Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's guess what Google requires in 14 days or they kill our extension

blog.pushbullet.com

Post reply on HN
Print view View original

431–440 of 811 posts

Re: Let's guess what Google requires in 14 days or they kill our extension

#431

Post by justinclift »

toohotatopic wrote: post #210
cpascal wrote: post #150

Earlier quoted context omitted.

One worry about tying your identity to your own domain, is the security of your identity (aka your domain) hinges on the security of your registrar. If a bad actor can socially engineer their way into controlling your domain, your entire identity is compromised. Here's a blog post about this nightmare happening to someone: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...

So, which ones are the good registrars?

EasyDNS (https://easydns.com), based in Canada has been around for years, and has a good reputation for not blindly actioning DMCA requests (which can be important for some). :)

Re: Let's guess what Google requires in 14 days or they kill our extension

#432

Post by sneak »

wlesieutre wrote: post #36
Baeocystin wrote: post #11

Another long-term PushBullet customer here. Anyone at Google who is listening- this kind of behavior kills my desire to continue using your products dead. I need functionality, of the type PushBullet has provided for years, to do my work. The recent nerfing of ublock origin has already had me feeling iffy on things. Behavior like this is simply unacceptable. If you want people to use your services, you need to have s…

Chrome is a trivially easy product to switch off of compared to other Google properties like Gmail and YouTube. Have you tried Firefox recently?

Firefox’s security is a lot less than that of Chrome.

Re: Let's guess what Google requires in 14 days or they kill our extension

#433

Post by mrits »

fgonzag wrote: post #274
danpalmer wrote: post #53

As much as we can criticise Google's handling of this situation, the fact that the developer was able to reduce permissions from accessing data on _all websites_ down to _their website_, as well as tighten up a few other permissions, shows that Google is correct that the extension is asking for more than it needs. I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved.…

That's what you got out of it? Google doing a good job? They sent an email with no guidance whatsoever. These guys went above and beyond what most developers would've done, which would have been to contact support until they get a clear answer. This only alienates the extension ecosystem. And this was the primary reason I switched to Firefox. Google is the new Microsoft. If I remember correctly, they started Chrome e…

14 days is an absolutely egregious duration to get a response for a software change. A developer could be out on vacation for that long. Encouraging fast fixes is also irresponsible from a security perspective, which is what they are trying to fix to begin with.

Re: Let's guess what Google requires in 14 days or they kill our extension

#434

Post by StavrosK »

gowld wrote: post #372
propogandist wrote: post #343

Earlier quoted context omitted.

owning your domain and having control of a domain through a trusted registrar is better than relying on the worlds largest advertising company to manage your digital identity (email), which is offered as a free service, that's subject to a catch-all ToS.

The article is literally about a user who was attacked because Twitter, Facebook ad GoDaddy have bad security, while his Google account was safe.

Google Domains exists.

Re: Let's guess what Google requires in 14 days or they kill our extension

#435

Post by filoleg »

toohotatopic wrote: post #284
ztjio wrote: post #277

Earlier quoted context omitted.

Google is great for this because they will never actually let anyone talk to a human in order to apply social engineering techniques ;)

But do you lose your domain if google bans your account? The requirement is being able to switch email providers, especially google, when they lock your account. You don't secure your flow of email with a domain if that domain is managed by google, too.

If you don't use your google account for anything but domain registration, what could they even possibly ban you for?

While I am aware that Google tends to have quite a few false positive account bans, it is one of the most extremely unlikely things to happen, if all you do with it is pay for your domain registration.

Re: Let's guess what Google requires in 14 days or they kill our extension

#436

Post by StavrosK »

cpascal wrote: post #298
toohotatopic wrote: post #210

Earlier quoted context omitted.

So, which ones are the good registrars?

I use namecheap which has two-factor authentication, domain locks, and support pins.

I use Namecheap too, but they took forever to add 2FA (it was added a few months to a year ago, maybe?) and I don't have any faith they'll add FIDO2/U2F any time soon.

EDIT: Oh daaamn it looks like they did it! Huh, faith restored. jgc, CloudFlare should follow!

EDIT 2: I'm just full of failures today, CloudFlare supports U2F as well. This is great news all around.

Re: Let's guess what Google requires in 14 days or they kill our extension

#437

Post by [deleted] »

geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

[deleted]

Re: Let's guess what Google requires in 14 days or they kill our extension

#438

Post by jshevek »

Aperocky wrote: post #315
danpalmer wrote: post #53

As much as we can criticise Google's handling of this situation, the fact that the developer was able to reduce permissions from accessing data on _all websites_ down to _their website_, as well as tighten up a few other permissions, shows that Google is correct that the extension is asking for more than it needs. I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved.…

I disagree with you here because: 1. The article contains more relevant information that you did not show in your point. 2. Those relevant information made your point void 3. I think your point make no sense on the relevant information. There, I refuted your claim, you have 14 days to change it and show what you learned.

Please don't use that quoting style for non-code.

Re: Let's guess what Google requires in 14 days or they kill our extension

#439

Post by raybb »

snazz wrote: post #52
raybb wrote: post #9

This is awful. I'm going to send GCP support a message with the small hope that someone can flag it up to the right team.

GCP and the rest of Google are separated from each other similarly to how YouTube and Google are separated. Unfortunately, the odds of that technique working are very low.

Well they responded saying:

> Although I am sure that this is not the correct place to reach out, I have reached out to the Chrome privacy team to see if they can give us some advice for PushBullet.

Though I posted this before this article was on the front page of HN.

Re: Let's guess what Google requires in 14 days or they kill our extension

#440

Post by smnthermes »

tialaramex wrote: post #87
skinnymuch wrote: post #32

Earlier quoted context omitted.

Can you give a few examples of how Mozilla/Firefox have changed? We all know about FF Quantum. Yeah it sucks what happened. Maybe there was an alternative, but any one saying Firefox should’ve just stuck to not being compatible with Chromium extensions is kidding themselves on how badly that would’ve continued hurting Firefox’s market share. The XUL powered extension I’m sure were powerful so the outcry in certain pl…

Quantum wasn't even about Chrome compatibility. The XUL extension mechanism was permanent technical debt loaded onto the browser because of how it exposed features, basically welding things directly onto the browser's guts, which on the one hand is super-convenient for making radical changes in an extension and on the other hand is a nightmare to maintain. The analogy I've used is the Amiga operating system design ve…

> The XUL extension mechanism was permanent technical debt loaded onto the browser because of how it exposed features, basically welding things directly onto the browser's guts, which is a nightmare to maintain.

There is no evidence for this at all. Extensions can't modify the rendering engine.

Post reply on HN