chrisbalt

Pretty sure this is legitimate.

Kiro, you can view this information and more in the "Network" tab of the Developer Tools in Chrome. Make sure the red "Record Network Log" circle is enabled, refresh the page (suggest you also check the "Disable cache" checkbox) and you should see a stream of everything loading on the page in great detail, including the timing data, which is painted on the page with this tool.

Hope this helps.

Some good notes on its reconstruction can be found in the readme: http://www.microsoft.com/en-us/discover/1994/readme.html

Whether or not it was your intention or the design of your extension, that was the behavior I observed - hence my factual claim.

I've looked deeply into your extension and you did a very nice, impressive job. I don't believe anyone is discounting the quality of your work here. The pattern you exhibited by enabling the ecolinks feature by default (right or wrong) simply highlighted, for many, the risks inherent in granting browser extensions such great permissions to the browser.

Really what this boils down to, imho, is a need to educate users on the meaning of the permissions that are granted (with approval) to these extensions. Certainly the vast majority of users confirm the security permissions without comprehending the weight of access they've just provided the extension author.

With JavaScript, it's nearly impossible for Chrome to reasonably explain, with any level of granularity, what exactly an extension will do with its access - hence the "access your data on all websites" warning.

A proof of concept to demonstrate how you can take advantage of this access for nefarious reasons, even after getting approval into the Chrome Web Store, would be quite simple.

Long/short of it is: make sure you trust the author of any extension you install!

Seems like the quintessential dark pattern is to have a "feature" like this enabled by default. Further, I discovered that the feature would re-enable on a regular cadence - perhaps every time the extension was updated.

One thing I wish I had called out more clearly in my post ("See it in action") was the fact that the "feature" would re-enable itself after every update of the extension, which seemed to be quite frequently.

It's a shame; it really was a feature-packed, helpful extension.

^ Would love to hear what comes of this.

I definitely appreciate Cuban's words.

I think the truth is that one must question the sincerity of their passion if they're unwilling to put forth effort for it. For many, I think a passion is something they'd like people to think they do. If they're really passionate about it, they'll do something about it; at that point, there'd be no question.

Couldn't agree with you more. Microsoft is an excellent launchpad. Your points are on point with most of the 20-somethings or 30-somethings I work with. Can't wait to see what we're all doing in 10 years.