Yep switched a few months back last I heard about Stylish being bad, and never looked back. It works very similarly and you can import/export all your stuff so it's super easy to switch.
Firefox lets you know when addon changes permission between versions. You are prompted to accept the new permissions before upgrading the addon. This has been helpful in weeding out addons that become too data hungry.
Sort of ironic sending an abuse notification to a company that does precisely the same thing on a much vaster scale. And I would assume that the T&C for the new and improved Stylish that you accept when you install it informs you that you are giving them permission to do this, so there isn't even any abuse to complain about here.
I had this extension installed for years, from back when it was "still good". I don't recall ever seeing a T&C prompt, and in the last 3-4 years I've become quite vigilant about always reading full T&C texts (much to the amusement of others).
I was put in this tracking program without my consent.
Most browser extensions seem to require access to one's browsing history and keystrokes, even for legitimate functioning. Is there any way to ensure that they do only what they claim to do, and don't abuse the permissions? (Apart from verifying the source code, because clearly, lines of junk code >> interested eyeballs).
For example, would it be reasonable to enforce that an extension only acts locally, and cannot communicate with any external server? (I guess allowing arbitrary local modifications essentially allows the extension to execute arbitrary javascript code, including communicating with arbitrary remote entities?)
Yes, it's very hard to block that, since even if you block XHR from their JavaScript code, by changing the page DOM they can inject elements that communicate with a server.
> ... Firefox extensions are written in JavaScript too and NoScript doesn't block scripts living outside web pages (i.e. the browser components, included extensions) ...
The GDPR is UK law automatically because it is a Regulation, not a Directive (which needs to be transposed into national law).
The Data Protection Act 2018 implements the Law Enforcement Directive (as the GDPR excludes that from its scope) and a couple of minor derogations (such as changing the age of consent for children to use websites by themselves to 14).
"Where provided under applicable law (such as within the European Union), you may have the right to ask us to delete Personal Information which you have provided to us [... ] contact our Data Protection Officer at: dpo@userstyles.org."
That's nice for them. I also have the right to refer them to my local data commissioner though, about the absolutely lack of meaningful consent they gathered from me here. I hope their investors get taken to the cleaners by the resulting fines.
One of those (either annoyances, headers, or popups) broke a fork of Stylish. I'd click on the icon in the toolbar and the drop-down wouldn't appear. I noticed the user style also broke AWS navigation.
None of those sheets except for Annoyances should be applied globally.
I don't guarantee Annoyances won't break other things, but I do guarantee that the others will.
Assign the to a nonexistent URL or domain initially, or disable them.
If you've got specific bugs with the Annoyances sheet ... I may be able to address them.
My usual first-stop debugging tools are adding either an outline or background colour to an element:
outline: solid 2px red;
background: #faa;
... which tends to show what rule(s) are being triggered. If something breaks, add those rules, and disable the "display: none;" one.
I'm also finding that the shift to "display: flex;" styles is breaking some of my assumptions. It's no longer safe to presume that everything is displayed as one of block, inline-block, or inline.
Position directives are also problematic: initial, static, relative, absolute.
That said: I've evolved those styles over a few years, and they tend to work reasonably well. Some nursemaiding required.
You must have done something wrong, of course the applied domains are also transferred. Maybe you didn't use the export function but just copied the source?
This reminds of the "WOT, Web of Trust" (haha) privacy issue in 2016: Reporters (disguising as business men) were offered data that includes the surfing habits of three million German citizens. This data was, at least partly, collected by the “Web of trust” (WOT) browser extensions. The reporters were able to use this data to identify the browsing habits of individual persons – including high-ranking German and EU politicians.
Indeed. I never trusted it. I never trust any feature or add-on that uploads anything. That includes malicious site detectors. I only use stuff that relies on local databases.
Any recommendations on malicious site alternatives?
I'm still looking to update my router (Turris Omnia) to use DNSMasq rather than Knot Resolver, which may offer an edge on DNSSec capabilities (though I believe this has lapsed), but is far less capable of being locally customised along the lines of DNSMasq.
Google needs to take action here. From requiring re-confirming permissions every time a significant privacy policy change is made, or just by nuking SimilarWeb altogether from the web App Store.
Thanks, but what I'm really trying to ask here is what a vanilla Chrome installation does. If someone just installs Chrome, leaves all settings as defaults, and doesn't opt in to anything, what data is being sent back to the mothership? I've never managed to find a convincing answer to that question.
It collects it for the purpose of building a better advertising profile of you- so it can make more money from ads. It’s still using my data about me and making money off of it.
Not to complain about downmodding - I can afford to loose the karma - but this threads a little unusual in terms of comments summing up Google's business model (which most people on HN should be aware of) going from highly upmodded to highly downmodded.
As others have said, immediately switch to Stylus. While we're at it stop using Ghostery as well since they were bought by an ad company. Use Privacy Badger or a decent alternative (noscript + heavy/custom uBlock lists should work just fine)
There are two, similar, though different, extensions.
uBlock origin is a dedicated, quite-good, low-fuss, ad blocker.
uMatrix is a much more general, very powerful, though somewhat fussy, general Web capabilities manager. If you don't mind fiddling with sites periodically, it's very strongly recommended, but for user populations who don't do this or grasp technology poorly, it will require some fairly close managing, _especially_ if the user base doesn't report problems and just accepts "the site is broken".
I'd highlighted my preset recommended set of browser extensions for 2018 a couple of weeks back. The hero image is uMatrix's control interface.
If you've not been paying attention or specifically trying to counter that trend, you'd be amazed at how complex a typical site is. Even those which otherwise appear clean.
I appreciate the sentiment but indeed I know very well how complex a typical site is. Unfortunately I think a very large portion of most websites are far too complex for what they provide.
> for user populations who don't do this or grasp technology poorly, it will require some fairly close managing
I would never have imagined installing it for non-technical users, but one was interested in giving it a try and had no problem. They even said they really liked learning how the web worked (uMatrix shows a grid (the matrix) of hosts and functionality, such as CSS, images, scripts, media, etc.). So I gave it to another non-technical user, and they also like it.
Both have been surprised to see the number of domains that contribute to one webpage (most users assume it's all from the domain they typed into the URL field), and how often Facebook, Twitter, Google Analytics, and other tracking domains show up in that matrix.
While we're at it stop using Ghostery as well since they were bought by an ad company.
Ghostery invites you to submit various data to support it these days, but seems to be transparent about it and to work on an opt-in basis, so quite different to Stylish. Are you aware of other things that Ghostery is doing without the same transparency and consent?
Ghostery can replace scripts like Google Analytics with stubs that expose the same API but don't do anything. Last time I checked, NoScript/uMatrix can only outright block those scripts from loading, which breaks some poorly-coded sites.
Honestly, the only reason I had Stylish installed was because multiple people on HN recommended it. So you'll excuse me if I don't "immediately" switch to the next random recommendation, especially if it comes with the reason that others in this thread are recommending it too!
BTW your characterisation of Ghostery's relation to an "ad company" is incorrect. It's an odd enough situation that I'm not using it any longer but they didn't get "bought by an ad company". Unless something new happened to them, in which case, please provide a link.
This is a huge problem for the extension ecosystem in general. Who originally publishes an extension may not be the same entity that is pushing you updates in two years time, and there's no way as a user to know this.
I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can imagine what kind of deals are being made when the extension has a million plus users.
When pushed for exactly why they wanted to buy the extensions, which are in no way monetizable, they gave vague answers about "user insights". I can guarantee there will be many other major extensions that have sold out their users.
Build a social/interaction graph and fill everything with Ads while selling the same information to intelligence agencies. No discretion. Only money. Nothing personal, it's just business. Sounds familiar? Facebook invented that already.
It gets sold to private investigators and insurers, and you shouldn't have ever Googled for "alzheimer disease symptoms" and you lose your child custody rights after a judge decides what you're looking at on YouPorn isn't sufficiently healthy.
The dystopian scenarios are fun to think about, but realistically speaking what happens is your data is used for market research. The vast majority of it is used to curate your advertising profile more effectively or to generate financial insights about companies based on consumer habits.
In my experience anonymization is hit or miss, but ostensibly always in place.
A lot of people focus on how this information is used by advertisers, which can be a problem, but in my opinion the bigger issue is how data brokers are starting to act like completely unregulated and sometimes highly inaccurate credit reports.
I also have been contacted many times, and offered 1-3k for an extension I have with about 15k users.
The extension has a backend API and web service which is required for the extension to work, not once has a buyer asked about acquiring that. They only want the extension and literally have no understanding of how it works or what it does. Their intent is obvious.
On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see.
I've not received my own updates for weeks a few times because I haven't noticed the warning, and about a third of our users are on ancient versions presumably because of it [1].
I think the real solution to this problem is GDPR: massive fines if you abuse your users' trust (and get caught).
I'm not keen on the literal dark pattern that Firefox uses to dissuade developers from requiring new permissions.
>On the other side of the coin, Firefox makes it quite hard to push updates to users that require more permissions, requiring manual intervention to update. It signifies this with a small muted yellow exclamation mark on the hamburger menu, which is really hard to see.
I'm not sure how you can see this as anything but a good thing. If your extension wants more permissions than originally promised, then it absolutely should have to require user intervention to do. You can't just change the agreement like that. Maybe it could be better communicated, although I have to say I don't think I've ever not noticed that yellow icon, but this is far, far better than the alternative.
New permissions shouldn't be taken lightly. One day you'll install an extension that access only on a specific site, and the next day it's requesting access to all your bookmarks, location data, history etc. If you make it into a next next next dialogue box you're implementing an easily abused dark pattern.
A better approach would be to allow extension upgrades, irrespective of permissions. If a user chooses to deny permissions the extension should still work on the latest version.
Why not just return empty datasets to extensions that ask for too much? Empty history, empty address book, white noise for camera and microphones, etc. Then it would be possible not only to ‘accept’ what it does or uninstall, but seamlessly deny what you don’t want.
The thing with Chrome extensions is, many, many extensions already require the ability to interact with every page you visit, which is essentially Chrome extension root. If your extension already requires this, you don't need to add permissions when you update / sell your extension, so nobody is warned.
Firefox is in the right here. I absolutely do not ever want extensions to automatically get new permissions automatically just because I accepted an old version's lesser permissions.
If you want more permissions, then ask for more permissions.
And don't be surprised when people say NO.
Not everyone wants to grant the permissions to your update even if the update fixes bugs in older versions. Not everyone will want your new feature in the first place. Denying permissions is an easy way to eliminate the risk of having to go through and figure out whether or not the new feature is trustworthy.
And if you're not adding a new feature, then why do you need more permissions?
Automatic permission addition is totally unacceptable, agreed. But I do think that Firefox should actually ask, at least once. A vague exclamation point on the edge of the screen isn't really a sufficient way of handling that for extensions a user has chosen to add.
I agree with you. As another reply to you states, however, Firefox doesn't currently let me ask. You have to kind of go hunting for it.
> And if you're not adding a new feature, then why do you need more permissions?
Firefox does not let me explain why the permissions are needed. It would be nice if we could have a little blurb where we can state our case next to each permission.
Our current approach is to explain likely upcoming permissions requests in advance and ask our users to stay vigilant for the appearance of the tiny yellow exclamation mark, but that's not very helpful to the third of users stuck on old verions before we learnt that trick.
> And don't be surprised when people say NO.
I think very few of these users have said no on purpose. We ask for (and use) almost everything [1], so any marginal new permissions are unlikely to give us much more power. The current permission model actually makes it tempting to just literally ask for everything because we might want it for a new feature in the future.
The optional permissions are not fine-grained enough to be useful (you can accept all optional permissions, or none) and not available for enough permissions, otherwise we would use them.
Also, the first versions of our software were really slow and bad. I really doubt many people are staying there on purpose. (If there are any Tridactyl users in this thread using an old version on purpose, I'd like to hear from you :) ).
I can kind of understand that charge when it is levelled about people complaining about Quantum and doing nothing about it, but I already spend countless hours a week working on a replacement for an extension that died because of Quantum.
How much more time can I reasonably be expected to donate? Just trying to find duplicates on the BMO could take ages.
Complaining into the void on the internet takes much less time and makes me feel better :)
Firefox (Chrome) should make it very easy for anyone to audit what extension/plugin are doing.
If url, div, cookies and any other info are collected, what are they?
What server connections are made by the extension, IP, Name, contents of info transmitted?
All the GUI, collection system should be in place as part of JS dev/debug tools already. Just customized it a bit so any tech savvy users can check the audit logs and enable more logging for a plugin if needed.
If an user spots something not right, it is also easy to out the "plugin/extension" on a public forum.
It's actually how I became active in the webstore.. Tab Manager was sold to some other company and filled with malware afterwards. It took the webstore team over a year to take it down.
Luckily enough the source code was still on github, and I managed to fork it and improve that version into "Tab Manager Plus" [1]
Since then I've refurbished around 10 extensions and published a few of my own. It's fun, just annoying that malicious extensions aren't getting taken down fast enough, since I suppose not enough people report them.
How to report malicious extensions is also sometimes unclear. Some people think they have to install them first, that's only true for ratings, not reports. For example to report the extension from this blog post you just have to submit this form [2]
For other malicious extensions simply replace the extension id in that link.
SimilarWeb and Jumpshot are the major clickstream companies that buy these extensions. One way to see whether an extension mines your browsing history is to use a tool like Fiddler to sniff out the outgoing requests.
One sneaky way to get back at them is to send a bunch of fake “poison” requests with fake data back at these guys. It probably wont hurt them but if enough people do it, it might make their data worse and make their operation unprofitable.
Those two reddit plugins are great, particularly the comment collapse one. I'm used to using the appolo reddit app now and I love its collapse feature (the native reddit one sucks).
Installed and will be using both. Please don't steal my data!
This issue stands for apps as well. I once had someone try to buy [1] my popular Android app just to replace it with malware which would then be pushed to users through an innocuous update. What's so interesting to me is that there's no good way to prevent or even detect this.
This is absolutely not confined to free products. I did security audits for companies and part of that job was giving a go ahead before we allowed people to install software on their devices. Free software behaved much better than paid software by a wide margin.
Mozilla yes - there's a delay when publishing whilst an actual human reviews the changes. For Google, updates are instantly published with, as far as I can tell, no kind of audit.
The Mozilla one is great, they insist on reproducible builds and do a thorough review. Although they can't catch everything, I would pick FF over Chrome all day for this reason alone.
Are you sure about that? AFAIK there is just an automatic validation system. I am an extension author myself and this is from a recent update approval email:
"This version has been screened and approved for the public. Keep in mind that other reviewers may look into this version in the future and determine that it requires changes or should be taken down. In that case, you will be notified again with details and next steps."
Perhaps this also depends on the number of users...
Back in 2015 when Detectify (me being co-author) looked into this issue [1] many plugins do not actually have this code in the extensions, but rather a feature to download remote code and add it to the extension so to say. As long as that practice is allowed, source review would not help.
In what is certainly a complete coincidence, the Stylish Firefox extension threw up an "agree to our new TOS 'effective May 22, 2018.'" modal for me today..
Somewhere around 10 years ago I switched strategy:
I don't read them at all. If anyone wants to sue my defense would be that nobody in their right mind (sorry younger me) would read that nonsense.
I assume the rules are basically "don't abuse our content or service",
... and I assume that they will sooner or later sell, abuse, leak, or hand over my data to law enforcement in any country including middle Eastern and African ones.
Tampermonkey seems to be a good alternative as well and is available for all major browsers.
Does anyone have information on if the Safari Stylish Addon does the same shady things? It's available in the official App Store and was approved by Apple it seems.
I was curious about this too. The source is on GitHub (https://github.com/350d/stylish), but who knows if Apple checks that they're the same when they're approving it.
Edit: I should note that it collects analytics, but it can be turned off in the preferences. I don't remember if it's on by default, but I suspect it is.
I really love that one, it does a great job in Safari. Unfortunately, there is no Safari App Extension yet. Since I'm running Safari Preview and Safari 12 does not accept extensions from unknown sources anymore I'm out for now.
So it boils down to trust anyway. No way a code signing certificate can impose that trust. At the end of the day, it all goes back to human stance towards other beings in this world and own dignity.
I actually ran into this issue previously when for some reason I got a request on a `hidden` (very cryptic URL listed nowhere) diagnostic endpoint on one of our APIs.
I ended up identifying stylish as the culprit, at first I disabled the tracking option (which is opt out and probably violates GDPR), a few weeks later I installed stylus.
I also reported it around the same time and gave it a 1/5 star rating but google had no interest in the report it seems.
I've gotten annoyed enough to just copy the source from most of my extensions (located at `~/.config/google-chrome/Default/Extensions/`), remove the update stuff from the `metadata.json` and load them as developer extensions so they never update.
It's easy enough to update them + audit the code when something breaks. The hardest part is downloading the new code (.crx) without installing it, I had to write javascript I paste into the console. StackOverflow can unzip a crx by striping the first 306 bytes.
Dangit - I just installed it yesterday to block Twitter's annoying timeline additions ("So-and-so liked such-and-such") which don't honor the account's word filter/blacklist. Any alternatives out there that are better?
Dark Reader (which generates dark themes dynamically) added support for static CSS so that style sheets can be migrated http://darkreader.org/blog/stylish/
I didn't know until today. I'm annoyed because I never noticed the opt-out checkbox. It feels almost like I've been hacked... my browser history I thought was my own private business, is actually in the hands of a some marketing company.
I’ll have to double check and make sure but as far as I know the safari version of stylus doesn’t do this — it’s written and maintained by a totally different developer.
I’m planning to write my own Safari stylesheet extension some time in the coming months, though, because old style Safari extensions are being phased out in favor of Safari app extensions and I don’t know if the dev of the Safari stylish extension plans to make the leap.
Correction, in my previous reply I meant to say that the Safari version of Stylish (not stylus) has a different developer and doesn’t appear to share the Chrome/Firefox extension’s tracking issues.
With a quick glance it looks to include google analytics, but that’s only used on the extension’s settings page and doesn’t send browser history or anything like that. JS isn’t my forte, though, so if anybody else could take a look and confirm that’d be great.
Use a real browser ? But (bad) joke aside, could you not use multiple browser instead of the just the one ? Stylus and Dark Reader are both available for Firefox and Chrome/Chromium.
Firefox's ability to transparently sync tabs between all your devices is useful but it's not up to speed with Safari's -- sometimes it takes MINUTES for it to sync.
I'd argue with you about what a "real" browser is all day but really, it boils down to -- I am not interested if the latest standards are implemented. Those latest standards are made by regular humans, and they do dumb crap all the time. So "newest" =/= "best".
I quite like Safari's Reading mode and Reading list (especially having in mind that it can cache offline things you put in the reading list; you can read all of those without internet).
I will concede however that it's definitely very behind in terms of addons. That's a weak point. And Firefox gets better and quicker constantly.
TL;DR: I use both Safari and Firefox heavily and I love both. But Safari is little better in terms of information management.
160 comments
[ 3.0 ms ] story [ 218 ms ] threadI guess there should be an addon that notifies users for any ownership changes to browser addons they use. Or is there?
[1] https://github.com/openstyles/stylus
(I'm only a user)
So once they are ready to add malicious code in the future to pass that information somewhere else, no permission changes will be required.
Before downloading any extensions, I usually inspect them quickly with https://chrome.google.com/webstore/detail/chrome-extension-s...
Most important parts are "manifest.json" and then if defined then content scripts that match catch all urls and "https://*/*" / "http://*/*.
It's particularly annoying, because I do have this Stylish extension installed (using css ::after rules to tag HN users)
EDIT: You can submit an abuse report when uninstalling a Chrome extension.
I was put in this tracking program without my consent.
For example, would it be reasonable to enforce that an extension only acts locally, and cannot communicate with any external server? (I guess allowing arbitrary local modifications essentially allows the extension to execute arbitrary javascript code, including communicating with arbitrary remote entities?)
I do see in https://noscript.net/faq
> ... Firefox extensions are written in JavaScript too and NoScript doesn't block scripts living outside web pages (i.e. the browser components, included extensions) ...
Also, the transition period will bind the UK to most EU laws for a few more years.
* http://legislation.gov.uk/ukpga/2018/12/contents/enacted/dat...
The GDPR is UK law automatically because it is a Regulation, not a Directive (which needs to be transposed into national law).
The Data Protection Act 2018 implements the Law Enforcement Directive (as the GDPR excludes that from its scope) and a couple of minor derogations (such as changing the age of consent for children to use websites by themselves to 14).
https://ec.europa.eu/commission/sites/beta-political/files/n...
"Where provided under applicable law (such as within the European Union), you may have the right to ask us to delete Personal Information which you have provided to us [... ] contact our Data Protection Officer at: dpo@userstyles.org."
https://addons.mozilla.org/en-US/firefox/addon/stylish/priva...
I've got a system where I use a set of standard styles applied broadly against many sites.
E.g.,
Annoyances -- applied globally to all websites by default: https://pastebin.com/raw/GrE9KX6D
Local Gifs: https://pastebin.com/raw/tn7cqGtJ (Exceptions to global gif filtering)
The following break on many sites too much to be applied as default, but can be used fairly generally to selected sites as needed.
Animations blocking: https://pastebin.com/raw/7Gjxj6AT
Headers / Footers: https://pastebin.com/raw/PsXWhUGf
Popups / Overlays blocker: https://pastebin.com/raw/VcgNNwDp
"Unstyled" CSS: what I apply to unstyled / minimally styled pages: https://pastebin.com/raw/rtfev3vj
For development / testing / debug:
Debug CSS: https://pastebin.com/raw/Z3kFrRQy
(Highlights class/id and entities in page.)
I don't guarantee Annoyances won't break other things, but I do guarantee that the others will.
Assign the to a nonexistent URL or domain initially, or disable them.
If you've got specific bugs with the Annoyances sheet ... I may be able to address them.
My usual first-stop debugging tools are adding either an outline or background colour to an element:
... which tends to show what rule(s) are being triggered. If something breaks, add those rules, and disable the "display: none;" one.I'm also finding that the shift to "display: flex;" styles is breaking some of my assumptions. It's no longer safe to presume that everything is displayed as one of block, inline-block, or inline.
Position directives are also problematic: initial, static, relative, absolute.
That said: I've evolved those styles over a few years, and they tend to work reasonably well. Some nursemaiding required.
English: https://ocr.space/blog/2016/11/wot-browser-extension-collect...
I'm still looking to update my router (Turris Omnia) to use DNSMasq rather than Knot Resolver, which may offer an edge on DNSSec capabilities (though I believe this has lapsed), but is far less capable of being locally customised along the lines of DNSMasq.
https://www.knot-resolver.cz/
http://www.thekelleys.org.uk/dnsmasq/doc.html
https://myactivity.google.com/myactivity
More seriously: if Stylish concerns you, Chrome should too.
There have been rumours forever, but I'm interested in verifiable facts.
https://news.ycombinator.com/item?id=17453471
uBlock origin is a dedicated, quite-good, low-fuss, ad blocker.
uMatrix is a much more general, very powerful, though somewhat fussy, general Web capabilities manager. If you don't mind fiddling with sites periodically, it's very strongly recommended, but for user populations who don't do this or grasp technology poorly, it will require some fairly close managing, _especially_ if the user base doesn't report problems and just accepts "the site is broken".
I'd highlighted my preset recommended set of browser extensions for 2018 a couple of weeks back. The hero image is uMatrix's control interface.
https://plus.google.com/104092656004159577193/posts/WVEM83FY...
I would never have imagined installing it for non-technical users, but one was interested in giving it a try and had no problem. They even said they really liked learning how the web worked (uMatrix shows a grid (the matrix) of hosts and functionality, such as CSS, images, scripts, media, etc.). So I gave it to another non-technical user, and they also like it.
Both have been surprised to see the number of domains that contribute to one webpage (most users assume it's all from the domain they typed into the URL field), and how often Facebook, Twitter, Google Analytics, and other tracking domains show up in that matrix.
Ghostery invites you to submit various data to support it these days, but seems to be transparent about it and to work on an opt-in basis, so quite different to Stylish. Are you aware of other things that Ghostery is doing without the same transparency and consent?
It's on my flagged list, but remains installed.
BTW your characterisation of Ghostery's relation to an "ad company" is incorrect. It's an odd enough situation that I'm not using it any longer but they didn't get "bought by an ad company". Unless something new happened to them, in which case, please provide a link.
I publish a few extensions [1] [2] [3] and have been contacted multiple times by companies asking to buy them for several thousand dollars. They told me the going rate was 0.20 USD per user. You can imagine what kind of deals are being made when the extension has a million plus users.
When pushed for exactly why they wanted to buy the extensions, which are in no way monetizable, they gave vague answers about "user insights". I can guarantee there will be many other major extensions that have sold out their users.
[1] https://chrome.google.com/webstore/detail/old-reddit-redirec...
[2] https://chrome.google.com/webstore/detail/break-timer/hklkdb...
[3] https://chrome.google.com/webstore/detail/reddit-comment-col...
In my experience anonymization is hit or miss, but ostensibly always in place.
The extension has a backend API and web service which is required for the extension to work, not once has a buyer asked about acquiring that. They only want the extension and literally have no understanding of how it works or what it does. Their intent is obvious.
I've not received my own updates for weeks a few times because I haven't noticed the warning, and about a third of our users are on ancient versions presumably because of it [1].
I think the real solution to this problem is GDPR: massive fines if you abuse your users' trust (and get caught).
I'm not keen on the literal dark pattern that Firefox uses to dissuade developers from requiring new permissions.
[1] https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim...
I'm not sure how you can see this as anything but a good thing. If your extension wants more permissions than originally promised, then it absolutely should have to require user intervention to do. You can't just change the agreement like that. Maybe it could be better communicated, although I have to say I don't think I've ever not noticed that yellow icon, but this is far, far better than the alternative.
A better approach would be to allow extension upgrades, irrespective of permissions. If a user chooses to deny permissions the extension should still work on the latest version.
> Chrome prompts the user if adding the permissions results in different warning messages than the user has already seen and accepted.[1]
[1]: https://developer.chrome.com/extensions/permissions
If you want more permissions, then ask for more permissions.
And don't be surprised when people say NO.
Not everyone wants to grant the permissions to your update even if the update fixes bugs in older versions. Not everyone will want your new feature in the first place. Denying permissions is an easy way to eliminate the risk of having to go through and figure out whether or not the new feature is trustworthy.
And if you're not adding a new feature, then why do you need more permissions?
I agree with you. As another reply to you states, however, Firefox doesn't currently let me ask. You have to kind of go hunting for it.
> And if you're not adding a new feature, then why do you need more permissions?
Firefox does not let me explain why the permissions are needed. It would be nice if we could have a little blurb where we can state our case next to each permission.
Our current approach is to explain likely upcoming permissions requests in advance and ask our users to stay vigilant for the appearance of the tiny yellow exclamation mark, but that's not very helpful to the third of users stuck on old verions before we learnt that trick.
> And don't be surprised when people say NO.
I think very few of these users have said no on purpose. We ask for (and use) almost everything [1], so any marginal new permissions are unlikely to give us much more power. The current permission model actually makes it tempting to just literally ask for everything because we might want it for a new feature in the future.
The optional permissions are not fine-grained enough to be useful (you can accept all optional permissions, or none) and not available for enough permissions, otherwise we would use them.
Also, the first versions of our software were really slow and bad. I really doubt many people are staying there on purpose. (If there are any Tridactyl users in this thread using an old version on purpose, I'd like to hear from you :) ).
[1] https://github.com/cmcaine/tridactyl/blob/e20a224fb8d8bbb2b7...
How much more time can I reasonably be expected to donate? Just trying to find duplicates on the BMO could take ages.
Complaining into the void on the internet takes much less time and makes me feel better :)
If url, div, cookies and any other info are collected, what are they?
What server connections are made by the extension, IP, Name, contents of info transmitted?
All the GUI, collection system should be in place as part of JS dev/debug tools already. Just customized it a bit so any tech savvy users can check the audit logs and enable more logging for a plugin if needed.
If an user spots something not right, it is also easy to out the "plugin/extension" on a public forum.
Luckily enough the source code was still on github, and I managed to fork it and improve that version into "Tab Manager Plus" [1]
Since then I've refurbished around 10 extensions and published a few of my own. It's fun, just annoying that malicious extensions aren't getting taken down fast enough, since I suppose not enough people report them.
How to report malicious extensions is also sometimes unclear. Some people think they have to install them first, that's only true for ratings, not reports. For example to report the extension from this blog post you just have to submit this form [2]
For other malicious extensions simply replace the extension id in that link.
[1] Tab Manager Plus - https://chrome.google.com/webstore/detail/tab-manager-plus-f...
[2] Report extension - https://chrome.google.com/webstore/report/fjnbnpbmkenffdnngj...
One sneaky way to get back at them is to send a bunch of fake “poison” requests with fake data back at these guys. It probably wont hurt them but if enough people do it, it might make their data worse and make their operation unprofitable.
Installed and will be using both. Please don't steal my data!
[1] https://willrobbins.org/a-clever-malware-tactic-and-why-ther...
1/ New great product is built. People love it.
2/ Once enough people use it, start monetizing in shady ways, annoying users just not too much or they leave.
3/ Very annoyed users switch to another product back to 1/
1/ New great _free_ product is built. People love it.
Image and file hosting services and messengers are the best examples.
I swear it's because the well has been poisoned and it's just impossible to monetize these services in a moral way.
"This version has been screened and approved for the public. Keep in mind that other reviewers may look into this version in the future and determine that it requires changes or should be taken down. In that case, you will be notified again with details and next steps."
Perhaps this also depends on the number of users...
[1] https://labs.detectify.com/2015/11/19/chrome-extensions-aka-...
https://chrome.google.com/webstore/detail/styler-classic/hbh...
Addon for Firefox:
https://addons.mozilla.org/en-US/firefox/addon/sudo-styler/
I'm getting all money on development/support from Patreon.
For example,
> TOS agreements require giving up first born—and users gladly consent
https://arstechnica.com/tech-policy/2016/07/nobody-reads-tos...
Somewhere around 10 years ago I switched strategy:
I don't read them at all. If anyone wants to sue my defense would be that nobody in their right mind (sorry younger me) would read that nonsense.
I assume the rules are basically "don't abuse our content or service",
... and I assume that they will sooner or later sell, abuse, leak, or hand over my data to law enforcement in any country including middle Eastern and African ones.
Does anyone have information on if the Safari Stylish Addon does the same shady things? It's available in the official App Store and was approved by Apple it seems.
Edit: I should note that it collects analytics, but it can be turned off in the preferences. I don't remember if it's on by default, but I suspect it is.
Tampermonkey is here BTW: https://tampermonkey.net/?browser=safari
I really love that one, it does a great job in Safari. Unfortunately, there is no Safari App Extension yet. Since I'm running Safari Preview and Safari 12 does not accept extensions from unknown sources anymore I'm out for now.
I also reported it around the same time and gave it a 1/5 star rating but google had no interest in the report it seems.
It's easy enough to update them + audit the code when something breaks. The hardest part is downloading the new code (.crx) without installing it, I had to write javascript I paste into the console. StackOverflow can unzip a crx by striping the first 306 bytes.
I forked Stylish v1.5.2 a year ago before I heared of Stylus, but I've no need to to switch since the original extension was pretty good. https://github.com/Zren/chrome-extension-stylish#fork
I'm curious though - What about it is better than turning off automatic updates for addons?
Used it a couple of times in the past, it is a good one.
Allows to easily audit and download the extension right from the Web Store page.
https://addons.mozilla.org/firefox/addon/styl-us/
Any alternatives for Mac users?
I’m planning to write my own Safari stylesheet extension some time in the coming months, though, because old style Safari extensions are being phased out in favor of Safari app extensions and I don’t know if the dev of the Safari stylish extension plans to make the leap.
If you do write such an addon as you said, please advertise it here in HN!
The code for the safari version is available here: https://github.com/350d/stylish
With a quick glance it looks to include google analytics, but that’s only used on the extension’s settings page and doesn’t send browser history or anything like that. JS isn’t my forte, though, so if anybody else could take a look and confirm that’d be great.
I'd argue with you about what a "real" browser is all day but really, it boils down to -- I am not interested if the latest standards are implemented. Those latest standards are made by regular humans, and they do dumb crap all the time. So "newest" =/= "best".
I quite like Safari's Reading mode and Reading list (especially having in mind that it can cache offline things you put in the reading list; you can read all of those without internet).
I will concede however that it's definitely very behind in terms of addons. That's a weak point. And Firefox gets better and quicker constantly.
TL;DR: I use both Safari and Firefox heavily and I love both. But Safari is little better in terms of information management.