Hacker News Reader

Comment by mschuster91 | Hacker News Reader

I hate silent takeovers so much. Chrome developer extensions are another very popular thing for bad actors to buy out and replace with malware, and it sucks.

View on HN

As a maintainer of a semi-popular chrome extension[1], I receive so many buy-out offers that I started publicly collecting them[2] for everyone to see.

[1] https://chrome.google.com/webstore/detail/hover-zoom%20/pccc...

[2] https://github.com/extesy/hoverzoom/discussions/670

A Firefox equilivant: https://addons.mozilla.org/en-US/firefox/addon/imagus/

Well, Imagus also exists for Сhrome. And I do publish hoverzoom+ for Firefox and Edge as well.

I LOVE Hoverzoom. You must resist so much, since the app does require deep access.

That's exactly why it is a desirable target for would-be malware distributors.

you're one of the goodies. thank you.

what is the difference between hoverzoom and Imagus?

>I hate silent takeovers so much.

This is a great app idea. Monitor the app owner. If the owner changes overnight, alerts to the moon.

Until we learn that this monitoring app has itself been acquired. /s

Or if the browser companies themselves were owned by large corporate behemoths!

Wait…

Obviously don't narc on yourself!

Who watches the watchmen?

Have we finally found the killer app for blockchain?

Another set of watchmen.

... unless they conspire together. Ugh.

It's watchmen all the way down.

Watchwomen by a process called nagging.

They would just change the acquition details to avoid changing the owner and giving the account credentials over instead.

Yes, maybe. In this case, it would be a very actionable alert.

wouldn't they just buy the account/password and not let google know?

That's the problem with free apps. Very few people want to donate, no decent company is interested in buying the app and making it profitable, so all that's left are the worst kind of companies who buy these extensions and apps to exploit the users.

All these free apps have value but unfortunately it doesn't translate to any income for the developer so they find other ways.

And their values are what exactly? They offer something for free with no reasonable expectation of compensation then rug pull by selling out. It’s hard to be sympathetic. If you want to get paid to write code then get a job writing code.

Conversely, since it's free do they not have a right to sell their app (even if selling it to someone evil is dickish) just as they have a right to decide to "update" it to remove well-liked functionality? Or just as they have the right to update it to add ads that support the dev of the app?

People/users will complain about all of these. I've especially seen people complain about ads; the only real issue I see is when there's no alternative to ads provided (ie subscription, pay a couple dollars to buy a copy of the app, etc). It's Google's mistake, tbh, as that's the common rhetoric with Youtube, people got it for free for too long to be happy with more ads. Blame the people who're uploading "120 hours of black screen" multiple times per day.

Couldn't this happen to paid apps just as easily?

If the developer is well paid, probably not? Why would they throw away what they built for a lump sum if they have decent side-business and recurrent revenues?

For me, StackOverflow proved that literally everyone has a price. The world is hurtling full-speed towards the corporation-citizenship cyberpunk dystopia people have been writing for years, as every company buys up everything they can in order to stay "competitive."

If I offer you 100 years worth of revenue for your browser extension are you really not going to entertain the idea of selling?

Sure but they probably won't offer that much. What I mean is that the value of this app, despite being free, is not zero, but that's probably what the developer was getting. So even if he got 10K for it, he's happy and moved on.

The app originally set the desktop theme to dark mode or not. That’s not worth more than a single one dollar payment, if that.

If I want to do some shady app shit I am buying install base. 100x an app that makes a few grand a year could still be worth it for my nefarious purposes.

Given a sufficient lump sum that guarantees I no longer have to work, my morals can be easily bought.

Seems like a developer that is getting literally nothing for his app or plugin is more likely to sell it than a developer that's getting some income from it. At the least, the buyer would need to match the current value that the app provides its author.

I don't know.

A developer who didn't charge anything from the beginning has more likely other motives releasing his software than making money.

But if you already make a little money you may easily fall for a lot of money.

I mean, everyone's gotta eat. I think there's plenty of instances of someone building a tool that they personally find useful and then making that tool available for free, unsure of what the reception will be and not expecting a lot of users. But if that something does very well and finds a wide audience I think it's natural to try to earn a living from it. And, if the attempts to "monetize" fail (as they often do) and someone is offering a lot of money in a lump sum to take it off their hands, well frankly I think they'd be foolish not to take it. And if that arrangement happens to turn out poorly for the userbase, well hopefully that will be another small object lesson in paying for things you find useful, when politely asked.

(And yes, I'm aware that's a lesson that really should have been learned by now, if it was going to be learned at all. Alas.)

I think it starts with passion - he created some useful software, he shares it and initially enjoy working on it. Then he puts a donate link (I saw there was a donate link in the previous site), and gets almost nothing, but he still needs to add bug fixes, maybe new features, answer to the user's emails, etc.

After a while it becomes a chore... and still getting $0 out of it. And that's when he might want to find other ways to get something out of the efforts he put in. Unfortunately the only option is to turn it into malware since nobody wants to pay for it, or turn it into a decent profitable business.

Look at Red Shell for example:

https://www.polygon.com/2018/6/20/17485762/red-shell-spyware...

I don't have a link handy but I distinctly remember Take Two, a giant corporation with billions in revenue, saying when they removed it from Kerbal Space Program that they promised to wait a while and be more subtle next time they did that.

It's a problem with "free as in beer" apps but not with "free as in freedom" apps.

When the packages are built from source code by a trusted distributor like Debian or F-Droid [1], this kind of change is likely going to be noticed by the packager and not let through to users.

[1] https://f-droid.org/

It's not a problem with Free apps. If you're forced to redistribute the source code, it heavily disincentivizes attacks like this.

ActionDash being bought by Sensor Tower comes to mind. One of the most invasive apps requiring insane levels of permissions (rightly so to perform system level functions) being bought out by an ad and data-selling entity seamlessly is absurd

<libertarian> What's silent about it? It's right there in the TOS, which you agreed to by using the software. Caveat Emptor, and all that. </libertarian>

<dictionary> silent: tending to speak very little: not loquacious <dictionary>

If the buyer alone was responsible, there would be no terms of service. It's only with community protections and regulations that you get the information required to attempt to make an informed choice. The same community should be empowered to drive normal ethics without it being overtaken by the 'drivers licenses are tyranny' crowd.

The perfect market will solve this and if it doesn't it's the users' fault for not having perfect information!

Reply on news.ycombinator.com