TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

The Great Suspender: New maintainer is probably malicious

389 pointsby AdamGibbinsover 4 years ago

26 comments

blindmover 4 years ago
I am one of the few people that inspects the source-code of extensions. It&#x27;s easy to do, for Firefox for example, just right-click and save-as in the extensions site, then rename your extension to a .zip file and extract e.g:<p><pre><code> addon.xpi --&gt; addon.zip </code></pre> Then manually sift through the code looking for obvious malicious intent (or not so obvious malicious intent if the author is doing obfuscation). Note: obfuscation is a red flag! A simple scan for `<a href="https:&#x2F;&#x2F;" rel="nofollow">https:&#x2F;&#x2F;</a>` &#x2F; &#x27;<a href="http:&#x2F;&#x2F;" rel="nofollow">http:&#x2F;&#x2F;</a>&#x27; would usually yield interesting URLs where data is sent. I have actually spotted malicious addons in the wild this way and reported them to Mozilla. They were thankfully removed.<p>Note: Obfuscation is NOT the same as minification, and I don&#x27;t mean minification when using the word obfuscation!
评论 #25622243 未加载
评论 #25623526 未加载
评论 #25622663 未加载
评论 #25622615 未加载
评论 #25622293 未加载
paulgbover 4 years ago
I&#x27;ve been telling everyone who will listen[1][2][3] that as an extension developer, I&#x27;d love to be able to guarantee through the Chrome App Store that an extension matches a git commit (or auditable build pipeline artifact) exactly.<p>It wouldn&#x27;t fix everything (for example, you could still put a payload in an innocent-looking dependency), but it would at least fix the blatant problem that a maintainer can add code when uploading an extension even if the extension itself is open source and therefore (appears to be) auditable.<p>[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=23265699" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=23265699</a> [2] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16881343" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16881343</a> [3] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16317686" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16317686</a>
评论 #25623538 未加载
_qulrover 4 years ago
We need to talk about how difficult it is to monetize browser extensions. Most of these problems occur when a reputable extension gets sold to a less reputable owner, frequently for a relatively small amount of money (4-5 figures). Even very popular extensions have a hard time monetizing. Unfortunately, Chrome has recently made the situation worse by deprecating Chrome Web Store payments, and Firefox eliminated their paid extension store several years ago.<p>If the only way to monetize an extension is to exploit its users for data, this kind of thing is going to keep happening. It&#x27;s perfectly understandable how someone who is doing a lot of work for no pay will eventually get tired of it or have other priorities in life, which is what happened in this case. Perhaps we all need to stop taking it for granted that browser extensions ought to be free? Or maybe the browser vendors themselves can find ways of financially supporting extension authors. I feel that money is essential to both the problem and the solution.<p>Of course, paid upfront software gets sold to new owners too. But if the software is paid upfront, the expectation is that the new owner will perhaps do a better job of maintaining and marketing the software, and that&#x27;s why the new owner buys it. When the software is paid, the new owner has an opportunity to make money legitimately, without secretly exploiting the existing user base.
评论 #25624041 未加载
评论 #25643806 未加载
评论 #25624791 未加载
escape_goatover 4 years ago
The culpability of Dean Oemcke in this particular incident should not be understated. Hindsight is hindsight, of course, but the fact that the new owner of the platform distribution rights of this open-source project was (and apparently remains) anonymous seems like it ought to have been a huge red flag. The fact that these rights were paid for made it obvious that monetization was pending. The lack of transparency made it obvious that the form of that monetization would not be acceptable to the contributing community.<p>There might be a way of contesting the rights to the project name but that would require legal activism and external funding. Basically the original project is dead insofar as the contributors are not comfortable with supporting a parasitic and probably malicious actor. I guess a fork is inevitable. Meanwhile the parasite will harvest the value of the &#x27;brand&#x27;, distribution rights, and existing codebase until it is drained by obsolescence.<p>A really disgusting way to treat a community by both parties. One can only hope that Mr. Oemcke desperately needed the money for some vital purpose.
supernova87aover 4 years ago
Isn&#x27;t this a huge vulnerability that rises to the level of &quot;Chrome team should police this&quot;?<p>I mean, just thinking potential threats (which now I&#x27;m removing the extension because of them):<p>-- corporate web pages potentially sniffable if installed on work computer<p>-- personal passwords, password manager traffic<p>The potentially malicious actor is able to just scoop up any domain&#x27;s encrypted traffic, isn&#x27;t it? Or is there any practical assurance that they&#x27;re only gathering domain names, high level traffic stats, etc?
评论 #25622778 未加载
评论 #25625309 未加载
protoman3000over 4 years ago
I recently tried to find a health related tracking app on the Apple AppStore in order to conveniently track and manage my health but I noticed that I cannot trust any offered app anymore, regardless of paid or free.<p>This can come either because the proliferation of *analytics, broad openness of supposedly sandboxed systems, needless availability of fingerprinting methods and lack of proof of privacy commitment by the vendors (and any published privacy policy is not enough), or because I just became too paranoid (or both?).<p>Examples like these validate the suspicion that you can’t trust any app or plug-in anymore, with big vendors being in a inbetween position of “too big to lose trust”.<p>I wonder when we will reach the point where there is no trusted web browser anymore, no trusted computer appliance. When will it be that you cannot even say a word to a person in-person anymore because it lands in a weakly secured cloud by the microphone inside their smartwatch that runs a weather app that is run by crooks. Or is that point reached already?
评论 #25624074 未加载
评论 #25622445 未加载
fractionalhareover 4 years ago
Seems like another case where a successful Chrome extension was bought out so it could be used for either:<p>1. Mining the users&#x27; traffic and reselling it as market research, or<p>2. Using the users&#x27; computers as a pool for a residential proxy service, or<p>3. Replacing and inserting ads into users&#x27; browsers.<p>This is unfortunately quite common.
评论 #25623445 未加载
tyingqover 4 years ago
Chrome extensions are an interesting study in trust. Even with their push for manifest v3, you can still run arbitrary JS on any url. Which, of course, allows arbitrary spying and manipulation.<p>If they hobble that, though, a large portion of extensions become useless. I don&#x27;t personally see any real middle ground. It&#x27;s either a credible risk, or too complicated for practical use. The way manifest v3 hobbles practically required things like heuristics is a good example.
评论 #25622601 未加载
评论 #25623064 未加载
ce4over 4 years ago
Reminds me of the uBlock vs uBlock origin story some years ago:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=9437182" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=9437182</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=9718625" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=9718625</a>
评论 #25623212 未加载
评论 #25628226 未加载
timhiginsover 4 years ago
I&#x27;d just like to mention that if the community was determined enough we&#x27;d<p>1. Demand removal of analytics software 2. If no action, fork and re-publish.<p>Obviously folks who aren&#x27;t technical&#x2F;didn&#x27;t see these threads wouldn&#x27;t get the benefit of an update.<p>This is something where an explicitly pro-opensource and anti-tracking (or at least minimal tracking) policy by the browser extension stores would be valuable. The store itself could recommend the no-tracking community version instead. Of course this would have to happen on an individual basis and be carefully managed as so not to be abused.
评论 #25623132 未加载
kyriakosover 4 years ago
Unrelated to the security implications, Microsoft Edge is doing tab suspension natively in the latest builds.<p><a href="https:&#x2F;&#x2F;www.windowslatest.com&#x2F;2020&#x2F;09&#x2F;17&#x2F;microsoft-edge-sleeping-tabs-feature&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.windowslatest.com&#x2F;2020&#x2F;09&#x2F;17&#x2F;microsoft-edge-slee...</a>
评论 #25622579 未加载
评论 #25627097 未加载
RandyRandersonover 4 years ago
This type of developer &#x27;switch&#x27; is becoming so common that I now have to add my chrome extensions to google alerts so as to feel safe. As a user below comments: &quot;We need to talk about how difficult it is to monetize browser extensions&quot; b&#x2F;c w&#x2F;o this we will see this continue.
arusahniover 4 years ago
I wrote a browser extension that interacted with a password manager.<p>I receive almost-weekly messages from folks offering to buy my extension.
Lammyover 4 years ago
If anyone is looking for an alternative, I&#x27;m a big fan of Auto Tab Discard:<p><a href="https:&#x2F;&#x2F;add0n.com&#x2F;tab-discard.html" rel="nofollow">https:&#x2F;&#x2F;add0n.com&#x2F;tab-discard.html</a><p><a href="https:&#x2F;&#x2F;addons.mozilla.org&#x2F;en-US&#x2F;firefox&#x2F;addon&#x2F;auto-tab-discard&#x2F;" rel="nofollow">https:&#x2F;&#x2F;addons.mozilla.org&#x2F;en-US&#x2F;firefox&#x2F;addon&#x2F;auto-tab-disc...</a><p><a href="https:&#x2F;&#x2F;chrome.google.com&#x2F;webstore&#x2F;detail&#x2F;auto-tab-discard&#x2F;jhnleheckmknfcgijgkadoemagpecfol" rel="nofollow">https:&#x2F;&#x2F;chrome.google.com&#x2F;webstore&#x2F;detail&#x2F;auto-tab-discard&#x2F;j...</a>
crucialfelixover 4 years ago
Out of an abundance of paranoia, I always open all financial and secretive websites in Incognito mode, and I always disallow all extensions in Incognito mode.<p>We should really have separate dedicated browsers just for doing transactions.
dawnerdover 4 years ago
Wouldn’t be perfect but I’d like to see the ability to prevent extensions from making any web requests.<p>I’d also like them to not silently update in the background.
yoloswaginsover 4 years ago
I did the work of downloading a forked version [1] of the extension and disabling the mainline extension.<p>In doing so, I lost about 60 suspended tabs, with no record in history as to what they were.<p>In some ways, this is like a weight off my back. On the other hand, I was going to read those tabs, I swear!<p>Oh well, time for me to search jstor for a history of copper mine consolidation, again.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;aciidic&#x2F;thegreatsuspender-notrack" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;aciidic&#x2F;thegreatsuspender-notrack</a>
yodonover 4 years ago
Many comments in the GitHub issue mention Tabs Outliner as an alternative for the now-sketchy-looking The Great Suspender.<p>Speaking as a long time paid user of the free&#x2F;paid Tabs Outliner, I can&#x27;t recommend it strongly enough.<p>[0]<a href="https:&#x2F;&#x2F;chrome.google.com&#x2F;webstore&#x2F;detail&#x2F;tabs-outliner&#x2F;eggkanocgddhmamlbiijnphhppkpkmkl?hl=en" rel="nofollow">https:&#x2F;&#x2F;chrome.google.com&#x2F;webstore&#x2F;detail&#x2F;tabs-outliner&#x2F;eggk...</a>
评论 #25623469 未加载
评论 #25632378 未加载
praptakover 4 years ago
What prevents bad actors from buying a popular extension and rolling out malicious code to everyone who uses the extension?<p>I mean except the integrity of extension developers.
评论 #25623448 未加载
评论 #25625739 未加载
tonymetover 4 years ago
I stopped using Great Suspender a few years back when Chrome built this in <a href="https:&#x2F;&#x2F;developers.google.com&#x2F;web&#x2F;updates&#x2F;2015&#x2F;09&#x2F;tab-discarding" rel="nofollow">https:&#x2F;&#x2F;developers.google.com&#x2F;web&#x2F;updates&#x2F;2015&#x2F;09&#x2F;tab-discar...</a><p>I encourage people to disable all chrome extensions. They have unprecedented access to your data (they can read your bank credentials), and they are a big performance hit. e.g. using Chrome Devtools you can see that Lastpass doubles page load times.<p>You can use SimpleExtManager (only has perms to turn on &#x2F;off extensions) to turn everything off until you need them.
评论 #25625413 未加载
sheepdestroyerover 4 years ago
Three builds published to Chrome Webstore without corresponding commits published to GitHub.<p>This Extension being GPLv2, is there a way to report this obvious license violation to Google&#x2F;GitHub? Would they care?
gcatalfamoover 4 years ago
TGS is absolutely critical for my everyday use: can someone confirm if everything is still as in the linked GitHub issue?
评论 #25643230 未加载
hda111over 4 years ago
This is a problem with many package managers. Even if one downloads a package in Emacs from MELPA. How can one be sure it’s not containing malware? Read through all code every in every dependency after every update?
swileyover 4 years ago
Curated app stores are great at preventing malware because they prevent you from installing packages from anyone other than the <i>official</i> maintainer, including yourself.
EGregover 4 years ago
In general, there is a huge problem with how we distribute software, and package managers are even worse.<p>We basically only look at the top level of things, when instead, every branch in the tree should have a bunch of security people watching it, like editors watch every change to a Wikipedia article, before it goes out.<p>Corporations using automation and technology have hijacked our &quot;Free Speech&quot; ideals, and caused us to think that it&#x27;s a good thing when one party can push out a tweet to 5 million people at once, or a single corporation can buy up local stations and enforce talking points on journalism. That&#x27;s not freedom of speech at all. That&#x27;s just a preference for maintaining entrenched power because someone &quot;amassed it voluntarily&quot;... and this mentality extends recursively all the way down ... Take for example the first Twitter mega-celebrity. Ashton Kutcher himself amassed it voluntarily because he was chosen by TV and movie executives once upon a time, to be used in mass media, and their platforms were &quot;voluntarily&quot; built in the past, from the invention of the TV, and people subscribed &quot;voluntarily&quot;, and Twitter was built &quot;voluntarily&quot; and funded by VCs voluntarily, and so on. And the end result is, some power (in this case, audience) is concentrated in the hands of a few people, who disproportionately act as kingmakers for various other people and ideas. That&#x27;s also how we get &quot;too big to fail&quot; issues in telecoms, banks, and so on.<p>In science, things work differently. Arxiv.org exists but peer review is a big thing. Wikipedia has multiple distrusting parties for each large article. So does Bitcoin (presumably, anyway).<p>In general, the more value (votes, data, code, money) accumulates in one place, the more &quot;checks and balances&quot; you should have for each release. You can&#x27;t just have someone push out something in the middle of the night and have everyone pull it into their codebase via npm and then &quot;launder&quot; the (malicious) bugs through more and more releases. You need it to go through &quot;peer review&quot;, and not on the top level of an entire tree, but rather, for each subtree there need to be people who understand what&#x27;s going on.<p>THAT is a society that&#x27;s far more secure, that can&#x27;t be easily backdoored by some hackers paid by a state to find vulnerabilities. And the capitalistic system we have today is pushing the other way (closed source, centralized databases, extract rents reward early investors through information asymmetry, etc.) and the result is stuff like SolarWinds, Equifax hack, Yahoo hack, etc. etc. etc. We&#x27;re finally starting to put a tax on storing data without an explicit purpose, hopefully that will make it expensive enough that people will be custodying their own data at least. But when it comes to &quot;broadcasting&quot; things, I&#x27;d rather have less &quot;real time pushes&quot; and instead slow things down until we can &quot;run byzantine consensus&quot; gradually releasing to the public via concentric circles.<p>The full solution would involve Merkle trees where some security organizations and researchers &#x2F; peers (anonymous or not, but with reputations) sign off on each changeset. Instead of just Apple or something. Git + Verified Claims can already support most of the infrastructure, btw.
评论 #25622456 未加载
Cactus2018over 4 years ago
For anyone not clicking the link, TheMageKing opened this issue on Nov 3, 2020.