Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google to reject Chrome extensions outside of Chrome Web Store

techcrunch.com

Post reply on HN
Print view View original

41–50 of 71 posts

Re: Google to reject Chrome extensions outside of Chrome Web Store

#41

Post by jfoster »

Zikes wrote: post #10

There's a comment on the Chromium blog [1] (via magicalist's comment [2]) that nails this: if security is all they cared about, a signed certificate is all that's necessary. Knowing that option exists and persisting with their store-only approach means they must have an ulterior motive of some sort, most likely control and money. Ad blockers that target Google Ads will be no more, as well as anything else that the us…

Would a signed certificate approach allow them to deny extensions, or not? If yes, they could still deny ad blockers that way. If no, it is a weaker form of security than this is.

Re: Google to reject Chrome extensions outside of Chrome Web Store

#42

Post by Zikes »

jfoster wrote: post #41
Zikes wrote: post #10

There's a comment on the Chromium blog [1] (via magicalist's comment [2]) that nails this: if security is all they cared about, a signed certificate is all that's necessary. Knowing that option exists and persisting with their store-only approach means they must have an ulterior motive of some sort, most likely control and money. Ad blockers that target Google Ads will be no more, as well as anything else that the us…

Would a signed certificate approach allow them to deny extensions, or not? If yes, they could still deny ad blockers that way. If no, it is a weaker form of security than this is.

The alleged reasoning is to stop malware. A signed certificate must come from an authority willing to put their own reputation on the line, but Google does not need to be the only such authority.

Re: Google to reject Chrome extensions outside of Chrome Web Store

#43

Post by BrianEatWorld »

Does this really solve the problem?

I imagine most of these complaints come from people who pick up the extensions via bundling (not opting out of something when installing software). As those bundles run off of executables with admin privileges in Windows, the last change was circumvented simply by altering some files in the user's chrome directory and the registry. I imagine a similar tactic will defeat this measure. At least before the removal of the third party installation route, Chrome was able to control the messaging and generate warnings. These changes are simply pushing the malevolent even further underground.

Re: Google to reject Chrome extensions outside of Chrome Web Store

#45

Post by SudoNick »

taway2012 wrote: post #18

I am displeased by this change. Although the Firefox version of my extension is more work to develop, I will be pouring most of my resources into that in the future. I currently have a product that uses a Chrome extension to work. I am privately beta'ing it out by hosting it on my own website. Because I don't want to be killed with negative reviews of my unpolished first version in the Chrome store. Now I am forced t…

Snowden or no Snowden, a security focused developer wouldn't want someone else signing on their behalf or someone else controlling availability and updating. A security focused user wouldn't want to see that either.

Re: Google to reject Chrome extensions outside of Chrome Web Store

#46

Post by jfoster »

dustywusty wrote: post #17

Finding it very strange that this change is presented under the guise of safety, as there are absolutely very malicious extensions currently circulating on the Chrome Web Store.

They do seem to have very little policing of the Chrome Web Store. It's actually annoying to have an app on there that is legit, as so many of the top places in the store are taken up by unscrupulous rip-offs of Super Mario Bros and Sonic the Hedgehog. I could make some money too by putting classic games into a javascript emulator, plastering the page with ads, and submitting a few hundred apps (one for each game) to the Chrome Web Store. I'd rather play by the rules and have Google properly run their marketplace, though.

Re: Google to reject Chrome extensions outside of Chrome Web Store

#47

Post by throwaway2048 »

magicalist wrote: post #3

actual source instead of useless techcrunch filler: http://blog.chromium.org/2013/11/protecting-windows-users-fr... Wasn't this already largely the case? You have to manually download extensions and then drag them into the extensions manager to install them outside the store right now, don't you? The only change here seems to be that now you need a checked "Developer mode" box in order for that to work. I guess that…

the most obnoxious part about this is extensions will not update automatically or otherwise. you are forced unpack and drag in the extension for every change.

Re: Google to reject Chrome extensions outside of Chrome Web Store

#48

Post by throwaway2048 »

winslow wrote: post #44
JohnTHaller wrote: post #8

Let's start betting on when Google starts to squeeze ad blockers through feature changes or right out of the web store.

And Firefox will be there with open arms :)

Funded almost solely by Google.

Re: Google to reject Chrome extensions outside of Chrome Web Store

#49

Post by jfoster »

Zikes wrote: post #42
jfoster wrote: post #41

Earlier quoted context omitted.

Would a signed certificate approach allow them to deny extensions, or not? If yes, they could still deny ad blockers that way. If no, it is a weaker form of security than this is.

The alleged reasoning is to stop malware. A signed certificate must come from an authority willing to put their own reputation on the line, but Google does not need to be the only such authority.

So the extension being installed on some malicious site would have a popup talking about security certificates and such, and asking the user whether they want to proceed? You and I might think twice, but most users just click "Yes". Signed certificates would not be adequate to protect the average user.

Re: Google to reject Chrome extensions outside of Chrome Web Store

#50

Post by io45900 »

SudoNick wrote: post #20
zobzu wrote: post #15

Earlier quoted context omitted.

Firefox, Chromium.

I think Mozilla may be headed in the same direction. Add-on File Registration System: http://www.ghacks.net/2013/11/01/mozillas-add-file-registrat... Merging of AMO with Firefox Marketplace: http://www.ghacks.net/2013/10/26/thunderbird-seamonkey-kicke...

Firefox Marketplace is open source. It's based on Django and you can host your own. Source: https://github.com/mozilla/zamboni
Post reply on HN