A new disaster for adblockers - Nano defender/adblocker sold to dubious developers

[williamcll]

Quick note: Ublock origin is still safe to use
Nano adblocker, a famous fork of the popular ublock origin which had added anti-adblocking capabilities was recently sold to a self proclaimed turkish startup, who has since then been making questionable changes to the software and has keep the code closed, a violation of the GPL since ublock origin itself is open source. The extension has since then removed from the google play store and the firefox port has since stopped as well. 

Quote

When Nano Defender was launched in 2019, it quickly became a go-to extension to bypass anti-adblocking mechanisms on Internet sites. It used code from uBlock Origin, one of the most prominent content blocking extensions, and users started to install the new extension in Chrome and other Chromium-based browsers. One of the main differentiating factors between Nano Defender and uBlock Origin was that the former supported a reporting option to let the developer know about issues encountered while using the extension.

 

 A port for Firefox was created by another developer to cover all major browsers on the Windows platform. Nano Defender has more than 200,000 users that installed the extension from the Chrome Web Store alone. The developer of the extension revealed on the official GitHub that he decided to sell the extension twelve days ago to two Turkish developers. Community members and Raymond Hill, developer of uBlock Origin, shared their thoughts on the deal and the fact that little information was provided. Gorhill suspected that the new owners main intention was to monetize the extension in one form or another, or do worse with it.

 

Hill suggested that users uninstall Nano Defender / Nano Adblocker immediately to block data from being submitted to the new owners.

Note that as mentioned in the topic, the firefox port has stopped updating as well.

Source: https://www.ghacks.net/2020/10/16/time-to-remove-nano-adblocker-and-defender-from-your-browsers-except-firefox/

Thoughts: This is certainly worrying, guess I'm back to using the regular UBO once again. It's interesting since the original dev was not expecting this to happen AND he himself still has control over the IE release. I am unsure how this is going to develop. But in the meantime I'm going to stay away from nano.

[Teddy07]

Still happy with Adblock plus

[TetraSky]

Never heard of it. Still happy with uBlock Origin.

[strajk-]

Shame, I did use it, Nano Defender + Nano Adblock was great, went back to UBlock again.

Great to know that the community acted and mass reported the changes of both extensions to the point the pages are no longer available on the Store.

[Soppro]

I'm using Nano Defender to block anti-adblock popups ... hmm this is interesting 

[circeseye]

10 hours ago, Teddy07 said:

Still happy with Adblock plus

adblock plus is good but they take money to allow ads through (been this way for a few years)
best is to run both adblock plus AND ublock origin

[WereCatf]

11 hours ago, williamcll said:

Quick note: Ublock origin is still safe to use

This is the important bit. The people behind Ublock Origin seem to be in it for ideological reasons, so they're not likely to be interested in attempts at someone buying them off or anything like that. As a sidenote, I've been a happy user of Ublock Origin for years and I pushed my hubby into it as well.

[straight_stewie]

I just use Brave (a chromium browser).

[RejZoR]

I use to use uBlock almost religiously, but AdGuard is just so much better. It blocks ads better, it blocks cookie messages better, it blocks annoyances better (especially Youtube's login notification bullshit) without being too aggressive like uBlock that just blocks EVERYTHING even stuff I need or want. Plus AdGuard also has URL click tracking filtering and first/third party cookie expiratioin controls which is nice.

[Lord Vile]

Or you could use Safari...

[Doobeedoo]

Well, I do use AdGuard though. 

[CTR640]

Fuck ads and fuck abusive cookie windows and fuck popups and fuck all. Google Chrome has gone down the bullshit disabling uBlock Origin and youtube is riddled with all the shitton of ads. Seriously, I can live without using internet and would only be using internet banking and emails so if webbrowsers some day decides to block all adblocks, the choice will be very simple for me: no more browsing. Would use my pc only purely for gaming and nothing else.

 

All the ads HAS to stop! Ads contains malware too because the ads providers won't do any shit to check their ads.

[Sauron]

Everyone should use ublock. It's open source and doesn't take bribes from anyone.

[kewtz]

Now we just need a method to block in-line ads (I'm looking at you, twitch) and we'd be golden.

[Energycore]

On 10/17/2020 at 2:16 PM, williamcll said:

Nano Defender has more than 200,000 users that installed the extension from the Chrome Web Store alone.

These numbers are tiny for an adblocker. As long as uBlock Origin isn't touched I wouldn't be worried

[WereCat]

I use uBlockOrigins and I used Nano Blocker but now I use Tampermonkey with the "Anti-Adblock killer Reek" script and it works prefectly. 

[startrek03]

I used to use Adblock Plus, but I switched to using uBlock Origin, since Adblock Plus wasn't working on Soundcloud anymore. To this day, I'm rather satisfied with uBlock.

[Pickles von Brine]

I use malwarebytes browser guard plus ghostery. Does a good job. 

[Vishera]

I use Nano Defender...

But there is a silver lining! - The original developer controls the original repos and the website,so i grabbed the last version off there.

The new developer has a mere fork of the original repo.

It appears that the original developer still cares about the project,it's just that he doesn't have time for it.

[mxblue]

And in new developments in the story, turns out the new "developers" that took over maintaining injected malware into the code and managed to push a new version, until it got taken down around 12hrs ago: https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210

 

Data stolen was any headers sent in requests made to pages. Of note, cookies.

 

Anyone who had the extension installed in the last few days should go to every site they visited in that time and log out of sites to invalidate the session cookie.

[CotyTernes]

The original developer does appear to care, but his inexperience in software management and transition is very apparent. There are multiple other ways he should have gone about it. In the official discussion thread on GitHub he said: "As I mentioned here [1], I planned to donate most of the money back to the new developer(s) if they do a good job. If I wanted to make a quick buck, I would sell the projects and disappear."

If his intention was to reinvest what they paid him back into the project (which I am not questioning) he should have told them just to fork it, and if they did well he could push the user base over by releasing a small update that informs users that it is no longer supported and to go to the fork. His intentions clearly were good, but he fundamentally misunderstood what he was doing by selling it. He wasn't selling the software; he was selling the users and didn't realize that when he was in the process. It's GPL-3, those malicious devs didn't need to buy him out to get their hands on the software.

Furthermore, his inexperience is shown by clearly not having a clause in the sale contract to reverse the sale if harm or malicious activity is done to or with the purchased software. Many business takeovers have similar clauses to that in those contracts directly in case something like this happens.

This situation has caused irreparable harm to his developer identity, and unfortunately in some ways it should. People need to realize when they run something, in charge of something, or otherwise representing something that those things effect people in wide reaching ways. Not having time or not caring about something anymore is not an excuse to cause harm to them, whether it was intentional or not. The actions of the new devs with this project are forever his fault and his responsibility (obviously to a lesser degree than the devs themselves as his fault and responsibility is indirect) because he didn't take the proper actions in the transition. I'm sorry jspenguin2017 that you must deal with all this anger and frustration, I really do feel bad for you. But you deserve at least some of it, and WE, the community, deserve a full-throated apology outlining what you did wrong in this transition, that you accept this wrongdoing, and what you will do in future projects to address those specific points of what was wrong.

[CotyTernes]

Now to get controversial I would like to reply to everyone out there who is saying things along the line of "The userbase wasn't THAT large, so what's the big deal?" I'd like to use a few examples to show how that line of thinking is dangerous to have.

"It's only SOME unarmed black people that are killed by police, why do we have to change the whole police system?"

"The genocide in Yemin isn't that big relative to like the Holocaust, and I'm not there so why should I care"

Yes, those are very extreme examples, but my point stands. Bad is bad, wrong is wrong, and we as various communities need to stand together to both call out what is wrong and take actions to stop things that are harmful on every level. If you can excuse harm to thousands of people you don't know it's not too much of a stretch to excuse harm to others.
Just to be clear I'm not accusing anybody that didn't think this was a big deal of thinking that police brutality or the genocide in Yemin don't matter. I'm just using examples to hopefully make you reflect internally into that line of thinking and hopefully make a mental change of your own. Thanks for taking the time to read my perspective.

Edited October 20, 2020 by CotyTernes
Correct grammar and spelling