Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google and Mozilla are failing to support browser extension developers

armin.dev

Post reply on HN
Print view View original

181–190 of 195 posts

Re: Google and Mozilla are failing to support browser extension developers

#181

Post by michaelmrose »

michaelt wrote: post #140
michaelmrose wrote: post #73

Earlier quoted context omitted.

Just never allow such a transfer force a new user to create a new name. Ensure this is part of the terms of service. Prosecute violators that is to say buyer and dev under cfaa and ensure a hefty fine is levied with prison time. Nefarious parties will find few sellers thereafter.

As long as an extension can be owned by a company, you can bypass restrictions on transferring the extension by transferring ownership of the company. Unless you think plugins for HTTPS Everywhere, Google Translate, and LastPass should be signed by an individual developer - in which case you'll have to solve the problem of what to do when that developer moves between jobs :)

The point is not whether its possible to transfer ownership of the code it's whether its possible to transfer it in a way that causes a user who agreed to trust Bob or Bobco inc to automatically end up trusting Crook or Crookco inc.

A buyer company or individual ought to have to create a different name and convince users to install/trust their extension if ownership is transferred instead of merely taking control of the existing name and having the next automatic update install malware.

Extension systems and language specific package managers on the overall have garbage security and are going to be a way bigger problem in the future. They are low hanging fruit.

Re: Google and Mozilla are failing to support browser extension developers

#182

Post by jhayward »

Mindwipe wrote: post #149
malka wrote: post #130

Earlier quoted context omitted.

You held the développer legally liable of abuses with thé extension if he did not notify mozilla or Google that he sold it

The developer is the company, not the individual. Holding an individual responsible for the company is simply not plausible in most jurisdictions for anything short of actual criminal actions.

Legally, companies are individuals and the same sort of personal responsibility and accountability sanctions can be applied to both.

Re: Google and Mozilla are failing to support browser extension developers

#183

Post by michaelmrose »

unionpivo wrote: post #137
michaelmrose wrote: post #73

Earlier quoted context omitted.

Just never allow such a transfer force a new user to create a new name. Ensure this is part of the terms of service. Prosecute violators that is to say buyer and dev under cfaa and ensure a hefty fine is levied with prison time. Nefarious parties will find few sellers thereafter.

\s Right that solved pirating, torrenting and hacking. None of the above happens on internet any more since cfaa was passed. Shady people will do shady stuff, no mater what law says. And you will never catch all or even most of them. So if it's all the same it would be better if we come with solution, that prevents abuse from happening in the first place

The point is not to stop anyone on earth from behaving in a shady fashion its to make it systematically challenging for the normal behavior of non malicious people to enable malicious people.

If you can buy or take over responsibility for extension foo and automatically exploit thousands of people who automatically get updated to foo 1.1 now with 1000% more malware then it will happen.

If you have me/foo and you want to take over maintaining foo and you have to create you/foo and convince people to remove the working version of me/foo and switch to your you/foo this is a small burden for legitimate users but a higher bar for scummy companies whose accounts will doubtlessly either have a bad history or far more likely none at all to lean on.

Further the time required to convince users to switch will be much longer leading to more time for something to be discovered as malicious before users are effected.

Best this whole process makes exploiting users much less valuable and thus you have less of it to start with.

Re: Google and Mozilla are failing to support browser extension developers

#184

Post by michaelt »

michaelmrose wrote: post #181
michaelt wrote: post #140

Earlier quoted context omitted.

As long as an extension can be owned by a company, you can bypass restrictions on transferring the extension by transferring ownership of the company. Unless you think plugins for HTTPS Everywhere, Google Translate, and LastPass should be signed by an individual developer - in which case you'll have to solve the problem of what to do when that developer moves between jobs :)

The point is not whether its possible to transfer ownership of the code it's whether its possible to transfer it in a way that causes a user who agreed to trust Bob or Bobco inc to automatically end up trusting Crook or Crookco inc. A buyer company or individual ought to have to create a different name and convince users to install/trust their extension if ownership is transferred instead of merely taking control of…

Right, but if a user has trusted an extension by Bobco Inc, and Bobco becomes a wholly-owned subsidiary of Crookco Inc, then Crookco can put what they like into the trusted extension.

I suppose you could argue that when Facebook buys Instagram the Instagram app should be uninstalled from users' phones and all their accounts and posts deleted, because they didn't agree to trust Facebook or consent to the data being shared with Facebook. There's a certain logic to that, but it would be a big change to how the current tech ecosystem works.

Re: Google and Mozilla are failing to support browser extension developers

#185

Post by michaelmrose »

michaelt wrote: post #184
michaelmrose wrote: post #181

Earlier quoted context omitted.

The point is not whether its possible to transfer ownership of the code it's whether its possible to transfer it in a way that causes a user who agreed to trust Bob or Bobco inc to automatically end up trusting Crook or Crookco inc. A buyer company or individual ought to have to create a different name and convince users to install/trust their extension if ownership is transferred instead of merely taking control of…

Right, but if a user has trusted an extension by Bobco Inc, and Bobco becomes a wholly-owned subsidiary of Crookco Inc, then Crookco can put what they like into the trusted extension. I suppose you could argue that when Facebook buys Instagram the Instagram app should be uninstalled from users' phones and all their accounts and posts deleted, because they didn't agree to trust Facebook or consent to the data being sh…

This should trigger a requirement for a new install to a new name the same as selling the extension to Crookco.

Re: Google and Mozilla are failing to support browser extension developers

#186

Post by CobrastanJorji »

imhoguy wrote: post #136
stuartd wrote: post #86

Earlier quoted context omitted.

Indeed: https://github.com/gorhill/uBlock/wiki/Why-don't-you-accept-...

Excellent answer. "no donations = no expectations"

Should he decide to terminate the project, I expect that he'll find that he's wildly underestimated human capabilities for entitlement. The upside is that he won't feel obligated to those people.

Re: Google and Mozilla are failing to support browser extension developers

#187

Post by SquareWheel »

rifung wrote: post #179
SquareWheel wrote: post #119

Earlier quoted context omitted.

I'm curious. What specifically would you like to see removed from Chrome?

To be honest I don't know too much about what's been added but I can only assume new functionality must account for the increased bloat. I imagine it's support for things like "Chrome Apps" or more generally the desire to get websites to be able to do the same things as native apps. I suspect there's also the fact that Chrome has to support Chrome OS as well. But I am new to Chrome OS so admittedly I am not too famil…

Chrome OS was my thought as well. I'm not sure how much of that is included in Chrome itself, and how much is bundled separately as part of the OS though.

For some reason I thought Chrome Apps were deprecated. PWAs can do most of the same things today.

Re: Google and Mozilla are failing to support browser extension developers

#188

Post by efreak »

thepangolino wrote: post #138
pteraspidomorph wrote: post #107

Earlier quoted context omitted.

Your extensions are listed along with their resource usage in about:performance !

There’s a real discoverability issue with those kind of pages. They should be listed somewhere in some submenu. You can’t expect people to go through all the documentation like they used to go through manuals in decades past.

Chrome has chrome://chromeurls and Firefox has about:about (Firefox chrome urls tend to be actual browser resources, not information or settings or debugging. Eg with xul you used to be able to open the toolbars/browser ui itself in a window)

Re: Google and Mozilla are failing to support browser extension developers

#189

Post by efreak »

cartlidge wrote: post #157
giancarlostoro wrote: post #134

Earlier quoted context omitted.

Firefox has a task manager now. They should improve on this to compete with Googles. Nobody wants to type a URL when they can hit an easy shortcut.

I have a hope of remembering about:performance. I can bookmark it, and it's there in autocomplete. You can make a link to it in your webpage or in a nice plugin (which, once it gets a couple thousand users, you can sell to an honest businessman for tens of thousands). Shift-Escape? what? I'm supposed to just randomly press every key combination till something happens?

If you can remember the hotkey for Windows task manager, sure. It's Ctrl+Shift+ESC. If not, you can access it through the menu.

Re: Google and Mozilla are failing to support browser extension developers

#190

Post by michaelmrose »

Mindwipe wrote: post #148
michaelt wrote: post #140

Earlier quoted context omitted.

As long as an extension can be owned by a company, you can bypass restrictions on transferring the extension by transferring ownership of the company. Unless you think plugins for HTTPS Everywhere, Google Translate, and LastPass should be signed by an individual developer - in which case you'll have to solve the problem of what to do when that developer moves between jobs :)

Indeed. It's a superficially attractive answer, but the reality is that it's unenforceable. Nation states get unstuck here on taxation, and bluntly it is unlikely any browser vendor will ever invest as heavily as nation states do on getting revenue.

If you can't enforce the rules on an extension/library developer because they are based in a non compliant nation just kick them off the market.

To be blunt most current software in use in US/Europe already comes from US/Europe.

Post reply on HN