Hacker News Reader

Comment by perihelions | Hacker News Reader

Some discussion happened here (issue closed by owner):

https://github.com/d2phap/ImageGlass/issues/1252

The malware (at the very least) makes the user's machine the exit node of a commercial proxy service, without users' knowledge or consent.

In the repo maintainer's own words (in a "privacy" menu setting that was enabled by default):

>"Share devide IP with Spider.com customers to pass traffic through your device."

>"Learn more about privacy policy at {0}. To opt out an option, you can uncheck it, then click 'Save' or 'Apply' button below. It will be disabled immediately."

https://github.com/d2phap/ImageGlass/blob/51f9f5eaa17f6fc42e...

View on HN

>Before this integration, I made an announcement to poll people's reaction on ImageGlass discord server for the first release of IG Moon. There were very little comments, I guessed people were fine with the changes, it's been there for 2 weeks.

I've seen this exact attitude before. It's always interesting to me when a developer like this announces huge changes exclusively through a channel that it turns out most of their users aren't even aware of.

>There’s no point in acting surprised about it. All the planning charts and demolition orders have been on display at your local planning department in Alpha Centauri for 50 of your Earth years, so you’ve had plenty of time to lodge any formal complaint and it’s far too late to start making a fuss about it now. … What do you mean you’ve never been to Alpha Centauri? Oh, for heaven’s sake, mankind, it’s only four light years away, you know. I’m sorry, but if you can’t be bothered to take an interest in local affairs, that’s your own lookout. Energize the demolition beams.

-Hitchhiker's Guide to the Galaxy

I just use “Beware of Leopard!” as shorthand for this phenomenon.

Let's be honest, even fewer would have reacted to some Github Discussion or Issue trying to discuss the object.

As I see it the dev asked the void and got no negative feedback.

Afterwards the void grew legs and started running after him

It's worse than it seems.

The very first mention of "spider" on that Discord was already the release announcement of a version containing it and got negative reactions: https://i.imgur.com/gLKce8W.png

I skimmed through the dev's messages prior to that (not many) and couldn't find anything else related.

I believe "I made an announcement to poll people's reaction" is intentionally deceptive wording to imply they made a poll beforehand, but they're actually just referring to the release announcement. Same with "There were very little comments" which misses out the fact that all those comments were negative, and there were few comments primarily because it's a small unknown Discord server.

Spider (.) com claims to have access to 70 million residential IPs

How is this legal? And who even uses it?

Scrapers - it's hard to detect bot traffic mixed in with a regular residential IP address

They sure have a fancy website for such a scummy operation

One may often hear the expression "if you're not paying, then you're the product" for websites, but in the case of "free VPN" (or maybe even very low cost ones), it's my understanding that's how they're free to the user: because they're paid by folks who want residential IP egress

I'd guess any such VPN can even put in their ToS "you grant $company the ability to send and receive traffic from your device" which wouldn't raise eyebrows in the same way such a clause in an image viewing binary would

I don't know how many VPNs do this but Hola and BrightVPN do, they both make you a Bright Data exit node.

See also https://brightdata.com/ (formerly Luminati Networks) which does the same hting but with Chrome Extensions.

I always tell people to watch out what extensions they install, the webstore is a minefield

Should be noted that developer has already removed malware right after feedback.

New version has been released.

That's something. I'd still _never_ use anything this developer ever writes though.

Saying you are responding to user feedback is like punching someone in the face and then saying surprised "Oh, you dont like that? Sorry I wont punch you directly in the face again!"

I agree completely.

Reading the issue it seems to have been removed in the latest version.

On a semi-related note: Woof, issues like that make me want to never do open source again. Did that guy make a mistake? Obviously. Was it in good faith? It seemed so. Were people jerks even after he fixed it. Absolutely.

The guy deceptively enlisted thousands of users into a botnet without notification and likely through auto-update mechanisms (such as the Windows app store). That sounds criminal.

It’s not auto updated on windows, it’s an annoying pop up suggesting you go download a latest version, thankfully

From the guy:

> ImageGlass Store version is not affected.

Does the Windows Store not allow you to sneak in proxies to user machines?

It's paid for, so I guess it would be in bad taste to have that included. At least the free one you can argue it's ad-supported or whatever.

"ad-supported" and "malware" are not the same thing.

Maybe the author is located in a country with weak cyber crime laws (and does not intendl to leave it).

IIRC the author is from and lives in Vietnam.

The author added malware to the project. That's about as user hostile as it gets, and hostility breeds hostility.

A reverse hostility sandwich, if you will

xD fixed the typo

Shipping malware is not a mistake. The amount of people simping for this guy is unreal.

"Poor guy doing open source takes dumb decision because they need money" is a sorry excuse I've been hearing too much lately.

And quite distasteful when many people have collaborated on your software. If you deserve some compensation, what about all of them? Will you share whatever you earn from it?

> And quite distasteful when many people have collaborated on your software. If you deserve some compensation, what about all of them? Will you share whatever you earn from it?

Most contributions are from drive by contributor's that may not even use the project.

Neither those nor the maintainer are entitled to compensation, but open source is a cruel environment where people want to use what you made but they wouldnt give you a dime unless they had to

Maybe it’s time we re-examine the value prop for open source authors

Everyone knows their value prop going in: unless you are able to monetize the complement like RedHat or Google, payment is in experience, reputation, and a fun challenge.

Very idealistic people might not realize this as they start working on their project.

I wish it was otherwise, people, but it's usually "build it and they WON'T come" ("they" being the funds needed to make a living.)

Payment can also appear in the form of collaborators helping improve a tool you want for yourself, especially if you choose the right license.

I was struck by the stark difference in tone among so few commenters. There were firm, constructive, factual feedbacks, and aggressive, inflammatory personal attacks (“how can anyone trust you?”). Laid bare like that, it is so obvious which approach is better and most effective. Obviously the maintainer made a terrible decision, but there’s a right way and a wrong way to suggest correction.

We need more martinlindhes in open source and fewer Yakabuffs.

Well, it's a good question. How can you trust someone who thought this was okay? Even if they're just too ignorant to realize what they were doing, that's also a good reason not to trust them. What else will they think is a good idea?

These are all legitimate questions, but when you phrase them that way and address them to the maintainer, consider how the message will be received. He is likely to consider it an attack, and will be tempted to mount a defense. Now, instead of a constructive problem-solving discussion, you have a destructive battle—one that does not move things forward towards the goals: removing the change and preventing further bad decisions.

There is no constructive criticism possible and no possible further relationship. If I'd been a user of this project, I'd be reformatting my PC and restoring from backups, and the nasty message I'd leave on github would only be intended to warn others away from this toxic person's code.

If someone conspired to enroll my computer in a botnet, constructive problem solving would not be the first thing on my mind, and in fact I don't see how it could be my responsibility. If I fuck up very badly and people are mad and unconstructive, that's unpleasant but the problem is my fuckup, not people being mad about it in the wrong way.

It seems to me that it's up to the author to explain why the project can still be trusted, they can't just do this and expect that people will still trust them just because they reverted it.

You are right.

everyone makes a mistake at some point and the fact that the dev used the ip hijacking service's name in the commit message to me signals that he wasn't aware of how shady it is

Even if he was, a comment like "I don't think this is acceptable and will fork" is a lot more appropriate than "don't talk shit"

You have it backwards. Open source is the reason why it was detected. Closed source would have made it extremely hard to find.

For the poster you're responding to, I get the impression that their main goal is to avoid dealing with angry users, so people not noticing the change would have been a feature, not a bug.

How do you conclude that quietly integrating malware into an image viewer was done "in good faith"? Because the author didn't twirl their mustache when they did it and claimed surprise that people were mad?

Hell no it was not in good faith - if this makes you think that you shouldn't do open source because of people having malware patched into their system to profit some guy, please, never do it.

> Did that guy make a mistake? Obviously. Was it in good faith? It seemed so.

Adding unwitting users' computers to a proxy network by default is so obviously and blatantly unethical, it beggars belief. I'm not angry at the creator, because they seem oblivious. I am, however, extremely saddened and frustrated by their obliviousness. Like in no universe is it ever OK to do this even if nobody responds to your discord poll. It takes a real failure in responsible, ethical upbringing to get here. It takes a lack of consideration and empathy for other people to believe that including this isn't an act of aggression towards everyone who encounters the software.

I personally have a very hard time believing they are oblivious. It’s a literal caricature of malware. There is no way one could think it wouldn’t cause this kind of reaction. The best one could hope for is that people don’t notice.

I want to be able to agree with you, but too much of the world is poisoned by toxic "me before you" society. There's a high probability that this person just never learned to recognize and challenge behaviors like this. So, maybe, but also maybe not. Either way it's sad.

Looking at how he named the commit that introduced it.. it just stinks, looks like it's trying to go in unnoticed.

Or sadly, that commit log standards are nonexistent and don't have to describe the changes and be misleading, it's one of those.

> Like in no universe is it ever OK to do this even if nobody responds to your discord poll

As far as I can tell, they didn't even really make a Discord poll.

The first mention of "spider" (or "IP" or "proxy" or any related words) is from the release announcement of a version which already contains Spider, which got negative reactions: https://i.imgur.com/gLKce8W.png

It's very deceptive wording since "I made an announcement to poll people's reaction" is technically true, but it wasn't a poll or before the changes were made as is implied. Same with "There were very little comments", which leaves out the fact the comments they did get were negative and the low quantity is just from it being a small unknown Discord server.

>Was it in good faith?

On what planet could this be considered good faith?

This is not a 'good faith' action. It is a way to try to monetize your users bandwidth in a way that exposes them to liability. It is so far across the line that it is sad that that needs to be explained.

Reply on news.ycombinator.com