Earlier quoted context omitted.
Firefox’s security is a lot less than that of Chrome.
Firefox gives me much more control than Chrome and that makes it much more secure.
Here is a button. You may now decide if you want to push it.
Let's guess what Google requires in 14 days or they kill our extension
501–510 of 811 posts
Re: Let's guess what Google requires in 14 days or they kill our extension
#502Earlier quoted context omitted.
But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with the issue at hand. If localhost is the issue, Google could literally respond exactly the way you did and the problem is gone, "why do you need http://localhost/?" This isn't about permissions at all. This is about communication and whether it's worth putting eff…
That's the thing I'm sympathetic to - having fixed the bug , it's frustrating that it's not clear what the next steps are. But given that they had the bug, Chrome was absolutely in the right to deny them the first time. And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong, if extensions that go "oh hey, we don't actually need access to literally every website,…
Google could afford to hire more than 10 people, and I doubt there are 200,000 unique ways extensions could be wrong.
Re: Let's guess what Google requires in 14 days or they kill our extension
#503I am the proud recipient of many Apple rejection notices from the App Store (I have been releasing iOS apps since 2012). I have not had an app pulled, but I have had many rejections to submitted apps (the latest were received yesterday). In all of the notices, Apple is usually quite explicit in what the problem is, including attaching screengrabs, and they will respond, if I ask them for further clarification.
Someone from Apple got on the phone with me to explain a rejection. I was disappointed with the outcome but very surprised at how they were willing to talk about it and explain why.
I was able to get a couple of apps approved, but I have perfected my forelock-pulling and wheedling skills. I always deal with them very respectfully and deferentially.
Basically, I support Apple’s “walled garden.” It’s a pain to deal with, but it makes their App Store a lot more valuable.
There is a lot of loud, vocal, opposition to it, but the vast majority of regular (as in non-geek) people like it just fine.
Re: Let's guess what Google requires in 14 days or they kill our extension
#504For people focusing their comments on this particular extension + the permissions it asks for, please take a quick look at the numerous recent posts in the official forum for Chrome extension developers to see it's not an isolated issue: https://groups.google.com/a/chromium.org/forum/#!forum/chrom... It's a systematic issue that isn't specific to anything Pushbullet is doing and it's been like this before the pandemi…
The rule still applies: if you build your business on someone else's property, don't act surprised when they they casually destroy you. It has happened again and again and again. Building for FB or Google is you making yourself their serf, and you will be allowed to exist at their whim.
What business short of The Principality of Sealand's data warehousing is not "built on someone else's property"? Even a brick-and-mortar business needs to appease the taxman.
Re: Let's guess what Google requires in 14 days or they kill our extension
#505Earlier quoted context omitted.
And both Grammarly and LastPass have had security bugs that let any website worm their way into the extension and access all the data from the extension (anything you've ever typed, for Grammarly, and all your passwords, for LastPass). Extensions with wide-ranging access are useful, and there's a reason Chrome has support for it, but they're also very very hard to get right, even if your entire business is writing a…
Do you have a link for that claim on LastPass? I use the extension and am wondering if I shouldn't use an PM extension thats more reliable in terms of security. Any recommendations obviously welcome.
See my podcast's episode on this :) https://looseleafsecurity.com/episodes/password-manager-secu... (there's a full transcript in there if audio isn't your thing)
The LastPass issues are all pretty old at this point - I mostly mention it to drive in the point that getting this stuff right is hard. (For what it's worth, the researcher who found those issues has good things to say about LastPass: https://twitter.com/taviso/status/1167311357957435392 and also fairly negative things to say about 1Password, which is what I happen to use.)
Re: Let's guess what Google requires in 14 days or they kill our extension
#506Earlier quoted context omitted.
But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with the issue at hand. If localhost is the issue, Google could literally respond exactly the way you did and the problem is gone, "why do you need http://localhost/?" This isn't about permissions at all. This is about communication and whether it's worth putting eff…
That's the thing I'm sympathetic to - having fixed the bug , it's frustrating that it's not clear what the next steps are. But given that they had the bug, Chrome was absolutely in the right to deny them the first time. And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong, if extensions that go "oh hey, we don't actually need access to literally every website,…
[deleted]
Re: Let's guess what Google requires in 14 days or they kill our extension
#507Earlier quoted context omitted.
How can you realistically avoid this for certain products though? For mobile for example, you've got the iOS and Android store policies to go through, the iOS and Android SDKs, and whatever restrictions Safari (e.g. no proper PWAs) and Chrome have. Not everything can be a website that just needs basic browser capabilities.
At least Android allows sideloading without using the Play Store. Chrome used to allow this, and I believe they've made it much more difficult.
[deleted]
Re: Let's guess what Google requires in 14 days or they kill our extension
#508Earlier quoted context omitted.
I'm confused - Firefox and Chrome act completely identically to a self signed cert for me. Both let me click through after looking at the cert or expanding a section. I have never been "blocked" by some hidden modal unless the site chooses to be HSTS-enforcing, and in that case Firefox does not allow a clickthrough either. Both examples on latest current, taken right now: Firefox: https://i.imgur.com/4VMjDZ4.png Chro…
Youre confused because you're not using Chrome on OSX: on osx there's no "Proceed to " option.
I was literally going to say that at one point that screen didn't look like that, and it appears it still doesn't but only sometimes.
Re: Let's guess what Google requires in 14 days or they kill our extension
#509Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…
https://*/* being allowed at all without aggressive vetting is a big mistake. It's astonishing to me that they ever made it easy to do this.
Agreed, that in itself should require an application
Re: Let's guess what Google requires in 14 days or they kill our extension
#510The fact that they were requesting https://*/* and http://*/* (i.e. full control over all your accounts) without it being absolutely necessary reflects terribly on them. Still not clear why localhost (which can mean root access to the local machine since it may have localhost-only services that enable that) and cookies access is needed, also http://*.pushbullet.com is unnecessary since they should always use HTTPS. I…
Nobody is against enforcing better behaviors from developers, the issue is that they are not telling anyone what those issues are. I don't know why you can always count on someone to defend a multi-billion corporation against small companies, is there no empathy left?
> I don't know why you can always count on someone to defend a multi-billion corporation against small companies, is there no empathy left?
I don't have empathy for companies, I (try to) have empathy for people. Small companies are made up of people. Large companies are made up of people. I try (and often fail, alas) to have empathy for the people in both cases.