Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's guess what Google requires in 14 days or they kill our extension

blog.pushbullet.com

Post reply on HN
Print view View original

801–810 of 811 posts

Re: Let's guess what Google requires in 14 days or they kill our extension

#801

Post by LorenPechtel »

awill88 wrote: post #670
geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

Hit it right on the head. The localhost thing and coupled with the http thing make me cringe. And to know they went from https://* to just one domain, yikes indeed. Then they left localhost. Hell, that probably made the case worker’s knee jerk even harder because of such a dramatic change, I can’t imagine they spend much time on each case. Yes, 14 days is not a lot of time, but this is the ecosystem that needs to cha…

Yeah, it sounds like they were working on a "it works, ship it" approach. That's not good enough when there are security implications to what you're doing.

Re: Let's guess what Google requires in 14 days or they kill our extension

#802

Post by LorenPechtel »

IG_Semmelweiss wrote: post #555
geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

I agree. This is hackernews, so it is easy why devs would feel otherwise, but as a nondev, I represent the the end users. Why would anyone think it is appropriate for google to reveal their hand, and allow blackhat operators to build apps up to the max limit of permissions? (If they were revealed by google via white glove customer service). If goog did provide guidance on permissions, goog would literally have to aud…

As a developer I had the same thought. Revealing the rules tells them what they can get away with.

Re: Let's guess what Google requires in 14 days or they kill our extension

#803

Post by laughinghan »

icer2312 wrote: post #676
laughinghan wrote: post #612

Earlier quoted context omitted.

> If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones. This makes no sense. For the sake of the grandmas, Google already needs to audit every app in the store and separate bad actors from good ones. How in the world would making it more clear how to write more secure extensions possibly worsen the extension…

> How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem? Unfortunately, information that helps the good guys get their extensions past the audit check is exactly the same information that helps the bad guys get their extensions in too. The bad guys simply move onto the next security flaw that Google hasn't anticipated. Maybe the bad guys…

Unfortunately, information that helps the good guys get their extensions past the audit check is exactly the same information that helps the bad guys get their extensions in too.

This is just an assertion I'm wrong. It can't possibly persuade me or the people upvoting me. Would you be persuaded by me just asserting you're wrong?

In terms of Google already auditing every app, [e.g.] the source code for Dark Reader [is] fairly complex.

Firstly, Apple is able to do it, there's no reason to make excuses for Google. See anecdotes elsewhere in the thread about how Apple attaches screengrabs, explains rejections by phone conversation, even decompiles apps to point to exact methods/lines of code in apps they reject from the iOS App Store, even small free ones: https://news.ycombinator.com/item?id=23170498

And anyway, without reading a single line of Dark Reader's source code, I can deduce plenty of permissions it shouldn't need, e.g. "cookies" (which it doesn't ask for). Without reading a single line of PushBullet's source code, one can easily deduce it shouldn't need access to "https://*/*", and indeed, it doesn't, yet it asked for it.

Can you explain concretely (not just by pointing to unnamed "no-no's") how could harmful side-effects result from Google telling PushBullet that "https://*/*" specifically was in violation?

If you release a list of known no-no's, the bad guys just get smarter and avoid them.

Firstly, isn't bad guys avoiding no-no's exactly what we want?

If you're saying that there may be some, probabilistic red flags that Google uses to find possible bad guys—sure, that could be true, I have no idea and you don't either, you admitted it was speculation. But in this case, "Request access to the narrowest permissions necessary to implement your product’s features or services." is not a probabilistic red flag, it's a hard rule.

Again, concretely how could harmful side-effects result from Google pointing out the specific violation?

Re: Let's guess what Google requires in 14 days or they kill our extension

#804

Post by Florin_Andrei »

PopeDotNinja wrote: post #580
Florin_Andrei wrote: post #193

Earlier quoted context omitted.

> No idea what’s going on at Google. It's like trying to troubleshoot a machine learning algorithm.

Now that you mention it, it does sound like an adversarial network!

No, you're the adversarial network!

/joke

Re: Let's guess what Google requires in 14 days or they kill our extension

#805

Post by seph-reed »

krallja wrote: post #743
tornato7 wrote: post #634

Earlier quoted context omitted.

What should I use for search? I tried switching to DDG for a month but I kept finding myself manually typing in Google.com to make the more obscure searches.

Well, quit typing google.com, for one. Use DDG’s !g feature. Or !sp, which is like Google results without the Google frontend. https://duckduckgo.com/bang

Couldn't find !sp. What is it?

Re: Let's guess what Google requires in 14 days or they kill our extension

#806

Post by znpy »

tams wrote: post #740
znpy wrote: post #735

Earlier quoted context omitted.

the free tier is for that, isn't it ?

You don't get much in terms of performance and capacity in the free tier preventing you from testing anything beyond the tiniest workloads. If you need to pre-arrange expenses with the finance department, it's much faster to test drive with credits.

ah, i see. in that case i think it's okay that you should pay.

its not like ice cream.

if you messaged random people it's quite reasonable that they didn't bother answering you. i wouldn't have done it either.

you should get in contact with sales people via the proper channels and arrange testing (whether paid or not) with them.

If you message random "people that work at gcp" then "not caring" is probably one of the most polite things they could do.

Re: Let's guess what Google requires in 14 days or they kill our extension

#807

Post by Too »

I haven't used Pushbullet in depth but on first glance it doesn't seem like a browser extension at all. It looks more like a standalone chat app that happens to be running in the browser. It has nothing to do with enhancing the browsing experience, except for a share-link feature?

Google might not want to make Chrome the browser into an OS.

If i were Google i would also be skeptical when such standalone apps wants to read my browser cookies or access my http://localhost. Actually i think cookies is the violating permission here.

Re: Let's guess what Google requires in 14 days or they kill our extension

#808

Post by labawi »

IG_Semmelweiss wrote: post #558
bentcorner wrote: post #544

Earlier quoted context omitted.

Couldn't malware authors start from the other direction? Create a no-op extension with no permissions and gradually add things until it's no longer approved.

No. This gets you banned.

Malware authors can register a dozen or thousand throwaway accounts (probably not super easy but not hard either).

It's the honest developers that get their meaningful accounts banned.

Re: Let's guess what Google requires in 14 days or they kill our extension

#809

Post by krallja »

seph-reed wrote: post #805
krallja wrote: post #743

Earlier quoted context omitted.

Well, quit typing google.com, for one. Use DDG’s !g feature. Or !sp, which is like Google results without the Google frontend. https://duckduckgo.com/bang

Couldn't find !sp. What is it?

StartPage

Re: Let's guess what Google requires in 14 days or they kill our extension

#810

Post by rogem002 »

throwawayext wrote: post #79

Different extension developer here. The Chrome Extension store ecosystem has become a nightmare for developers over the past year. Some items: - Extension review times have gone from 1 hour to a variable amount of time ranging from 1 minute to 3 weeks or longer (try to plan a release or spot fix an issue when you have no idea how long it will take for a deploy to reach users) - User reviews of extensions have been di…

I removed my Chrome Extension from the store in February. It was averaging about £30 per a month in sales and the cost of keeping up-to-date with the changes in Chrome/the extension store seemed hardly worth it.

The thing which really pushed me over the edge was their new developer dashboard, it was a step in the right direction but what missing some key features which were present in the old dashboard. Googles solution? Make us use both dashboards for almost a year.

Post reply on HN