Hacker News Reader

Comment by amadeuspagel | Hacker News Reader

The root problem here is that there's no legitimate way to monetize browser extensions. Extensions are meant to be simple, so it's hard to sell premium features. Extensions usually don't "own" any space to embed ads in.

View on HN

There used to be.

https://developer.chrome.com/docs/webstore/money/

"The web has come a long way in the 11 years since we launched the Chrome Web Store. Back then, we wanted to provide a way for developers to monetize their Web Store items. But in the years since, the ecosystem has grown and developers now have many payment-handling options available to them."

Another failed Google product...of course every company has huge back catalogs of deprecated products but the sheer % of fails by Google is almost unbelievable.

This is the reason I removed my extension from the Chrome Web Store.

Just want to put a plug in for https://extensionpay.com/ - I've used it in extensions in the past. It takes away the headache of setting up a backend for payment. They do take an extra 5%, but it's worth it especially. for smaller projects

An extension user could theoretically be willing to pay for the value the extension provides them. The malicious actors sending these emails are willing to pay for the value that a user's data provides them. These two numbers are not related in any way, and the value of user data will often be much higher than the value of the extension's functionality.

There is no way for monetization to solve this, because the two potential customers are not purchasing the same product.

Yeah. We've already seen user data win over paid software in other spaces. Someone charitable or just not-so-bad has to buy it out instead.

Do you believe that if there was a way to monetize extentions devs would not be approached by data thives?

Not sure if sarcasm but will respond as if it's not.

There are lots of business models to choose from

  - subscription
  - affiliate links
  - sponsors
  - one time charge, this one is tricky as restricting access requires a back-end that needs ongoing maintenance and server costs

[edit: formatting, spelling]

It is not clear what problem you are solving.

Extension devs know the rules of the game up front and have no expectation of profit.

I may have misunderstood your prior comment so please excuse me if I got it wrong. The problem I was solving was how to make money from an extension that I publish. I was outlining different business models where you could give the user access to the extension, and make money without having to accept this arrangement with data thieves.

I don't see this as problem that needs to be solved. It is freeware from the start.

It's wonderful that people are willing to share their knowledge and time for free - why not let it be the way it is?

I believe problem isn't the right word. I think OP is challenging your assumption that it's inherently freeware. There are methods for monetizing an extension and they're infrequently used or associated with a much larger experience (e.g. my BitWarden extension is critical for using BitWarden, but I pay for BitWarden's subscription elsewhere).

Perverse incentives being one, you make the extension for free, for the purpose of selling out later.

Project being maintained by a single dev being another, there needs to be incentive to keep the project going and not abondon or sell out.

Yes, most extension devs probably start out with no intentions of profit. They wrote their extension to scratch an itch. However, once they get an installed base and start getting offers to do shady stuff, it seems obvious that they might be tempted by easy money. If they had a more legitimate way to make money, they may be less tempted by the shady stuff.

That is indeed obvious but I'd argue that in this case the problem is weak moral spine. Fortifying it with money will not make it go away.

> one time charge, this one is tricky as restricting access requires a back-end that needs ongoing maintenance and server costs

If a browser extension is allowed to use license keys (not sure on the various store rules i.r.t. browser extensions), you could create a timed license key that is cryptographically signed.

No back-end required for that.

Not the OP, but I'd presume that it would be significantly less tempting to sell out.

Everyone has a price, and when everything is going smoothly, that price goes up.

Might at least make these attacks harder if users could disable extension updates, or had to opt into them. Most of these extensions are simple and don't really need to be updated, yet the update mechanism is silent full auto bada bing bada boom no rollbacks. I can't think of any updates more aggressive, not even Steam.

Yet another opportunity to recommend Firefox to readers.

I'm not sure I advise doing it, but you can go to about:addons and hit the gear icon and you can uncheck "Update Addons Automatically". Even better, click on an extension and under the "details" tab there's an option per-addon to set whether you want automatic updates or not, so you can disable updates just for the one addon you don't trust (or enable updates just for the one addon you do trust).

Also, want to run older version of an extension? The Mozilla Addons page for each extension has a list of every release and you can download each version independently as a signed XPI file if you want to sideload it.

The big thing I wish Mozilla would add is self-compiled releases like F-Droid does, especially since their ill-advised signing process means it's hard for users to compile an extension from source -- it's way too easy for a submitted extension to deviate from its source code. But that (admittedly large) issue aside, Firefox offers a lot of control for users who want to manage their own extension versions. Forced automatic updates are a Chrome problem.

Yeah, that's very nice. The only reason I'm even aware of how Chrome does it is because we're forced to use Chrome at work. We're allowed to use some vetted internal extensions with it, and I do, but someone pushed an update that broke an extension by accident. Then I was like, why is this a thing.

Thanks for mentioning this

I don't think this is necessarily true. I run a software licensing API with quite a handful of customers running browser extensions with respectable user bases.

So there are monetization opportunities, just like any other distribution channel.

I think the only way is to treat access like we do web apps, then enable/disable features accordingly.

That's kinda lame because now you have to have a backend setup, just so you can charge for some features.

The issue with that is that "Gets to read and/or write the DOM" happens to be the only permissions a nefarious extension needs while also being those that a vast number of useful extensions require.

I think you're thinking from the browser level. I was thinking from the standpoint of what I could do as an extension developer.

If we approach it from that angle, then your extension can only restrict access to it's features via a round trip to your own servers to validate access and/or show a checkout view to purchase access.

That's why it'd be nice to have a general "access the internet" permission, since DOM reads are usually harmless if they can't get any data back.

I suspect it would be a very hard permission to implement. There are a lot of ways to exfiltrate data from a website if you have DOM access. But yeah, agreed.

Some of the difficulty around securing extensions boils down to the fact that Javascript permissions could be better. Websites do a decent job of sandboxing the website, but sandboxing within websites (without relying on iframes) is much more difficult.

Per-site permissions and click-to-activate are also really useful features here. It's easy to forget how recent they are. But it would be good to go further if possible and having barriers in front of exfiltration would be a big part of that -- there are many browser permissions that would become less dangerous if you could know for sure that the data they generate can't get off your device. I just think it would be really difficult to try and build browser permissions around that in a user-legible way.

The root problem is that extensions are such a good platform for ads/tracking.

If monetization was better, it would just end up like Google Play, with adtech spam crowding out the "legitimately" monetized apps.

Dracionian restrictions on web access (like requiring a prompt whenever an extension wants to upload/download data) might help a little.

You can easily monetize Safari extensions by selling them through the App Store.

I wouldn't say "easily", but you can.

Google could easily find a way to display ads for all extensions: pre-roll ads before extension launches, mid-roll ads when user is using extension for some period of time; not sure what is stopping them.

Reply on news.ycombinator.com