Hacker News Reader

Comment by staunch | Hacker News Reader

It's not awkward to violate people's privacy, it's wrong. Maybe you didn't know that before, but you still don't seem to get it.

View on HN

Person posts cool tool they wrote, that they find useful. Shows it to the community, this community, which many may really appreciate. Then gets ripped for not thinking through the complex privacy issues with said tool. Not everything is malicious.

It would be better to give constructive criticism, like:

This is a really cool tool! I might even choose to use it, but I have a few concerns: 1) it sends too much data unfiltered to the algolia search servers. Could you instead make it a button that only then triggers the request or opens another browser window? 2) the analytics are also a concern. In general, you should always make these opt-in; better, ask the user through a dialogue to enable them; even better, request feedback through some other system (github for example).

Let’s try and be nice here and give people the benefit of the doubt.

Heh, thanks bluejekyll. I appreciate this.

FWIW, I am taking the privacy and security concerns raised in this thread seriously. In fact, this type of candid feedback is one of the best things about HN. I anticipate it will take me a few days to choose and implement some of the fixes suggested here.

I agree with the sentiment but not this example.

Sharing people's browsing data with third-parties can threaten their lives in some circumstances. There's no excuse for a developer creating browser extensions not to take this threat seriously in 2018. It's negligent.

I did read your comment (and I didn’t downvote you b/c I agreed with you). The reason I wrote this response was because your comment read as being very aggressive in response to an honest attempt at explaining an issue the dev was having. What your comment lacked was any additional information about better approaches.

I get the concern and share it, but your comment only said that what they did was wrong. It didn’t offer any ideas of how to fix it. Telling someone they’re on the wrong road but not telling them how to get to the correct one leaves them just as lost.

What the developer didn't seem to understand in this case was the gravity of the issue. I don't think your explanation would have conveyed it as well.

Take care of yourself.

Thank you!

And let's all try not to get the users of our software imprisoned or killed: https://boingboing.net/2018/01/28/30000-accused.html

It's not a violation if there is consent. I'll grant that I didn't think through the consent process for the extension very well, though.

You did not get consent. You did violate people's privacy. Your extension got removed by Google and Mozilla.

Anyone who takes security/privacy seriously shouldn't install any Chrome extension under any circumstances. Many extensions secretly do terrible things that take months or years for anyone to uncover, or the extension is simply sold to a new owner who slips in a malicious payload which is automatically distributed to all users of the extension.

I find it strange how everyone used to be concerned about XSS exploits (including Google themselves who painstakingly implemented reflective XSS prevention, nonce support, and support for XSS-blocking HTTP headers in Chrome) and now they all love XSS as long as it has decent marketing and a clean presentation as an "extension".

Reply on news.ycombinator.com