Hacker News Reader

Comment by infogulch | Hacker News Reader

I'm quite sympathetic to the stated goal, and the technical limitations are understandable, but the fact that it sends a list of all your extensions to an extension-oriented ad network is a bit sus...

> Why does this need an external server? - Browsers have special rules about modifying extension marketplace domains. For example, you cannot set declarative_net_request rules for chromewebstore.google.com. Therefore, this extension delegates the developer info checking to the ExBoost [1] API server.

[1]: https://www.extensionboost.com/

> What Is ExBoost? - ExBoost is a collaborative network of browser extensions that want more users and more reviews.

> How does ExBoost work? - Extensions add ExBoost slots inside their UI. These slots will show promotions for similar extensions, or reminders to review your extension.

View on HN

Good find! I've dug a bit and the extension, at least for now, does not send any metadata associated to your browser[1], only a comma separated list of extension IDs. Of course the IP could be easily used.

Looking at the result from the API of one extension I had installed[2], it lists metadata associated to the developer. I've tried to use the `chrome.management.get(id)` Chrome API and it does not return this information, and there does not seem to be a way to get the content of the manifest.json programatically. Therefore, to do the job of the extension as it is, it does need an external source.

[1]: https://github.com/classvsoftware/under-new-management/blob/...

[2]: https://api.extensionboost.com/v1/developer?extension_ids=gh...

I tried very hard to find a way around using an external server, as I knew HN would harp on the related privacy issues. No luck.

It looks like Extboost is also a project by OP. The charitable explanation would be that they used its API server because they already had the data they needed to scrape an extension's metadata (i.e. its owner) given an extension ID.

Yes and the fact that you can just scrape the logs for extension installation statistics which you can use to sell AD space is just an accidental convenient side-effect, I'm sure.

For the record, this is bang on.

I've developed some small extensions for fun. A couple of weeks ago I got an email from ExBoost with the subject "Collaboration To Grow Our Extensions." They wanted me to include their code in my extensions. I quote: "You show mine, I show yours. Zero cost, all win."

I thought it was suspicious and junked the email. It didn't seem any different from the other spam emails I got from scammers.

I'll admit, the launch messaging could have been better.

That is not a connection I expected in this kind of project. Blimey

Why does it need to contact an external service? I thought the extension ID changed when the owner changed, so you'd just need to locally track extension IDs and flag any new ones that appear. Or do I misunderstand something?

Extension IDs do not change, in my experience. (I could be wrong in some cases, but I know for a fact that at least one extension I've used has been bought up without the ID changing.) It seems to me that if they did change, it would defeat the purpose of buying up extensions in the first place, because automatic updates would stop working and they'd lose the installed user base.

Reply on news.ycombinator.com