4 ms·

The root problem here is that there's no legitimate way to monetize browser extensions. Extensions are meant to be simple, so it's hard to sell premium features

The root problem here is that there's no legitimate way to monetize browser extensions. Extensions are meant to be simple, so it's hard to sell premium features. Extensions usually don't "own" any space to embed ads in.

6DM 3y ago
I think the only way is to treat access like we do web apps, then enable/disable features accordingly. That's kinda lame because now you have to have a backend setup, just so you can charge for some features.
- Chabsff 3y ago
  The issue with that is that "Gets to read and/or write the DOM" happens to be the only permissions a nefarious extension needs while also being those that a vast number of useful extensions require.
  - 6DM 3y ago
    I think you're thinking from the browser level. I was thinking from the standpoint of what I could do as an extension developer. If we approach it from that angle, then your extension can only restrict access to it's features via a round trip to your own servers to validate access and/or show a checkout view to purchase access.
  - jcparkyn 3y ago
    That's why it'd be nice to have a general "access the internet" permission, since DOM reads are usually harmless if they can't get any data back.
    - danShumway 3y ago
      I suspect it would be a very hard permission to implement. There are a lot of ways to exfiltrate data from a website if you have DOM access. But yeah, agreed. Some of the difficulty around securing extensions boils down to the fact that Javascript permissions could be better. Websites do a decent job of sandboxing the website, but sandboxing within websites (without relying on iframes) is much more difficult. Per-site permissions and click-to-activate are also really useful features here. It's easy to forget how recent they are. But it would be good to go further if possible and having barriers in front of exfiltration would be a big part of that -- there are many browser permissions that would become less dangerous if you could know for sure that the data they generate can't get off your device. I just think it would be really difficult to try and build browser permissions around that in a user-legible way.
sorokod 3y ago
Do you believe that if there was a way to monetize extentions devs would not be approached by data thives?
- 6DM 3y ago
  Not sure if sarcasm but will respond as if it's not. There are lots of business models to choose from - subscription - affiliate links - sponsors - one time charge, this one is tricky as restricting access requires a back-end that needs ongoing maintenance and server costs [edit: formatting, spelling]
  - sorokod 3y ago
    It is not clear what problem you are solving. Extension devs know the rules of the game up front and have no expectation of profit.
    - 6DM 3y ago
      I may have misunderstood your prior comment so please excuse me if I got it wrong. The problem I was solving was how to make money from an extension that I publish. I was outlining different business models where you could give the user access to the extension, and make money without having to accept this arrangement with data thieves.
      - sorokod 3y ago
        I don't see this as problem that needs to be solved. It is freeware from the start. It's wonderful that people are willing to share their knowledge and time for free - why not let it be the way it is?
        bavarianbob 3y ago
        I believe problem isn't the right word. I think OP is challenging your assumption that it's inherently freeware. There are methods for monetizing an extension and they're infrequently used or associated with a much larger experience (e.g. my BitWarden extension is critical for using BitWarden, but I pay for BitWarden's subscription elsewhere).
burkaman 3y ago
An extension user could theoretically be willing to pay for the value the extension provides them. The malicious actors sending these emails are willing to pay for the value that a user's data provides them. These two numbers are not related in any way, and the value of user data will often be much higher than the value of the extension's functionality. There is no way for monetization to solve this, because the two potential customers are not purchasing the same product.
- hot_gril 3y ago
  Yeah. We've already seen user data win over paid software in other spaces. Someone charitable or just not-so-bad has to buy it out instead.
brucethemoose2 3y ago
The root problem is that extensions are such a good platform for ads/tracking. If monetization was better, it would just end up like Google Play, with adtech spam crowding out the "legitimately" monetized apps. Dracionian restrictions on web access (like requiring a prompt whenever an extension wants to upload/download data) might help a little.
butz 3y ago
Google could easily find a way to display ads for all extensions: pre-roll ads before extension launches, mid-roll ads when user is using extension for some period of time; not sure what is stopping them.
jaredsohn 3y ago
There used to be. https://developer.chrome.com/docs/webstore/money/ https://developer.chrome.com/docs/webstore/money/ "The web has come a long way in the 11 years since we launched the Chrome Web Store. Back then, we wanted to provide a way for developers to monetize their Web Store items. But in the years since, the ecosystem has grown and developers now have many payment-handling options available to them."
- arcticfox 3y ago
  Another failed Google product...of course every company has huge back catalogs of deprecated products but the sheer % of fails by Google is almost unbelievable.
- lapcat 3y ago
  This is the reason I removed my extension from the Chrome Web Store.
- grubbyboy 3y ago
  Just want to put a plug in for https://extensionpay.com/ https://extensionpay.com/ - I've used it in extensions in the past. It takes away the headache of setting up a backend for payment. They do take an extra 5%, but it's worth it especially. for smaller projects
ezekg 3y ago
I don't think this is necessarily true. I run a software licensing API with quite a handful of customers running browser extensions with respectable user bases. So there are monetization opportunities, just like any other distribution channel.
jshier 3y ago
You can easily monetize Safari extensions by selling them through the App Store.
- lapcat 3y ago
  I wouldn't say "easily", but you can.
hot_gril 3y ago
Might at least make these attacks harder if users could disable extension updates, or had to opt into them. Most of these extensions are simple and don't really need to be updated, yet the update mechanism is silent full auto bada bing bada boom no rollbacks. I can't think of any updates more aggressive, not even Steam.
- danShumway 3y ago
  Yet another opportunity to recommend Firefox to readers. I'm not sure I advise doing it, but you can go to about:addons and hit the gear icon and you can uncheck "Update Addons Automatically". Even better, click on an extension and under the "details" tab there's an option per-addon to set whether you want automatic updates or not, so you can disable updates just for the one addon you don't trust (or enable updates just for the one addon you do trust). Also, want to run older version of an extension? The Mozilla Addons page for each extension has a list of every release and you can download each version independently as a signed XPI file if you want to sideload it. The big thing I wish Mozilla would add is self-compiled releases like F-Droid does, especially since their ill-advised signing process means it's hard for users to compile an extension from source -- it's way too easy for a submitted extension to deviate from its source code. But that (admittedly large) issue aside, Firefox offers a lot of control for users who want to manage their own extension versions. Forced automatic updates are a Chrome problem.
  - hot_gril 3y ago
    Yeah, that's very nice. The only reason I'm even aware of how Chrome does it is because we're forced to use Chrome at work. We're allowed to use some vetted internal extensions with it, and I do, but someone pushed an update that broke an extension by accident. Then I was like, why is this a thing.
  - variadix 3y ago
    Thanks for mentioning this

6DM 3y ago

I think the only way is to treat access like we do web apps, then enable/disable features accordingly. That's kinda lame because now you have to have a backend setup, just so you can charge for some features.

Chabsff 3y ago
The issue with that is that "Gets to read and/or write the DOM" happens to be the only permissions a nefarious extension needs while also being those that a vast number of useful extensions require.
- 6DM 3y ago
  I think you're thinking from the browser level. I was thinking from the standpoint of what I could do as an extension developer. If we approach it from that angle, then your extension can only restrict access to it's features via a round trip to your own servers to validate access and/or show a checkout view to purchase access.
- jcparkyn 3y ago
  That's why it'd be nice to have a general "access the internet" permission, since DOM reads are usually harmless if they can't get any data back.
  - danShumway 3y ago
    I suspect it would be a very hard permission to implement. There are a lot of ways to exfiltrate data from a website if you have DOM access. But yeah, agreed. Some of the difficulty around securing extensions boils down to the fact that Javascript permissions could be better. Websites do a decent job of sandboxing the website, but sandboxing within websites (without relying on iframes) is much more difficult. Per-site permissions and click-to-activate are also really useful features here. It's easy to forget how recent they are. But it would be good to go further if possible and having barriers in front of exfiltration would be a big part of that -- there are many browser permissions that would become less dangerous if you could know for sure that the data they generate can't get off your device. I just think it would be really difficult to try and build browser permissions around that in a user-legible way.

sorokod 3y ago

Do you believe that if there was a way to monetize extentions devs would not be approached by data thives?

6DM 3y ago
Not sure if sarcasm but will respond as if it's not. There are lots of business models to choose from - subscription - affiliate links - sponsors - one time charge, this one is tricky as restricting access requires a back-end that needs ongoing maintenance and server costs [edit: formatting, spelling]
- sorokod 3y ago
  It is not clear what problem you are solving. Extension devs know the rules of the game up front and have no expectation of profit.
  - 6DM 3y ago
    I may have misunderstood your prior comment so please excuse me if I got it wrong. The problem I was solving was how to make money from an extension that I publish. I was outlining different business models where you could give the user access to the extension, and make money without having to accept this arrangement with data thieves.
    - sorokod 3y ago
      I don't see this as problem that needs to be solved. It is freeware from the start. It's wonderful that people are willing to share their knowledge and time for free - why not let it be the way it is?
      - bavarianbob 3y ago
        I believe problem isn't the right word. I think OP is challenging your assumption that it's inherently freeware. There are methods for monetizing an extension and they're infrequently used or associated with a much larger experience (e.g. my BitWarden extension is critical for using BitWarden, but I pay for BitWarden's subscription elsewhere).

burkaman 3y ago

An extension user could theoretically be willing to pay for the value the extension provides them. The malicious actors sending these emails are willing to pay for the value that a user's data provides them. These two numbers are not related in any way, and the value of user data will often be much higher than the value of the extension's functionality. There is no way for monetization to solve this, because the two potential customers are not purchasing the same product.

hot_gril 3y ago
Yeah. We've already seen user data win over paid software in other spaces. Someone charitable or just not-so-bad has to buy it out instead.

brucethemoose2 3y ago

The root problem is that extensions are such a good platform for ads/tracking. If monetization was better, it would just end up like Google Play, with adtech spam crowding out the "legitimately" monetized apps. Dracionian restrictions on web access (like requiring a prompt whenever an extension wants to upload/download data) might help a little.

butz 3y ago

Google could easily find a way to display ads for all extensions: pre-roll ads before extension launches, mid-roll ads when user is using extension for some period of time; not sure what is stopping them.

jaredsohn 3y ago

There used to be. https://developer.chrome.com/docs/webstore/money/ https://developer.chrome.com/docs/webstore/money/ "The web has come a long way in the 11 years since we launched the Chrome Web Store. Back then, we wanted to provide a way for developers to monetize their Web Store items. But in the years since, the ecosystem has grown and developers now have many payment-handling options available to them."

arcticfox 3y ago
Another failed Google product...of course every company has huge back catalogs of deprecated products but the sheer % of fails by Google is almost unbelievable.
lapcat 3y ago
This is the reason I removed my extension from the Chrome Web Store.
grubbyboy 3y ago
Just want to put a plug in for https://extensionpay.com/ https://extensionpay.com/ - I've used it in extensions in the past. It takes away the headache of setting up a backend for payment. They do take an extra 5%, but it's worth it especially. for smaller projects

ezekg 3y ago

I don't think this is necessarily true. I run a software licensing API with quite a handful of customers running browser extensions with respectable user bases. So there are monetization opportunities, just like any other distribution channel.

jshier 3y ago

You can easily monetize Safari extensions by selling them through the App Store.

lapcat 3y ago
I wouldn't say "easily", but you can.

hot_gril 3y ago

Might at least make these attacks harder if users could disable extension updates, or had to opt into them. Most of these extensions are simple and don't really need to be updated, yet the update mechanism is silent full auto bada bing bada boom no rollbacks. I can't think of any updates more aggressive, not even Steam.

danShumway 3y ago
Yet another opportunity to recommend Firefox to readers. I'm not sure I advise doing it, but you can go to about:addons and hit the gear icon and you can uncheck "Update Addons Automatically". Even better, click on an extension and under the "details" tab there's an option per-addon to set whether you want automatic updates or not, so you can disable updates just for the one addon you don't trust (or enable updates just for the one addon you do trust). Also, want to run older version of an extension? The Mozilla Addons page for each extension has a list of every release and you can download each version independently as a signed XPI file if you want to sideload it. The big thing I wish Mozilla would add is self-compiled releases like F-Droid does, especially since their ill-advised signing process means it's hard for users to compile an extension from source -- it's way too easy for a submitted extension to deviate from its source code. But that (admittedly large) issue aside, Firefox offers a lot of control for users who want to manage their own extension versions. Forced automatic updates are a Chrome problem.
- hot_gril 3y ago
  Yeah, that's very nice. The only reason I'm even aware of how Chrome does it is because we're forced to use Chrome at work. We're allowed to use some vetted internal extensions with it, and I do, but someone pushed an update that broke an extension by accident. Then I was like, why is this a thing.
- variadix 3y ago
  Thanks for mentioning this