Adware vendors buy Chrome Extensions to send ad- and malware-filled updates | Hacker News Reader

Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

arstechnica.com

99 pointshollerith43 comments

It’s a good point to be aware of and to raise from.time to time, but the subject line should be amended to indicate that this article was written in 2014.

Yeah, I have a Firefox extension with around 50k installs, and get emails every so often from people offering to monetize it.

Here's an excerpt from a recent one, from Nick at NJB Brands Sales:

> We offer .50 CTR (per 1,000) traffic and can use each unique IP up to 10 times a day. There is no limitation to what we will purchase other than the cap per unique IP. We offer flexible payment options via PayPal, Bitcoin, WesternUnion or Check. Payment can be done every 1 day, 7 days or 30 days.

Ha! We got the exact same message. Really weird getting a glimpse of that part of the internet.

I have a relatively popular novelty extension and I get approached by ad companies to buy/monetize it regularly. I refuse, because I despise advertising and I don't need the money. But I suspect I am in the minority and that many extension owners probably just decide it is easier to sell it and not think about it.

I switched my chrome extension to a paid model (one off payments). Most the offers from these shady people, work out as approximately 1 year worth of sales.

Who pays for extensions? Like, honest question.

3-4 people a day. My extensions are development tools so I’d imagine people get their companies to pay for it.

How much did they offer?

And for what reach?

Anywhere from $2-25k. But most don't give a price upfront and I just send it to my spam folder.

Use uBlock Origin [1] and uMatrix [2] instead. Also using Inox [2] browser helps too.

[1] https://github.com/gorhill/uBlock/ [2] https://github.com/gorhill/uMatrix [3] https://github.com/gcarq/inox-patchset/releases

Instead of what?

This is why RMS calls auto-updates "universal backdoors".

Most people would be screwed without auto-updates.

From the article:

> "Update: Google got back to us, and stated that Chrome's extension policy is due to change in June 2014. The new policy will require extensions to serve a single purpose."

It appears to be an easy way to at least weaken this practice:

Why doesn't chrome prompt it's user / demands a confirmation of permissions when an extention changes ownership, before updating it again?

It could at least impact the rentability of this buying up of extentions, but definitely help alert users of such things

How would they know it changed ownership?

But it couldn't/won't guarantee anything, say Chrome could notify user the change ownership of an extension then the new owner state that they won't be evil, blah blah blah, but 1 or 3 months later they changed their minds and send ads to users. What next?

before that - why doesnt Chrome let you DISABLE updates?

(2014)

Still a large risk, even though this was authored in 2014.

I would be surprised if extensions that "read and change content on all websites you visit" haven't yet been used in some wide-scale account/identity compromise without making much noise.

That is why I never install browser extensions.

Do you live without adblock?

Not OP, but I live without adblock. In Chrome, I disable Javascript on all sites by default. Rarely do I need to unblock a new site. I have a paid subscription to the Washington Post (which grants access to articles, but doesn't actually hide the ads...), and the ads on other sites I visit aren't too oppressive.

More than anything else, over nearly twenty years on the Internet I've developed the mental reflex to "tune out" and automatically ignore any Internet ad, anywhere, unless it's literally shoved in my face to the exclusion of all other content.

I've previously used adblock extensions, but my reasons for going without mirror the link author's. I simply can't trust Google/Chrome not to autoinstall a new, broken, malware-infested version of my favorite extension. I don't feel I should have to mess with directory permissions or application sandboxing in order to achieve some half-measure of extension security, so instead I eschew them completely.

Host blocking at the OS level. No need for extensions.

Sometimes you need to temporary disable filters or edit them. How do you manage that? Is it user-friendly?

Never ran into a problem really. Maybe a couple times a year I'll manually open the host file and ctrl+f a host I need to comment out temporarily after seeing it's causing an issue via the browser's network tools.

I adblock then disable extension updates. The only extension I add.

how do you disable extension updates in chrome?

Blocking updates on chrome is harder than I remember. A couple of ways here: https://stackoverflow.com/questions/27657617/how-to-disable-...

Another way is to enable developer mode on the extension page then install an unpacked version of the extensions you want.

manually installing unpacked extensions is the only way that currently works, update_url doesnt work for more than a year, Chrome just calls home on hardcoded IPs.

you can do it quite effectively outside the browser using a host block[1] list or pi-hole. my uBlock now only fires sporadically for cases I don't catch with the /etc/hosts approach (e.g. disallowing e.g. remote fonts)

[1] https://github.com/StevenBlack/hosts

Many years ago Opera had a blacklist for URLs with wildcard support that was implemented in a native code, not HTML/JS. I used to use it then.

Install the version from Github instead of the store, and you can avoid the problem. Instructions for Chrome/Firefox here: https://github.com/gorhill/uBlock/blob/master/dist/README.md

Other browsers see the overview here: https://github.com/gorhill/uBlock/blob/master/README.md#chro...

Yes, but I have JS disabled on most sites. Regarding adblock, there were posts that it slows the browser down, injects huge CSS rules into every iframe etc.

How do you selectively disable has without an extension?

Chromium can do that. You can disable JS globally in the settings and then there will be a script icon in the address bar to enable it on a specific site.

It's pretty easy going without adblock. There are a lot of websites without obtrusive ads and it's pretty easy to start to recognize which sites I just don't want to go to anymore.

I'm not sure about Chrome but on Firefox for a time being one still can install extensions the classic "old school" software installation way - by placing the files on disk.

Not even Firefox manually review extensions anymore. Sad, happened twice for me (one was a cryptominer) so now I have like 2 extensions installed.

Not true. Extensions are still subject to manual review, however they are permitted to be posted publically as soon as they pass a suite of automated checks.

You know what I mean. It's like checking for poison after you eat the entire pie.

(2014)

Reply on news.ycombinator.com