Tell HN: You.com extension injects tracking beacons across the web and locally
15 comments
As somebdoy who is currently trying out you.com at work, I'm interested to know what their rationale for this is. Meddling in the DOM of third parties requires a good reason! I have a bunch of extension installed who I want to do this. But you.com is not among them.
Hey there! Sorry that name of the div confuses you.
But the div doesn't mean to be injected to anywhere else except you.com site and localhost (for our own testing). It does nothing but let us know if you are in a browser with the extension installed when accessing to our site, so that we show you a clean page without extension nudge (https://github.com/You-OpenSource/You-Firefox-Extension/blob...).
But the div doesn't mean to be injected to anywhere else except you.com site and localhost (for our own testing). It does nothing but let us know if you are in a browser with the extension installed when accessing to our site, so that we show you a clean page without extension nudge (https://github.com/You-OpenSource/You-Firefox-Extension/blob...).
How would they provide personalized search results without tracking you?
I dont want this to come across as condoning the tracking. I hate being snooped on.
But everything including your vacuum tries to track you.
Anything that markets itself as personalized is just weasle speak for tracking your every move.
I dont want this to come across as condoning the tracking. I hate being snooped on.
But everything including your vacuum tries to track you.
Anything that markets itself as personalized is just weasle speak for tracking your every move.
Well, they never asked my consent for universally tracking all my browser activity, nor do I have an account personally so I'm not sure if personalization even applies in this case.
Nonetheless turning an extension that's sole function is to add a search engine in the browser to a universal tracker is invasive to say the least.
Nonetheless turning an extension that's sole function is to add a search engine in the browser to a universal tracker is invasive to say the least.
The browser didn't mention anything about reading/writing/modifying content of all sites? It's been a minute since I've messed with browser extensions, but I remember the ability to write 'tags' to a site's content was gated behind a permission dialog during "installation".
I think the browser telling you what an extension is technically capable of is different to the extension letting you know what it’ll be doing and why.
Installing my adblocking extension the browser told me the app is capable of reading all web pages and editing them, but I assume they aren’t using that capability to track me.
Installing my adblocking extension the browser told me the app is capable of reading all web pages and editing them, but I assume they aren’t using that capability to track me.
Hi there this is Bryan, CTO at you.com This post is not true: the you.com extension does not inject tracking beacons across the web or locally.
I went back and looked at the open source code, and I can see how someone might misunderstand what is happening so I will clarify here with pointers to the open source code as well. The Firefox extension should be unminified too, so anyone who has it installed can check that the code I'm referring to is represented in that open source repository I will link to below.
Let's walk through the extension code, starting with the relevant part of the manifest.json:
"content_scripts": [ { "matches": ["://localhost/", "://you.com/", "://.you.com/"], "js": ["content-script.js"] }
This says that on domains that match ["://localhost/", "://you.com/", "://.you.com/"], we run content-script.js.
source: https://github.com/You-OpenSource/You-Firefox-Extension/blob...
In content-script.js we have:
``` let beacon = document.createElement("div"); beacon.className = "you-firefox-addons-beacon" document.body.appendChild(beacon); ``` https://github.com/You-OpenSource/You-Firefox-Extension/blob...
So if you are on localhost or a you.com owned domain (certainly not "across the web"), we add a div to the page that does nothing by itself. We do this so that our client side code can detect whether you have the extension when you are on you.com and other you.com subdomains. We had the localhost in there for convenience while developing and should have removed it before publishing, but to be clear, even with that localhost match in the code, there is still no tracking, not across the web and not locally. We'll take the localhost match out out though to avoid any confusion.
We unfortunately named that div "you-firefox-addons-beacon", which I think misled the original poster to think we were doing something with the Beacon API (https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API). But we are not. It is just an empty div that our client side code checks for when it loads the page for you.com domains and subdomains so you don't see the "Install extension" buttons and things like that once you have the extension. We will change the name so that it does not create this misperception moving forward.
And to address the downstream concerns in the other comments, we don't track users around the web. We don't use tracking to provide personalized search results -- we use the App Preferences feature that is available after someone signs up.
I'm glad that it is newsworthy that our search engine and browser plug-ins don't spy on our users! Please check the source code if you'd like: https://github.com/You-OpenSource/You-Firefox-Extension and spread the good word!
I went back and looked at the open source code, and I can see how someone might misunderstand what is happening so I will clarify here with pointers to the open source code as well. The Firefox extension should be unminified too, so anyone who has it installed can check that the code I'm referring to is represented in that open source repository I will link to below.
Let's walk through the extension code, starting with the relevant part of the manifest.json:
"content_scripts": [ { "matches": ["://localhost/", "://you.com/", "://.you.com/"], "js": ["content-script.js"] }
This says that on domains that match ["://localhost/", "://you.com/", "://.you.com/"], we run content-script.js.
source: https://github.com/You-OpenSource/You-Firefox-Extension/blob...
In content-script.js we have:
``` let beacon = document.createElement("div"); beacon.className = "you-firefox-addons-beacon" document.body.appendChild(beacon); ``` https://github.com/You-OpenSource/You-Firefox-Extension/blob...
So if you are on localhost or a you.com owned domain (certainly not "across the web"), we add a div to the page that does nothing by itself. We do this so that our client side code can detect whether you have the extension when you are on you.com and other you.com subdomains. We had the localhost in there for convenience while developing and should have removed it before publishing, but to be clear, even with that localhost match in the code, there is still no tracking, not across the web and not locally. We'll take the localhost match out out though to avoid any confusion.
We unfortunately named that div "you-firefox-addons-beacon", which I think misled the original poster to think we were doing something with the Beacon API (https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API). But we are not. It is just an empty div that our client side code checks for when it loads the page for you.com domains and subdomains so you don't see the "Install extension" buttons and things like that once you have the extension. We will change the name so that it does not create this misperception moving forward.
And to address the downstream concerns in the other comments, we don't track users around the web. We don't use tracking to provide personalized search results -- we use the App Preferences feature that is available after someone signs up.
I'm glad that it is newsworthy that our search engine and browser plug-ins don't spy on our users! Please check the source code if you'd like: https://github.com/You-OpenSource/You-Firefox-Extension and spread the good word!
Hi probably a dumb question but why does it need extension for that? On chrome mobile there are no extensions, are there features we are missing out on chrome mobile?
The Firefox extension is only there to make it easier to set you.com as the default search engine in the browser. It is possible to do this manually by changing settings, but a lot of our users would prefer to just install an extension instead. Link: https://addons.mozilla.org/en-US/firefox/addon/you-com/.
The desktop Chrome extension (https://chrome.google.com/webstore/detail/youcom-search-chat...) has some additional functionality. It lets users easily switch their default search engine between you.com, our new youchat feature, and our youcode mode. It also has quick shortcuts to some of our most popular apps, like YouImagine (which is an image generation app, like Stable Diffusion).
For mobile, we have our own custom mobile browsers apps on iOS (https://apps.apple.com/us/app/you-com-search-and-browser/id1...) and on Android (https://play.google.com/store/apps/details?id=com.you.browse...) where we pack in a lot of additional features since as you mention there are no extensions for Chrome mobile and Safari extensions are somewhat hard to install.
The desktop Chrome extension (https://chrome.google.com/webstore/detail/youcom-search-chat...) has some additional functionality. It lets users easily switch their default search engine between you.com, our new youchat feature, and our youcode mode. It also has quick shortcuts to some of our most popular apps, like YouImagine (which is an image generation app, like Stable Diffusion).
For mobile, we have our own custom mobile browsers apps on iOS (https://apps.apple.com/us/app/you-com-search-and-browser/id1...) and on Android (https://play.google.com/store/apps/details?id=com.you.browse...) where we pack in a lot of additional features since as you mention there are no extensions for Chrome mobile and Safari extensions are somewhat hard to install.
Makes sense thank you sir
It would be newsworthy to
if a search engine / browser plug-in didn’t spy on its users.
I just take it as given that they all do, and you just need to examine the source code to see where and how.
I just take it as given that they all do, and you just need to examine the source code to see where and how.
[deleted]
I didn't get to remove the extension and a few days ago while I was on the element inspector in devtools I noticed a strange div on the bottom of the page which contained a class of "you-firefox-addons-beacon". Needless to say I forward immediately and removed the extension.
I didn't get the chance to share it then and I happened to think about it today. Went ahead and re-installed the extension to make sure its still the case and no surprises it is.
I think this won't come as a big surprise as to my knowledge you.com is vc-backed so that is something one would most likely anticipate in such scenarios. Thought I share that as it might be interesting to know for people using the engine/extension.