Hacker News Reader

Comment by jdormit | Hacker News Reader

Well this is awkward. Seems that shortly after I posted this here both Mozilla and Google rejected the extension from their stores. Mozilla's primary concern was that the analytics were opt-out, not opt-in, so I'm patching that in and resubmitting.

Typically, Google just said that it "did not comply with their policies" with no additional information, but I'm guessing their concerns are along the same lines.

Meanwhile, if anyone is interested in trying it out, the README has instructions on running the extension locally in Firefox or Chrome.

View on HN

Out of curiosity, why did you choose to set up analytics as opt-out? What do you even need them for?

I built this as an exercise in product management - even though it is just a little extension, I want to run it as if it were a revenue-generating product so that I can gain experience in that area.

Part of that is looking at usage data to identify what parts are working, what needs improvement, retention statistics, etc. I made them opt-out because I would be pissed if someone made a cool thing that I wanted to use but insisted on tracking me with it :)

I think you misunderstood my question. Why "opt out" instead of "opt in"? Or better still, "ask the user at first run"?

Because DNT was the quickest solution. I'm actually rewriting that part over the next couple of days to be opt in instead (via a popup the first time the sidebar is opened, I think).

One problem is the risk of self-selection bias.

Having given it more thought, and in response to some of the concerns raised in this thread, I removed analytics entirely.

The build instructions say that it will create ext/js/generated, but I'm only seeing ext/js, with a few .js files, but no "generated" directory.

Did you run `lein cljsbuild once`? If so, would you mind filing an issue?

My apologies, the configuration for cljsbuild was incorrect. It's been fixed now.

Anybody knows how long it will take before Mozilla will make the new version available (avg. review time)?

I'm still working on making the changes they requested - once I've finished that and submitted a new version, I anticipate it will be a couple days at most until they make the new version available.

@JepZ, the new version has been approved by Mozilla and is available at https://addons.mozilla.org/en-US/firefox/addon/looped-in

Thx for the hint.

One suggestion that came to my mind: As most pages I visit have no comments, I closed the sidebar again. But that way I don't see the comments when there are some. How about adding a setting to let the sidebar open/close automatically if there are comments for a page?

The extension icon should have a number on it that corresponds to the number of comments. My thinking was that you could use that to see if a page had comments or not.

It's not awkward to violate people's privacy, it's wrong. Maybe you didn't know that before, but you still don't seem to get it.

It's not a violation if there is consent. I'll grant that I didn't think through the consent process for the extension very well, though.

You did not get consent. You did violate people's privacy. Your extension got removed by Google and Mozilla.

Person posts cool tool they wrote, that they find useful. Shows it to the community, this community, which many may really appreciate. Then gets ripped for not thinking through the complex privacy issues with said tool. Not everything is malicious.

It would be better to give constructive criticism, like:

This is a really cool tool! I might even choose to use it, but I have a few concerns: 1) it sends too much data unfiltered to the algolia search servers. Could you instead make it a button that only then triggers the request or opens another browser window? 2) the analytics are also a concern. In general, you should always make these opt-in; better, ask the user through a dialogue to enable them; even better, request feedback through some other system (github for example).

Let’s try and be nice here and give people the benefit of the doubt.

Heh, thanks bluejekyll. I appreciate this.

FWIW, I am taking the privacy and security concerns raised in this thread seriously. In fact, this type of candid feedback is one of the best things about HN. I anticipate it will take me a few days to choose and implement some of the fixes suggested here.

I agree with the sentiment but not this example.

Sharing people's browsing data with third-parties can threaten their lives in some circumstances. There's no excuse for a developer creating browser extensions not to take this threat seriously in 2018. It's negligent.

I did read your comment (and I didn’t downvote you b/c I agreed with you). The reason I wrote this response was because your comment read as being very aggressive in response to an honest attempt at explaining an issue the dev was having. What your comment lacked was any additional information about better approaches.

I get the concern and share it, but your comment only said that what they did was wrong. It didn’t offer any ideas of how to fix it. Telling someone they’re on the wrong road but not telling them how to get to the correct one leaves them just as lost.

What the developer didn't seem to understand in this case was the gravity of the issue. I don't think your explanation would have conveyed it as well.

Take care of yourself.

Thank you!

And let's all try not to get the users of our software imprisoned or killed: https://boingboing.net/2018/01/28/30000-accused.html

Anyone who takes security/privacy seriously shouldn't install any Chrome extension under any circumstances. Many extensions secretly do terrible things that take months or years for anyone to uncover, or the extension is simply sold to a new owner who slips in a malicious payload which is automatically distributed to all users of the extension.

I find it strange how everyone used to be concerned about XSS exploits (including Google themselves who painstakingly implemented reflective XSS prevention, nonce support, and support for XSS-blocking HTTP headers in Chrome) and now they all love XSS as long as it has decent marketing and a clean presentation as an "extension".

Reply on news.ycombinator.com