6 ms·
cool, but "read and change your data on all websites" is imho not worth the functionality. that seems ripe for takeover by some scammer.
by notatoad 3y ago
cool, but "read and change your data on all websites" is imho not worth the functionality. that seems ripe for takeover by some scammer.
- deleted 3y ago[deleted]
- p1mrx 3y agoIPvFoo author here. The problem is that there's no way to obtain the (hostname, ip) stream from Chrome/Firefox without requesting the "all websites" permission. In theory, browser vendors could define a narrowly-scoped permission that only reports (hostname, ip), or roll this functionality into the browser UI, but neither seems likely to happen. I made IPvFoo to promote IPv6 adoption, and wouldn't consider selling it for less than $10M USD. It probably won't ever be worth that much because it's an easily-cloned utility without a "moat", but it's more rational to set a price than refuse to sell under any circumstances.
- janardanyri 3y agoJust wondering, do you expect non-scammers to have the $10m?
- p1mrx 3y agoNo. I expect that I won't sell it because it's worth more to me than anyone else.
- mkl 3y agoThe danger with extension acquisitions is malicious buyers, who use their ability to run arbitrary code to steal credit card numbers or credentials, insert or replace ads, run cryptocurrency mining, etc. For malicious purposes number of installations is the important thing, not how clonable the extension is.
- jl6 3y ago$10m could be worth it for a nation state actor targeting a specific high-value individual known to use the extension.
- GoblinSlayer 3y agoYou can do those in private windows, there's separate permission for those: https://support.mozilla.org/en-US/kb/extensions-private-browsing https://support.mozilla.org/en-US/kb/extensions-private-brow... Miners need the least amount of permissions anyway.
- notatoad 3y agoyeah, i appreciate that. my post wasn't meant as a criticism, it's a cool project and i'm happy your extension exists. i have no reason to think you'd sell out to scammers, but stranger things have happened and for a product whose whole utility to me is "huh, that's cool" it's not worth it. and i thought that was worth highlighting to others. some chrome extension hygeine is always good.
- ugh123 3y agoTo determine ipv4/6, do you need to send that hostname and ip off to somewhere to get a response? or can it be done locally without leaving the machine?
- shzhdbi09gv8ioi 3y agoYou can determine that by looking at the value. IPv4: 123.123.123.123 IPv6: 2001:db8::8a2e:370:7334
- ugh123 3y agoOh yeah. DUH!
- p1mrx 3y agoIt's local. The webRequest API provides an 'ip' field with each request, and the hostname can be extracted from the URL. Once you have an IP address, just check for colons. https://developer.chrome.com/docs/extensions/reference/api/webRequest https://developer.chrome.com/docs/extensions/reference/api/w...
- dieortin 3y agoipv6 addresses are different, so they’re easy to distinguish
- justsomehnguy 3y agoOfftopic: // Don't waste time rewriting the same tooltip. // Don't waste time redrawing the same icon. Finally someone who understands the basics.
- codetrotter 3y ago> IPvFoo author here It makes sense that you would notice the change then :D Was this a situation where you had to do a double-take? Like, you opened HN today and saw that your extension said IPv6 and for a split second you wondered if your extension had made a mistake? Before seeing that indeed HN has IPv6 now.
- p1mrx 3y agoI didn't really think it was a mistake, just switched to "Morpheus is fighting Neo!" mode and started collecting evidence, most of which is in the post.
- playingalong 3y ago> $10M USD Hah. You take a strong starting position in the negotiations ;)
- ffomni 3y ago> roll this functionality into the browser UI, Is it hard to get patches into firefox? I never tried, just curious.
- amne 3y ago$10M for access to a pool of 100k (and growing) tech-savy users that are harder to hack than gen-pop? You guys, the 100k+, are lucky I'm not made of money.
- networkchad 3y ago[dead]
- mort96 3y agoI appreciate the honesty, and the reality is that most add-on developers have a price; a lot of people would probably sell their add-on for $10M. But these things auto update. If a government (or even just a moderately big org) really wants to spy on someone, and they determine that said someone uses IPvFoo, $10M isn't a very large price to pay to just get complete access to the target's web browser. This isn't specific to your add-on in any way, but, well... that seems ripe for takeover by someone nefarious.
- OJFord 3y agoIf your threat model includes a government...
- mort96 3y agoWhich it kinda should? It's not as if governments universally have proven themselves to not do messed up shit and not violate people's privacy
- OJFord 3y agoAs a member of your country's public society at large, sure (media campaigns, propaganda, government contracts for IT equipment and infrastructure). For individual targeting.. not many people.
- deleted 3y ago[deleted]
- rixthefox 3y agoTY for making the extension. As someone who uses it daily, you are my saving grace and my go-to for telling when a website has enabled IPv6 or not, if it wasn't you making this post that's how I would have found out HN had enabled it too. I get fun questions from people when I screenshare and they notice the green "6" or the red "4" and ask about it. Sure it doesn't do anything fancy behind the scenes but that's also what makes it perfect.
- dtaht 3y agoThank you for writing this tool. It cheers me up every time I see a green 6.
- cbracketdash 3y agoJust download the repo as a zip file and manually upload it as an extension to your browser.
- p1mrx 3y agoNote that the top-level manifest.json is for Chrome. To use it with Firefox, you have to copy "manifest/firefox-manifest.json" onto manifest.json first.
- mortallywounded 3y agoThough be warned, after a restart Firefox doesn't re-enable side loaded extensions that were added in the "debug" mode. Also, Chrome (Google) has a habit of randomly disabling or removing side loaded extensions. I even had a side loaded extension that Google forced removal of because Google deemed it contained malware (which it didn't, I know because I wrote it).
- justsomehnguy 3y agoJust read the source code.
- lolinder 3y agoNot good enough to protect against the kinds of attacks that OP is warning against. Chrome extensions update automatically and there have been many cases of extensions being purchased by malicious actors who modify the code to be spyware or adware. You can download the current version and install it manually to get around that. If you do that and read the code you're probably safe. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=Extension%20sold&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- justsomehnguy 3y agoSo the problem is in the behaviour of the browser, but not the extension. Read the code, don't update 'till you read the code, don't use the browser which knows better what is good for you.
- mulmen 3y agoSeems to me fine grained access controls would go a long way. The extension gets access to specific capabilities. Such as network connectivity. Local extensions have a much smaller blast radius.