Our Chrome Extension Is Safe • Hacker News Board

Re: Our Chrome Extension Is Safe

#101

Post by graham_paul » Fri, May 15, 2020, 7:19 PM UTC

coolspot wrote: post #92

graham_paul wrote: post #77

As a Firefox fan, I really hope it happens again and again. It's good for the web as a whole when Chrome fails and Firefox doesn't. As a technical person, you should be advocating the use of (real, community owned) open source browsers not just whatever the majority uses. I feel that Google's monopoly on the browser market for desktops will be more and more endangered as they (for legitimate business reasons) refuse…

1) Chromium is open-source as well. 2) Like 90% of Mozilla revenue comes from contract with Google. 3) Not sure what community-owned means here, but one could submit useful patch to both Chromium and Mozilla teams and have it accepted into main codebase. 4) Decisions for both products are not made by a community, but by internal full-time employees who are subordinates of CEO. Mozilla CEO knows the company absolutely…

1. No, it is not. Chromium relies on binaries as well as calling Google's web services whose code you cannot read. That is why ungoogled-chromium is a thing

2. Not sure what your point is here. Mozilla needs to make money to maintain and improve its advocacy work

3. See point 1. You don't own or control Google's web services nor its domains therefore you have no full control of the build process if Google decides to shut down its services. If you want to see what community owned means, I suggest you look at the Python community. No hidden binaries or mysterious calls to corporate web services

4. Google's goal is to make money, Mozilla is to keep an open web. Obviously, Google has potential business conflicts while Mozilla doesn't, Mozilla wins even if it dies as long as the web is kept open, Google wins if it makes money full stop

You simply cannot compare them. Just look at Chrome in a fully Google-owned environment (Android), it does not even have extensions.

Re: Our Chrome Extension Is Safe

#102

Post by oefrha » Fri, May 15, 2020, 7:20 PM UTC

rapind wrote: post #93

oefrha wrote: post #45

Earlier quoted context omitted.

It’s not insane to have a *://*/* permission, since things like generic content blockers have to be able to modify any page (you definitely need to take great care when installing these extensions, which unfortunately most users aren’t equipped to assess, which is why extension security is such a headache and stringent review is welcome). On the other hand, this particular extension requesting this access just becaus…

I think it's better to implement content blocking outside of the browser (especially considering it's not in the interest of the most popular browser's backing company) and eliminate these types of permissions completely! I.e. Wireguard + DNS adblocker (or w/e you want to block). Not only does it perform better but you aren't leaking data to third-parties, who even if they are noble could be acquired by a less noble…

DNS filtering is a very crude form of content blocking. It’s a supplement, not a replacement. Have a look at uMatrix for an example of heavy machinery. See also CSS-based blockers like Shut Up (or mixed blockers like ABP that include CSS-based rules), which are completely impossible on the network layer.

Also, content blocking is just one example. There are other legit use cases of the all sites permission: Tampermonkey, Stylus, password managers, any kind of web clipper, trivial things like Don’t Fuck with Paste, auto refresh, user agent switcher, etc. The list is endless.

Re: Our Chrome Extension Is Safe

#103

Post by renewiltord » Fri, May 15, 2020, 7:21 PM UTC

pgrote wrote: post #80

benatkin wrote: post #44

Earlier quoted context omitted.

I'd like to know what the number of users that directly used Pushbullet in the last day (or week, or month) over the number of users that have the Android app installed is. If they have it installed, everything they copy to the clipboard on Android is being sent to their servers, is it not? That puts them in the same category as Yahoo! Toolbar for me. At one time Yahoo! Toolbar was useful for a significant percentage…

I am a premium pushbullet user and have it on my android phone. It is the only reliable solution to handle texting and notification from the Windows or Chromebook desktop I have come across. I've never thought about the information they capture or keep, but I do know photos sent through text are kept on https://dl3.pushbulletusercontent.com for a certain period of time. I don't know how long.

You don’t use messages.android.com?

Re: Our Chrome Extension Is Safe

#104

Post by craftinator » Fri, May 15, 2020, 7:25 PM UTC

RHSeeger wrote: post #7

> All of that attention resulted in our issue being resolved. This is good for us. It is not yet clear if the attention will help other developers that are struggling with similar vague rejections. I think it's been made abundantly clear that Google will not, in fact, improve anything from experiences like this. They happen over and over and every single time it's the same; if it gets publicity, someone helps resolve…

Google has effectively crowdsourced both developer support/restitution and extension filtering for chrome.

Instead of paying people to answer emails for developer support, they pay a small number of people to monitor social media sites for complaints that reach some threshold of outrage/publicity.

Way less hassle to let the public solve their problems.

Re: Our Chrome Extension Is Safe

#105

Post by fouric » Fri, May 15, 2020, 7:33 PM UTC

Who's keeping a list of all of the times that Google has shut down someone's Adwords/YouTube/Gmail/Play Store account / rejected their app / something else without any communication (this doesn't count as communication, as communication has to convey information) or apparent cause? Bonus points for finding the correlation between an article being linked to on Hacker News and the problem being resolved.

Re: Our Chrome Extension Is Safe

#106

Post by fouric » Fri, May 15, 2020, 7:39 PM UTC

rosywoozlechan wrote: post #11

I imagine the value that Google gets from chrome extensions is a small fraction of what they would get from Android apps. They're not going to be able to spend millions of dollars to fund better human moderators and tools for the extension reviews when a typical extension brings what, a few cents for Google? They probably can't justify the resources to do the sort of specific feedback that would make this process muc…

I think that you're assuming that the number of apps that can be reviewed by a human remains constant over time.

If Google hires programmers to do the review process, they can identify patterns, develop new techniques, and build tools to accelerate the process.

Additionally, I bet that they're expecting the value of the Chrome store to increase over time, which compounds on the effect above.

Re: Our Chrome Extension Is Safe

#107

Post by seanwilson » Fri, May 15, 2020, 7:39 PM UTC

Until Google gives us a roadmap with what they're going to change about the review process and when, I'm not hopeful right now. I don't understand why they need to be this opaque about it if they want a healthy developer ecosystem.

It's currently expected behaviour that extension updates from developers can take up to 3 weeks to be reviewed and go live (same as before the pandemic):

https://developer.chrome.com/webstore/faq

> "If your item's status says "pending review" for more than three weeks, you should contact support."

Is it going to change? When? See here for all the developers waiting over 3 weeks for their updates to go live (that's not including what happens when they don't pass review):

https://groups.google.com/a/chromium.org/forum/#!topic/chrom...

All we seem to get back from the few people on the Chrome extension team that communicate with extension developers is along the lines of "I understand your concerns, I want it to change as well, and I'll talk to the team".

It's like the person from Google is talking about getting in touch with a team that work for entirely different company, as if what the team can't be influenced.

Who's the one making the actual decisions and why don't they talk to us directly?

Re: Our Chrome Extension Is Safe

#108

Post by 7ewis » Fri, May 15, 2020, 7:49 PM UTC

renewiltord wrote: post #99

7ewis wrote: post #94

Earlier quoted context omitted.

Funnily enough, I was actually trying to figure this out today. I created a very basic Extension, to modify the new tab page (as it's something you can't set in G Suite the way we'd like it). I wanted to deploy it our G Suite users, and saw there was an option to deploy via a URL. So I packaged it up in Chrome, put the .crx in an public S3 bucket and set it to force install. Unfortunately it did nothing... is this no…

You can’t have your users “Load Unpacked...”? That always works for me.

For testing sure, but this needs to go to just over 1000 people.

The only example I can find online on deploying via URL is this:

https://support.securly.com/hc/en-us/articles/360036540753-H...

Can't see many official docs on it at all.

Now I've gone the Developer route I can see you can create internal apps without having to get them approved so think that's my best option now.

Re: Our Chrome Extension Is Safe

#109

Post by notriddle » Fri, May 15, 2020, 7:51 PM UTC

graham_paul wrote: post #77

As a Firefox fan, I really hope it happens again and again. It's good for the web as a whole when Chrome fails and Firefox doesn't. As a technical person, you should be advocating the use of (real, community owned) open source browsers not just whatever the majority uses. I feel that Google's monopoly on the browser market for desktops will be more and more endangered as they (for legitimate business reasons) refuse…

Firefox has gotten plenty of flack from extension authors. So have Apple and Microsoft.

The widespread failure of every major app store makes me skeptical that Google is going to improve. It's a good sign that it isn't possible, but even if it is, it's not going to happen unless a competitor forces it.

Re: Our Chrome Extension Is Safe

#110

Post by bovine3dom » Fri, May 15, 2020, 7:54 PM UTC

jiveturkey wrote: post #71

oefrha wrote: post #24

Earlier quoted context omitted.

> I understand that the Chrome extension store is free Pretty sure it’s not free, I had to pay a nominal $5 fee ages ago, and looks like that hasn’t changed. https://developer.chrome.com/webstore/publish#pay-the-develo... Even found a recent news article reporting that now you need to pay the fee immediately on signup as opposed to when you publish the first extension/app. https://9to5google.com/2020/03/12/chrome-web…

If you don't have $5, how do you have the resources to develop an extension?

I have $5 but on principle I don't want to give it to Google so that I can make their web browser better.

That with the horror stories about the review process has stopped me from publishing an extension for Chrome.

Edit: there was a nice article on HN last week about how relationships change once you start to have a monetary exchange, which I think suggests I wouldn't be the only one to be irrational about it [1].

[1]: https://news.ycombinator.com/item?id=23104875