Detect when your installed Chrome extensions have changed owners

Unfortunately, it's been established for a long time now that users cannot be trusted to perform updates by themselves, no matter how naggy you get about it, even for the most critical of security fixes.

Automatic updates, again unfortunately, are critical to safety.

Anyone who has had to administer anything user-facing will tell you that some users will ignore any warning. Updates need to be automatic and mandatory. You can give them a grace period, but you have to force the issue after a while, or users will delay the update prompt every 15 minutes for months.

Why is this downvoted?

I am shocked, people actually think that automatic updates are very good? Because for me, it is trivial that automatic updates are very bad. One of the greatest security risk of extensions are due to automatic updates, they can't be verified, since they change.

edit : BTW I've submitted a related submission about Guerilla Script, a userscript injecting engine, where userscripts are not even updateable: https://news.ycombinator.com/item?id=39620863 This is the ideal way of safe extensions IMO

I don't advise turning this on because I think automatic updates in most cases are preferred to manual updates for most users. However, in Firefox you can in fact disable automatic updates on a per-addon basis. So you can have the addons that you trust automatically update, but for the addons that you're less sure about or that basically already work, you can just turn off updates for them.

Just go to about:addons, click on the addon you want to change, and then swap "Allow automatic updates" to off. You can also change the default behavior to not automatically update except for individual addons that you override (although again, I don't recommend it for most users).

I don't believe you'll get notified about updates (correct me if I'm wrong), which isn't ideal, so you'll have to periodically go and check for updates yourself.

I believe Firefox at least alerts you when an extension update has changed the permissions it requests (and you need to accept the new permissions). Of course, there are many cases where malicious code doesn't require new permissions.

I'd also prefer more visibility into updates. Enabling auto-updates might be okay, if there's a way to opt out of it, and if the updates were significantly more visible. I want to see a big modal when one of my extensions has updated, and ideally I'd be able to see the diff of its source code. But even without that, just knowing it updated would be enough for me to unpack the CRX and check for myself (like I did when I installed it originally).

Disclaimer: I run exactly two extensions in my main browser: uBlock Origin, and Little Rat (monitors network requests of other extensions). I have a separate Canary browser for web development where I install other extensions I might need.

I believe this is how firefox behaves.

No such license can exist, if it did it wouldn't be open source.

Open Source, as defined by the Free Software Foundation or Open Source Initiative, requires the right to create a modified version of a piece of software and sell it. It doesn't matter if the modification is nothing.

A trademark on the name will require a reseller to rename it to avoid trademark infringement.

A patent on some part of it is a scummy way to do it, but that violates the spirit of open source.

I said he copied, not stole.

In terms of timeline...

here is him commenting on my the shown HN post I made https://news.ycombinator.com/context?id=38328305

here is his days later https://news.ycombinator.com/context?id=38398571

Also you are completely missing the point that it was likely sold and transferred ownership.

https://chromewebstore.google.com/detail/ad-speedup-skip-vid...

in addition to that, actually had random people start reaching out to me that it is now bloat ware ...

There he is: https://news.ycombinator.com/user?id=corn-dog

Let's tar and feather the scoundrel.

Maybe he's afraid of getting sued.

100%. Is someone is going to be shitty they deserve to be called out front and centre. If they just copied the program and shipped it as their own that speaks volume as to being a bad person and I would not want to collaborate with a person like that. If they took the open source program and truly made some great additions to it and improved it then that would be a different matter. Pretty sad to not give credit to the creator of the program. Call this guy out in my opinion as well.

sometimes the beef ain't worth it, man

Contrary the sibling comment, the answer is no, and it isn't pedantry at all. The people who established the free software and open source movements care deeply about the standards embodied in the licenses those movements use. It disrespects their work and vision to conflate other licenses with FOSS licenses, and it pollutes the commons. We use words to communicate things, and having a clear definition of what is and isn't open source is important.

There are certainly licenses which meet those goals, and in my opinion at least, there's nothing wrong with using them. I'm not opposed to proprietary software, or source-available licenses which come with certain restrictions. But by definition, it isn't open source or free software.

The pedantic answer you'll probably get here is that there's no such thing because that wouldn't be trve FOSS, but that would be missing the point of the question, so:

There's the Business Source License[1] used by MariaDB, which allows for any "non-production" usage and automatically converts to fully open source 4 years after publication.

There's also the Commons Clause[2] which is supposed to be appended to any other open source license to add a restriction against the "right to Sell the Software".

And there's also Creative Commons NonCommercial license[3], but that one's not specifically meant for software.

All of these are interesting licenses, but honestly I haven't fully read them yet and I don't know if they have any issues or ambiguities or loopholes.

[1] https://mariadb.com/bsl11/

[2] https://commonsclause.com/

[3] https://creativecommons.org/licenses/by-nc/4.0/

He copied OP's idea, not their code AFAIK.

Why not this time?

The drama killed my enthusiasm and at the end of the day it was a silly side project. Have more important things to do if it is not fun.

Another question is for how long YouTube and Chrome will allow it to work. (They may also feel disappointed).

It'd probably have to get orders of magnitudes more users for YouTube to do something. But not every streaming site is as laissez faire; Hulu detects it if you set it to the max speed (16x) and Twitch is more obfuscated.

the buyer is buying the users, not the software.

Yep then it likely changed ownership to exploit the user base, which their recent reviews seem to point to

https://chromewebstore.google.com/detail/ad-speedup-skip-vid...

MIT only requires attribution. A fork can still monetize the original work with minimal changes. A trademark could help at least protect the name.

Or if they stripped all attribution then a legal case could be made.

Isn't Opera chinese owned these days?

I interviewed at their office and at the time their business was to use the high user count the browser had on mobiles in africa to push microcredit.

Unfortunately, it probably even makes sense that they'd want that for non-nefarious reasons.

If you shut down your extension and they had to put up their own copy, they'd have to re-acquire your installed base. That could be a sharp decline in value to them, particularly if the extension mostly got popular off a one-time front-page feature rather than via gradual discovery with active word of mouth.

The chance that people jump through all the hoops to impulse-install again twice is low. They'd have to really like your extension, even if your version notified them of shutdown of yours and availability of the new one. Growing an installed base is generally more a factor of not chasing your users away than explicitly doing things to retain them. That change would chase them away.

In an ideal world, you'd be able to officially transfer the single extension to a new owner while keeping all the installed users--preferably with a notice dialog enforced by the browser popping up to tell the user the ownership changed and offering them a chance to uninstall. That would also chase some users away, but it's sort of the ethical minimum (hence this HN post).

But I doubt many browsers, if any, work like that.

While I too would back out from anything requiring giving away credentials, is there no other way to transfer ownership? A charitable interpretation could be that they wanted to also buy the "popularity" of the extension simply for discoverability.

But it's equally easy to envision nefarious reasons of course.

IIRC Google does the build, so they need the private key to sign the resulting binaries?

Edit: I'm probably thinking of Android and they'd probably sign with their own key.

The problem is that this isn't just a code signing system. In a code signing system, the public key would be tied to a developer, and they could rotate their private key to sign their app. But in this case, the extension ID itself is tied to a (private) key, so it's not even possible for the developer to rotate their key without changing their extension ID, which breaks existing installations and breaks interoperability for code that expects the extension pages at chrome-extension://{extensionID}

How is this even possible that Google allows this? Is this really true?

Yes, you only need to upload the key (meaning, include a `key.pem` in your packed zip file) on first upload. [0]

However, I'm not sure if Google will allow you to upload with a _different_ key. Since that would cause the extension ID to change, I'm not sure what would happen, both to the webstore page (does the previous one 301 to the new one?) and to existing installations (do they stop auto-updating?).

Incidentally, I expect this is also the reason Google allows subsequent uploads without the key. They don't want someone to lose their extension when they lose their private key.

This weekend Chrome decided to disable all these extensions on just one machine

There is a trick for this, if you are loading an unpacked extension. Simply edit `manifest.json` in the unpacked extension directory, to add a `"key": "<base64 encoded public key>"`, where that public key matches the public key associated with the extension from the store. You can do this with any extension from the store, since you can extract the public key from a .crx file [1]. When you load an extension this way, the ID will be the same as the "real" extension.

[0] https://groups.google.com/a/chromium.org/g/chromium-extensio... (note the "You don't need to repeat this procedure ever again")

[1] https://github.com/milesrichardson/crxmon/blob/4dae445b05b76...

Why does nobody ever propose these deals to me? :(

The price for convenience is security. If you are willing to hand your digital life to others, you will gain the convenience that you seek. You are seeking to become a digital king by gaining digital servants that handle every aspect of your life. The day one of them betrays you, it will be painful for you at the very least

These things worked well when the internet was a toy.

Now it's no longer a good idea because that same browser is also:

- your bank,

- likely your point of contact with the government / tax folk

- the place you do your shopping

- the portal for most of your communications with the rest of the world

There is a block and allowlist for which sites can it run.

For example Firefox can't even control on which websites the extensions run. This is stupid and bad. Tampermonkey just does this thing right too.

Edge at least has an allowlist, if I'm not mistaken.

Further, there's no requirement that a tampermonkey script be open-source. They usually are, but so are the regular extensions I choose to install.

I don't know about chrome, but Firefox also allows automatic updates to be disabled on a per-extension basis.

I'm a fan of userscripts but lets not pretend they're magically better.

Just sounds good in theory:

- More malicious apps found in Mac App Store that are stealing user data - https://appleinsider.com/articles/18/09/07/more-malicious-ap...

- How 18 Malware Apps Snuck Into Apple's App Store - https://www.wired.com/story/apple-app-store-malware-click-fr... ...

I get that you're jabbing at the Apple situation, but nobody has a problem with what you're suggesting. The problem arises when that is the only avenue to get onto a platform. Apple actively blocks sideloading and there's no way for a user to trust something that Apple has branded as "untrusted." Curation can coexist with untrusted code just fine, and in fact that's what Mozilla already does with their system mentioned in this thread!

Almost, yes, but not quite.

Curation and integration by a trusted party is a valuable service, and I very much appreciate Mozilla, Debian and others doing this work and enforcing their inclusion policy, e.g. the Debian Free Software Guidelines and whatever Mozilla's technical review involves. Debian's onerous rules in particular are great for the user – I can rely on packages to be appropriately licensed, to receive security patches without breaking my system with incompatible changes, to be compatible with the rest of the packages in the distribution, etc.

Some important differences from "marketplaces" provided by various for-profit companies are 1) the user can choose whatever curator they wish, or opt to install whatever they want at their own risk; 2) the service doesn't usually involve payments, selling, shopping, etc. which would usually be associated with a marketplace.

Firefox has a marketplace with participation rules and enforcement where organizations that break the rules can be banned for violating them. That already exists.

They want something stricter. What they're asking for is the ability to have multiple marketplaces and validation measures, some of which have stricter rules than others. That these requests pop up in scenarios where marketplaces already exist suggest that singular universal marketplaces that attempt to be one-size-fits-all gatekeepers aren't scalable or sufficient to meet everyone's needs, and that a multi-marketplace setup would allow some of those marketplaces to offer stricter quality standards for the people who need them.

For the record, this is bang on.

Yes and the fact that you can just scrape the logs for extension installation statistics which you can use to sell AD space is just an accidental convenient side-effect, I'm sure.

I tried very hard to find a way around using an external server, as I knew HN would harp on the related privacy issues. No luck.

I'll admit, the launch messaging could have been better.

Extension IDs do not change, in my experience. (I could be wrong in some cases, but I know for a fact that at least one extension I've used has been bought up without the ID changing.) It seems to me that if they did change, it would defeat the purpose of buying up extensions in the first place, because automatic updates would stop working and they'd lose the installed user base.

Yep, Firefox and Chrome have declarativeNetRequest:

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Ublock Origin Lite uses it for example.

(It's also the thing everyone is angry at Chrome for as their 'plan to kill ad blockers' by replacing the current blocking APIs with declarativeNetRequest.)

Three options:

- make it the DNS for your wifi if your router can do that

- set Pihole to be the DNS for individual devices in their wifi settings if it can't

- create a personal VPN that uses Pihole as the DNS

As long as there's software/devices we can't run uBlock on, there's a reason to run both.

True, but at least it would require the exiting party to not have any illusions about what they are doing. I'd be surprised to hear that most extension takeover bids are open about their plans.

uBlock countered that they wanted minimum $XXX and we pulled out.

They could just purchase Extension Author LLC with the extension being one of its assets, and there would be no need to notify Google of the change in control.

Many things are sold that are not allowed to be sold, hasn't stopped criminals yet.

All you need is to send your password, and a quick session to set up 2FA with the buyer's methods, update recovery settings, etc.

As long as you don't use that account for anything else, it's seamless.

Legalese isn't going to stop that.

Yes, I think consumer brands for things like food are exactly the way this trend started, and the aggregation of them has been gradual but led to lower quality and more scamminess throughout

I always thought it would be a sensible law to make a company that displays a brand on a product also display their company name as-or-more prominently next to that brand, so people know who is actually making those products.

They should have to display the entire chain of companies in the corporate structure and, if it's too big to legibly fit on the package, you can't sell it.

Yes, it absolutely can. However, these decisions are more the rule than the exception in an acquisition or change of management, whereas people who set out to make things that get the good reviews in the first place will often value the effort they've put into the thing they've made, the reputation they've earned with it, their relationship with their customers, or even just take pride in making something well

Of course, perhaps it would be even rarer in a world whose incentives resisted "optimization" of this kind rather than actively encouraging it

Indeed, periodic checks with a well-thought-out interval do make sense. Well done!

It would be much better to at least have the option to automatically disable an extension with changed ownership instead.

The majority of owner changes are going to be malicious, so the action taken should account for that.

It seems fair for the browser to charge a fee (in the form of losing a percentage of users) in exchange for money earned by stealing data from users.

Creators do not get offered large sums of money by entities motivated by the desire to better serve the creator's users.

So yes, I agree that it would decrease the value of selling out. I see that as a good thing. It fights against what is currently killing the extensions ecosystem for everyone.

Sounds like Chrome isn't their daily driver. Firefox blocks a lot of ads by default in Strict mode. That's what I use, so I haven't used AdBlock for a long time.

I also have a Pi-hole on my home network.

How many change detectors to mitigate against 51% attacks?

Realistically, even with this extension functioning as advertised, there are still plenty of related risks. E.g., a software company could disguise its motives early on and convert its product into malware at a later date, or the developer could be paid by a 3rd party to add certain features.

Tbh one can always install it locally (as a local extension)

Oh nice, TIL. Another push for me to switch to ff