[ytx]

Also there's not much practical defense to an unscrupulous extension author "exiting" with an under-the-table password transfer or "oops we got hacked" to a shady buyer.

<tinfoil hat> One could imagine a nefarious state actor offering the author of e.g. uBlock $XX million to get access to a lot of browsers. Not sure about the economics, but more niche extensions could probably be targeted for a lot cheaper.

[usrusr]

True, but at least it would require the exiting party to not have any illusions about what they are doing. I'd be surprised to hear that most extension takeover bids are open about their plans.

[Uehreka]

My guess is that most extension takeovers happen because the developer was making no money from the extension, not a lot of money at their dayjob, maintaining the extension was sucking up all their free time and maybe they also got an unexpected bill or were hurting for cash.

Not that those are good reasons to sell out your users, but they’re the kinds of circumstances that you can easily imagine happening.

[usrusr]

Nothing of that changes their desire to avoid selling to the worst abuser. What circumstances can do is making them sell despite that despite.

That's why it's so important to have a clean handover way that does not involve handing over credentials: it allows circumstantial sellers to pick a least bad buyer, if it exists. The more visible the existence of a clean path (as in "advertised in the UI vs getting someone at Google on the phone") is the more difficult it becomes to pretend that the shady path is clean. There might even be some "conscience arbitrage", perhaps unintended: buyers who buy through regular handover mechanism, with a believable story of confidence in being able to make clean money (which they may or may not believe themselves), but who then sell dirty. Less money for the original dev, true, but at least there's one handover on record, eroding trust.

[dankwizard]

uBlock countered that they wanted minimum $XXX and we pulled out.