301–310 of 811 posts
I'm in the same boat. My open source chrome extension[1] has just been taken down[2] after several years of no complaints because it apparently violated content policies related to nudity and pornography. Say what? Well, I guess you could view _any_ image using my extension, including nudes. Isn't that the problem with most other extensions which could be used on porn sites, like editing cookies, etc? I've submitted…
As much as we can criticise Google's handling of this situation, the fact that the developer was able to reduce permissions from accessing data on _all websites_ down to _their website_, as well as tighten up a few other permissions, shows that Google is correct that the extension is asking for more than it needs. I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved.…
> I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved. You're missing the point here. The developer isn't given any guidance on what needs tightening. This shouldn't be guess and check. These rules impact this developer's livelihood. They should be well defined, documented, and communicated.
What do you think they should be providing? Honest question, I have some ideas but they all feel very tricky/error prone to implement.
Earlier quoted context omitted.
They aren't solving this problem, they're killing off extensions. And I say this having received many unsolicited attempts to "purchase" Chrome extensions.
I disagree. I think this practice could be seen as anti-developer, but it is pro-consumer.
As much as we can criticise Google's handling of this situation, the fact that the developer was able to reduce permissions from accessing data on _all websites_ down to _their website_, as well as tighten up a few other permissions, shows that Google is correct that the extension is asking for more than it needs. I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved.…
Disagree that G's motivation here is to reduce permission footprint, because: - if G has the ability to automatically audit necessary permissions, they'd do it when you upload to the plugin store - if they're doing this manually for popular plugins, then (1) they'd publicly certify safe plugins and (2) the interaction would be way more high touch Plugins are inherently unsafe + require trusting the developer. Could b…
If they added it more recently then they are just back-applying it to an already existing extension.
Alternatively, you can report plugins as requesting incorrect permissions – I've done this. Perhaps that's what's happened here, lots of reports triggering an investigation.
Earlier quoted context omitted.
Maybe I'm naive but what if pushbullet.com was just running a server-side fetch and returning the result? That would bypass CORS, essentially acting as a proxy server.
That's a great question, and it's not limited to Chrome extensions. In general, for any resources that don't require credentials to access, pushbullet could hypothetically serve them at like pushbullet.com/proxy/gmail.com/favicon or something. But resources requiring credentials are another thing entirely. In general, the thing that prevents a third-party server from MITM'ing your interactions with a target server is…
My understanding is that if an extension has a wildcard 'https://*' origin listed in its manifest, then it can make cookie-populated requests to any domain that matches the wildcard. That's actually pretty scary from privacy and security perspectives. But I suppose that's part of the reason CWS has moderation in the first place.
Earlier quoted context omitted.
I've seen cases where Apple will actually decompile/debug your app and point you the exact feature / method / line that they find unacceptable. Despite all of my other complaints about iOS ecosystem, they _do_ keep their App Store walled garden fairly well tended.
Out of curiosity, where those big name apps, or small ones? I assume that level of service is reserved or more important apps?
Another long-term PushBullet customer here. Anyone at Google who is listening- this kind of behavior kills my desire to continue using your products dead. I need functionality, of the type PushBullet has provided for years, to do my work. The recent nerfing of ublock origin has already had me feeling iffy on things. Behavior like this is simply unacceptable. If you want people to use your services, you need to have s…
Earlier quoted context omitted.
I've seen cases where Apple will actually decompile/debug your app and point you the exact feature / method / line that they find unacceptable. Despite all of my other complaints about iOS ecosystem, they _do_ keep their App Store walled garden fairly well tended.
Out of curiosity, where those big name apps, or small ones? I assume that level of service is reserved or more important apps?
Over the years, I've had over twenty apps in the store, but most are retired.
I'm down to seven: https://littlegreenviper.com/AppDocs/
Another long-term PushBullet customer here. Anyone at Google who is listening- this kind of behavior kills my desire to continue using your products dead. I need functionality, of the type PushBullet has provided for years, to do my work. The recent nerfing of ublock origin has already had me feeling iffy on things. Behavior like this is simply unacceptable. If you want people to use your services, you need to have s…
If that is the case, then a much better solution would be for Chrome to implement a secure channel for password managers to use for just that purpose and make access really really explicit. But again, without them saying anything we won't know.
My advice is to watch for a CVE regarding sniffing sensitive data off the clipboard to surface in the next 30 - 90 days.