4 ms·
This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly a
by bagels 2y ago
This is really confusing to me. The original discussion was about changing licenses, but somehow (coincidentally?) there was malicious code discovered shortly after? Are these related?
- dark-star 2y agoIt's a common theme: - build an open-source thing - wait till thousands or millions of people are using it - change the license and close down the source - implement malicious code - push an update - profit! you now have your malware running on millions of systems
- oneeyedpigeon 2y agoThis is a good description of the problem. I'm not sure why it's been downvoted, except that "common" is overstating it a bit.
- notpushkin 2y agoThe closing down step is optional. Just don’t build on a public CI, and inject malicious code in your builds, xz-style.
- pickledoyster 2y agoyup, many mobile app developers do this (inject any SDK that'd pay them) too. Doesn't need to be open source, though
- DANmode 2y agoMobile app devs are often scum, but no need to single them out. Plenty of bait and switch later free apps turned freemium, or malicious, out there.
- jeroenhd 2y agoShould be added that the malicious part is often done by a third party that takes over an open source project when the original developer doesn't have the time/energy/money to maintain their open source/free work. Many Chrome extensions end up being sold for thousands or just hundreds of dollars because there's no money in them and the dev isn't all that interested. Society as a whole could easily avoid this by funding open source/free utilities to the point where malware makers need to spend significant cash to outbid yearly community support, but unfortunately maintaining anything available online for free is a thankless job that barely covers the electricity required to maintain the code. In this case too, the developers behind the theme seemed to want to monetise their work, which had attained almost 4 million installs, in the past, but found themselves with a rather unwilling customer base. I don't know if they snapped and uploaded something malicious or if they're intentionally making it hard for forks to copy their work, but either way the lesson learned is that if you want to make money you should just abandon your free projects and start something else.
- tobyhinloopen 2y ago> Society as a whole As long as we won't have to pay 2 USD for an extension!
- hombre_fatal 2y agoEvery time piracy or Youtube ads come up, HNers grandstand on how they don't even pay a dime to the content creators making the hundreds of hours of videos they watch. GGs if you want a buck for the VSCode theme you made.
- izzydata 2y agoI fundamentally disagree with making money from ads. I have no problem giving money to people who make things.
- skyyler 2y agoI proudly block ads while giving directly to the people that make the stuff I like. I know I'm in the minority, but I block ads because of memetic hygiene. I don't want to deprive artists but I'm not sitting through adslop for a podcaster's sake.
- Thorrez 2y agoWith Youtube at least, you can buy Youtube premium, so you don't have to sit through Youtube ads without needing an ad blocker (though you'll still have to sit through any ads the Youtuber directly adds into the video itself). Disclosure: I work at Google.
- skyyler 2y agoI use Youtube Premium, plus an ad blocker, plus an extension that removes shorts, plus an extension that skips sponsored segments. Soon, I'm going to need an extension that removes the AI stuff I don't want and didn't ask for. Using youtube in 2025 is exhausting.
- talkingtab 2y agoHey! Isn't that the Microsoft business model? Doesn't MS control VS Code? (google microsoft antitrust).
- not_wyoming 2y agoAre you contending that's what happened here? This is not a leading question, I genuinely do not know and am trying to learn more.
- mightysashiman 2y agoreminds me of mx player on android (nova launcher also?)