Feature request: Inform users when an Anki addon communicates with third parties

Anki Suggestions
1

Anki addons are capable of communicating with third parties via api calls, etc, meaning that a user’s data could be shared inapropriately and without the user’s knowldege or consent.

Given this, I think it would be helpful if there could be a little info tag or something on an addon’s page that says something like ‘this addon communicates with third parties’ just to keep the user informed.

In order to create this feature, there would likely need to be something like a quick code scan of the addon to see if there’s something like an ‘import requests’, etc in the addon’s code.

Let me know what you think!

7 Likes
2

Maybe it is not possible to auto identify only communications with third parties.

E.g. I’m developing Anki Leaderboard (fork), which auto sends user statistics to the server as data. To simplify this part of the code, it looks like this:

import requests
url = "server URL"
data = "statistics data" 
response = requests.post(url, data=data, timeout=15)

This function is almost the same as when accessing a URL to retrieve data, e.g. if I want to only receive data without sending it looks like this:

import requests
response = requests.get(url, timeout=15)

So if we were to identify a function that sends data add-ons that merely receive data would be mis-detected, e.g. getting a definition from a dictionary, getting an image from Google, IPA, translating via google or DeepL, audio, using AI, etc. This is a very common feature in Anki add-ons.

Other challenging tasks such as these:

  • Developers can also use “urllib” instead of “requests”.

  • Developers can rename the module when importing.

    import requests as req
response = req.post(url, data=data, timeout=15)

  • Developers can incorporate different apps that are not easily readable, e.g. my add-ons:

    • AnkiRestart : There is a small app built in to restart the system.
    • Bulk Image Downloader : There is a small app built in to convert png and jpeg to the webp. (cwebp)

  • Some of the add-ons have extremely large source code, so I don’t think they can be auto parsed by AnkiWeb’s server. (maybe AnkiWeb does not have the ability to parse the source code.)

Another way would be to read the code of the add-on, many add-ons have simple source code and can be easily read. The most commonly used programming language in Anki is Python which is the easiest to learn and recently you can also use AI such as ChatGPT.

However even if we completely check them I don’t think it is completely safe to do so, e.g. add-ons can be auto updated so even if you read the source code completely there is a possibility that features will be added later.

So I think a practical solution is to check if the developer is trustworthy, e.g. Anking and Migaku are reliable because they are third party organizations they hire professional programmers, some well-known individual add-ons developers on Anki are Glutanimate, Abdo, ijgnd, Tatsumoto, Arthur Milchior, etc. they have been active on Anki for many years and are very reliable.

6 Likes
3

I imagine it would be difficult to identify malicious code within addons, but it would be cool to have an addon like this, as it would provide more security to users.

Shige, you are also part of the history and select group of great addon creators.

My knowledge of databases is almost zero at the moment, but I hope to one day create an addon that works like a DB, updating the necessary information automatically.

The idea would be for users to communicate with each other within Anki, either through messages or through competition.

For example: in a study competition to see who can make the same deck the fastest, it would be fun to study like this and see each other’s level.

1 Like
4

Thanks for your thoughts!

To respond to a couple of your points:

  • I don’t think that Anki should only look for when data is being sent to third parties. To simplify things: I’d suggest adding the ‘third party’ tag if an addon so much as retrieves data from third parties (e.g., calling a dictionary api)
  • I understand that the ‘requests’ module isn’t the only python module to communicate with third parties and that this can be renamed, but I still think detection of importing these types of modules should be possible most of the time with good enough accuracy.
  • You bring up a good point about updating addons. That would require a bit of work, for example if an addon were to previously make calls to a locally installed dictionary, then later switch to a third party dicitonary.
  • When it comes to checking with the trustworthiness of the developers, I wouldn’t be so generous (even if they are organizations with professional programmers). I won’t name names, but I strongly distrust one of the names you mentioned.

Overall, while I don’t think adding this tag would make addons safe in itself, I do think it would encourage users to exercise more caution within the anki ecosystem and keep them more informed as well.

1 Like
5

For Sublime Text packages (add-ons), a public repository is reviewed before a new package is added: Pull requests · wbond/package_control_channel · GitHub

Adding a community-driven review process for add-ons before submitting them could be a start. However, that does not help if the add-on developer later adds such third-party communication (i.e., after the add-on is accepted and published). This happened with one famous Sublime text addon with about 3 million downloads. The community spotted the ‘intrusive’ code in one update and removed the add-on some days later from the public channel. Later, the ‘intrusive’ code was removed, and the add-on was re-accepted for new downloads again.

A reliable solution could be an AI that analyzes each add-on update (code) before publishing and studies its code to look for bad actors. However, the AI should be prone to error; someone would have to supervise it and instruct it/correct its behavior when it goes wrong, not to mention the costs of running this AI for each add-on submission.

Given the current situation, someone looking for a trustworthy add-on should read its evaluations, who the author is, and, if possible, look into its source code (if they can understand it).

3 Likes
6

Given the current situation, someone looking for a trustworthy add-on should read its evaluations, who the author is, and, if possible, look into its source code (if they can understand it).

Agreed.

Adding a community-driven review process for add-ons before submitting them could be a start.

What could such a community-driven review process look like? I’ve personally never heard of anything like that.

1 Like
7

It can probably be used alongside with community review. In Wikipedia, we have tools that rate contributions on whether they are damaging or not or whether they were made in good faith, etc. It helps those who are patrolling. I imagine it would be helpful if particular parts of the code can be flagged in a similar way.

1 Like
8

A more restricted code review could be a GitHub repository; all addons would have to open a pull-request committing their code. Selected community members will review this pull request and, if approved, merge it. After the code is merged, Anki will be able to download this addon. This is entirely restricted, as any add-on update would have to submit a new pull request to be reviewed and approved again before being released to Anki users.

This is also the safest option for any Anki user, as it would significantly reduce the probability of malicious code being installed. However, it would perhaps burden the community, which would have to review pull requests and merge them constantly.

It seems like a good idea. A GitHub bot with AI capabilities could review these pull requests and pre-approve or reprove them, and later, some community members could merge or close them.

1 Like
9

A community review sounds ideal in many ways, but, as you said, it would likely burden the community. Not only would it be a lot of work for good open source devs to maintain, but I think it would also discourage more anki addon development.

Personally, I’m more in favor of some sort of an automated code scan - be it AI or otherwise, just to look for high risk code.

More generally however, it’s not like I think addons communicating with third parties is bad in any way, I just think that there is currently a dangerous level of trust (naivety?) in the Anki ecosystem. People actually do store sensitive information in their decks and they do put too much trust into the addons and decks they download (which aren’t vetted). Fundamentally, I was just thinking that the ‘communicates with third parties’ could work to make users just a bit more thoughtful(/paranoid) about what they download and thus a bit more safe.

2 Likes