Malware in open-source web extensions

This page summarizes the projects mentioned and recommended in the original post on news.ycombinator.com

Our great sponsors
  • SurveyJS - Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App
  • InfluxDB - Power Real-Time Data Analytics at Scale
  • WorkOS - The modern identity platform for B2B SaaS
  • uBlock

    uBlock Origin - An efficient blocker for Chromium and Firefox. Fast and lean.

  • I want to clarify a few points in the article re. uBlock Origin, they might be seen as minor details but to me these matter.

    > Raymond Hill, after (you guessed it) he transferred ownership of uBlock to a new, untrustworthy maintainer

    Only the GitHub repo was transferred, I never transferred the extension in the Chrome Store, and Opera Store.[1]

    The Firefox version was published by a contributor, and he chose to stay with the new maintainer, and as a result I created a new publication for uBlock Origin in Firefox store.

    All this was nearly 6 years ago.

    > Aljoudi began reducing blocking features, eventually choosing to permit certain ads via the "acceptable ads" program

    "Acceptable Ads" was added to "uBlock" in February 2019 by the new owner, BetaFish Inc. (maker of AdBlock).[2]

    BetaFish Inc. was itself sold circa October 2015 to an (still) anonymous buyer.[3]

    > Hill created a fork, now called uBlock Origin, which reverted the changes

    I didn't revert any change, I forked while I was still controlling the GitHub repo.[4] If you look at the project timeline, it shows that I have been in charge since the first commit in June 2014.[5]

    > Nano Defender and its 200,000+ users, upon their recent acquisition, immediately began having their personal data mined.

    Note that the malware did not require the blocking ability of the webRequest API to collect the data, it needed only the observational ability, which is not deprecated by Manifest v3.[6]

    **

    [1] https://github.com/gorhill/uBlock/issues/57

    [2] https://github.com/uBlock-LLC/uBlock/releases/tag/0.9.5.13

    [3] https://news.ycombinator.com/item?id=10318200

    [4] This was the first release following the split, nothing had to be reverted:

  • NanoCore

    Discontinued An adblocker

  • SurveyJS

    Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

    SurveyJS logo
  • google_translate_this

    This WebExtension translates the current page with Google Translate. It does so on demand so it does not change the page unless the user selected this. It is fast, light and privacy friendly.

  • The restriction worth for security but also pain for some extensions. For example, A Google Translator add-on on Firefox can't be regitered to Mozilla's store.

    https://github.com/andreicristianpetcu/google_translate_this

  • bypass-paywalls-chrome

    Bypass Paywalls web browser extension for Chrome and Firefox.

  • I've wondered about whether something like this could happen to the "Bypass Paywalls" Chrome extension [1]. However what makes me feel more comfortable (and please correct me if I'm wrong) is that in order to use the extension, you need to save a copy of it locally and then drag that over to Chrome to install it. If I delete the local version of the extension then it no longer works. Assuming that there were no malware at the time of downloading the extension from GitHub, does this mean that no one can "push" malware code to my local version of the extension?

    [1] https://github.com/iamadamdev/bypass-paywalls-chrome

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a more popular project.

Suggest a related project

Related posts