Let's guess what Google requires in 14 days or they kill our extension • Hacker News Board

Re: Let's guess what Google requires in 14 days or they kill our extension

#721

Post by kire456 » Thu, May 14, 2020, 11:39 AM UTC

skrebbel wrote: post #680

chc wrote: post #486

Earlier quoted context omitted.

This isn't very actionable advice, though, since there is basically no such thing as a software product that isn't built on somebody else's property. You might think, "Ah-ha, web apps!" But no, Google can still casually destroy you there. Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there.

> Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there. Casually? The amount of effort and goodwill, say, Microsoft would need to spend to prevent me from installing $PROGRAM on my computer is significantly higher than the amount of non-effort a single extension reviewer would need to expend to click "no" arbitrarily because they are having a bad day. How would Microsoft do it?…

The OS vendor could "destroy" you by making changes to the OS that affect your app, right? The Old New Thing[0] is full of stories of apps that exploited undocumented implementation details of the OS, and were surprised that those aspects were in fact changed in a later OS version.

To its credit (though not everyone agrees), MS has spent a lot of effort making compatibility shims, basically doing other people's work for them, but they have no such obligation.

0. https://devblogs.microsoft.com/oldnewthing/

Re: Let's guess what Google requires in 14 days or they kill our extension

#722

Post by grishka » Thu, May 14, 2020, 11:42 AM UTC

skrebbel wrote: post #680

chc wrote: post #486

Earlier quoted context omitted.

This isn't very actionable advice, though, since there is basically no such thing as a software product that isn't built on somebody else's property. You might think, "Ah-ha, web apps!" But no, Google can still casually destroy you there. Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there.

> Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there. Casually? The amount of effort and goodwill, say, Microsoft would need to spend to prevent me from installing $PROGRAM on my computer is significantly higher than the amount of non-effort a single extension reviewer would need to expend to click "no" arbitrarily because they are having a bad day. How would Microsoft do it?…

> I'm less deep into Apple land but I expect something similar holds on macos.

Well, considering how hard Apple tries lately to make sure every piece of macOS software goes through them one way or another...

Re: Let's guess what Google requires in 14 days or they kill our extension

#723

Post by lucideer » Thu, May 14, 2020, 11:42 AM UTC

JaggedJax wrote: post #485

geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with the issue at hand. If localhost is the issue, Google could literally respond exactly the way you did and the problem is gone, "why do you need http://localhost/?" This isn't about permissions at all. This is about communication and whether it's worth putting eff…

Google's customer service is pretty terrible across the board and it seems their review process is no exception, but even so, reading the account of the above issue with domain access does not imbue in me a sense that the developer of this extension is competent. It would not surprise me in the slightest if there are many many other issues with this extension's code.

Re: Let's guess what Google requires in 14 days or they kill our extension

#724

Post by qwertox » Thu, May 14, 2020, 11:45 AM UTC

maartn wrote: post #246

I think that reading all of a users' cookies from all websites is pretty privacy invading...

True, that was the way before they removed the "http(s):///" permission. That is a tremendous permission to ask for and would be a huge red flag in any case.

Now they limited it to ".pushbullet.com", but even then they don't need that permission since ".pushbullet.com" is a server controlled by them, so they are free to set and read those cookies anyway.

The cookies permission is only needed if you want to read cookies from a domain you don't own. The extension has no need to modify the cookies, and if Pushbullet wants to set or change them, for example to set session cookies, it can do so in a non-extension tab. The extension can then send those cookies in their API request automatically without needing to access them.

Re: Let's guess what Google requires in 14 days or they kill our extension

#725

Post by lucideer » Thu, May 14, 2020, 11:46 AM UTC

arcticbull wrote: post #536

geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

> ... all of this is consistent with an extension that should be kicked off the app store within 14 days. No, it absolutely isn't. You can't take someone's livelihood off the app store within 14 days when they have every interest in complying with your policy but you just don't feel the need to even tell them what all the policy is. The fact it was approved in the first place is Google's fault, not the app developer,…

I think there's two issues here:

1. should Google provide more context to the developer? Of course.

2. if the extension is a genuine danger to users, should they remove it immediately? Of course

I agree that Google should do #1 as well as #2, but I absolutely believe it's better to do #2 (even without #1) than to do neither.

Re: Let's guess what Google requires in 14 days or they kill our extension

#726

Post by winkeltripel » Thu, May 14, 2020, 11:47 AM UTC

adrianN wrote: post #650

marcus_holmes wrote: post #647

Earlier quoted context omitted.

Not really, because malicious actors don't care about their reputations, accounts, etc. A reputable developer has a reputation to maintain (by definition), which makes Google's threat to permaban them a threat indeed. A disreputable developer doesn't care about their reputation (again, by definition). They can create a new throwaway account every day and apply using the same (or slightly, easily, altered) code with d…

The point is making it more expensive for malicious actors. You can't make it impossible to get malicious extensions in, but you can make it harder. It's the same as captchas. You can also defeat captchas, but adding them reduces abuse a lot. As with captchas you're making it harder for good actors too. The difficult part is finding a good balance. Reputation can be bought too btw.

Except that in this case, it's misplaced, and causing benign actors far more pain than malicious actors. If they want to hurt malicious developers, they need to flag extensions as untrustworthy for:

1. age 2. dau 3. some rule around user reports of malice on uninstall?

and this gets a bright warning banner on the top of the page, and it can't be discovered through the chrome store until crossing these thresholds.

Re: Let's guess what Google requires in 14 days or they kill our extension

#727

Post by arsome » Thu, May 14, 2020, 11:48 AM UTC

cwyers wrote: post #656

ximeng wrote: post #587

Earlier quoted context omitted.

Invest in more open platforms. Not a great short term solution, but not many alternatives.

Microsoft threw in the towel, discontinued their web browser development and became a Chromium fork. How are these extension developers supposed to invest enough in platforms that complete with Chrome to succeed?

Their platform still does compete, it's a separate web store run by a separate entity and in fact for extension developers it makes ports even easier.

Re: Let's guess what Google requires in 14 days or they kill our extension

#728

Post by grishka » Thu, May 14, 2020, 11:52 AM UTC

jboydyhacker wrote: post #543

I think folks are drastically missing the forest for the trees here. This is just one minor example of the INSANE process that is now the Chrome Approval Process. I've seen extensions go for many months getting random rejections with no reason given. This forces developers to GUESS as to what is wrong. Want to try and develop according to a roadmap or timeline- forget about it. There is no "app store" approval proces…

Interestingly, the very same Google is somewhat different in Google Play. Whenever your app is rejected, they will specify why. Sometimes it's evident that there was a human involved — I once received one of my listing screenshots, with the part needing change circled. The thing is, sometimes those rejections are bogus. Then good luck getting to any humans to fix it if you don't know anyone from developer relations.

Re: Let's guess what Google requires in 14 days or they kill our extension

#729

Post by shkkmo » Thu, May 14, 2020, 11:54 AM UTC

Wowfunhappy wrote: post #719

saurik wrote: post #673

Earlier quoted context omitted.

I agree, and will go further in that I believe they actually should have such an obligation: it should be a consumer right to find out why you were denied access to a platform--or a restaurant, or a barber shop, or a wedding cake maker, or whatever else that someone is refusing you service due to, as a business operating in the public--and that whatever reason that is must be something that either 1) has nothing to d…

I was ready to get behind this line of reasoning, but then I thought about e.g. comment sections. Anyone who has moderated a forum will know that trolls find every possible way to walk right up to the line without technically crossing it. If you say "personal attacks aren't allowed", they'll say "I wasn't attacking him personally, I just suggested that anyone who says [the thing he said] should consider getting evalu…

> If you say "personal attacks aren't allowed", they'll say "but I wasn't attacking him personally, I just suggested that anyone who says [the thing he said] should consider getting evaluated by a doctor for mental retardation."

1) That pretty clearly qualifies as a personal attack

2) There is a significant difference between a forum and a business critical software distribution platform.

Re: Let's guess what Google requires in 14 days or they kill our extension

#730

Post by sdrinf » Thu, May 14, 2020, 11:56 AM UTC

_jal wrote: post #474

seanwilson wrote: post #84

For people focusing their comments on this particular extension + the permissions it asks for, please take a quick look at the numerous recent posts in the official forum for Chrome extension developers to see it's not an isolated issue: https://groups.google.com/a/chromium.org/forum/#!forum/chrom... It's a systematic issue that isn't specific to anything Pushbullet is doing and it's been like this before the pandemi…

The rule still applies: if you build your business on someone else's property, don't act surprised when they they casually destroy you. It has happened again and again and again. Building for FB or Google is you making yourself their serf, and you will be allowed to exist at their whim.

Except chrome isn't really a "property app" so much as a "proprietary OS"; it's the platform in which ~70% of desktop users spend >10 hours a day. This is different from eg Facebook, in that FB's valueprop is being "full stack" (content + controls + ads); while Chrome's design is open-ended -running other people's websites, with other people's extensions.

The other side of the issue is tough, though: Chrome extensions are regularly purchased & have ads embedded into them ( https://superuser.com/questions/1551266/how-to-track-down-wh... ), so Google's chrome extension team (couple of ~hundred person?) is essentially held accountable by ~1 billion users to the behavior of ~10s of thousands of extensions.