Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's guess what Google requires in 14 days or they kill our extension

blog.pushbullet.com

Post reply on HN
Print view View original

601–610 of 811 posts

Re: Let's guess what Google requires in 14 days or they kill our extension

#601

Post by gmueckl »

chc wrote: post #486
_jal wrote: post #474

Earlier quoted context omitted.

The rule still applies: if you build your business on someone else's property, don't act surprised when they they casually destroy you. It has happened again and again and again. Building for FB or Google is you making yourself their serf, and you will be allowed to exist at their whim.

This isn't very actionable advice, though, since there is basically no such thing as a software product that isn't built on somebody else's property. You might think, "Ah-ha, web apps!" But no, Google can still casually destroy you there. Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there.

This is actionable advice. The action is to create an offer that is not entirely depeneent on a single platform provider. Don't build browser extensions for just a single browser. Don't build an app based business solely around an iOS or Android app - support both platforms. And so on.

Re: Let's guess what Google requires in 14 days or they kill our extension

#602

Post by adrianN »

umvi wrote: post #596
kelnos wrote: post #518

Earlier quoted context omitted.

I can only assume that this isn't the result of a human flagging Pushbullet like this; I expect it's an automated system. And if that automated system can make a decision to flag the extension, it could also include in the email specifically what caused that flagging to happen. At this point I'm really starting to become unsympathetic to the idea that they can't tell you what you're doing wrong because it'll enable p…

> And if that automated system can make a decision to flag the extension, it could also include in the email specifically what caused that flagging to happen Unless it's a black box machine learning model that just says yes/no but can't tell you why

I think it's more likely that their flagging is heuristic based and could easily defeated by a malicious extension author and giving detailed feedback makes reverse engineering the rules trivial.

Re: Let's guess what Google requires in 14 days or they kill our extension

#603

Post by bigfoot675 »

arcticbull wrote: post #536
geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

> ... all of this is consistent with an extension that should be kicked off the app store within 14 days. No, it absolutely isn't. You can't take someone's livelihood off the app store within 14 days when they have every interest in complying with your policy but you just don't feel the need to even tell them what all the policy is. The fact it was approved in the first place is Google's fault, not the app developer,…

I mean they can. It's their store. I don't think they should, but still

Re: Let's guess what Google requires in 14 days or they kill our extension

#604

Post by adrianN »

SftwrSvior81 wrote: post #540
tomlagier wrote: post #525

Earlier quoted context omitted.

Sure, it's anti-social. But is it more or less anti-social than running a huge software platform that advertises the ways to exploit itself? I think it's a very interesting question. Who is more deserving of a good experience - uninformed users who might get taken advantage of by malicious extensions, or developers for the platform, who definitely do get taken advantage of by virtue of running afoul of rules they can…

> But is it more or less anti-social than running a huge software platform that advertises the ways to exploit itself? Security through obscurity is no security at all. Google is not doing its user a favor by hiding the criteria it uses to determine whether an extension is malicious or not. Also, just because Google won't publish the criteria, it does not mean that it can't be discovered by someone with enough determ…

It seems likely to me that it's impossible to have an extension system that allows useful extensions that users want while also being completely secure against malicious actors. Security by obscurity is an important tool in the abuse fighting toolbox, because it allows you to have cheap heuristics while increasing the costs for malicious actors.

Re: Let's guess what Google requires in 14 days or they kill our extension

#605

Post by pvg »

tastroder wrote: post #582
geofft wrote: post #541

Earlier quoted context omitted.

By "the bug" I mean the fact that they're asking for permissions on any site when they don't need them - which is a bug (and a serious one) whether or not Chrome notices.

I'm not sure I get your point, yes that permission was overreaching but they fixed that and were still rejected and left in limbo without Google's system giving them enough specific information to reliably mitigate whatever it is the system did not like.

They haven't fixed the localhost thing which is in a roughly similar category. Google's response was vague and poor but the problems this extension had are quite serious. More serious than, say, Zoom's recent ones.

Re: Let's guess what Google requires in 14 days or they kill our extension

#606

Post by raister »

jboydyhacker wrote: post #543

I think folks are drastically missing the forest for the trees here. This is just one minor example of the INSANE process that is now the Chrome Approval Process. I've seen extensions go for many months getting random rejections with no reason given. This forces developers to GUESS as to what is wrong. Want to try and develop according to a roadmap or timeline- forget about it. There is no "app store" approval proces…

This year, my resolution was to start reducing my dependency on Google products. I installed Firefox and deleted Chrome. Then I downloaded a file size manager and remove all files I haven't open in past 5 years, deleting from GDrive. THe same with GDocs. All emails larger than 1Mb were checked if they needed to persist. I end up unsubscribing from the 100Gb service from Google, my inbox has 6Gb, I deleted the Picasa stuff (I was not using), and the GDrive was reduced to 3Gb (the limit is 15Gb altogether). I am quite happy with this. PS: I started considering doing this, despite being a Gmail user since 2006 because of their removal of clause "stop being evil" and the huge amount of tracking being done in Chrome, which frankly, annoyed me very much.

Re: Let's guess what Google requires in 14 days or they kill our extension

#607

Post by jchook »

cycomanic wrote: post #571

I think the interpretation that Google does this because it does not want to compromise the review process to malicious extension authors is a very generous one. As others pointed out, a motivated enough entity could very well be probing the system using multiple submissions (sure it gets your account banned, just use several accounts). No what is really going on is that Google wants the ability to reject an app for…

Critical to realize that Google gets all the permissions afforded to extensions and uses them for objectionable self-interest.

Re: Let's guess what Google requires in 14 days or they kill our extension

#608

Post by thelibrarian »

Florin_Andrei wrote: post #193
foobarbazetc wrote: post #131

lol. We have the same problem, but on the Google Play Store. We have an brand name app used by millions of people. We uploaded an update where the only change was a new Firebase library. Google rejected the update for vague reasons (“violation of Google Play policies” but not telling us which one). Appealing the rejection, the CSR just pasted the vague policy thing back at us. We asked for more information and they j…

> No idea what’s going on at Google. It's like trying to troubleshoot a machine learning algorithm.

It is trying to troubleshoot a machine learning algorithm. Google is quite proud of the fact that most of their support is handled by machines.

Re: Let's guess what Google requires in 14 days or they kill our extension

#609

Post by toohotatopic »

ztjio wrote: post #350
toohotatopic wrote: post #284

Earlier quoted context omitted.

But do you lose your domain if google bans your account? The requirement is being able to switch email providers, especially google, when they lock your account. You don't secure your flow of email with a domain if that domain is managed by google, too.

So my statement was a total comedic effort not to be taken seriously, I'd never suggest anyone use a company on the basis of terrible customer support. That's what the semi-colon parentheses at the end was meant to signify. To attempt to actually answer your question, I believe the nature of the governance around registrars would ensure you have recourse to transfer your domain in the case that Google be Google. It m…

Sorry, that went over my head.

Re: Let's guess what Google requires in 14 days or they kill our extension

#610

Post by [deleted] »

_jal wrote: post #516
chc wrote: post #486

Earlier quoted context omitted.

This isn't very actionable advice, though, since there is basically no such thing as a software product that isn't built on somebody else's property. You might think, "Ah-ha, web apps!" But no, Google can still casually destroy you there. Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there.

People have been complaining about $dominant_player's power to destroy forever. It was IBM, then it was Microsoft, now we have new overlords. (For that matter, Sun was big enough to be a little obnoxious for a bit.) That's unfortunate, but it is how the software market has worked thus far. Platform owners have massive power over those who build on them. For it to change, the market fundamentals will have to change. P…

[deleted]
Post reply on HN