Hacker News Reader

Comment by charcircuit | Hacker News Reader

>Popa botnet

It's no more of a botnet than ProtonVPN for example. Apps intentionally added the Popa SDK to their apps as a monetization method. This allows apps without ads and tracking to be financially viable. I would expect FSF to support apps being able to move off of monetization schemes that depend on tracking people so it is disappointing for them to put such alternative monetization technologies in a negative light.

View on HN

This monetization scheme benefits the botnet controller and the developer who added the SDK and not the user who likely did not realize they signed up to become an exit node.

It allows as free versions of apps to be economically viable and compete with others. It helps users because they don't need to be spied on and shown ads to fund the development of the app.

The existence of an app brings users value, else they wouldn't use it.

Recruiting your users' systems into a botnet is not an acceptable way to make an app "economically viable" any more than, say, installing a rootkit on their systems.

Is Google Maps a botnet because all of the clients share location data to make navigation more optimized? Having multiple users connecting back to a central server does not make something a botnet. Users should be able to decide for themselves whether they want apps like this or not.

The difference of course is that Popa does not provide 1. informed consent to users and 2. actual useful app functionality. The user does not know when an application is using the Popa SDK and does not know their device has been compromised. It is bundled inside seemingly legitimate software without the user's knowledge. Therefore, the user cannot make an informed decision about whether to use the app. Also, unlike the Maps example, the botnet provides no feature that the user would want or choose.

Popa is an illegitimate and botnet[1] that no end user knowingly/willingly uses.

1: https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-...

I would not have as big of a problem with it if it was a transparent arrangement that the app is free of cost, but the Internet connection would be shared with customers of RoboVPN. The issue is that the often invisible arrangement is not obvious and likely breaks the terms of service with the Internet Service Provider. If the user was intentionally running a TOR node, I would not have a problem with it. The current reality of it is absolutely unethical and breaking the Internet as we know it.

I agree that users should be informed, but if parts of the internet are breaking due to user anonymity it is hard for me to feel bad for those sites.

the fsf has never really been concerned with commercial viability. They're the worst audience for this sort of argument.

and I doubt these apps are really Free versions - do they support user modifications and access to the code? If they did support the four freedoms maybe the fsf would have something positive to say to balance it out?

You are not wrong. The FSF often takes an absolute stance on these things where they don't properly support partial steps towards more free computing.

"Monetization". What a horror.

I pay for some software services. The services I pay for have a billing page (or a donation page) and I pay via the banking system

I rigorously block every ad, every tracker, every thing that does "monetization"

The evil period of trying sneaky ways to generate money is, I am optimistic, coming to an end.

If you want my money, ask me. If you must have my money, demand it. If you are sneaking around "monetization" I will do everything I can to stop you.

Yeah but they don’t want your money. They want the botnet users money.

You got a genuinely free, to you, app.

Reply on news.ycombinator.com