Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Chrome Extension Is Safe

blog.pushbullet.com

Post reply on HN
Print view View original

151–160 of 206 posts

Re: Our Chrome Extension Is Safe

#151

Post by ulises314 »

Just a couple of loose thoughts on this:

-The permissions that pushbullet needed originally where a bit overaching.

-We never knew which was the offending one.

-Reading the original article it crossed my mind that some of the permissions the extension asked could be used for marketing (I'm not implying that they were used for that), and maybe google just didn't wanted extension developers to have a cut on that.

-I really don't like how this marketplaces have made big companies gatekeepers for market share.

Re: Our Chrome Extension Is Safe

#152

Post by tyingq »

rapind wrote: post #93
oefrha wrote: post #45

Earlier quoted context omitted.

It’s not insane to have a *://*/* permission, since things like generic content blockers have to be able to modify any page (you definitely need to take great care when installing these extensions, which unfortunately most users aren’t equipped to assess, which is why extension security is such a headache and stringent review is welcome). On the other hand, this particular extension requesting this access just becaus…

I think it's better to implement content blocking outside of the browser (especially considering it's not in the interest of the most popular browser's backing company) and eliminate these types of permissions completely! I.e. Wireguard + DNS adblocker (or w/e you want to block). Not only does it perform better but you aren't leaking data to third-parties, who even if they are noble could be acquired by a less noble…

It's not unlike malware analysis. Heuristics make it better, and you need to be in the DOM for that. There's also handy things like "right click to block".

Re: Our Chrome Extension Is Safe

#153

Post by m463 »

gowld wrote: post #131
graham_paul wrote: post #70

Earlier quoted context omitted.

Maybe just maybe, you will consider Firefox. 1. Same or better performance 2. Open source for real not just (pretending to be) Open Source 3. More transparent process 4. No business conflicts Support Firefox if you care about the open web

Does Firefox have the useful extensions that Chrome has? Are they as safe or safer?

chrome purposefully breaks some privacy oriented extensions.

Re: Our Chrome Extension Is Safe

#154

Post by AgentME »

danShumway wrote: post #87
ocdtrekkie wrote: post #41

Earlier quoted context omitted.

It's worth noting that the Chrome Web Store is currently full of malware and most malware I see on PCs was installed via the Chrome Web Store. By design, HTTPS does not protect your privacy at all if you have extensions that violate it, since they see what you see after TLS termination. So this is a huge deal, Google is already bad at it, but I can't fault them for heavily restricting extension install: Currently the…

This is still something of a problem of Chrome's own creation though. The reason Chrome can't be much, much more restrictive about what extensions get placed in the store is because there is no alternative. The less important your store is, the more exclusive (and safer) it can be. Look at Linux with package managers like AUR. If a package isn't included in the official Arch repos, I generally don't mind. I can go in…

I don't think their priority is making a specific area where users are free from malware; they're trying to make it hard for malware overall to integrate with Chrome. Adding a supported path for software to integrate with Chrome (allowing extensions not through the store) where they can't block malware would be giving up on that goal.

Re: Our Chrome Extension Is Safe

#155

Post by ehsankia »

zmmmmm wrote: post #141
ehsankia wrote: post #122

Earlier quoted context omitted.

You do realize that the original Pushbullet issue arose from Google trying to be even more strict and reduce the amount of malware, right? And even with all that, as you mention, CWS is still full of malware. What hope does any other store then have to create a malware free web store if even Google can't? And if they allow installation from anywhere, do you realize that whatever state we are in now, it would be order…

> What hope does any other store then have to create a malware free web store if even Google can't? I think you're giving Google too much credit here. For years nearly every single extension, no matter how targeted the purpose, has told me "This extension will have access to all your data on all your web pages". It is such a no brainer to do a little better than that but they tolerated it for years. In a few cases I…

Just because they had a more lax approach in the past doesn't mean they aren't working hard to regain control now. And either way, none of that addresses the issue where expanding control would only make the malware issue worse, not better.

Re: Our Chrome Extension Is Safe

#157

Post by archon810 »

kinlan wrote: post #91
on_and_off wrote: post #72

Earlier quoted context omitted.

If it works the same way as the play store does, the DA has little to do with that. A play store advocate can not look up why your app got rejected, they can at most ask their play store colleagues to look it up and to contact the app owner. It is this way to avoid getting in a situation where being friends with a DA is an huge advantage. Their job is to collect dev feedback, as well as evangelizing good practices. A…

As the lead of that Devrel team, this is pretty much spot on. The process for these things is out of our hands (prevents abuse etc). There is a lot of things we can improve about the Chrome Web Store processes, not to mention a lot of other areas across Chrome.

And yet this single DA is the one who's able to request an appeal with undoubtedly more weight than the developer.

https://twitter.com/DotProto/status/1261325118774493190

Re: Our Chrome Extension Is Safe

#158

Post by userbinator »

theandrewbailey wrote: post #6
DrJaws wrote: post #2

They could also tell what was wrong to the customers. Also, I laugh about the google promise of being more open. Every single time they screw it and goes viral, they promise the same until 6 months later when another business is screwed again. Call it having your mail shut down, your cloud, app deleted on the play store, the extension on chrome, etc etc. We've already heard that story dozens of times.

A Google reviewer can select one of three canned responses to tell a developer what's wrong. https://www.blog.google/products/gmail/save-time-with-smart-... Oh, you wanted an artisanal hand-crafted response unique to each individual situation? That's not scalable!

I abhor such... dehumanising (for lack of better term) "features" whose advertised benefit is saving time, but has a subtle effect of gradually delegating decisionmaking to someone or something else --- whose goals may not be in your best interests.

Every time you "didn't have to think" is a time when someone else did the thinking for you. Take that too far and there is no you left in your life.

Re: Our Chrome Extension Is Safe

#159

Post by jaggederest »

juped wrote: post #127

Wow, they used the "complaining online and getting enough upvotes" support channel. It should not reflect well on companies when they fix things that come to their attention this way.

I almost want to start a customer service pledge that says "We won't do anything special based on social media unless it retroactively takes into account other customers, and involves process changes that would resolve the problem in the future."

Then at least they would be internally consistent about things like this. Too many Google products have "support by public outrage".

Re: Our Chrome Extension Is Safe

#160

Post by ajayyy »

Avamander wrote: post #149
aasasd wrote: post #146

Earlier quoted context omitted.

> However Chromium is open source and it's still impossible to do so. I don't know if it's true that the official Chromium or Chrome don't allow sideloading at all—but the rather popular ‘Ungoogled Chromium’ build certainly does (in fact, it probably still doesn't work with the web store directly): https://ungoogled-software.github.io/ungoogled-chromium-bina... However, the security of these builds may be questionabl…

You can absolutely load unpacked extensions on Chrome, it's just not as convenient.

Previously, you could load self-signed crx files as well. This doesn't require developer mode.

This was removed around a year ago.

Post reply on HN