Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's guess what Google requires in 14 days or they kill our extension

blog.pushbullet.com

Post reply on HN
Print view View original

611–620 of 811 posts

Re: Let's guess what Google requires in 14 days or they kill our extension

#611

Post by ehsankia »

teruakohatu wrote: post #569
yellowapple wrote: post #456

Earlier quoted context omitted.

I mentioned this in the GitHub issue thread (howdy!), but I strongly suspect it has to do with specific references to pornographic sites in the extension's manifest. If only Google would mind its own business instead of playing mommy-knows-best and dictating its morality on grown adults.

It is also a fork of an extension that contained malware, so an automated code review tool trained on malware might be catching it.

I was actually gonna ask, isn't hoverzoom a malware? But I guess this is a fork of it. I've since switched to Imagus but I do miss HoverZoom.

Re: Let's guess what Google requires in 14 days or they kill our extension

#612

Post by laughinghan »

IG_Semmelweiss wrote: post #555
geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

I agree. This is hackernews, so it is easy why devs would feel otherwise, but as a nondev, I represent the the end users. Why would anyone think it is appropriate for google to reveal their hand, and allow blackhat operators to build apps up to the max limit of permissions? (If they were revealed by google via white glove customer service). If goog did provide guidance on permissions, goog would literally have to aud…

> If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones.

This makes no sense. For the sake of the grandmas, Google already needs to audit every app in the store and separate bad actors from good ones.

How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem?

Re: Let's guess what Google requires in 14 days or they kill our extension

#613

Post by jonnycomputer »

ChrisMarshallNY wrote: post #62

I am the proud recipient of many Apple rejection notices from the App Store (I have been releasing iOS apps since 2012). I have not had an app pulled, but I have had many rejections to submitted apps (the latest were received yesterday). In all of the notices, Apple is usually quite explicit in what the problem is, including attaching screengrabs, and they will respond, if I ask them for further clarification.

Which pretty much blows up the idea that Google's vagueness is about security.

Re: Let's guess what Google requires in 14 days or they kill our extension

#614

Post by kd5bjo »

IG_Semmelweiss wrote: post #555
geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

I agree. This is hackernews, so it is easy why devs would feel otherwise, but as a nondev, I represent the the end users. Why would anyone think it is appropriate for google to reveal their hand, and allow blackhat operators to build apps up to the max limit of permissions? (If they were revealed by google via white glove customer service). If goog did provide guidance on permissions, goog would literally have to aud…

> If goog did provide guidance on permissions, goog would literally have to audit every app in the store

You’re talking about vetting suppliers and products in order to ensure they’re selling safe products that consumers want. That sounds like an ordinary part of every retailer’s job to me.

Re: Let's guess what Google requires in 14 days or they kill our extension

#615

Post by highlysyntropic »

cycomanic wrote: post #571

I think the interpretation that Google does this because it does not want to compromise the review process to malicious extension authors is a very generous one. As others pointed out, a motivated enough entity could very well be probing the system using multiple submissions (sure it gets your account banned, just use several accounts). No what is really going on is that Google wants the ability to reject an app for…

don't create extensions. create browser controllers. you can release them as binaries. anyone can download them. They instrument chrome using the remote devtools API.

an oss example here: https://github.com/dosyago/22120

and an idea I have for a browse controllers store here.

https://github.com/dosyago/browsercontrollers.store

Re: Let's guess what Google requires in 14 days or they kill our extension

#616

Post by Ice_cream_suit »

extesy wrote: post #259

I'm in the same boat. My open source chrome extension[1] has just been taken down[2] after several years of no complaints because it apparently violated content policies related to nudity and pornography. Say what? Well, I guess you could view _any_ image using my extension, including nudes. Isn't that the problem with most other extensions which could be used on porn sites, like editing cookies, etc? I've submitted…

""js": ["plugins/imagefap.js"], "matches": ["://.imagefap.com/*"]"

This line and others like this, are probably the issue.

Re: Let's guess what Google requires in 14 days or they kill our extension

#617

Post by highlysyntropic »

geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

paid Google shill.

Re: Let's guess what Google requires in 14 days or they kill our extension

#618

Post by [deleted] »

wtetzner wrote: post #551
seanwilson wrote: post #84

For people focusing their comments on this particular extension + the permissions it asks for, please take a quick look at the numerous recent posts in the official forum for Chrome extension developers to see it's not an isolated issue: https://groups.google.com/a/chromium.org/forum/#!forum/chrom... It's a systematic issue that isn't specific to anything Pushbullet is doing and it's been like this before the pandemi…

I guess the solution is to stop using Chrome.

[deleted]

Re: Let's guess what Google requires in 14 days or they kill our extension

#619

Post by [deleted] »

wtetzner wrote: post #552
unnouinceput wrote: post #548

Earlier quoted context omitted.

After 2nd to 3rd rejection if it will require a human to intervene Google will have to hire half the earthlings to deal with crappy spammers that will simply spam google store with their extensions. The answer is not human interaction, the answer is automation tool to give more details as what was detected and didn't pass.

The answer is probably to stop using Chrome.

[deleted]

Re: Let's guess what Google requires in 14 days or they kill our extension

#620

Post by cerberusss »

highlysyntropic wrote: post #617
geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

paid Google shill.

Are you saying geofft is a paid Google shill? Or the maker of the Pushbullet extension?
Post reply on HN