Since the list of extensions they query targets certain religious groups and medical conditions, it&#x27;s almost certainly in violation of US federal employment and hiring law.

They only mention this being a potential violation of the DMA. How about north american countries? US and Canada?

I would debate that. Most work computers have some extensions installed by default. That&#x27;s millions of laptops. Ex. Snow Inventory Agent, ad blockers etc.

Seems like it. Which is serious but far from what I thought when I read the title. I suspect 90% of LinkedIn users don&#x27;t even have a single browser extension installed.

Pretty sure that if they could they would, but browsers sandboxing security prevent this to go unnoticed.

This has been going on for at least 5 years. It pops up on HN every so often.

They have! It&#x27;s these developers either not knowing or not caring about it which is the issue!
I did a blog post about this a while back showing how they do it, and how you can get around it, it&#x27;s not very complex for the devs.<a href="https:&#x2F;&#x2F;www.linkedin.com&#x2F;pulse&#x2F;how-linkedin-knows-which-chrome-extensions-you-have-installed-arnott-busae" rel="nofollow">https:&#x2F;&#x2F;www.linkedin.com&#x2F;pulse&#x2F;how-linkedin-knows-which-chro...</a>

There&#x27;s nothing to patch, scanning is not possible.It&#x27;s either the extension&#x27;s choice to become detectable (&quot;externally_connectable&quot; is off by default) or it makes unique changes to websites that allow for its detection.

Still pretty annoying browsers haven&#x27;t patched that yet.

LinkedIn is far from the only actor doing this. Browser extension fingerprinting is not new. LinkedIn‘s size, scope, network effects make this especially concerning.

It seems it scans your extensions not your system - reading the details. The intro made it a bit unclear.

Because we let them get away with it. Take something they&#x27;re going to miss and can&#x27;t replace (e.g. their freedom or their head) and it will stop as long as enforcement is reliable enough that they expect to get caught.These aren&#x27;t good people, but if you make the fine to the organisation much more expensive than the expected return, lock up the whole board and leave their families without a pot to piss in we will see this become the exception instead of the norm.

because corporate greed corrupts every nice thing: it pushes the other (maybe more moral) &#x27;nice thing&#x27; alternatives out of the ecosystem by subsiding using VC funding to provide &#x27;NiceThing!&#x27; for free until &#x27;NiceThing!&#x27; is the monopoly or bought by another entity to become part of the monopoly (due to weak&#x2F;not enforced antitrust laws).

if they do a better job at showing me an ad that might be relevant to me, how is that disgusting? if I have to see an ad at all I at least want them to give it their best shot

Almost certainly they are using that for audience segmentation and ad targeting. Clever and disgusting. This isn&#x27;t the invention of some evil moustache-twirling executive, this was the invention of an employee or group of employees who value money more than morals. We should think of such employees as henchmen.

It scans thousands so in thousands, some of them have these weird names

There&#x27;s an implicit trust that a site doesn&#x27;t try to racially profile you, as it is illegal. There&#x27;s no enforcement, but that&#x27;s why trust is being violated.

&gt; this is a massive violation of trustThis is not. To violate trust, there should have been some.

If you mean by the website, then - surely not. What basis do you have to trust websites you visit? Especially a social network that owned by Microsoft to boot?If you mean the _browser_, then I agree in principle, but - it is a browser offered to you by Alphabet. And they are known to mass surveillance and use of personal information for all sorts of purposes, including passing copies to the US intelligence agencies.But of course, this is what&#x27;s promoted and suggested to people and installed by default on their phones, so even if it&#x27;s Google&#x2F;Alphabet, they should be pressured&#x2F;coerced into respecting your privacy.

This. Do not install any extension unless you absolutely need. Assume they all leak your browsing data. 
Not familiar with Google but if you can just vibe code your own extension then do that.

Your explanation makes sense if LinkedIn is blocking browsers with these extensions installed. Are they?

Many extensions designed to scrape data from social media websites are disguised as simple extensions that do something else.If I had to guess: I sought that automatic content blurrer, neurodivergent website simplifier, or anti-Zionist tagger actually work. They’re all just piggybacking on trending topics to get users to install them and then forget about them, then they exfiltrate the data when you visit LinkedIn.

It&#x27;s for fingerprinting and possibly ad targeting.It&#x27;s no different from when you visit an Islamist or anti-Zionist website that has analytics&#x2F;trackers&#x2F;ads on it.It&#x27;s bad, but this &quot;massive violation of trust&quot; is happening everywhere and has been for decades. There&#x27;s nothing that&#x27;s unique to Microsoft here.

These extensions sound like straight up malware anyway<pre><code> LinkedIn scans for Anti-woke (“The anti-wokeness extension. Shows warnings about woke companies”), Anti-Zionist Tag (“Adds a tag to the LinkedIn profiles of Anti-Zionists”), Vote With Your Money (“showing political contributions from executives and employees”), No more Musk (“Hides digital noise related to Elon Musk,” 19 users), Political Circus (“Politician to Clown AI Filter,” 7 users), LinkedIn Political Content Blocker, and NoPolitiLinked.</code></pre>

this is a massive violation of trust&gt; The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify).

So these extensions allow linkedin to do this though, it&#x27;s literally them saying &quot;yes, this site can ping this resource&quot; - called &quot;web_accessible_resources&quot;.This is fair from Linkedin IMO as I&#x27;ve seen loads of different extensions actually scraping the linkedin session tokens or content on linkedin.

The &quot;The Attack: How it works&quot; section explains how it works. It&#x27;s not an API.I am a little surprised something like CORS doesn&#x27;t apply to it, though.

What is a Chrome-based browser? Isn&#x27;t Chrome Google&#x27;s Chromium based browser? How many are based on Chrome?

Firefox uses UUID for the local extension url per extension so you can&#x27;t search for hardcoded local urls.

&gt; Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions.It&#x27;s not clear though, either they only tested against chrome-based browsers or Firefox isn&#x27;t enabling them to do so.edit: I answered before I go fully through the article but it does say it&#x27;s only Chrome based.&gt; The extension scan runs only in Chrome-based browsers. The isUserAgentChrome() function checks for “Chrome” in the user agent string. The isBrowser() function excludes server-side rendering environments. If either check fails, the scan does not execute.&gt; This means every user visiting LinkedIn with Chrome, Edge, Brave, Opera, Arc, or any other Chromium-based browser is subject to the scan.

I was under the impression Firefox randomises extension IDs on install, so hopefully not?

they seem to be calling `chrome-extension:&#x2F;&#x2F;.....` so i don&#x27;t think it applies to firefox

The answer to &quot;why would Chrome ever undermine privacy and security?&quot; is always &quot;Google&#x27;s revenue stream&quot;.I&#x27;m happy to see that this doesn&#x27;t hit firefox. I wonder if safari is impacted.

why would the browser ever expose extensions api to a web page. does firefox does this as well?

To broaden my point, I think we’d find that many websites we use are doing this.My point isn’t that this is acceptable or that we shouldn’t push back against it. We should.My point is that this doesn’t sound particularly surprising or unique to LinkedIn, and that the framing of the article seems a bit misleading as a result.

Why is it possible for a web site to determine what browser extensions I have installed? If there are legitimate uses, why isn&#x27;t this gated behind a permission prompt, like things like location and camera?

&gt; What business is it of LinkedIn&#x27;s what browser extensions I have installed?The list of extensions they scan for has been extracted from the code. It was all extensions related to spamming and scraping LinkedIn last time this was posted: Extensions to scrape your LinkedIn session and extract contact info for lead lists, extensions to generate AI message spam.That seems like fair game for their business.

&gt; I think we should push back hard on behavior like this.Indeed, so I gather all of you have canceled your LI account over this?I never made one in the first place because it was pretty clear to me that this company - even before the acquisition - had nothing good in mind.

If I had to guess, LinkedIn would be primarily searching for extensions that violate their terms of service (e.g. something that could be used to scrape data).  They put a lot of effort into circumventing automated data collection.  I could be wrong.

So why not say that LinkedIn is murdering people? I mean, if all you care about is raising awareness with maximal clickbait...

I disagree, I think we should push back hard on behavior like this. What business is it of LinkedIn&#x27;s what browser extensions I have installed? I think the framing for this is appropriate.

&gt; The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits themAnd probably also vibe-coded therefore 2 tabs of LinkedIn take up 1GB of RAM (was on the front page a few days back).

To be clear, expecting != accepting.The point was more that the headline frames this as some major revelation about LinkedIn, while the reality is that we’re getting probed and profiled by far more sites than most people realize.

Regulation is also a cat-and-mouse game. Life is a cat-and-mouse game.

LinkedIn&#x27;s whole business model is gatekeeping their database.They&#x27;re scanning your extensions to make sure you aren&#x27;t using third party tools to scrape LinkedIn.It&#x27;s stupid, but they&#x27;re trying to stop people from making money on LinkedIn when they feel like they&#x27;re the only ones that should be able to do that.

&gt;... everyone feels the need to run an ad-blocker.I don&#x27;t: never have and never will. I don&#x27;t notice the ads, they don&#x27;t bother or distract me: I&#x27;m online 4-8 hours&#x2F;day.diaphimisticophobia: fear of advertisements or commercialsI would bet HN has the highest proportion of people with diaphimisticophobia of any group on the planet.

&gt; I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.Expecting and accepting this kind of thing is why everyone feels the need to run an ad-blocker.An ad-blocker also isn’t full protection. It’s a cat and mouse game. Novel ideas on how to extract information about you, and influence behavior, will never be handled by ad-blockers until it becomes known. And even then, it’s a question of if it’s worth the dev time for the maker of the ad-blocker you happen to be using and if that filter list gets enabled… and how much of the web enabling it breaks.

Understandable, and yet none of that makes it ok.

&gt; it&#x27;s entire purpose is literally to make the website more enjoyable for the good users.There are people who actually enjoy using LinkedIn?

&gt;Linked in is heavily scraped by scammers who do the BEC scams.It&#x27;s also heavily scraped by businesses for lead generation for sales and recruiting. Either before their API became available or to not pay them or to get around the restrictions of their API.

It is likely in response to scraping. Linked in is heavily scraped by scammers who do the BEC scams. So linked in is trying to find ways to link together banned accounts, to handle their ban evasion.I run a site which attracts a lot of unsavoury people who need to be banned from our services, and tracking them to reban them when they come back is a big part of what makes our product better than others in the industry. I do not care at all about actually tracking good users, and I am not reselling this data, or anything malicious, it&#x27;s entire purpose is literally to make the website more enjoyable for the good users.

When &quot;the browser is the OS&quot;, scanning that is a pretty big chunk of &quot;your computer&quot;.

In the same way that scanning and identifying your microwave for food you put inside it is not the same as scanning your house and reading the letters in your postbox.Your browser is a subset of your computer and lives inside a sandbox. Breaching that sandbox is certainly a much more interesting topic than breaking GDPR by browser fingerprinting.

There are rules and laws about fingerprinting too, I thought.

&gt; How is probing your browser for installed extensions not &quot;scanning your computer&quot;?I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. If this was happening, the magnitude of the scandal would be hard to overstate.But this is not happening. What actually is happening is still a problem. But the hyperbole undermines what they’re trying to communicate and this is why I objected to the title.&gt; They chose to put that particular extension in their target list, how is it not sinister?Alongside thousands of other extensions. If they were scanning for a dozen things and this was one of them, I’d tend to agree with you. But this sounds more like they enumerated known extension IDs for a large number of extensions because getting all installed extensions isn’t possible.If we step back for a moment and ask the question: “I’ve been tasked with building a unique fingerprint capability to combat (bots&#x2F;scrapers&#x2F;known bad actors, etc), how would I leverage installed extensions as part of that fingerprint?”What the article describes sounds like what many devs would land on given the browser APIs available.To reiterate, at no point am I saying this is good or acceptable. I think there’s a massive privacy problem in the tech industry that needs to be addressed.But the authors have chosen to frame this in language that is hyperbolic and alarmist, and in doing so I thing they’re making people focus on the wrong things and actually obscuring the severity of the problem, which is certainly not limited to LinkedIn.

&gt;Calling the title misleading because they didn&#x27;t breach the browser sandbox is wrongBy this logic we could also say that LinkedIn scans your home network.

Scanning your computer is an entirely different thing than scanning browser extensions. By maximizing the expectation via &quot;Illegally searching your computer&quot;, the truth suddenly appears harmless.

It 100% implies that it&#x27;s looking for locally installed binaries.

&gt;How is probing your browser for installed extensions not &quot;scanning your computer&quot;?The same way taking a photo of a house from the street is not the same as investigating the contents of your pantry.

Because &quot;scanning your computer&quot; technically could include scanning plugins, but it could also include scanning your files, your network or your operating system.While &quot;scanning your browser&quot; would be more accurate and would exclude the interpretation that it scans your files.The reason the latter is not used is that, even though more precise and more communicative, it would get less clicks.

I personally think its misleading and even when you start reading the page it links to is even more misleading in my opinion.&gt;Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed software, collects the results, and transmits them to LinkedIn’s servers and to third-party companies including an American-Israeli cybersecurity firm.When I read that, I think they have escaped the browser and checking which applications I have installed on my computer. Not which plugins the browser has in it. Just my 2cents.

How is probing your browser for installed extensions not &quot;scanning your computer&quot;?Calling the title misleading because they didn&#x27;t breach the browser sandbox is wrong when this is clearly a scenario most people didn&#x27;t think was possible. Chrome added extensionId randomization with the change to V3, so it&#x27;s clearly not an intended scenario.&gt; vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”)They chose to put that particular extension in their target list, how is it not sinister? If the list had only extensions to affect LinkedIn page directly (a good chunk seem to be LinkedIn productivity tools) they would have some plausible deniability, but that&#x27;s not the case. You&#x27;re just &quot;nothing ever happens&quot;ing this.

&gt; I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.We should not normalise nor accept this behaviour in the first place.

They already have so much telemetry from your phone, IP, etc.God forbid they make an educated guess based on your actual LinkedIn connections, name, interests, etc.

&gt; i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”But I bet they could reliably guess your religious affiliation based on the presence of some specific browser extensions.

&gt; It also seems like what I’d expect to find in modern browser fingerprinting code.Time to figure out if I can make FireFox pretend to be Chrome, and return random browser extensions every time I visit any website to screw up browser fingerprinting...

&gt; The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers.Why is this even possible in the first place? It&#x27;s nobodies business what extensions I have installed.

it apparently scans for something like &quot;PQC Checker&quot;, an extension for checking if TLS connection is PQC-enabled? how is that a spam extension (and thats just a random one i saw)

This has been covered several times including reverse engineering of the code. The list of extensions they check for doesn’t include common extensions like ad blockers. It’s exclusively full of LinkedIn spamming and scraping type of extensions.They also logically don’t need to fingerprint these users because those people are literally logging in to an account with their credentials.By all appearances they’re just trying to detect people who are using spam automation and scraping extensions, which honestly I’m not too upset about.If you never install a LinkedIn scraper or post generator extension you wouldn’t hit any of the extensions in the list they check for, last time I looked.

&gt; no available getAllExtensions()Well great there is no avalable &#x27;getAllFiles()&#x27; or such either because they&#x27;d be scanning your files for &quot;fingerprinting&quot; as well.&gt; alarmist framingWell they literally searching your computer for applications&#x2F;extensions that you have installed? (and to an extent you can infer what are some of the desktop applications you have based on that too)

I&#x27;ve been avoiding Chrome-based browsers for many years now but have only recently become aware of how catastrophically low the Firefox market share is. I&#x27;m kind of shocked that more people aren&#x27;t choosing to avoid Chrome.

&gt; the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).Your computer is your private domain. Your house is your private domain. You don&#x27;t make a &quot;getAllKeysOnPorch()&quot; API, and certainly don&#x27;t make &quot;getAllBankAccounts()&quot; API. And if you do, you certainly don&#x27;t make it available to anyone who asks.It absolutely is sinister.

I wonder if this is part of the reason why LinkedIn tabs seem to use so much ram, and sometimes run away CPU processes.

Ad blockers focus on ads, not fingerprinting.

&gt; and if everyone actually listened, much of the Internet (and economy) as we know it would disappear.Would it really? It seems to me that most normal users spend most of their time and attention on apps, not in browsers.

I asked an LLM to create a plan for a &#x27;digital rebirth&#x27; in order to minimize privacy harms. It&#x27;s a lot of work, but increasingly: a worthwhile endeavor.

Majority of people use their mobile devices these days to browse the Internet. Installing an ad blocker on your iPhone is a significantly bigger challenge than on desktop.

Don&#x27;t worry, soon you&#x27;ll need to pay every website 5.99 a month because AI is destroying click through rates. The internet will likely be far worse without ads than with ads. Solving the tracking problem doesn&#x27;t need to be mixed up with blocking ads outright. What&#x27;s funny is that tracking isn&#x27;t nearly as meaningful for click through rates on ads as relevance to what&#x27;s on the page, and yet so much effort is placed onto tracking for the slim improvement it provides.

YT made sure adblockers ruin the experience. We really need a good YT alternative, as it has become AI slop (shorts) and most new videos are of real poor quality.

It’s worse than that. My mom wants to see ads. I thought I was doing her a favor adding her to my pihole but she really likes ads, especially Facebook ads.

The crazier part is that its an official government position, and we (people at large &#x2F; the government) aren&#x27;t immediately slapping down the actions of these companies.

&gt;the average person&#x27;s response is &quot;nah, that would take at least a couple of minutes of my time,As a data point I, a technical person who tweaks his computer a lot, was against adblocking for moral reasons (as a part of perceived social contract, where internet is free because of ads). Only later I changed mi mind on this because I became more privacy aware.

The FBI also recommended people use commercial VPNs… coincidentally they don’t need a warrant to spy on communications that leave the country

Every browser should have ad blocking technology included and enabled by default. I do not understand why Apple in particular has not pushed this with Safari, as they like to portray that they care about privacy.I get why Chrome doesn&#x27;t, and that&#x27;s why you should not use it. But Netscape? Edge? What is stopping them?Browsing the web without an ad blocker is a miserable experience. Users who have never tried or don&#x27;t know how to set one up would be delighted.

&gt; the average person&#x27;s response is ... I&#x27;ll just go ahead and continue to suffer with invasive adsThe real reason is that the average person neither suffers with ads nor finds ads invasive, despite what a vocal online minority would have you believe. We just ignore them and get on with life. ::shrug::

&gt; this is why I run ad blockers.It&#x27;s pretty wild that we live in a world where the actual FBI has recommended we use ad blockers to protect ourselves, and if everyone actually listened, much of the Internet (and economy) as we know it would disappear. The FBI is like &quot;you should protect yourself from the way that the third largest company in the world does business&quot;, and the average person&#x27;s response is &quot;nah, that would take at least a couple of minutes of my time, I&#x27;ll just go ahead and continue to suffer with invasive ads and make sure $GOOG keeps going up&quot;.

There is clear rules around what you can and can&#x27;t do to fingerprint users. if it&#x27;s being done overtly, covertly, obscurely, indirectly, all for the same result through direct or indirect or correlated metadata it ends up with the same outcome.My understanding is the rules and laws are to prevent the outcome, by any means, if it&#x27;s happening.

&gt; &quot;they&#x27;re checking to see if you&#x27;re a Muslim&quot;This could be easily inferred from the depth, breadth, and interconnectedness of data in the website.By downplaying it, it&#x27;s allowing it to exist and do the very thing.The issue here is this stuff is working likely despite ad blockers.Fingerprinting technology can do a lot more than just what can be learned from ads.From the site:&quot;The scan doesn’t just look for LinkedIn-related tools. It identifies whether you use an Islamic content filter (PordaAI — “Blur Haram objects, real-time AI for Islamic values”), whether you’ve installed an anti-Zionist political tagger (Anti-Zionist Tag), or a tool designed for neurodivergent users (simplify). Under GDPR Article 9, processing data that reveals religious beliefs, political opinions, or health conditions requires explicit consent. LinkedIn obtains none.&quot; <a href="https:&#x2F;&#x2F;browsergate.eu&#x2F;extensions&#x2F;" rel="nofollow">https:&#x2F;&#x2F;browsergate.eu&#x2F;extensions&#x2F;</a>

&gt; this is why I run ad blockers.What&#x27;s been really obnoxious lately is the number of sites I try to do things on that are straight up broken without turning off my ad-blocker.

I do think a degree of alarm is appropriate.But it’s critical to sound the correct alarm.To me, it seems like the authors pulled the fire alarm for a single building when in reality there’s a tornado bearing down.And by doing so, everyone is scrambling about a fire instead of the response a tornado siren would cause.They’re both dangerous and worthy of an immediate reaction, but the confusion and misdirection this causes seems deeply problematic.When people realize the fire wasn’t real, they start to question the validity of the alarm. The tornado is still out there.I realize this analogy is a bit stretched.As someone who has spent quite a lot of time steeped in security&#x2F;privacy research, the stuff described in the article has been happening pervasively across the industry.People absolutely should be alarmed. Many of us have been alarmed for quite some time. Raising the alarm by saying “LinkedIn is searching your computer” isn’t it.

&gt; I’m certainly not endorsing it, do think it’s pretty problematic, and I’m glad it’s getting some visibility. But I do take some issue with the alarmist framing of what’s going on.Speaking has someone who shares the same lack of surprise, perhaps some alarm is warranted. Just because it’s ubiquitous doesn’t mean it’s ok. This feels very much frog in boiling water for me.Why do you think the alarmist framing is unwarranted?

Your post sounds like &quot;it sounds bad, but it&#x27;s no different from what others do, so it&#x27;s not that bad.&quot;I would put it more like: it sounds bad, and it&#x27;s no different from what others do, so they&#x27;re all that bad.The fact that they&#x27;re working around an API limitation doesn&#x27;t make this better, it just proves that they&#x27;re up to no good. The whole reason there isn&#x27;t an API for this is to prevent exactly this sort of enumeration.It&#x27;s clear that companies will do as much bad stuff as they can to make money. The fact that you can do this to work around extension enumeration limits should be treated as a security bug in Chrome, and fixed. And, while it doesn&#x27;t really make a difference, LinkedIn should be considered to be exploiting a security vulnerability with this code.

I get the point you&#x27;re making, but to be clear, &quot;they’re checking to see if you’re a Muslim&quot; vs &quot;they’re checking to see if your fingerprint matches that of known Muslims in our ever-expanding database&quot; are not too far off.

The next step for a forensic investigator, is to found out how many of those extensions, are actually from a partner or fully owned subsidiary from LinkedIn... When you see a cockroach...

Firefox FTW. I was relieved to find this was a Chrome-only problem.

&gt; The scan probes for thousands of specific extensions by ID, collects the resultsWhy exactly does Chrome even allow this in the first place!? This is the most surprising takeaway for me here, given browser vendors&#x27; focus on hardening against fingerprinting.

What are the religious-related extensions described in the article doing that&#x27;s &quot;evil&quot;?

&gt; I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinisterThis seems like a really weird argument to make. The fact that the platform doesn&#x27;t provide a privacy-violating API is not an extenuating circumstance. LinkedIn needed to work around this limitation, so they knew they&#x27;re doing something sketchy.For the record, I don&#x27;t think they&#x27;re being evil here, but the explanation is different: they&#x27;re don&#x27;t seem to be trying to fingerprint users as much as they&#x27;re trying to detect specific &quot;evil&quot; extensions that do things LinkedIn doesn&#x27;t want them to do on linkedin.com. I guess that&#x27;s their prerogative (and it&#x27;s the prerogative of browsers to take that away).

The tracking described is extremely invasive. You say you are not endorsing it but you are certainly normalizing it. This is unacceptable.The people behind this URL are trying to hold Microsoft accountable. The power to them.

Yes, but FF also prevents the extension scanning. It&#x27;s scandalous that Chrome allows this!

&gt;this is why I run ad blockers.It&#x27;s important to note that this isn&#x27;t fixed by ad blockers. To avoid this kind of fingerprinting, you need to disable JavaScript or use a browser like Firefox which randomizes extension UUIDs.

The page isn&#x27;t allowed to know what extensions you have, instead LinkedIn is looking for various evidence that extensions are installed, like if an extension was to create a specific html element, LinkedIn could look for evidence of that element being there.Since the extensions are running on the same page as LinkedIn (some of them are explicitly modifying the LinkedIn the website) it&#x27;s impossible to sandbox them so that linked in can&#x27;t see evidence of them. And yes this is how a site knows you have an ad blocker is installed.

Why is JavaScript running in a page even allowed to know what extensions I have? Is this also what sites use to see I&#x27;ve got an ad blocker?Just run everything in a safe environment that it can&#x27;t look out of.

But I do take some issue with the alarmist framing of what’s going on.I’ve come to mostly expect this behavior from most websites that run advertising codeWe should be alarmed that websites we go to are fingerprinting us and tracking our behavior. This is problematic, full stop. The fact that most websites are doing this doesn&#x27;t change that.

But what would be the benefit of them doing that?

Which browsers in which mode (normal&#x2F;private) are affected?

&gt; The headline seems pretty misleading.Yes. I was expecting LinkedIn was connecting to extensions that are using their exhanced privileges to scan your computer, per the &quot;LinkedIn Is Illegally Searching Your Computer&quot; headline.Instead, LinkedIn is scanning for extensions.

I wonder if their motivation for doing this is to detect the LinkedIn automation tools that power all the spam messaging and connection requests?

&gt;vs. something inherently sinisterThis is inherently sinister.

&gt; expect to find in modern browser fingerprintingNo. Don&#x27;t need extensions for that. See how Cloudflare Turnstile does it, recently popped up at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=47566865">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=47566865</a> cause ChatGPT uses it now:Layer 1: Browser Fingerprint
WebGL (8 properties): UNMASKED_VENDOR_WEBGL, UNMASKED_RENDERER_WEBGL, WEBGL_debug_renderer_info, getExtension, getParameter, getContext, canvas, webglScreen (8): colorDepth, pixelDepth, width, height, availWidth, availHeight, availLeft, availTopHardware (5): hardwareConcurrency, deviceMemory, maxTouchPoints, platform, vendorFont measurement (4): fontFamily, fontSize, getBoundingClientRect, innerText. Creates a hidden div, sets a font, measures rendered text dimensions, removes the element.DOM probing (8): createElement, appendChild, removeChild, div, style, position, visibility, ariaHiddenStorage (5): storage, quota, estimate, setItem, usage. Also writes the fingerprint to localStorage under key 6f376b6560133c2c for persistence across page loads.Scanning for 6000 extensions is anti-competitive, surveillant and immoral.

If your electrician was known to be hostile like the Internet, then you&#x27;d put locks on your drawers.The browser security model right now is more like those completely ineffective &quot;gun free zone&quot; signs cities tack up in public parks.

Just because someone lets the electrician (LinkedIn) into their home (browser) doesn&#x27;t mean they can do whatever the hell they want that isn&#x27;t expressly prohibited. If the electrician wants to rifle through my desk drawers, they should ask for permission, and I will politely tell them to leave.

this is obviously not fingerprinting code to anyone with a brain, it&#x27;s about scraping

I worked for a company that sold b2b contact data and they had (maybe still have) a linkedIn extension. It basically enriched the linkedIn profile. I wonder if linkedIn is trying to block these, or heavily target, in some way, these types of users to push folks towards their sales navigator.

This blows my mind. What good reason is there for giving javascript such permissions by default? This should at the minimum trigger an explicit permission request from the user.

More [1][1] - <a href="https:&#x2F;&#x2F;www.whatsmyip.org&#x2F;more-info-about-you&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.whatsmyip.org&#x2F;more-info-about-you&#x2F;</a>

Javascript can query chrome extensions [1] and much more [2].[1] - <a href="https:&#x2F;&#x2F;browserleaks.com&#x2F;chrome" rel="nofollow">https:&#x2F;&#x2F;browserleaks.com&#x2F;chrome</a>[2] - <a href="https:&#x2F;&#x2F;browserleaks.com&#x2F;javascript" rel="nofollow">https:&#x2F;&#x2F;browserleaks.com&#x2F;javascript</a>

I agree. The first paragraph on the page implies the javascript can natively search your machine (vs. via Browser Extensions)

&gt; sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”)Then why search for PordaAI or Deen Shield? Or more specifically, since getAllExtensions() would return them, why would they be on the &quot;scan list&quot;, instead of just ignored?

My biggest gripe is why these JS APIs even exist in the first place

Your expectations do not matter here frankly. This reads like CFAA to me, unauthorized access.

How does this scan happen. AFAIK there is no API for a webpage to scan for extensions. The most a page could do is try to figure out indirectly if an extension exists if that extension leaks info into the page.

The bigger problem I see here is browser security and Javascript as a whole. Browsers should not be allowed to extract and send such vast amounts of information in the first place, especially without the user&#x27;s consent. At most, they should return a few broad things such as browser type (major version), language perhaps, and device type (mobile&#x2F;desktop). That&#x27;s it. Other things, such as exact resolutions, time zones, and other hardware identifiers make it trivially easy to track users across the Internet. Now that it&#x27;s too late to revise Web standards, browsers should default to return spoofed values for all the rest.

&gt; But I do take some issue with the alarmist framing of what&#x27;s going on.On the contrary, your framing is quite defeatist IMO. The fact that stores get robbed frequently does not mean we should just normalize that and accept it as a fact of life.

&gt; I’m not deeply familiar with what APIs are available for detecting extensionHere is what the article says:Method 1<pre><code> async function c() {
 const e = [],
 t = r.map(({id: t, file: n}) =&gt; {
 return fetch(`chrome-extension:&#x2F;&#x2F;${t}&#x2F;${n}`)
 });
 (await Promise.allSettled(t)).forEach((t, n) =&gt; {
 if (&quot;fulfilled&quot; === t.status &amp;&amp; void 0 !== t.value) {
 const t = r[n];
 t &amp;&amp; e.push(t.id);
 }
 });
 return e;
 }
</code></pre>
Method 2<pre><code> async function(e) {
 const t = [];
 for (const {id: n, file: i} of r) {
 try {
 await fetch(`chrome-extension:&#x2F;&#x2F;${n}&#x2F;${i}`) &amp;&amp; t.push(n);
 } catch(e) {}
 e &gt; 0 &amp;&amp; await new Promise(t =&gt; setTimeout(t, e));
 }
 return t;
 }
</code></pre>
The API is making an HTTP request to<pre><code> chrome-extension:&#x2F;&#x2F;${store_id}&#x2F;${file_name}
</code></pre>
There is then a second stage where they walk the DOM looking for text signatures and element attributes indicative of the store_id valuesIt looks like the user has the freedom to manage this by launching chrome with this flag: --disable-extensionsIt also seems there is an extension for extension management to deny extension availability by web site: <a href="https:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;1546186&#x2F;enable-disable-chrome-extensions-per-site-via-white-or-blacklist" rel="nofollow">https:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;1546186&#x2F;enable-disable-chrom...</a>

linked in is scummy but yes I was puzzled by how linked in could scan your comouter from the browser.  when i saw they meant extensions I thought aha.

For what it&#x27;s worth - and I&#x27;m not saying that LinkedIn is doing this for the right reasons - I can imagine a frontend QA team wanting to do this to understand how prominent certain extensions are for users of various parts of their product, correlating those extensions against frontend bug reports, and using that to guide QA procedures with real-world extension sets.When you&#x27;re literally the company that invented Kafka for your clickstreams, &quot;everything looks like a nail.&quot;(More likely, though, this is an anti-scraping initiative, since headless browsers are unlikely to randomize their use of extensions, and they can use this to identify potential scrapers.)

&gt; It also seems like what I’d expect to find in modern browser fingerprinting code.Exactly what I think it is. It&#x27;s all for tracking and ultimately for advertisement. Linkedin can get exactly who you are and then they share that data with ad companies to better target you.Really gross behavior.

Well, that&#x27;s precisely what is sinister here.Those profiling tools don&#x27;t really care which features are going to be used for predictions. It&#x27;s just machine learning, and it&#x27;s indiscriminate. So if you have an extension that correlates with you being Muslim, it will be used for whatever ML predictions they give to other companies, and the worst case will be another &quot;oh we didn&#x27;t do this intentionally&quot;.Of course, that&#x27;s not the first time this ever happened in human history, so even if it&#x27;s not &quot;something inherently sinister&quot;, it&#x27;s just &quot;criminal negligence&quot;.

To flip it around, if one of those chrome extensions saved parts of the contents of the page it was on into a database, and I had the chrome extension navigate around on LinkedIn for me, collecting information, LinkedIn would sue me for CFAA violations because I&#x27;m scraping them for email addresses and phone numbers. This is not theoretical either, as LinkedIn has sued people in the past for scraping.

Android had a similar feature, but google removed it because it was invasive and being misused to target people.

extensions create so many bug reports, I would do the same

I&#x27;m confused, you call this &quot;misleading&quot; then quote the claim, but say it&#x27;s &quot;what [you&#x27;d] expect to find in modern browser fingerprinting code&quot;.So what is it? Misleading, or exactly what you expected to find? It cannot be both.It sounds more like you object to the negative framing of Microsoft hoovering up as much data as possible for profit, even though this is objectively a crime in the jurisdictions they are being sued in.

&quot;The headline seems pretty misleading.&quot;How? What exactly would a reader be &quot;mislead&quot; to believeThe part about &quot;inherently sinister&quot; seems to be a thought from the mind of an HN commenter not the authors of the submitted web page. The later only describe LinkedIn&#x27;s actions as illegal, not &quot;sinister&quot;. The laws cited by the authors do not appear to consider any &quot;state of mind&quot;, e.g., &quot;sinister&quot;, or intent as relevant&quot;But I do take some issue with the alarmist framing of what&#x27;s going on.&quot;AFAICT, the submitted web page does not suggest that anything LinkedIn does is &quot;dangerous&quot;, i.e., cause for &quot;alarm&quot;. What it suggests is that LinkedIn&#x27;s actions _violate European privacy laws_. The authors claim LinkedIn&#x27;s actions present an opportunity to enforce these laws, i.e., &quot;take action&quot;<a href="https:&#x2F;&#x2F;browsergate.eu&#x2F;why-its-illegal&#x2F;" rel="nofollow">https:&#x2F;&#x2F;browsergate.eu&#x2F;why-its-illegal&#x2F;</a><a href="https:&#x2F;&#x2F;browsergate.eu&#x2F;take-action&#x2F;" rel="nofollow">https:&#x2F;&#x2F;browsergate.eu&#x2F;take-action&#x2F;</a>

&gt; This does seem invasive. It also seems like what I’d expect to find in modern browser fingerprinting code. I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).Working around deliberate API designs that are designed to make it harder to get a list of all installed extensions is inherently sinister. It&#x27;s very clearly malicious. We absolutely should not accept that kind of behavior from anyone and definitely not from the corporations large enough that we can&#x27;t realistically avoid depending upon them.

The headline seems pretty misleading. Here’s what seems to actually be going on:&gt; Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions. The scan probes for thousands of specific extensions by ID, collects the results, encrypts them, and transmits them to LinkedIn’s servers.This does seem invasive. It also seems like what I’d expect to find in modern browser fingerprinting code. I’m not deeply familiar with what APIs are available for detecting extensions, but the fact that it scans for specific extensions sounds more like a product of an API limitation (i.e. no available getAllExtensions() or somesuch) vs. something inherently sinister (e.g. “they’re checking to see if you’re a Muslim”).I’m certainly not endorsing it, do think it’s pretty problematic, and I’m glad it’s getting some visibility. But I do take some issue with the alarmist framing of what’s going on.I’ve come to mostly expect this behavior from most websites that run advertising code and this is why I run ad blockers.

I hate the way they just started saying you have a new message when you really don&#x27;t. Now I&#x27;m going to miss when I really have new messages for a while because I&#x27;m not going to go to that site anymore when they say that.And not letting you read your messages when on your mobile phone unless you use their app is particularly mean. Considering again where they are sending all the information they scrape.

This gave someone the opportunity to add in &quot;Jeffery_Epstein_did_not_kill_himself&quot; to linkedin&#x27;s client facing code base through this.
If you open dev tools -&gt; network tab -&gt; network search icon (magnifying glass) -&gt; search for &quot;epstein&quot; and load up linkedin, you should see it for yourself too!I really don&#x27;t think they&#x27;re &quot;illegally&quot; searching your computer, they&#x27;re checking for sloppy extensions that let linkedin know they&#x27;re there because of bad design.

I wonder how much of this is also used for audience segmentation for their advertisements? Linkedin ads are some of the most expensive out of any social media platform, but they also tend to have the highest conversion since you can get pretty niche with your targeting.

Why would you go to LinkedIn to play puzzle games? There&#x27;s thousands of other places to do so.

I really like going to linkedin daily to play minisudoku and a couple of other puzzles, then never engage the feed or other features

LinkedIn has been overtly evil for decades, and their power users are the most insufferable sort of middle management yuppy scum.  I know job searching can be hard, but I don&#x27;t go near LinkedIn with a ten foot pole.

<a href="https:&#x2F;&#x2F;browsergate.eu&#x2F;how-it-works&#x2F;" rel="nofollow">https:&#x2F;&#x2F;browsergate.eu&#x2F;how-it-works&#x2F;</a>: “Every time you open LinkedIn in a Chrome-based browser, LinkedIn’s JavaScript executes a silent scan of your installed browser extensions”⇒ which Chrome allows sites to do.

Allowed to do? Not prevented from by technical measures, but certainly not allowed to do.Considering the goal is to identify people, this is undeniably PII. As the article demonstrates, it also pertains sensitive information.

Well, they&#x27;re able to do it; “allowed” to do it is an ambiguous enough phrasing that it&#x27;s practically begging to have an argument whose crux is fundamentally about a differing interpretation.

TFA goes into a lot of detail explaining why they &quot;allegedly&quot; aren&#x27;t actually allowed to do so in the EU.

&quot;allowed&quot; by the web browser, but almost certainly not by the end user. The law is pretty clear on this in the US:&gt; &#x27;the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;&#x27;The problem, of course, is that by clicking on a LinkedIn link, you agree to a non-negotiated contract that can change at any time, and that you have never seen. If that weren&#x27;t allowed, then this sort of crap would correctly be considered &quot;unauthorized access&quot;:<a href="https:&#x2F;&#x2F;www.law.cornell.edu&#x2F;uscode&#x2F;text&#x2F;18&#x2F;1030" rel="nofollow">https:&#x2F;&#x2F;www.law.cornell.edu&#x2F;uscode&#x2F;text&#x2F;18&#x2F;1030</a>

Can you build a version of chromium where this will just return false always?

TFA explains it is looking for installed browser extensions (which sites are allowed to do)

The title is clickbaity. The website scans the browser for installed extensions.

While you&#x27;re at it, you should also find out why a website can scan your internal network...

it can in the fantasy world of incorrect headlines

How a web site can search one&#x27;s computer?

Reminder for windows control alt shift windows L

If other people collect data like that it&#x27;s probably also illegal.

I don&#x27;t like any of this, but I&#x27;m not totally clear how this is substantially different from other fingerprinting technologies which I assume are used by every large tech company. Could anyone elaborate?  The post isn&#x27;t very clear why this is different from other data surveillance.

I don’t see this article showing that. They query for extensions that could be used to do that, and that likely already is illegal, but those queries could solely be used to uniquely identify users (grabbing more bits makes it less likely to get collisions)

They also try to profile for things like political beliefs.

The most obvious reason for this is browser fingerprinting, right? So your visits to other websites can be linked to your Linkedin identity? Or no?

Yeah, this is the easiest way to get around it

Or just not allow them to load the URIs at all

You would need to use use_dynamic_url: true in the manifest to create a unique one.

Interesting. I didn&#x27;t know a extension’s web-accessible resource (e.g. chrome-extension:&#x2F;&#x2F;&lt;id&gt;&#x2F;...) could be abused to learn about the user&#x27;s installed extensions by checking whether it resolves or not.

Hmm I opened linkedin in Firefox and ublock origin showed it blocked 4 items... then switched away and back and the counter was up to 12.Is that enough blocking, I wonder?

&gt; The “how it works” page suggests it only works on chrome based browsers. Anyone able to determine if firefox or safari are affected too?The code filters out non-chrome browsers:
&gt;The extension scan runs only in Chrome-based browsers. The isUserAgentChrome() function checks for “Chrome” in the user agent string. The isBrowser() function excludes server-side rendering environments. If either check fails, the scan does not execute.

The “how it works” page suggests it only works on chrome based browsers.  Anyone able to determine if firefox or safari are affected too?

For my curiosity what would the fair use be?

Doesn&#x27;t it depend how they&#x27;re storing the data? If it&#x27;s sufficiently transformed, it could be considered fair use.

Therefore it’s okay, is that your point? Because I don’t think it is.

Bait, just look at browser addons, millons of site do it as well

You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles.Firefox with a non-default profile can be created like that:<pre><code> .&#x2F;firefox -CreateProfile &quot;profile-name &#x2F;home&#x2F;user&#x2F;.mozilla&#x2F;firefox&#x2F;profile-dir&#x2F;&quot;
 # For linkedin that would be:
 .&#x2F;firefox -CreateProfile &quot;linkedin &#x2F;home&#x2F;user&#x2F;.mozilla&#x2F;firefox&#x2F;linkedin&#x2F;&quot;
</code></pre>
And you can launch it like that:<pre><code> .&#x2F;firefox -profile &quot;&#x2F;home&#x2F;user&#x2F;.mozilla&#x2F;firefox&#x2F;profile-dir&#x2F;&quot;
 # For linkedin that would be:
 .&#x2F;firefox -profile &quot;&#x2F;home&#x2F;user&#x2F;.mozilla&#x2F;firefox&#x2F;linkedin&#x2F;&quot;
</code></pre>
So, given that &#x2F;usr&#x2F;bin&#x2F;firefox is just a shell script, you can<pre><code> - create a copy of it, say, &#x2F;usr&#x2F;bin&#x2F;firefox-linkedin
 - adjust the relevant line, adding the -profile argument
</code></pre>
If you use an icon to run firefox (say, &#x2F;usr&#x2F;share&#x2F;applications&#x2F;firefox.desktop), you&#x27;ll need to do copy&#x2F;adjust line for the icon.Of course, &quot;.&#x2F;firefox&quot; from examples above should be replaced with the actual path to executable. For default installation of Firefox the path would be in &#x2F;usr&#x2F;bin&#x2F;firefox script.So, you can have a separate profiles for something sensitive&#x2F;invasive (linkedin, shops, etc.) and then you can have a separate profile for everything else.And each profile can have its own set of extensions.

Sounds like containers and potentially adblocking and js blocking prevent this. For my part, I use linked in on my &quot;god dammnit I hate corporate websites so much&quot; browser which is used only for medical bill pay and amazon &#x2F; wal mart purchases and then monthly bills. Could LinkedIn get something from me there? Potentially, but they&#x27;re also not really following me around the web. I think given this I&#x27;ll go install a 3rd browser for linkedin only, or maybe finally just delete my account. It never got me a job and it&#x27;s a cesspool.

Yeah, that won’t work for Firefox users as well (extension IDs are randomized on install).But people do use Chrome, and this trick works there.

I can’t take an article seriously that starts:&gt; Every time any of LinkedIn’s one billion users visits linkedin.com, hidden code searches their computer for installed softwareand then proceeds not to explain how it’s doing that to me, a Safari user.Because, spoiler: it isn’t. Or, it might try to search, and fail, and nothing will be collected.

It&#x27;s one thing if they have a shadow profile on you (and dozens of companies almost certainly do), but it&#x27;s another thing if you give them meaningful info about you to enrich that profile with. They can figure out roughly what block you live on, OK fine, but unless you&#x27;re in a rural area with no neighbors they might not be able to do much better than that.

If you use both from the same IP without using a VPN… the profiles are most certainly grouped. There are commercial datasets on IP addresses with almost 100% accuracy with tags like “school”, “house”, “apartment block” etc. Furthermore, if you ever logged into both sites from within the same browser by accident, the link by fingerprinting was made right there and then. The final profile on you may not be 100% accurate, but certainly is in the 98% range.

I alway use LinkedIn and Meta websites in a different browser altogether.I hope browsers in the future will need to ask for permission before doing any of that.

That&#x27;s the intention. Make the internet so unbelievably shit that you just accept and move on.

It’s the fake drama. Punchy sentences. Contrast. And then? A banal payoff.

It’s 100% LLM text. HN really needs a button “flag as slop”.

I&#x27;ve had the same thought pretty often, lately.I get it... I&#x27;m not a good writer. It just sucks that now people are going to assume the stuff I said isn&#x27;t even me.I guess I always scored pretty low on the Turing test and never even knew it.

It might be normal language but lets say maybe 5% of real human blog writers use short punchy phrases like that. The noticeable problem is now its 50% of blog posts because almost every single AI authored post uses the same phrasing, it&#x27;s tiring knowing you are just reading ChatGPT output. Its usually part of a low-effort funnel to guide you to some product&#x2F;service.

Is it actually stylistically close to how you&#x27;d write it? If I reformulate your comment in slop style I&#x27;d do something like:The language is natural. Normal. Human. Who could question its authenticity?The original example isn&#x27;t the worst offender, but even small offenders stick out when you can&#x27;t escape seeing this kind of thing everywhere.

The other replies have explained what&#x27;s jumping out but I&#x27;d agree that without the other surrounding sentences of the article&#x27;s introduction I&#x27;d be inclined to think that quoted sentence by itself might be human. The full text, however, doubles down on the AI-smelling constructions and IMHO almost certainly indicates some AI provenance.

This is incredibly normal language and quite close to how I would write this quote, so what makes you think this is LLM text?

what makes you think that? and what sets your comment appart from beeing created by an llm?

How is that quote in any way demonstrative of this being written by LLM? You do know that LLMs were trained on the internet and every digitized text they could get their hands on? You are jumping at shadows, calm down already.

Reading (and even more so, using the tools to produce) a bunch of LLM-output writing also affects one’s writing style. Ever sat down and blown through 3-4 books by a favorite author, then written something and found yourself using similar structure, word choice, style…? This could very well be a human author that’s been exposed to a lot of LLM output (ie 95% of this site’s audience).I find myself doing this a lot, and I’m sure even more slips without my notice.

Nice try, but you em-dashed like a filthy human. The drone has been dispatched.

Why don&#x27;t we train LLMs on the entire internet every day? Then we don&#x27;t even need to read anything. Reading is something people did in 2025

I get it — it can be frustrating to encounter so much low effort AI content these days. But I think it’s worth looking at the bright side here: the increase in our production of entropy from GPU consumption will hasten the heat death of the universe.Would you like me to suggest some AI summarizer tools you could use to more efficiently read AI generated content in the meantime?

LLMs didn&#x27;t invent the &quot;Rule of Three&quot;.

Who cares if it’s LLM written or assisted writing?What matters is the content!

I agree that that line reads GPT-like, but it&#x27;s far from a conclusive tell. One option that I wonder about is if frequent interaction with AI will begin to influence people&#x27;s organic writing style.

Ehh… this quote alone is pretty benign. If you didn’t mention it, I wouldn’t have even considered the possibility of AI.

One cannot make an accurate assessment of liking or disliking an article without having read the article.

&gt; It&#x27;s all so tiring.What&#x27;s tiring is a comment like this. If you don&#x27;t like the article don&#x27;t read it -- and don&#x27;t comment.

Nothing in this sentence is evidence of AI.What&#x27;s next? &quot;There&#x27;s punctuation in the sentence, must be AI&quot; ?

I don’t like AI slop as much as the next guy, but that part doesn’t seem so bad? Sounds like something anyone could write.

&gt;The user is never asked. Never told. LinkedIn’s privacy policy does not mention it.OMG is literally every article written with LLMs these days I just can&#x27;t anymore. It&#x27;s all so tiring.

What scanning for browser extensions taught me about B2B sales

LinkedIn has been a weirdest social network for a long time.<a href="https:&#x2F;&#x2F;hn.algolia.com&#x2F;?q=linkedin+weird" rel="nofollow">https:&#x2F;&#x2F;hn.algolia.com&#x2F;?q=linkedin+weird</a>

LinkedIn is searching your browser extensions