Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google enforcing Web store only extensions for Chrome

sites.google.com

Post reply on HN
Print view View original

31–40 of 84 posts

Re: Google enforcing Web store only extensions for Chrome

#31

Post by 7952 »

mehrdada wrote: post #7

> Why couldn’t this problem be solved by having a setting/option to load extensions that are not hosted in the Chrome Web Store? Unlike modern mobile operating systems, Windows does not sandbox applications. Hence we wouldn’t be able to differentiate between a user opting in to this setting versus a malicious native app overriding the user’s setting. Sounds a bit BS to me. In what reasonable threat model the attacker…

One of the main selling points of Chrome apps was a belief that they are safer than native apps. But on a lot of computers now the vast majority of sensitive information is held in browser sessions, not in the My Documents folder. Running code in a sand-boxed browser session with full permissions could be far more profitable for an attacker than running arbitrary code on the OS. The only way to maintain security is to control access to the particular ecosystem within which data exists (in the way Facebook does). At the moment Google are trying to control an ecosystem that includes everything the user does, which is impossible to secure in its entirety.

Re: Google enforcing Web store only extensions for Chrome

#32

Post by higherpurpose »

mehrdada wrote: post #7

> Why couldn’t this problem be solved by having a setting/option to load extensions that are not hosted in the Chrome Web Store? Unlike modern mobile operating systems, Windows does not sandbox applications. Hence we wouldn’t be able to differentiate between a user opting in to this setting versus a malicious native app overriding the user’s setting. Sounds a bit BS to me. In what reasonable threat model the attacker…

Because it is BS. The drag and drop "security feature" for external extensions was more than enough to protect against the vast majority of "evil extensions" (which I believe was a small amount to begin with, and Google never even bothered to show us any numbers behind these "scary external extensions that are totally going to destroy the world if we don't do this", before they even implemented the drag and drop restriction).

Watch for their next step - getting rid of all Adblockers in the store. This has nothing to do with security, or rather very little to do with it. The real agenda is something entirely different (not letting the user to install whatever extensions he wants: Adblock, TPB unblockers, Hulu/Netflix unblockers, Youtube downloaders, and so on). MPAA didn't get on W3C's board for nothing, after all.

I've warned before this would happen, when MPAA joined the W3C. They're going to demand more features be removed from the browsers that they think "facilitate piracy", and Google is totally going to go along with it, because many of the requests benefit them, too, especially if they get something in return from that from the big studios and so on. Some just benefit them directly (removing Adblock).

Re: Google enforcing Web store only extensions for Chrome

#33

Post by d0 »

blueskin_ wrote: post #11
pixelcort wrote: post #6

I worry we are heading towards a day when all electronic devices are jailed, and you have to jump through hoops to own and use "development" devices. It's like we're taking away pens and pencils, since they can be used to mess up books, instead of teaching more people how to write.

Google, Apple and MS, sure, but that's just Linux's gain. Yes, the "Year Of The Linux Desktop" joke is as funny as ever, but I definitely foresee a split in computing into passive consumers with no idea how things work and hackers who need full access to the things they own and want to experiment, learn and create.

I'm not sure Apple and Microsoft fit that bill yet. They divide their empires into three separate concerns: walled garden consumer devices (phones, tablets), open enterprise/desktop and media. it's pretty easy to get into the internals of OSX and Windows still. In fact it's been made easier over the years.

I can still push apps to our customers on Windows and Mac desktops like I could in 1993.

Google on the other hand are pushing for everything being behind a web portal under strict control. All devices they promote ship apps which integrate with that ecosystem as lightweight app front ends and nothing else. Doing stuff whilst not connected to google is becoming increasingly difficult. The rate of change is also pretty extreme meaning that you have to work damn hard to keep up with things.

Linux (and FreeBSD possibly!) will never hit the desktop hard but we're not short of learning solutions whilst I can type csc at any windows command prompt and python at any OSX terminal and get somewhere. ChromeOS - not such a good picture.

Re: Google enforcing Web store only extensions for Chrome

#34

Post by d0 »

pixelcort wrote: post #6

I worry we are heading towards a day when all electronic devices are jailed, and you have to jump through hoops to own and use "development" devices. It's like we're taking away pens and pencils, since they can be used to mess up books, instead of teaching more people how to write.

I'm ok with this as long as there is always an alternative to retreat to if we need to. Even if it means throwing all my consumer electronics in the street.

Re: Google enforcing Web store only extensions for Chrome

#35

Post by xtracto »

simias wrote: post #5
coloncapitald wrote: post #2

If you want to keep any extensions that you didn't install from Web Store, use the dev channel[1] of Chrome and they will work just fine. I use an extension and they warned me one month back to either install their Web Store version will fewer functionality or move to dev channel. [1] http://www.chromium.org/getting-involved/dev-channel

Why don't they simply give me a config flag to change the behaviour? I understand what they are trying to do but it annoys me to have to use non-stable releases just so that I can use a couple of useful extensions not available from the store.

Nothing that OllyDBG and a free weekend cannot fix ;)

When/If this affects me, it will be an entertaining challenge to create a crack which disables the "allowed to install?" instruction. Seems quite simple.

Re: Google enforcing Web store only extensions for Chrome

#36

Post by userbinator »

pixelcort wrote: post #6

I worry we are heading towards a day when all electronic devices are jailed, and you have to jump through hoops to own and use "development" devices. It's like we're taking away pens and pencils, since they can be used to mess up books, instead of teaching more people how to write.

I agree completely. I feel the trend of excessive "security" and hiding things from the user "because it will confuse them", removing options because they "might cause irritation", "could be insecure if misused", etc. has gone too far. Modern devices are so locked-down and "polished" to the point that it makes it much harder for users to discover how they work, should they choose to, and takes away a lot of the incentive of doing so.

Contrast this with the early days of UNIX where every system came with its source code, plus compiler and assembler, so it was very easy for users to become developers. Even DOS and 32-bit versions of Windows came with (not sure if they removed it now, but it's there in XP at least) a rather primitive but still "empowering" debugger, DEBUG, where you could write short programs in assembly language. I remember PC magazines came with listings of these programs --- they weren't particularly complex, (usually a few hundred bytes at most), but they did something useful and also make way for the more inquisitive users (like me) to wonder what all the instructions actually do, and what happens if you change them, and that's what can really motivate people from becoming just users to learning about programming and how computers work.

Now, you have to be really motivated to jump through all the hoops in place to make it much harder for anyone to just write some short and useful piece of code and share it in a form that everyone else can use. Even browsers are becoming like this. It's sad that the IMHO bureaucratic measures like code signing, overly protective OS policies, and near-paranoid antivirus/security software just get in the way of this process. They say it's all "for your protection", but if you think about it, one of the most secure places to live is in a prison. Is that really what society should be heading towards?

"Freedom is not worth having if it does not include the freedom to make mistakes."

Re: Google enforcing Web store only extensions for Chrome

#37

Post by captainmuon »

derefr wrote: post #17
est wrote: post #8

Earlier quoted context omitted.

> solved by having a setting/option to load extensions that are not hosted in the Chrome Web Store It is the current solution. Unzip, go to extensions, enable developer mode, load extension. Which IMHO is much more dangerous than downloading crx

It's a lot more of a hassle, though, to ask users to keep an extracted directory sitting around which Chrome basically symbolically links to, than to just download a .crx, drop it on the extensions window, and then delete that .crx. Even I still get confused sometimes, as a chrome-app developer, when I move a project folder and Chrome suddenly can't find my extension. It goes against how we think of "deploying to tes…

Right, so thats why .exe installers for extensions will now be popping up, which is not exactly better security-wise.

Re: Google enforcing Web store only extensions for Chrome

#38

Post by nivla »

xtracto wrote: post #35
simias wrote: post #5

Earlier quoted context omitted.

Why don't they simply give me a config flag to change the behaviour? I understand what they are trying to do but it annoys me to have to use non-stable releases just so that I can use a couple of useful extensions not available from the store.

Nothing that OllyDBG and a free weekend cannot fix ;) When/If this affects me, it will be an entertaining challenge to create a crack which disables the "allowed to install?" instruction. Seems quite simple.

Until it auto-updates in a few days and breaks your crack.

Re: Google enforcing Web store only extensions for Chrome

#39

Post by captainmuon »

jrockway wrote: post #27
blueskin_ wrote: post #12

Yet again Google try to prevent users from gaining the same hacker mentality that created Google in the first place.

I doubt this is the reason. The reason is that less-educated users are being tricked into installing extensions they don't want and that make using their computer miserable for them. Meanwhile, anyone that wants to write their own extension need only click a checkbox.

But how does this protect against bad extensions? I mean they are installed along other programs as AdWare anyway, can't they just install themselves in developer or enterpise mode?

Re: Google enforcing Web store only extensions for Chrome

#40

Post by simias »

coloncapitald wrote: post #25
simias wrote: post #5

Earlier quoted context omitted.

Why don't they simply give me a config flag to change the behaviour? I understand what they are trying to do but it annoys me to have to use non-stable releases just so that I can use a couple of useful extensions not available from the store.

I'm curious. Which useful extensions are you talking about and why are they not listed in webstore? The one extension that I mentioned has two versions. The non-webstore version doesn't abide to Google's T&C [lets you download Youtube videos].

Some devs don't bother to put their extensions in the store, for instance this extension to play music files embedded in image files on 4chan: http://dnsev.github.io/4cs/

I doubt it violates any T&C but I could be wrong.

Post reply on HN