comment so please excuse me if I got it wrong. The problem I was solving was how to make money from an extension that I publish. I was outlining different business models where you could give the user access to the extension, and make money without having to accept this arrangement with data thieves.
      - sorokod 3y ago
        I don't see this as problem that needs to be solved. It is freeware from the start. It's wonderful that people are willing to share their knowledge and time for free - why not let it be the way it is?
        bavarianbob 3y ago
        I believe problem isn't the right word. I think OP is challenging your assumption that it's inherently freeware. There are methods for monetizing an extension and they're infrequently used or associated with a much larger experience (e.g. my BitWarden extension is critical for using BitWarden, but I pay for BitWarden's subscription elsewhere).
burkaman 3y ago
An extension user could theoretically be willing to pay for the value the extension provides them. The malicious actors sending these emails are willing to pay for the value that a user's data provides them. These two numbers are not related in any way, and the value of user data will often be much higher than the value of the extension's functionality. There is no way for monetization to solve this, because the two potential customers are not purchasing the same product.
- hot_gril 3y ago
  Yeah. We've already seen user data win over paid software in other spaces. Someone charitable or just not-so-bad has to buy it out instead.
brucethemoose2 3y ago
The root problem is that extensions are such a good platform for ads/tracking. If monetization was better, it would just end up like Google Play, with adtech spam crowding out the "legitimately" monetized apps. Dracionian restrictions on web access (like requiring a prompt whenever an extension wants to upload/download data) might help a little.
butz 3y ago
Google could easily find a way to display ads for all extensions: pre-roll ads before extension launches, mid-roll ads when user is using extension for some period of time; not sure what is stopping them.
jaredsohn 3y ago
There used to be. https://developer.chrome.com/docs/webstore/money/ https://developer.chrome.com/docs/webstore/money/ "The web has come a long way in the 11 years since we launched the Chrome Web Store. Back then, we wanted to provide a way for developers to monetize their Web Store items. But in the years since, the ecosystem has grown and developers now have many payment-handling options available to them."
- arcticfox 3y ago
  Another failed Google product...of course every company has huge back catalogs of deprecated products but the sheer % of fails by Google is almost unbelievable.
- lapcat 3y ago
  This is the reason I removed my extension from the Chrome Web Store.
- grubbyboy 3y ago
  Just want to put a plug in for https://extensionpay.com/ https://extensionpay.com/ - I've used it in extensions in the past. It takes away the headache of setting up a backend for payment. They do take an extra 5%, but it's worth it especially. for smaller projects
ezekg 3y ago
I don't think this is necessarily true. I run a software licensing API with quite a handful of customers running browser extensions with respectable user bases. So there are monetization opportunities, just like any other distribution channel.
jshier 3y ago
You can easily monetize Safari extensions by selling them through the App Store.
- lapcat 3y ago
  I wouldn't say "easily", but you can.
hot_gril 3y ago
Might at least make these attacks harder if users could disable extension updates, or had to opt into them. Most of these extensions are simple and don't really need to be updated, yet the update mechanism is silent full auto bada bing bada boom no rollbacks. I can't think of any updates more aggressive, not even Steam.
- danShumway 3y ago
  Yet another opportunity to recommend Firefox to readers. I'm not sure I advise doing it, but you can go to about:addons and hit the gear icon and you can uncheck "Update Addons Automatically". Even better, click on an extension and under the "details" tab there's an option per-addon to set whether you want automatic updates or not, so you can disable updates just for the one addon you don't trust (or enable updates just for the one addon you do trust). Also, want to run older version of an extension? The Mozilla Addons page for each extension has a list of every release and you can download each version independently as a signed XPI file if you want to sideload it. The big thing I wish Mozilla would add is self-compiled releases like F-Droid does, especially since their ill-advised signing process means it's hard for users to compile an extension from source -- it's way too easy for a submitted extension to deviate from its source code. But that (admittedly large) issue aside, Firefox offers a lot of control for users who want to manage their own extension versions. Forced automatic updates are a Chrome problem.
  - hot_gril 3y ago
    Yeah, that's very nice. The only reason I'm even aware of how Chrome does it is because we're forced to use Chrome at work. We're allowed to use some vetted internal extensions with it, and I do, but someone pushed an update that broke an extension by accident. Then I was like, why is this a thing.
  - variadix 3y ago
    Thanks for mentioning this

danjc 3y ago

Unbelievable how persistent redacted were over the years.

tomjen3 3y ago
Oh, it didn't occour to me before but you could have so much for naming your child redacted.
kojiromike 3y ago
"And how do you spell your name, sir?" "It's lowercase-italics 'r', lowercase-italics 'e', lowercase-italics 'd', lowercase-italics 'a', lowercase-italics 'c', lowercase-italics 't', lowercase-italics 'e', lowercase-italics 'd'" "Ha, ha, your name is 'redacted'?" "No"

gochi 3y ago

To see this many aggressive offers over an extension with ~300k users, it makes you wonder how intense the offers are for the likes that reach in the millions. The incentives seem entirely misaligned in the extension space.

headline 3y ago

Hell I have gotten offers like this on a Discord bot, even. Wherever user data can be found, there are those who'd like to have their finger on the pulse

odensc 3y ago

Can confirm. A couple years ago, I had a Chrome extension with ~100k users; I was receiving these types of emails every week. One of them straight up offered $10k, whether that was a real offer or not I don't know because I never replied to any of them. I've since taken down the extension as I'm no longer maintaining it, but weirdly I still get these emails, albeit less frequently.

dieulot 3y ago
I had a legit $13k offer for 180k users recently (even though it looked super shady, and the result for end-users would probably have been gross).

deleted 3y ago

[deleted]

mfrisbie 3y ago

ChatGPT for Google was #1 on HN earlier this year. Check out the GitHub repo now: that person sold the extension. I had a small side project extension, ~25,000 installs & free to use. I got enough inbound interest trying to "help me monetize" that I thought it would be worth cataloguing all the different unsavory avenues: https://mattfrisbie.substack.com/p/the-ugly-business-of-monetizing-browser https://mattfrisbie.substack.com/p/the-ugly-business-of-mone...

ericd 3y ago
The most galling offer we saw on the mobile app side was something that would turn on the user's microphone, and listen for ads on tvs around them to track what they'd been exposed to offline. Adtech is such a thoroughly gross field.
- uhtred 3y ago
  so this really does happen then? Because I used to be convinced it wasn't a coincidence when I saw ads online for some niche uncommon topic I had recently talked out loud about.
  - gregschlom 3y ago
    This matches the audio signature of the TV ad - basically, it's like Shazam, but for TV ads. It's currently not economically possible to listen to user's conversations, transcribe them to text, and serve ads based on that. It would cost orders of magnitude more in processing power than you could get from the extra sales. This might change in the future, of course
    - jabradoodle 3y ago
      Wouldn't cost that much if the transcribing is done on device
      - camdat 3y ago

kotaKat 3y ago

I have an extension I wrote that is literally for a single regional website to do some extra blocking to get around a paywall. There are under 10 installs total. For some reason, the most recent monetization email I got thought it was 10,000. > I'm reaching out to discuss a unique monetization opportunity for your extension, <name>, through our exclusive Premium Bing Hosted Product. > I'm thrilled to let you know that this invitation-only product offers the chance to earn as much as $500 per month for every 1000 users. Given that your extension has a user base of 10K, you stand to make up to $5000 monthly just by integrating the search functionality into your extension. This could be a significant source of passive income, and I truly believe it's an opportunity you won't want to pass up. I... I... I know the 10 installs are all basically /my devices/...

hamburglar 3y ago
You should counter by offering to sell them the whole thing for a flat price and then have all your users (you) switch to a new extension that does the same thing under a new name. :)
- tysam_and 3y ago
  Okay, even better, to follow on another user's idea and up the ante: Fake extensions created under burner dev accounts (w/ fake identities), astroturf the installs like crazy. Use ChatGPT to write the code, pump it out like chocolate out of Willy Wonka's Fudge Sludgefest. Sell to scammers/info scalpers for a flat fee via a non-refundable route under a semi-reputable escrow, rinse and repeat. The one downside is if you do that to somebody bad, and you've left any personal info out by accident.... Additionally, it's highly unethical. Don't do this. But it seems like 'easy money', the whole 'curse of maybe getting doxxed and XYZ from a sufficiently-motivated data thief' aside.
ConorSheehan1 3y ago
I got this too! For an extension that doesn't even work anymore after manifest v3
quickthrower2 3y ago

sergiotapia 3y ago

Hard to turn down $20k/month for doing basically nothing. Props to the author.

riskable 3y ago
This assumes the offer is legit. I seriously doubt even the most nefarious extension nonsense is actually going to bring in $20k/month. Even if there's millions of users.
- plorkyeran 3y ago
  Yeah, I've received plenty of similar offers over the years and I'd have been a lot more tempted if I actually believed any of the numbers.
- ajross 3y ago
  That's exactly it. The "extension monetization" field is a product area fundamentally designed to scam its users. Clearly they're not going to shy away from scamming their suppliers. They just need to fool the authors into giving them control before taking payment, then they move on to the next mark.
p1mrx 3y ago
It's only $20k/month if (1) their number is truthful, and (2) Google doesn't ban your extension for serving malware.
extesy 3y ago
It wouldn't be a long-term income anyways. Most likely Google would block the extension within weeks. So it's more like $20k total, not per month.
quickthrower2 3y ago
That is nothing. I turned down the opportunity to inherit a Saudi Prince’s fortune for doing nothing (well just needed to pay his sons bail bond or something)

deleted 3y ago

[deleted]

sdflhasjd 3y ago

And if you run a website you get constant emails like this: Hey There, I wanted to reach out and see if <website.com> accepts guest post contributions or link insertion in existing posts? If so, I'd love to hear more about your guidelines and any specific topics of interest. Thank you for your time, and I'm looking forward to your response. Best Regards, These ones are definitely spammed out en-masse, my site doesn't even have a blog. My site also has some Windows software downloads on it, and I occasionally get emails for bundling dodgy installers. Most of these tend to be "residential proxy" services looking to sell access to users' internet connections.

mschuster91 3y ago
> My site also has some Windows software downloads on it, and I occasionally get emails for bundling dodgy installers. Most of these tend to be "residential proxy" services looking to sell access to users' internet connections. I wonder what these people are thinking? Like, TOR operators know the risks with connection sharing - most particularly: pedos using their service to share CSAM. But everyday people?! They have no idea until one day they get v&.
- kccqzy 3y ago
  Prey on users who don't know the difference. Sell the residential proxy service to scammers who use high-reputation residential IPs to commit crime or fraud or other shady things.
- bornfreddy 3y ago
  I think these services are used mainly for scraping sites which try to hide their data (think LinkedIn). They don't offer any protection to those that are breaking the law, afaik. So I would expect that there isn't much risk of putting their victims ("endpoints") in trouble with the law. Not condoning it of course, it is still an ugly practice.
  - sdflhasjd 3y ago
    I've read through some of Brian Krebs' articles on some of these proxies, the ones I get these email offers from seem a little less slimy than that and more above board like you say. It's still not an acceptible thing to be seeling your users out to though.

jsnell 3y ago

I wonder whether there exists a cottage industry of fake extension writers pumping up their numbers with fake installs, all with the goal to sell the fake extensions to these scammers.

Buttons840 3y ago
You make the extension. I'll use bots to inflate the stats and make it look used. You pretend to not notice and sell-out. We split the profits. Fraud as easy as 1-2-3.
hot_gril 3y ago
I also wonder how they make these sales. Is there an escrow for this? Are Chrome extension transfers non-reversible? Can't imagine such a shady deal is safe for either party.

david422 3y ago

If you put something out on the web that gets somewhat popular, you are going to get all sorts of scummy people contacting you. The first one that happened to me: I have a domain name and someone emailed me to let me know, as a courtesy, that someone was buying similar Chinese domain names and did I want to get them first. I thought that was nice that they were notifying me ... oh wait, they're just trying to get me to buy their domain names. People contact me about redesigning my website, buying my website, exchanging links, straight up spamming my website. It's really strange.

aembleton 3y ago
Android apps too. Always getting offers to have some code added.
quickthrower2 3y ago
I used to reply, with the same offer “i can help complete YOUR set”

ZephyrBlu 3y ago

This one is interesting because it seems harmless, if not even helpful (Monitoring DNS errors). What am I missing here? "I’m sure you get business proposals all the time, so I’ll get straight to the point. I hope what I’m proposing is a little different and might actually interest you. I like Hover Zoom+ as a great alternative to it’s bigger brother Hover Zoom that lost its glamour over the last couple of months. We're conducting a DNS error research and we’re interested in small amounts of anonymous data that you might be able to provide via your Chrome extension. Our research has been going on for years and Google has never had the slightest problem with it. - Compatible with Google’s strict policies - No personal user data - No ads, no malware The data we’re interested in are basically just DNS errors: - NXD – Non Existent Domain - the domain that a user entered that resulted in a DNS error. - A time stamp – when it happened. - GEO – where it happened (USA, UK, RU etc.). - A unique randomly generated user ID (can be hashed, not traceable back to the user). Please, don’t confuse this with the user IP address. And that’s all. You can either use our script or collect the data on your own and send it to us via an FTP server, API etc. There’s a lot of different ways we can do this. We pay on a monthly basis. The payments depend on user GEOs, but it would be in thousands of dollars per year. Is this worth at least a brief discussion? Looking forward to hearing from you. A while back I reached out to you regarding a DNS error research our company conducts. Hover Zoom+ would be an ideal medium for our research. In return, this could become a solid new revenue stream for you. Our method has been going on for years and we’ve never had the slightest problem with Google. We pay regularly on a monthly basis. For you it would be in tens of thousands of dollars per year - the amount depends on your users base and data quality. If you’re concerned about including third party scripts, there’s still a lot of ways we can make this work. Please let me know if this is worth a brief discussion to you."

threecoins 3y ago
Typo squatting research. See what users frequently mistype and receive NX reply so that they can register it and serve ads or do phishing or such.
js2 3y ago
Probably looking for domains that are commonly typo'd that they can purchase and run ads on.

fancy_pantser 3y ago

I have had this exact experience for years now, which I described previously on HN: https://news.ycombinator.com/item?id=25848333 https://news.ycombinator.com/item?id=25848333 Some good discussion in that thread too :)

donatj 3y ago

Oh, hey! I just got my first one of those for my extension a couple days ago. I just marked it as spam and moved on with my life. Shameless self promotion - Open source chrome tab search way more powerful than the newish built in search (supports quotes, negative searches, things like host:example.com, etc). https://chrome.google.com/webstore/detail/tabasco/apnefdpgaignkblccanndkelkjabjgjh https://chrome.google.com/webstore/detail/tabasco/apnefdpgai...

butz 3y ago

Nuking all extensions that use any of the listed "monetization platforms" would make Chrome extension store a safer place for everyone.

theandrewbailey 3y ago
They will just rename everything and operate under a new shell company. Then everything will be back to the status quo.
- butz 3y ago
  Google could launch a honeypot extension to get offers from those new companies and keep removing offending extensions.

thallavajhula 3y ago

This is so true. I receive these emails every week. I've even had offers about acquisition that I had to turn down. Having a "Featured" chrome extension does seem to attract a lot of these offers. The more emails/offers I receive, the more I'm convinced that I shouldn't give up the extension. For those curious, here's the GitHub repo of my extension: https://github.com/mohnish/rearrange-tabs https://github.com/mohnish/rearrange-tabs

rplatimer 3y ago

I built an extension called Repibox that pulls the recipe out of any website that has instructions/ingredients in the meta data and displays it immediately. First time I got an acquisition email was exciting, but then I realized any acquisition would do a disservice to my friends/family who use my extension.

collaborative 3y ago

I don't know what the solution to this is, but I know a few trusted/legitimate companies that sell their user data for around £20/year even after having monetized their users with actual money I will never do this because violating privacy goes against the core of my beliefs, but there is a conflict I can't seem to work out. On the one hand, I KNOW that the vast majority of users prefer to sell their privacy than pay a single penny. They would gladly click on a "sell my data" over a "pay money" button any day of the week. I know this because I have interacted with enough users to know these things. Many users will suffer a fit when things are not free but won't lose any sleep over giving away their personal details. Again, I speak of the majority and in general terms On the other hand, I want the internet to be a place where unscroupulous actors don't flourish. Most people don't expect to get things for free in the real world, why should the internet be any different? Why does everyone (myself included) always look for free stuff on the internet? The worst bit of it all is that in the end, the only people interested in spending money online are data thieves and advertisers. Everyone else is giving their soul. Developers are somehow expected to work for free so that this entire edifice can stand

yukIttEft 3y ago
Name the companies!
thwarted 3y ago
The Internet has no easy to use fully-anonymous cash equivalent. If you pay for something, you're giving away your identity information anyway. The value exchange is definitely lopsided, but if I have to share my identity AND pay to get X, I'm out money AND shared my identity info. If I share my identity info and get X for free, at least I'm not out the money.
- jlnho 3y ago
  Can you hear that? It's the sound of a distant crypto-bro stampede coming your way!
- kmeisthax 3y ago
  Extensions are centrally distributed on platforms that could at least nominally handle payment. The problem is that $0.01 is infinitely more expensive than free. In order for me to pay you, I at a minimum have to do some amount of mental gymnastics to convince myself that it's worth it for me to pay you. This has a perceived cost even if the money spent is trivial. This is why people who take money in small increments - i.e. mobile games, arcade operators, casinos, and so on[0] have you buy a large amount of some scrip that they control, and then make it so easy to spend it that you might accidentally do so. Nobody is thinking "I'd buy this, but only if I can leave no record of ownership[1]", they're thinking, "is it actually worth buying". Identity and privacy isn't a thing that people actually account for when making purchases - mostly because it's never actually mentioned[2] in the terms of purchase. It's snuck in. So the choice is just "the free one" and "the $2 one", where the value of the $2 extension can never hope to overcome the mental transaction costs. [0] Nintendo and Microsoft used to do this around the Wii and 360 eras. While on the Wii it was 1 point equals 1 penny/yen, Xbox did something nasty and made it 80 points equals 1 dollar. [1] That would mean that setting up a new computer or browser profile loses you all your existing extensions that you paid for. [2] I do not consider legal disclaimers to be adequate notice, and neither should you. Dropping a clause in a EULA is the equivalent of dropping rohypnol in your drink.

GeekyBear 3y ago

Things have gotten bad enough that I've stopped using extensions that haven't been through a code vetting process. > Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-... If your browser doesn't have a code vetting process for extensions, I'm not interested in your browser.

c7DJTLrn 3y ago
What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily malicious code could slip through. I'm surprised there hasn't been a mass cookie stealing attack yet.
- GeekyBear 3y ago
  > What does that mean in reality? It means taking malware seriously, even if that means you have to pay human beings to vet code manually. I realize that Google wants to avoid paying human beings at all costs, but too bad.
- sfink 3y ago
  That's why AMO requires extensions to be uploaded with their source code and disallows obfuscation. They do allow minification for compression, and I don't know what stops someone from uploading different source code from the shipped addon.
- kevingadd 3y ago
  CWS doesn't review every extension submission, at best they do some % of them along with anything that sets off red flags. Out of hundreds of times I pushed updates to my extension (~100k monthly users by the end) it was delayed for human review maybe... twice?

deleted 3y ago

[deleted]

shadowgovt 3y ago

Stuff like this is why Google is pushing manifest v3.

mthoms 3y ago
How does manifest v3 combat this?
- shadowgovt 3y ago
  Without the additional constraints manifest v3 puts on what code an extension can run at runtime, an extension author can just slip some "grab some code from a server I control and eval it" logic into their extension, which Google can't vet. That makes it possible for an extension that was fine yesterday go to "harvesting your PII to send to a company that is building an AI based on your click frequency" today with no change indicated; just a silent "Oops I'm malicious now" shift. All cards on the table: Google does a not-great job of protecting against intentional malicious changes last I checked, i.e. they'll pass through a lot of new extensions and extension updates that do shady stuff behind the scenes. But without some lockdown on arbitrary code execution (which Mv3 provides), the problem is theoretically impossible to solve.
  - bensecure 3y ago
    Detect if the extension downloads and executes arbitrary code, and ban it if it does. That should be just as easy to detect as detecting that the code does something bad directly. In fact, the way extension policing works is (afaik) completely reactive: if someone reports that an extension is doing something bad, then the extension/the developer thereof is banned. No/minimal policing is done at the time of publishing. The exact same policy applies unchanged to extensions that download malicious code instead of packaging it directly: wait until someone complains about the malicious code, ban the extension for having malicious code.
    - shadowgovt 3y ago
      In manifest v2, downloading and executing arbitrary code is a feature. What you're describing is the migration path from v2 to v3. "Detect if the extension downloads and executes arbitrary code, and ban it if it does" is isomorphic to "deprecate the eval arbitrary code permission, cease supporting it in the store, and provide an alternative declarative model to get some of the behavior back;" it's what Google is trying to do.

s-xyz 3y ago

I don’t see the harm of monetizing something great. You could also say that its a way to reward the good work.

Meta4245 3y ago
This is data collection, not monetization
- Dulat_Akan 3y ago
  good work keep going

extesy 3y ago

Maintainer here. My extension is pretty much unmonetizable so any offer I receive would require some degree of a moral sacrifice. The least intrusive offer I've seen so far is to put a reciprocal link to somebody else's extension inside of mine, kind of like DarkReader is doing on their website. Even though it won't compromise any of my users data, the reason I'm not doing this is because it indirectly endorses that other extension and I don't control what they do with their users data.

justsid 3y ago
I really appreciate the transparency from you. I don't use Chrome anymore, but back in the day I absolutely loved Hover Zoom+ and my wife is still loving it to this day. It's a great extension and having read your comment and the linked Github issue, I feel even better about it. Thanks for your hard work.
- extesy 3y ago
  Thank you for the kind words. I actually publish hoverzoom+ to Firefox and Edge as well (links are in the repo's readme) so you can use it there too.
  - justsid 3y ago
    Wow! This just made my day, thanks so much. I don’t know why I never bothered to check if there was a Firefox version. Thank you!
imoreno 3y ago
You're doing a very admirable thing, and this helps dispel the little voiced but commonly held perception that "everybody sells out" when they get big.
- btown 3y ago
  uBlock Origin is also an incredible success story here!

cal85 3y ago

FWIW, and since a few of you probably use it… I own the JSON Formatter extension [0], which I created and open-sourced 12 years ago and have maintained [1] ever since, with 2 million users today. And I solemnly swear that I will never add any code that sends any data anywhere, nor let it fall into the hands of anyone else who would. I’ve been emailed several tempting cash offers from shady people who presumably want to steal everyone’s data or worse. I sometimes wish I had never put my name on it so I could just take the money without harming my reputation, but I did, so I’m stuck with being honourable. On the plus side I will always be able to say that I never sold out. [0] https://chrome.google.com/webstore/detail/json-formatter/bcjindcccaagfpapjjmafapmmgkkhgoa https://chrome.google.com/webstore/detail/json-formatter/bcj... [1] low effort tbh

Y_Y 3y ago
What size cash offers? Not that I want some of it, but then I do think there could be an industry re-scamming these people and want to know how much we're talking about.
- cal85 3y ago
  Convincing offers to buy it for $10-40K. One offer said $250K but I doubt that one was serious, more likely just a straight up scam. I have often emailed them back feigning interest to see if I can get them to state what they plan to do with it, since I cannot see anything that could possibly be ethical, but they always just start talking mumbo jumbo about their innovative monetisation strategy. Recently I’ve had a serious sounding offer to inject an ad, i.e. a one-off ad would open in a new tab when the extension updates, for $3K a pop, which I just ignored, then he emailed again saying $4K, then just yesterday he emailed again with a bunch of emoji and said what about $8K. It’s tempting, but it would still be selling out my users, who may be ungrateful little brats but I could never do that to them, I value their approval too much.
  - Y_Y 3y ago
    Thank you very much for the very informative response. As with any offer I think it's crucial to know what's at stake. You're very admirable for turning down tens of thousands, but if it had been tens of millions I'd have been questioning your judgement, as morally odious as the buyer might be. See also: https://news.ycombinator.com/item?id=14808881 https://news.ycombinator.com/item?id=14808881

jjcm 3y ago

Of all of these, I appreciated the one from 05/11/2016 the most. It felt the least shady because they were very up front with the scope and the data collected (which was narrowly focused), and left the implementation up to the developer (along with an optional script they could use). They also provided several options for sending the data, just to guarantee that the extension couldn't be compromised by their code. This one stood out from the rest for me. Curious though if I'm missing some way that this could be used for nefarious purposes though. Full text of the proposal below: ------ I’m sure you get business proposals all the time, so I’ll get straight to the point. I hope what I’m proposing is a little different and might actually interest you. I like Hover Zoom+ as a great alternative to it’s bigger brother Hover Zoom that lost its glamour over the last couple of months. We're conducting a DNS error research and we’re interested in small amounts of anonymous data that you might be able to provide via your Chrome extension. Our research has been going on for years and Google has never had the slightest problem with it. Compatible with Google’s strict policies No personal user data No ads, no malware The data we’re interested in are basically just DNS errors: NXD – Non Existent Domain - the domain that a user entered that resulted in a DNS error. A time stamp – when it happened. GEO – where it happened (USA, UK, RU etc.). A unique randomly generated user ID (can be hashed, not traceable back to the user). Please, don’t confuse this with the user IP address. And that’s all. You can either use our script or collect the data on your own and send it to us via an FTP server, API etc. There’s a lot of different ways we can do this. We pay on a monthly basis. The payments depend on user GEOs, but it would be in thousands of dollars per year. Is this worth at least a brief discussion? Looking forward to hearing from you. A while back I reached out to you regarding a DNS error research our company conducts. Hover Zoom+ would be an ideal medium for our research. In return, this could become a solid new revenue stream for you. Our method has been going on for years and we’ve never had the slightest problem with Google. We pay regularly on a monthly basis. For you it would be in tens of thousands of dollars per year - the amount depends on your users base and data quality. If you’re concerned about including third party scripts, there’s still a lot of ways we can make this work. Please let me know if this is worth a brief discussion to you.

bensecure 3y ago
non existent domains are the ones that are most likely to be somehow personal to the user, because they weren't trying to enter a domain at all but it got interpreted as one accidentally. Eg a password they meant to type into a password field but the url bar was highlighted. If they were interested in statistics regarding popular domains, like google or facebook, then it would actually be less of a privacy intrusion, because it would only end up telling you about populations, not individual users. I don't know what they actually intended to use this data for, but its telling that they don't mention that in their proposal.

hot_gril 3y ago

This reminds me of a dirty plan I had as a kid in middle school. 1. Make a legitimately useful Minecraft Bukkit plugin. 2. Wait for lots of installs. 3. Add a well-hidden backdoor that makes me "op" (admin) on any server I choose. 4. Surprise some mean op on a public server by suddenly banning him. I got through step 2 then decided to stop there.

Tijdreiziger 3y ago
Targeted Minecraft server backdoors do happen every now and then.
doix 3y ago
Minecraft Bukkit plugins are basically the wildwest. It's really hard to tell if something is intentional or not. I remember many years ago trying to find a motd (message of the day) plugin that would just display a message when you joined the server. I found one that was simple enough, but it would ping home to check if there were any updates as well. Now it could have been just the developer trying to add a useful feature, but the cynic in me believes it's so that they could get IP addresses of the servers running the plugin. It also had a debug command that wasn't authenticated that let you print the contents of any motd file in a folder. Except it didn't escape strings properly, so you could `../...` to escape out of that directory and print any file. I have no idea if the author actually exploited this, or if they were a naive 14 year old writing their first plugin. If they were trying to exploit, I don't know which file they were going to print the contents of, but it definitely made me very suspicious.
- hot_gril 3y ago
  > It also had a debug command that wasn't authenticated that let you print the contents of any motd file in a folder. Except it didn't escape strings properly, so you could `../...` to escape out of that directory and print any file. That's hilarious and showcases how un-sandboxed those plugins are.
kmeisthax 3y ago
2b2t got backdoored several times this way. Several people had access to WorldEdit, creative mode, admin commands, etc. Beyond ancient anarchy servers, right now the Minecraft mod community has been dealing with several supply chain attacks, deserialization vulnerabilities, and so on.

jdthedisciple 3y ago

What's wrong with selling data if it's truly anonymized?

extesy 3y ago
It would require collecting this data in the first place. Since it's not related to the primary functionality of the extension, it would require me to declare it in the privacy policy and extension stores. Probably needs additional access permissions as well. It's much easier to just not collect anything at all.
xboxnolifes 3y ago
If it was up-front and clear in scope and intent, I would have much fewer problems with it. But, I don't think I've ever some across software that clearly and explicit listed the scope of what will be tracked (and how), clearly stated that it was intended to be sold, and gathered clear and explicit consent from the user.
ptx 3y ago
It will inevitably turn out later, when the data has already leaked, that due to an unfortunate oversight or bug or misconfiguration it wasn't truly anonymized after all.

imoreno 3y ago

>Monetizing anonymous user data is happening on almost every website we visit - you may be leaving alot of money on the table by not monetizing your anonymous user data. Try dowloading Ghostry to see for yourself. Some people have no shame at all. It's like the caricature of the Devil from a Sunday Morning cartoon, offering you riches and power untold for the low, low price of your soul. Like dude, how do you know what Ghostery is and don't get why people use it?

latchkey 3y ago

If you do anything with web3 crypto or even money, always use different browser profiles. The profiles that you use for Metamask, don't install any extensions into those beyond MM.

quickthrower2 3y ago
Extensions that you activate when needed on a per tab basis would be good. Also treat it as an opt in on a per site basis

NelsonMinar 3y ago

So much sleaze with extensions, it's nice to see it documented. Have to be honest the name "HoverZoom" was spoiled for me because it was one of the first fraud extensions I was a victim of. Nice to see this open source fork with an author concerned about the problem. These days I pretty much only install open source extensions. Ironically I was using Imagus, just switched to HoverZoom+ thanks to this post.

sphars 3y ago
I too was a heavy user of imagus, until it stopped receiving updates and the owner went silent. I know there's a subreddit with some people picking it back up, but I've moved on to HZ+ now. And it's for reasons like the maintainer of HZ+ standing up morally being one of the reasons.
mickelsen 3y ago
I discovered Imagus yesterday thanks to another thread in here about extensions, and today I read this.

iza 3y ago

Yep, I've been getting these emails since 2014, around 200 in total. My extension has had between 30,000 and 100,000 active users. They often quote up to $500 a month per 1000 users, which sounds too good to be true.

huksley 3y ago

…«The WHOLE WORLD (WW) is monetized.»…

jallasprit 3y ago

I found it interesting to see ChatGPT being used on the later requests.

karaterobot 3y ago

This is terrifying. I'm glad the developer of Hover Zoom+ is both ethical and has a backbone. He demures, but I know that having a decent job has not kept other people from taking the money when presented with similar offers. I see that he's in this thread, so: hats off to you. What I'd like to know is, how many different entities are represented in this compilation? Since everything is redacted, it's not easy to tell. I was surprised that there are so many offers by, seemingly, so many different scumbags. I mean people.

kmeisthax 3y ago

Ruffle's official e-mail inbox is chock full of these. The sums of money being offered for a free and Free extension are so high that I can only assume the buyers are looking to load it up with whatever malware won't immediately get it banned by Google or Mozilla[0]. My personal opinion is that you shouldn't be allowed to transfer an extension between owners without prior approval and vetting of the new ownership structure. This should deliberately be harder than just setting up a new extension, because new listings won't have reviews or trust associated with it. I'm saying this as the person who occasionally gets caught on the business end of some of these policies[1] and knows how much of a pain it is to navigate bureaucracy. The underground extension sales marketplace is incredibly sketchy and plays fast and loose with user trust. [0] Joke's on them, our AMO listing is already flagged for machine-generated code (because we use Rust/WASM), so our extension submissions only get approved if Mozilla is able to reproduce our builds byte-for-byte. [1] https://ruffle.rs/blog/2023/04/23/mozilla-extension-postmortem.html https://ruffle.rs/blog/2023/04/23/mozilla-extension-postmort...

karlzt 3y ago

This submission comes from this comment 23 hours ago: https://news.ycombinator.com/item?id=37056613 https://news.ycombinator.com/item?id=37056613

mickelsen 3y ago

Keeping track of which extension goes rogue or what eventually breaks if not maintained gets really tiring. After dealing with this so many times, some strategies have stuck: 0. Prefer extensions that work locally, no data sent out anywhere. 1. Keep an extension audit profile, meant for testing them a bit. 2. Use different extensions for my main daily driver profile, shopping comparison profile, etc. 2. The audit profile also has bookmarks of the extensions I'm using and others for later review, or looking back, helps me declutter the main profile a bit. 3. Use https://chrome-stats.com/ https://chrome-stats.com/ to check the extensions' pedigree, they have a trust meter based on the amount of permissions asked, how long has the developer been around, etc. 4. Do your own review on what goes out with developer tools on requests, especially if the extension needs permission to a control domain. Many will tell you in the Privacy Policy that they don't collect anything PERSONAL, but need to process your data somehow, and from an initial look you can't really tell it's a service or the extension itself doing it. Lack of clear wording is key here. 5. Some mask the control domain using a subdomain of a cloud platform to host the app, so it looks more trustable, and tell they only send telemetry data there. 6. Prefer stuff that's also on github, but don't trust blindly: some developers have just posted a boilerplate hello world there. Two related anecdotes: 1. The Glarity extension (AI GPT autocomplete stuff) is open source, you can find it on github too, it explicitly said it worked only with your OpenAI API key only, yet when installing it, it just worked and I was getting GPT-powered summaries. They have their own service, where they relay all your input, but there is no documentation of it anywhere. I didn't double check if those requests stopped once you added your own API key. That was months ago, now just checked before posting, still no news from them on that functionality. While I can ascribe this to just general sloppiness, there've been some repos with serious accusations of stolen keys (lencx/nofwl) 2. I've had login data leaked with a shopping extension, where Chrome alerted me and disabled it. That was in 2021. It was pulled from the store. Months later I start getting login notifications in my email to some websites I use with my 'shopping/price compare' profile. They were attempts from Russia. The websites alerted to my email yet let session go through, since I don't use 2fa. It seems they were scanning for some saved credit card or something.

acarabott 3y ago

Another extension creator here, I've been getting more and more of these emails recently. I just checked, and my extension [1] now has a "Featured" badge, which I guess explains this uptick. No intention of "monetizing" as there is no non-shady way to monetize this feature. I perhaps don't maintain it as much as I could (sorry Windows and Linux users), but on the upside it is so little work that I'm never tempted. [1] https://chrome.google.com/webstore/detail/tab-to-windowpopup-keyboa/adbkphmimfcaeonicpmamfddbbnphikh https://chrome.google.com/webstore/detail/tab-to-windowpopup...

deleted 3y ago

[deleted]

Method5440 3y ago

I really like Hover Zoom+. I’d be willing to pay $7,000 to $8,500 USD for each kidney you’d be willing to sell. Once we know the size/functioning we can determine exact figures. Happy to buy both if you no longer need them, you probably barely use them anyway.

dieulot 3y ago

The catch with those enticing monthly offers (versus selling the extension) is that you are taking the risk to get your extension taken down, while the offerors can at any time switch to another partner/victim. Blog post from an ex-Chrome extension DevRel: https://dotproto.com/2023/06/06/a-warning-about.html https://dotproto.com/2023/06/06/a-warning-about.html

popol12 3y ago

Wow, thanks for sharing, I’d never have guessed the harassment level was this high It’s pretty concerning, does someone here know an extension that would block or signal other extension’s misbehavior? Any chances ublock does it already ?

MrPatan 3y ago

Extensions are too risky

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

uwagar 3y ago

redacted is such a capitalist pig.

seru 3y ago

Glad to see the precommitments here. Archive link to improve credibility of such since HN comments can be edited - I see multiple others in the past day as well: https://web.archive.org/web/20230810111519/https://news.ycombinator.com/item?id=37066680 https://web.archive.org/web/20230810111519/https://news.ycom...

delfinom 3y ago

(2021) in the title is not needed since the author has been keeping it up to date ;)

cactusplant7374 3y ago

How much money could they have made?

no_wizard 3y ago

There was a rumor I heard on some forums awhile back that at one point, ad tech companies wanted to kill uBlock Origin so bad that they were willing to offer a few million dollars to take it over, and gorhill stood tall. If this is true (and its a huge if, again, I heard it in the context of a rumor), just makes them more of a stand up developer!

unhammer 3y ago

Not that one should have to, but for Firefox you can cd .mozilla/firefox/$profile git init git add extensions git commit -am init echo '*.xpi diff=zip' >>.gitattributes echo '[diff "zip"]' >>.git/config echo ' textconv = unzip -c -a' >>.git/config which at least lets you take a peek at what kind of nefarious updates you're getting.

waynesonfire 3y ago

this is why we can't have nice things.

WhyNotHugo 3y ago

Extremely relevant: https://news.ycombinator.com/item?id=37052508 https://news.ycombinator.com/item?id=37052508 A rather popular app for macOS got purchased by some shady company and they updated it to include a botnet SDK. I'm guessing a lot of the potential buyers here have similar intents.

dougseismic 3y ago

If anyone's around here and isn't adverse to actually being paid for developing extensions in a non-shitty way, I built https://github.com/dougwithseismic/monetize-this https://github.com/dougwithseismic/monetize-this and use it in my own extensions. I get that it's noble to hold a position of 'no way, I will never monetize, I am a shining white knight' but lets be real, we all gotta eat. If you choose not to then that's great, Im glad but please; monetization !== shady shit. There's just an overlap.