Comment by jasode | Hacker News Reader

Comment by jasode | Hacker News Reader

>It's called Syrup, a fully open-source and transparent alternative to Honey. My goal is to make a browser extension that’s honest, ethical, [...]

If you want to make this solution for yourself and other very technically-savvy users like the HN crowd to use and collaborate on, that's fine. However, despite your declared good intentions, I would never recommend a browser extension like this to non-technical friends and family.

It doesn't matter if the browser extension has an "open source" repo because the maintainer of it can change in the future and then the code is altered to have unethical behavior that doesn't align with the original intentions. Basically a variation of a software dependency "supply-chain" attack. Examples include the xz backdoor and the first uBlock repo being bought by an advertising company (eyeo GmbH). The innocent non-techie browser users will not be sophisticated enough to monitor a Github repo to see if has been compromised and therefore, their "honest" browser plugin no longer does what they think. For those users, it's best to just manually search for coupons with Google/Bing.

Example of how a browser plugin places a "cognitive burden" on non-technical users and just confuses them:

- Chris Aljoudi takes over uBlock and tricks users : https://en.wikipedia.org/wiki/UBlock_Origin#uBlock_Origin

- https://old.reddit.com/r/uBlockOrigin/comments/ija23v/if_you...

- https://old.reddit.com/r/uBlockOrigin/comments/8uxcfv/ublock...

- https://news.ycombinator.com/item?id=26161702

- https://www.google.com/search?q=xz+backdoor+github+commit

You raise a really important issue, and I completely understand the hesitation around recommending browser extensions to non-technical users, even if they’re open-source. Supply-chain attacks and repo takeovers are valid concerns, and examples like you said the uBlock Origin situation highlight how things can go wrong.

With Syrup, my focus is on making it as transparent and community-driven as possible. That said, I agree it’s not a perfect solution for everyone, especially non-technical users who might not have the time or skills to monitor changes. Open-source alone doesn’t eliminate risks, and your point about cognitive load is fair—it’s something I need to think about more deeply.

One way I’m considering addressing this is by implementing robust safeguards, such as: - An open and transparent roadmap where changes and intentions are clearly communicated. - Encouraging a diverse, trusted group of maintainers rather than a single individual to reduce risks of compromise.

Ultimately, while Syrup might not solve every issue you’ve outlined, I hope it can be a step toward more ethical alternatives for those who value transparency. For non-techie users, maybe manual searches are the best approach right now, but I’d like to keep improving Syrup and exploring ways to make it safer for everyone.

Thanks again for your input, it’s giving me a lot to think about as I move forward with this project.

Perhaps a foundation or working group that manages the project collectively would help, as opposed to running it as an individual (benevolent) dictator for life.

Are you familiar with how Proton Mail/Proton AG was crowdfunded, and how it transitioned to a non-profit foundation structure, for example?

https://en.wikipedia.org/wiki/Proton_Mail

https://proton.me/blog/proton-non-profit-foundation

https://proton.me/foundation

Reply on news.ycombinator.com