4 ms·

I'm quite sympathetic to the stated goal, and the technical limitations are understandable, but the fact that it sends a list of all your extensions to an exten

I'm quite sympathetic to the stated goal, and the technical limitations are understandable, but the fact that it sends a list of all your extensions to an extension-oriented ad network is a bit sus... > Why does this need an external server? - Browsers have special rules about modifying extension marketplace domains. For example, you cannot set declarative_net_request rules for chromewebstore.google.com. Therefore, this extension delegates the developer info checking to the ExBoost [1] API server. [1]: https://www.extensionboost.com/ https://www.extensionboost.com/ > What Is ExBoost? - ExBoost is a collaborative network of browser extensions that want more users and more reviews. > How does ExBoost work? - Extensions add ExBoost slots inside their UI. These slots will show promotions for similar extensions, or reminders to review your extension.

chatmasta 3y ago
It looks like Extboost is also a project by OP. The charitable explanation would be that they used its API server because they already had the data they needed to scrape an extension's metadata (i.e. its owner) given an extension ID.
- infogulch 3y ago
  Yes and the fact that you can just scrape the logs for extension installation statistics which you can use to sell AD space is just an accidental convenient side-effect, I'm sure.
- mfrisbie 3y ago
  For the record, this is bang on.
Andrews54757 3y ago
I've developed some small extensions for fun. A couple of weeks ago I got an email from ExBoost with the subject "Collaboration To Grow Our Extensions." They wanted me to include their code in my extensions. I quote: "You show mine, I show yours. Zero cost, all win." I thought it was suspicious and junked the email. It didn't seem any different from the other spam emails I got from scammers.
- mfrisbie 3y ago
  I'll admit, the launch messaging could have been better.
8organicbits 3y ago
Why does it need to contact an external service? I thought the extension ID changed when the owner changed, so you'd just need to locally track extension IDs and flag any new ones that appear. Or do I misunderstand something?
- Sophira 3y ago
  Extension IDs do not change, in my experience. (I could be wrong in some cases, but I know for a fact that at least one extension I've used has been bought up without the ID changing.) It seems to me that if they did change, it would defeat the purpose of buying up extensions in the first place, because automatic updates would stop working and they'd lose the installed user base.
switch007 3y ago
That is not a connection I expected in this kind of project. Blimey
loginatnine 3y ago
Good find! I've dug a bit and the extension, at least for now, does not send any metadata associated to your browser[1], only a comma separated list of extension IDs. Of course the IP could be easily used. Looking at the result from the API of one extension I had installed[2], it lists metadata associated to the developer. I've tried to use the `chrome.management.get(id)` Chrome API and it does not return this information, and there does not seem to be a way to get the content of the manifest.json programatically. Therefore, to do the job of the extension as it is, it does need an external source. [1]: https://github.com/classvsoftware/under-new-management/blob/master/src/background.ts#L26-L35 https://github.com/classvsoftware/under-new-management/blob/... [2]: https://api.extensionboost.com/v1/developer?extension_ids=ghonlpiinhagjnhgiohnnbajakcfohid https://api.extensionboost.com/v1/developer?extension_ids=gh...
- mfrisbie 3y ago
  I tried very hard to find a way around using an external server, as I knew HN would harp on the related privacy issues. No luck.

chatmasta 3y ago

It looks like Extboost is also a project by OP. The charitable explanation would be that they used its API server because they already had the data they needed to scrape an extension's metadata (i.e. its owner) given an extension ID.

infogulch 3y ago
Yes and the fact that you can just scrape the logs for extension installation statistics which you can use to sell AD space is just an accidental convenient side-effect, I'm sure.
mfrisbie 3y ago
For the record, this is bang on.

Andrews54757 3y ago

I've developed some small extensions for fun. A couple of weeks ago I got an email from ExBoost with the subject "Collaboration To Grow Our Extensions." They wanted me to include their code in my extensions. I quote: "You show mine, I show yours. Zero cost, all win." I thought it was suspicious and junked the email. It didn't seem any different from the other spam emails I got from scammers.

mfrisbie 3y ago
I'll admit, the launch messaging could have been better.

8organicbits 3y ago

Why does it need to contact an external service? I thought the extension ID changed when the owner changed, so you'd just need to locally track extension IDs and flag any new ones that appear. Or do I misunderstand something?

Sophira 3y ago
Extension IDs do not change, in my experience. (I could be wrong in some cases, but I know for a fact that at least one extension I've used has been bought up without the ID changing.) It seems to me that if they did change, it would defeat the purpose of buying up extensions in the first place, because automatic updates would stop working and they'd lose the installed user base.

switch007 3y ago

That is not a connection I expected in this kind of project. Blimey

loginatnine 3y ago

Good find! I've dug a bit and the extension, at least for now, does not send any metadata associated to your browser[1], only a comma separated list of extension IDs. Of course the IP could be easily used. Looking at the result from the API of one extension I had installed[2], it lists metadata associated to the developer. I've tried to use the `chrome.management.get(id)` Chrome API and it does not return this information, and there does not seem to be a way to get the content of the manifest.json programatically. Therefore, to do the job of the extension as it is, it does need an external source. [1]: https://github.com/classvsoftware/under-new-management/blob/master/src/background.ts#L26-L35 https://github.com/classvsoftware/under-new-management/blob/... [2]: https://api.extensionboost.com/v1/developer?extension_ids=ghonlpiinhagjnhgiohnnbajakcfohid https://api.extensionboost.com/v1/developer?extension_ids=gh...

mfrisbie 3y ago
I tried very hard to find a way around using an external server, as I knew HN would harp on the related privacy issues. No luck.