The Great Suspender: New maintainer is probably malicious
github.com
github.com
addon.xpi --> addon.zip
Note: Obfuscation is NOT the same as minification, and I don't mean minification when using the word obfuscation!
Great idea!
this addon connects to:
* https://484044b296.execute-api.us-east-1.amazonaws.comIt doesn't have to be as overt making it look like a proxy (eg. a endpoint that makes arbitrary http requests on behalf of the caller). It can be as simple as changing the endpoint for the spying service from https://evil.example.com/api/ to https://484044b296.execute-api.us-east-1.amazonaws.com/evil/...
> Some more investigation would be required in some cases.
The point is that the "nutrition facts label" doesn't really do anything because it's trivial to bypass. If it becomes widespread I guarantee every malicious addon maker would adopt this tactic.
One might not like Google analytics, but at least you know exactly what you’re going to get when someone calls analytics.google.com.
but you can't. See the last part of my comment: "they can inject arbitrary scripts into pages to make requests for them".
>either way, if it is not a solvable problem, there is a major problem in the design.
Not really. It's like complaining that debuggers can impersonate programs they attach themselves to.
disallow that behavior?
You could also just pull that code but it might change based on request origin...
That's irrelevant. If you can make changes to the page, you can exfiltrate data. The security model for addons isn't designed with restricting an addon's network activity in mind, see my other post: https://news.ycombinator.com/item?id=25623281
This ends up effect as magically determining where it’ll call, with a lot less work.
And this was Google Play verified with a million downloads.
Is it even possible or would the sandbox prevent such an extension from functioning?
I wish I could block per-app connections on Linux like Little Snitch appear to allow on Mac.
However, if you allow everything to 80/443, the extensions would still be able to connect to their servers. Maybe the browsers should add the ability to allow/deny connections per extension.
https://github.com/gustavo-iniguez-goya/opensnitch/issues/21
And why is this? Unless the extension source is already public, I don't see any reason why anyone would not use obfuscation
That said, any extension using those tools without source code available and build verification should definitely be viewed with suspicion.
I'm not saying all obfuscation is necessarily bad, just something to look out for if you're trying to sleuth around for malicious intent by the addon's author.
Typically if you want to hide the fact you are collecting the browsing secrets of the addon's user, you would use some form of obfuscation (in order to have the addon in good standing by Mozilla and to stop a simple sweep by people like myself who first look for things like http:/https: in the source).
Note: Obfuscation is NOT the same as minification, and I don't mean minification when using the word obfuscation!
Now, some distros like Debian have enough political power to get Mozilla to allow them to put Firefox branding on their altered user-freedoms-respecting repo editions of FF release. But most don't. So the only way to use actual release FF is to go outside your repos and use the unbranded version. Possible, of course, but tedious.
On the other side. The chrome store starts to behave badly and ban extensions they don't like for random reason after they implement that.
About mozilla, i don't know. will they eventually be like that, or they won't?
Side note: the joke goes that Perl is a write only language as it is difficult to read it and understand it. Some twisted souls decided to create the obfuscated perl content: https://en.wikipedia.org/wiki/Obfuscated_Perl_Contest
For a list of some of the winners: https://www.foo.be/docs/tpj/issues/vol4_3/tpj0403-0017.html
But yes, even that shouldn't be encrypting strings.
e.g. original code:
function NewObject()
{
var mainApiUrl="https://google.com";
}
minified code:
function NewObject(){var mainApiUrl="https://google.com";}
obfuscated code:
var _0x8275=["\x68\x74\x74\x70\x73\x3A\x2F\x2F\x67\x6F\x6F\x67\x6C\x65\x2E\x63\x6F\x6D"];function ahyt56(){var _0xb40bx2=_0x8275[0]}
function a(){var b="https://google.com"}
That's why it's difficult to read minified code even if it's not obfuscated to the further extent that you sometimes see in attack payloads.
function a(){var b="https://google.com";}and insert the URL of the extension, for example https://addons.mozilla.org/en-US/firefox/addon/decentraleyes... .
Should they choose to, nothing stops the site you've linked from masking malicious tidbits in code you request.
It wouldn't fix everything (for example, you could still put a payload in an innocent-looking dependency), but it would at least fix the blatant problem that a maintainer can add code when uploading an extension even if the extension itself is open source and therefore (appears to be) auditable.
[1] https://news.ycombinator.com/item?id=23265699 [2] https://news.ycombinator.com/item?id=16881343 [3] https://news.ycombinator.com/item?id=16317686
(2) Traceability. git has secure hashes, and things can't change when you're not looking.
My experience is that Google cares deeply about its own security, but not much about the security of its users. This sort of change is reasonable, but completely outside of Google's psyche. Google will
(1) Silently disable Android updates, leaving many running exploitable phones
(2) Hold back security tools for Google Apps without a premium subscription. If your account was compromised, you have no way to do audits to understand what happened without $$$, which leads to many more attackers.
(3) Expires Chromebooks rather quickly. Fortunately, unlike Android, it lets users know, but given the target market, many can't afford to upgrade.
(4) Runs appstores full of malware. When malware is discovered, users have no way to know what it did. They're just notified malware existed.
(5) Doesn't allow any sort of reasonable sandboxing of Android apps. If an app asks for filesystem, maps, and other permissions, you need to agree to run the app. I can't have Android give a dummy location or otherwise
Given that the bulk of Google's business model is built on mass surveillance for advertising, with users-as-statistics, this isn't too surprising, but it's something to be aware of if you use Google.
I firmly believe in civil liability for software companies which ship insecure products. They shouldn't be able to externalize costs like this. Follow good security practices, or your insurance premiums go up.
1) Again, anyone who is willing to audit extension code can easily download it.
2) Extensions are auto-updating, so under the proposed solution the git hash would simply update with the new (say, backdoored) code. The fact that the extension is tied to a git commit hash has done nothing to protect you.
If the only way to monetize an extension is to exploit its users for data, this kind of thing is going to keep happening. It's perfectly understandable how someone who is doing a lot of work for no pay will eventually get tired of it or have other priorities in life, which is what happened in this case. Perhaps we all need to stop taking it for granted that browser extensions ought to be free? Or maybe the browser vendors themselves can find ways of financially supporting extension authors. I feel that money is essential to both the problem and the solution.
Of course, paid upfront software gets sold to new owners too. But if the software is paid upfront, the expectation is that the new owner will perhaps do a better job of maintaining and marketing the software, and that's why the new owner buys it. When the software is paid, the new owner has an opportunity to make money legitimately, without secretly exploiting the existing user base.
The problem here isn't exploiting user's data; that is not necessarily bad as long as the user is kept informed and accepts. The problem is that the current maintainers are essentially handing over code execution privileges on millions of machines to an untrustworthy actor and that actor intentionally exploits this to run spyware-like code on those machines without their user's knowledge nor consent.
Sounds like a feature to me :)
e: If there were paid extensions there would be pirated extensions and this problem would be even more common imo :)
When you can't accept money for your work, selling data instead seems to be the only business model for the Internet (sadly)
I disagree. Online commerce has always been very healthy and pervasive almost since the beginning of the web. Payments were never the problem they're sometimes made out to be. "Standards" are completely unnecessary except for the de facto standards of MasterCard and Visa that predated the web.
The rise of adtech is explained simply: many if not most consumers make decisions based on the price of the product, and nothing beats a price of free! If you can offer a product that's free and still make a profit from it by selling ads, then you have a huge advantage over non-free competitors. For physical products, that's nearly impossible, but for virtual products it's quite feasible.
Paid upfront software has a long history on the web, despite the Orwellian revisionism of the App Store apologists who want to erase the past. Even paid upfront software plugins sold on the web have a long history. Web browser plugins and extensions, on the other hand, have tended to be free. This may be the result of most web browsers being free, or included with the operating system. Firefox is free, Chrome is included with Android and free otherwise, Safari is included with macOS/iOS, Internet Explorer was and now Microsoft Edge is included with Windows. The browsers themselves never made a point of taking payments, and so browser extensions were never really designed by the browser vendors with taking payments as a priority. It's kind of an historical accident, but one the browser vendors don't seem to be interested in correcting. Although now for better or worse, Safari web extensions can only be distributed via the Mac App Store.
Actually, in the very early days of the Web, I was personally ridiculed by advertisers I approached with the idea of advertising online. Almost every single one I approached stated quite clearly that they were certain the web was "just a passing fad" and that "normal" people wouldn't be interested in it. They all thought advertising online was a waste of time an money.
Somehow we've gone from that to pretty much the entire advertising industry having convinced the world that the Internet could not survive without online advertising, and that they somehow have a right to spy on us all to achieve their ends, and almost nobody seems to care that we've been giving away more and more of our privacy to these unsavory characters.
"'Standards' are completely unnecessary except for the de facto standards of MasterCard and Visa that predated the web."
The web (and the Internet in general) would not exist as it does today, were it not for the existence of agreed upon standards. The entire infrastructure of the Internet is built upon standards of communication which ensure that communication between devices is even possible. Without those standards, it'd all fall apart at the seams.
"many if not most consumers make decisions based on the price of the product, and nothing beats a price of free!"
Actually, during the time I speak of above, it was also extremely common for most people to think that "free" = "garbage", and that only paid products were worth a damn. If something was given away for free, it was either a trick to get you to buy something, or it was something you wouldn't want anyway, because if it was worth anything, then it wouldn't be given away for free.
There might be a way of contesting the rights to the project name but that would require legal activism and external funding. Basically the original project is dead insofar as the contributors are not comfortable with supporting a parasitic and probably malicious actor. I guess a fork is inevitable. Meanwhile the parasite will harvest the value of the 'brand', distribution rights, and existing codebase until it is drained by obsolescence.
A really disgusting way to treat a community by both parties. One can only hope that Mr. Oemcke desperately needed the money for some vital purpose.
I mean, just thinking potential threats (which now I'm removing the extension because of them):
-- corporate web pages potentially sniffable if installed on work computer
-- personal passwords, password manager traffic
The potentially malicious actor is able to just scoop up any domain's encrypted traffic, isn't it? Or is there any practical assurance that they're only gathering domain names, high level traffic stats, etc?
How do you handle a situation like this, where an extension was previously trusted (and would therefore have passed your vetting procedure), then acquired by somebody else who is apparently malicious? Do you review every new version?
> Most allowed are owned by large companies.
He was implying that big companies are not in the business of selling their extensions. Smaller actors are more susceptible to this.
https://github.com/NanoAdblocker/NanoCore/issues/362#issueco...
Assume that any time an app has privilege to access your data, they are going to do it either deliberately or accidentally.
This can come either because the proliferation of *analytics, broad openness of supposedly sandboxed systems, needless availability of fingerprinting methods and lack of proof of privacy commitment by the vendors (and any published privacy policy is not enough), or because I just became too paranoid (or both?).
Examples like these validate the suspicion that you can’t trust any app or plug-in anymore, with big vendors being in a inbetween position of “too big to lose trust”.
I wonder when we will reach the point where there is no trusted web browser anymore, no trusted computer appliance. When will it be that you cannot even say a word to a person in-person anymore because it lands in a weakly secured cloud by the microphone inside their smartwatch that runs a weather app that is run by crooks. Or is that point reached already?
I believe it can already be the case with Google’s (and possibly Facebook’s) apps on Android—at least in case of Google I witnessed real-life tests showing how saying something in presence of the phone causes related ads and content to be shown in feeds—but it’s scarier with less scrupulous app maintainers.
Disclaimer: I am not claiming that Android API grants all apps unauthorized access to always-on mic. The device in question was configured to enable continuous listening by the owner. I am not claiming voice recordings are stored or used in nefarious ways.
I can’t see how this is fear mongering. Device was not acting against owner’s will: that person specifically does not tighten relevant privacy settings and enables always-on mic because they see useful content suggestions as a feature.
It is different from my outlook (and I take it yours too), but I think that point of view deserves the right to exist.
The issue is that now when I am talking to someone like that in real life, I know I may be implicitly agreeing that Google would pick up my speech as well. It’s a clash similar to one between a person (e.g., my mom) who grants messenger apps full access to their phone’s address book for convenience, and their contact (e.g., myself) who does not want their information to be shared with Facebook et al.
Addendum: a cursory search confirms this experience.
— https://www.vice.com/en/article/wjbzzy/your-phone-is-listeni...
— https://www.makeuseof.com/tag/your-smartphone-listening-or-c... (2019)
— https://www.quora.com/Does-Google-listen-to-my-conversations... (the first answer does not mention ads, but others share similar experience to what I saw)
— Counterpoint: https://www.bbc.co.uk/news/technology-49585682 “phones that secretly listen to us are a myth” (2019). Notably, with all my respect for BBC, this article lacks a lot of context (did they turn off voice activation before testing? what were their privacy settings?), and to test devices listening they played commercials in presence of the phone rather than using voice (I have relatively high confidence that modern devices can easily distinguish between speech nearby and sound from a commercial before recording leaves the phone).
Some sources claim that as of last year Google is changing the way their apps work. Not sure if they stop listening or stop showing relevant content.
(I don’t personally own an Android phone, and even if I did I would have turned off virtual assistants & disabled always-on mic just as I do with my iPhone, so I wouldn’t be able to present first-hand proof.)
Maybe read up on the concept of "extraordinary claims requiring extraordinary evidence"
Every company vehemently denies this is possible.
Regarding iOS, I hadn’t observed ads obviously based on what I spoke about in presence of my iPhone, but then I don’t use voice-activated Siri and generally tighten up privacy settings.
(Similar to Vice’s article I linked, but faster.)
Again, the owner of the device saw that as a convenience feature and consciously did not set the phone up to prevent it, which made me feel a little old-fashioned and unnecessarily paranoid.
Also, unlike Vice’s article, in the scenario I have witnessed the recording did not necessarily have to leave the phone: the news app could have kept a large cache of recent articles and locally pick the ones matching the %SUBJECT% that we spoke about.
I am inclined to believe that Google, given their business model and scale, is unlikely to store voice data insecurely or insufficiently de-anonymized, so I’m primarily worried about third-party apps getting access to always-on microphone without visual feedback. (Hopefully it’s not very likely and app stores have tools to detect nefarious uses of relevant APIs at review stage.)
As a person who's made a living the last few years working in the guts of Android on embedded devices, there are so many holes in this way too common myth that phones are listening all the time.
You don't even need to dive into the technical aspect of it, what on earth is the risk reward here?!
Risk: Forever break the trust people have in your devices, this isn't some grey area intrusive tracking that would just get swept under the rug...
Reward: Get noisy info about people's interests when you literally own the device that contains more information about than their own short term memory does!
It's nonsensical, and there's no way that Google could do this that wouldn't already have been caught.
I mean is the theory that all Google devices do it and somehow no OEM has realized their microphone is getting accessed? (Because even with the lowest level access on the device, modern microphones are not so unsophisticated, there's no universal way to access it in a way a manufacturer wouldn't catch onto sooner or later
Or Google did this but only on phones they own or something?
It's nonsense.
There is no proof it happens, and no proof it doesn’t happen, because it’s non-trivial to detect based on network activity. The only evidence is observing content relevant to what was being spoken about being suggested across apps.
> Risk: Forever break the trust people have in your devices, this isn't some grey area intrusive tracking that would just get swept under the rug...
Reward: get people to love your services for relevant suggestions. Believe it or not, there are people outside the extra privacy-conscious bubble who do not at all mind their devices listening.
> Or Google did this but only on phones they own or something?
I am pretty sure this depends on software. I have seen this demonstrated on a Google-branded phone with a Google app.
Like I already pointed out this is nonsense.
Always on listening even with perfect parsing would INCREDIBLY noisy. There are a million and one reasons for a term to come up in speech. The simplest conversation could surface hundreds of targeting terms.
Meanwhile they literally own the device and the services most people use. They have your search, they have your email, they have social graphs. They can literally make inferences before you even think to talk about them with other people! (and we've seen this happen before with things like disease and pregnancy reveals)
We're at the point where most people's cell phones hold more personal data than they could even recall on demand.
So why on earth would they go and muddy all that easily weighted data with noisy data like everything you say, literally every other form of interaction is already giving them better more concise information about you...
-
> There is no proof it happens, and no proof it doesn’t happen, because it’s non-trivial to detect based on network activity. The only evidence is observing content relevant to what was being spoken about being suggested across apps.
I can't believe people are entertaining this kind of stuff on HN.
You make an unreasonable claim... then act like because you yourself can't prove your unreasonable claim it should be entertained? What?
That's not how that works. You have no actual proof for your unreasonable claim... then that's it. It ends there. The burden doesn't suddenly fall on others to prove the contrary!
Come back with even a modicum of proof. Literally any real proof other than anecdotes where the ad companies who literally have almost all the data in your life anyways are able to come up with topics you're interested in... and maybe someone will entertain this.
And no, talking about something and getting an ad for it after is not proof any more than having a leaf fall on your head while you stand under in a mid-autumn forest right after you whispered "gravity" is proof that the forest is listening to your words.
FWIW there’s a technical paper[0] that summarizes existing studies as of 2019, and it’s been neither definitively proven nor disproven that it happens. Turns out it’s not at all that trivial to detect.
From the paper:
> Perhaps most importantly, Pan et al. were not able to rule out the scenario of apps transforming audio recordings into less detectable text transcripts or audio fingerprints before sending the information out. This would be a very realistic attack scenario. In fact, various popular apps are known to compress recorded audio in such a way [10, 33]. While all the choices that Pan et al. made regarding their experimental setup and methodology are completely understandable and were communicated transparently, the limitations do limit the significance of their findings. All in all, their approach would only uncover highly unsophisticated eavesdropping attempts. …
> Therefore, the fact that no evidence for large-scale mobile eavesdropping has been found so far should not be interpreted as an all-clear. It could only mean that it is difficult – under current circumstances perhaps even impossible – to detect such attacks effectively.
(Apparently, noticing relevant content being obviously suggested is the only way of detecting it at this time, and of course it comes with its own caveats.)
[0] https://link.springer.com/chapter/10.1007/978-3-030-22479-0_...
For sure, it’s an arms race between ecosystem’s root vendor and app developers, but the possibility of vendor itself using some privileged APIs that do not provide visual feedback is also a concern.
Until they get caught. They they issue a wishy-washing non-apology and put out a press release stating "We can do better."
We've been to this rodeo before.
In case of my friend showing me this, this happened a few months ago and I can’t remember exactly how the demonstration went. I’m inclined to believe there was no hotword activation, as I remember myself being quite startled (at that point I disbelieved that a phone can be listening and suggesting relevant content right away), and as you noted with hotword activation it would have been markedly less surprising.
> For your smartphone to actually pay attention and record your conversation, there needs to be a trigger, such as when you say “hey Siri” or “okay Google.” In the absence of these triggers, any data you provide is only processed within your own phone. This might not seem a cause for alarm, but any third party applications you have on your phone—like Facebook for example—still have access to this “non-triggered” data. And whether or not they use this data is really up to them.
If listening constantly was widespread it would have a dramatic effect on power consumption - and so battery life - and be noticed.
Since complex voice-recognition (of other than the activation hotword) is done off-device, you will be able to see network traffic as a result of this occurring. That's quite simple to check for.
Wrong. It’s been feasible to do on-device for years[0][1].
> That's quite simple to check for.
It’s also quite simple to check that it happens, if you have a Google phone. It’s been done in front of me last year[2]. It’s been demonstrated to happen by other people than me, so you don’t have to rely on my word here[3].
> a single person, ever, would have been able to furnish evidence of how this actually works.
I don’t think it’s easy to show how this works under the hood, since speech can be recognized on device and devices communicate with remote services very verbosely over HTTPS (probably with certificates pinned to prevent MITM) making it non-trivial to distinguish that traffic from background network activity. Recognized speech data doesn’t have to be communicated in real-time, in fact it would make sense to wait and batch it with other requests for efficiency.
(There’s a technical paper[4] that summarizes research in this direction as of 2019, and turns out it’s not trivial to definitely prove or disprove based on network activity.)
[0] https://ai.googleblog.com/2019/03/an-all-neural-on-device-sp...
[1] https://medium.com/better-programming/ios-speech-recognition...
[2] https://news.ycombinator.com/item?id=25622659
[3] https://www.vice.com/en/article/wjbzzy/your-phone-is-listeni...
[4] https://link.springer.com/chapter/10.1007/978-3-030-22479-0_...
A number of other anecdotal experiments, such as one performed by myself, failed to show this behavior. A more tightly controlled but still informal experiment by a vaguely related security firm failed to find this behavior[1]. An academic effort by researchers at Northwestern failed to find this behavior [2]. This is by far the most thorough academic effort on the topic I have seen.
Facebook has clearly denied it [3]. Google has not issued such a clear statement but has been reasonably open about changes in their policy on voice data [4]. After considering the issue from several angles, P. J. Vogt concluded that no such thing happens [5]. Even the paper you cite notes the total lack of evidence.
Perhaps most notably, almost all of the popular media reporting that bears headlines saying that your phone is listening to your conversations, actually say no such thing when you read the article. Instead they are talking about analytics on voice assistant activations and, frequently, voice memos in Facebook Messenger. Amusingly I've run into two cases where popular press had to issue retractions or corrections after they said that smartphones were always-listening.
The only serious sources I have ever seen assert that this is happening are Vice's Sam Nichols based on Dr. Henway. Henway makes some very specific claims to two different reporters but provides no explanation of how he came to that knowledge. To an almost comical extent, nearly all reporting in favor of this theory (that even claims to have a source) is based around the exact same quote from Henway, who has never published anything formal on the matter or even really elaborated beyond a single paragraph. Nichols only performs a very basic experiment and it is easy to come up with other ways he may have gotten the result he did - in fact, the experiment he performs is nearly identical to the ones performed by others that have failed to show results.
Look, I'm not totally unreceptive to the idea that this is happening, but I don't like people repeating the assertion-as-fact that it is a widespread behavior when major tech companies that have denied it, and no real evidence has ever been amassed to show that it does happen.
Just my opinion, but... well, just all of our opinions. Let's be careful about calling them facts.
[1] https://www.wandera.com/phone-listening/ [2] https://www.ftc.gov/system/files/documents/public_events/141... [3] https://www.forbes.com/sites/amitchowdhry/2017/10/31/faceboo... [4] https://www.theverge.com/2020/8/5/21354805/google-email-audi... [5] https://gimletmedia.com/shows/reply-all/z3hlwr
As to facts, I am not a security researcher myself, so I linked to articles when I encountered such a vehement rejection of my personal experience.
If you are calling me out in what I observed, then you are saying I am delusional or lying.
Google is changing their policies and the News app behavior, so I don’t know whether the experiment I witnessed is reproducible anymore. but I am reasonably sure that they would choose to stop showing relevant content as obviously but keep mining data, as it ultimately aligned with their business model.
> A private conversation with a friend about how I’d run out of data led to an ad about cheap 20 GB data plans
> Suddenly I was being told [sic] mid-semester courses at various universities
I absolutely belive Facebook can find system information like data caps, or can read notifications (as they explicitly ask for this to auto-fill SMS-based 2FA logins). As far as being in the same location as your buddy you took a trip with, that's a lack of imagination on the advertisers part - you get ads to return to Japan the same way you get ads for the vacuum you just. bought. As far as the writer possibly going back to school? I'd say many writers enjoy writing - so many, in fact, that prices have been depressed for decades. I'd assume many writers have to return to school and change careers.
Is it possible Facebook is listening? I won't dismiss it without at least reading the article. But the linked article reads like the author believes people are unique and, while they are, they're also far more predicatable than we like to pretend.
Doing this enough times I can mostly predict the result by just looking at the app and who's behind it so I no longer bother with apps and stick to the built-ins whenever possible.
Can’t it talk to its own servers that then talk to Facebook, in which case packet capture is of not much use?
Furthermore in the name of pragmatism I am not opposed to all ad targeting; some of it is indeed outside of my control. However, there's a difference between sending a name/email address combo once during signup and having the advertising SDK ping the advertiser every single time the app is interacted with (which is what the Facebook SDK does for example); the former only leaks "I use X service" once to the advertiser, the latter leaks a detailed trail of my usage patterns & IP addresses (can be used to correlate where I've been and who I'm hanging out with if their own phones are connected to the same Wi-Fi network and thus share the same IP).
1. Mining the users' traffic and reselling it as market research, or
2. Using the users' computers as a pool for a residential proxy service, or
3. Replacing and inserting ads into users' browsers.
This is unfortunately quite common.
If they hobble that, though, a large portion of extensions become useless. I don't personally see any real middle ground. It's either a credible risk, or too complicated for practical use. The way manifest v3 hobbles practically required things like heuristics is a good example.
There instead should be clear APIs for some access to page content (for example, right-click context menus, tab control without content access, etc).
The idea will probably be met with opposition because I didn’t explain it well enough, but maybe someone will get the idea hah.
I’ve worked on large chrome extensions that heavily rely on hacking UI on top of page content and it’s truly awful. Everything you do feels liked it will break at the setup of a feather, because it does. Sure, there are some ways of making that LESS painful, but at the end of the day it will always be dirty hacks.
1. Demand removal of analytics software 2. If no action, fork and re-publish.
Obviously folks who aren't technical/didn't see these threads wouldn't get the benefit of an update.
This is something where an explicitly pro-opensource and anti-tracking (or at least minimal tracking) policy by the browser extension stores would be valuable. The store itself could recommend the no-tracking community version instead. Of course this would have to happen on an individual basis and be carefully managed as so not to be abused.
https://github.com/aciidic/thegreatsuspender-notrack
Plus you can download the old 7.16 version which works fine and doesn't have the suspicious changes
https://www.windowslatest.com/2020/09/17/microsoft-edge-slee...
TGS caused issues resulting in loosing pinned tabs in Brave and Vivaldi and so I had to remove it there; Now I'm glad I had to do it.
I receive almost-weekly messages from folks offering to buy my extension.
https://add0n.com/tab-discard.html
https://addons.mozilla.org/en-US/firefox/addon/auto-tab-disc...
https://chrome.google.com/webstore/detail/auto-tab-discard/j...
We should really have separate dedicated browsers just for doing transactions.
I’d also like them to not silently update in the background.
In doing so, I lost about 60 suspended tabs, with no record in history as to what they were.
In some ways, this is like a weight off my back. On the other hand, I was going to read those tabs, I swear!
Oh well, time for me to search jstor for a history of copper mine consolidation, again.
Speaking as a long time paid user of the free/paid Tabs Outliner, I can't recommend it strongly enough.
[0]https://chrome.google.com/webstore/detail/tabs-outliner/eggk...
Unloading entire subtrees and restoring them on other computers is also a nice feature that I don't want to miss anymore.
The extension is closed source, and its dev sometimes needs a few weeks for important fixes, but it is still one of my most favorite browser extensions out there.
I mean except the integrity of extension developers.
This is a huge issue and Google is doing absolutely nothing to address it.
I encourage people to disable all chrome extensions. They have unprecedented access to your data (they can read your bank credentials), and they are a big performance hit. e.g. using Chrome Devtools you can see that Lastpass doubles page load times.
You can use SimpleExtManager (only has perms to turn on /off extensions) to turn everything off until you need them.
I wouldn’t install any extension permanently. I only keep Lastpass and it’s disabled until it’s needed for login.
This Extension being GPLv2, is there a way to report this obvious license violation to Google/GitHub? Would they care?
We basically only look at the top level of things, when instead, every branch in the tree should have a bunch of security people watching it, like editors watch every change to a Wikipedia article, before it goes out.
Corporations using automation and technology have hijacked our "Free Speech" ideals, and caused us to think that it's a good thing when one party can push out a tweet to 5 million people at once, or a single corporation can buy up local stations and enforce talking points on journalism. That's not freedom of speech at all. That's just a preference for maintaining entrenched power because someone "amassed it voluntarily"... and this mentality extends recursively all the way down ... Take for example the first Twitter mega-celebrity. Ashton Kutcher himself amassed it voluntarily because he was chosen by TV and movie executives once upon a time, to be used in mass media, and their platforms were "voluntarily" built in the past, from the invention of the TV, and people subscribed "voluntarily", and Twitter was built "voluntarily" and funded by VCs voluntarily, and so on. And the end result is, some power (in this case, audience) is concentrated in the hands of a few people, who disproportionately act as kingmakers for various other people and ideas. That's also how we get "too big to fail" issues in telecoms, banks, and so on.
In science, things work differently. Arxiv.org exists but peer review is a big thing. Wikipedia has multiple distrusting parties for each large article. So does Bitcoin (presumably, anyway).
In general, the more value (votes, data, code, money) accumulates in one place, the more "checks and balances" you should have for each release. You can't just have someone push out something in the middle of the night and have everyone pull it into their codebase via npm and then "launder" the (malicious) bugs through more and more releases. You need it to go through "peer review", and not on the top level of an entire tree, but rather, for each subtree there need to be people who understand what's going on.
THAT is a society that's far more secure, that can't be easily backdoored by some hackers paid by a state to find vulnerabilities. And the capitalistic system we have today is pushing the other way (closed source, centralized databases, extract rents reward early investors through information asymmetry, etc.) and the result is stuff like SolarWinds, Equifax hack, Yahoo hack, etc. etc. etc. We're finally starting to put a tax on storing data without an explicit purpose, hopefully that will make it expensive enough that people will be custodying their own data at least. But when it comes to "broadcasting" things, I'd rather have less "real time pushes" and instead slow things down until we can "run byzantine consensus" gradually releasing to the public via concentric circles.
The full solution would involve Merkle trees where some security organizations and researchers / peers (anonymous or not, but with reputations) sign off on each changeset. Instead of just Apple or something. Git + Verified Claims can already support most of the infrastructure, btw.
This barely works for open source software (how many open source projects have people auditing every commit?). How will it possibly work for closed source software?
I'm talking about:
Wikipedia beating Britannica and Encarta
The Web beating AOL / MSN / Compuserve / Prodigy
Apache and NGinX beating IIS
Linux beating Windows for tons of apps & archs
Science beating Alchemy
But it will take time. Open source collaboration is the tortoise, closed source competition is the hare.