Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Chrome Extension Is Safe

blog.pushbullet.com

Post reply on HN
Print view View original

41–50 of 206 posts

Re: Our Chrome Extension Is Safe

#41

Post by ocdtrekkie »

_fat_santa wrote: post #25

You know this wouldn't be so much of an issue if Chrome didn't disable the ability to install extensions outside of the web store. As an extension developer its absolutely infuriating to realize that: 1. There is no way to install extensions outside the web store 2. Google won't approve anything to the web store. 3. The vast majority of people use Chrome vs other browsers. ------ I get it, Chrome is Google's browser…

It's worth noting that the Chrome Web Store is currently full of malware and most malware I see on PCs was installed via the Chrome Web Store. By design, HTTPS does not protect your privacy at all if you have extensions that violate it, since they see what you see after TLS termination.

So this is a huge deal, Google is already bad at it, but I can't fault them for heavily restricting extension install: Currently they are way too lax.

Re: Our Chrome Extension Is Safe

#42

Post by csours »

rapind wrote: post #35
RHSeeger wrote: post #7

> All of that attention resulted in our issue being resolved. This is good for us. It is not yet clear if the attention will help other developers that are struggling with similar vague rejections. I think it's been made abundantly clear that Google will not, in fact, improve anything from experiences like this. They happen over and over and every single time it's the same; if it gets publicity, someone helps resolve…

The end result being a far less permissive extension. The permissions they required were insane but our entire focus is on Google's customer service. Now that we all agree that Google's process sucks, can we talk about how insane it is to even have this level or permissions available for request in the first place?

Google owns that side of it too. If Google thinks you are over-reaching in your access to permissions, they can simply choose not to provide access to the resources behind those permissions.

Re: Our Chrome Extension Is Safe

#43

Post by archon810 »

RHSeeger wrote: post #7

> All of that attention resulted in our issue being resolved. This is good for us. It is not yet clear if the attention will help other developers that are struggling with similar vague rejections. I think it's been made abundantly clear that Google will not, in fact, improve anything from experiences like this. They happen over and over and every single time it's the same; if it gets publicity, someone helps resolve…

Have a look at this https://twitter.com/ArtemR/status/1261159338170658816 and the surrounding discussion.

This is basically the only person at Google who can make things happen if there's a problem with Chrome extensions.

Re: Our Chrome Extension Is Safe

#44

Post by benatkin »

wpietri wrote: post #38
benatkin wrote: post #14

I don't think this is proper use of Chrome extensions, and it hearkens back to the days of search toolbars, like the Ask and Yahoo toolbars being installed by Java. https://www.pcworld.com/article/2940688/java-installer-ditch... As a user I want my browser's extension support to be more like Visual Studio Code's than like Atom's. Visual Studio Code has fine grained permissions, and prevents extensions from going thro…

As a Pushbullet user, I think the two cases are nothing alike. Pushbullet is doing things for me. The toolbar plague was about getting access to do things to you. Should Pushbullet be using the minimum set of permissions for that? Sure. Could there be better permission models, ones that make sure Pushbullet doesn't do anything naughty? Possibly! But neither of those justifies a blanket ban.

I'd like to know what the number of users that directly used Pushbullet in the last day (or week, or month) over the number of users that have the Android app installed is. If they have it installed, everything they copy to the clipboard on Android is being sent to their servers, is it not? That puts them in the same category as Yahoo! Toolbar for me.

At one time Yahoo! Toolbar was useful for a significant percentage of its users, because it would let them know how many email messages they have, as well as give them convenient access to the news and weather - so I disagree that it did nothing for its users.

Edit: I took a look at https://blog.pushbullet.com/2014/08/20/introducing-universal... - it appears it was doing that at one time, but currently it may only be doing that for premium users, who would conceivably be likely enough to get good use the feature that it would justify the potential security risk.

Re: Our Chrome Extension Is Safe

#45

Post by oefrha »

rapind wrote: post #35
RHSeeger wrote: post #7

> All of that attention resulted in our issue being resolved. This is good for us. It is not yet clear if the attention will help other developers that are struggling with similar vague rejections. I think it's been made abundantly clear that Google will not, in fact, improve anything from experiences like this. They happen over and over and every single time it's the same; if it gets publicity, someone helps resolve…

The end result being a far less permissive extension. The permissions they required were insane but our entire focus is on Google's customer service. Now that we all agree that Google's process sucks, can we talk about how insane it is to even have this level or permissions available for request in the first place?

It’s not insane to have a

  *://*/*
permission, since things like generic content blockers have to be able to modify any page (you definitely need to take great care when installing these extensions, which unfortunately most users aren’t equipped to assess, which is why extension security is such a headache and stringent review is welcome).

On the other hand, this particular extension requesting this access just because they weren’t told not to is more of a wtf.

Re: Our Chrome Extension Is Safe

#46

Post by robotnikman »

rosywoozlechan wrote: post #11

I imagine the value that Google gets from chrome extensions is a small fraction of what they would get from Android apps. They're not going to be able to spend millions of dollars to fund better human moderators and tools for the extension reviews when a typical extension brings what, a few cents for Google? They probably can't justify the resources to do the sort of specific feedback that would make this process muc…

Even Android App developers face the same thing. When they upload their app to the app store some bot looks at it, and can reject it for whatever reason and only provide a vague explanation. I've seen stories on /r/androiddev of developers apps getting rejected for uncertain reasons, or even having their whole account entirely banned. Unless you are a massive company like Netflix or Spotify you will have not way of contacting a human for support.

I've thought of messing around with developing an Android app and uploading it to the app store just to gain some experience and try something different, but the fact that my whole google account could be banned just because a bot thought my app was bad for whatever reason is scary.

Re: Our Chrome Extension Is Safe

#47

Post by kube-system »

asdf21 wrote: post #13
schoolornot wrote: post #9

Can someone from Google use a throwaway to explain why the hell their support is garbage. From the Chrome store, to G-Suite, to Pixel Support. It's just awful.

Always has been for 10+ years now. As a former Call Center Director, it's pretty amazing to me how much bad-will these massive companies are willing to foment by not running their support correctly. It's not that hard / expensive guys... you can hire great support employees for $20 / hour all across America.

It's much more expensive than not having it.

Back of the napkin math for 1 billion users and a 1:100 support staff ratio comes out to around 5.8 billion dollars/yr.

Re: Our Chrome Extension Is Safe

#48

Post by ocdtrekkie »

I actually had a similar experience with Google Ads: A site was flagged for malware, no explanation what they had found, once I got answers out of them, days later, I found where a non-resolving but probably former malicious link ended up on the site. I purged it, cleared the CDN, asked for review, and was quickly rejected because I allegedly hadn't removed the malicious link.

I asked them to show me where they still found it... and they then realized it was indeed gone, rejecting my re-review was incorrect, and reenabled the account.

The only positive on my end, was that since it was the Ads team, where Google's money is, I got human email responses.

Re: Our Chrome Extension Is Safe

#49

Post by [deleted] »

gnicholas wrote: post #33
_fat_santa wrote: post #25

You know this wouldn't be so much of an issue if Chrome didn't disable the ability to install extensions outside of the web store. As an extension developer its absolutely infuriating to realize that: 1. There is no way to install extensions outside the web store 2. Google won't approve anything to the web store. 3. The vast majority of people use Chrome vs other browsers. ------ I get it, Chrome is Google's browser…

At least it’s possible to side load extensions in Chrome. I’ve been more disappointed in Firefox, which doesn’t allow this at all, even in the developer release. The only thing similar to side loading that is allowed is a temporary debug process, which loads an addon but only until the browser is restarted.

[deleted]

Re: Our Chrome Extension Is Safe

#50

Post by ShamelessC »

wffurr wrote: post #17
HackOfAllTrades wrote: post #8

So what was the actual change they were required to make?

According to Dotproto, the changes they made in their first re-submission were sufficient: https://news.ycombinator.com/item?id=23168874

Makes you wonder - was there even a problem in the first place? Or were they just trying to silently kill this extension but failed due to this going viral?

I understand they were using a very broad wildcard for permission on websites they could access. I'm glad they narrowed that down. But after they did, they still needed this to blow up in order to get an actual response.

Post reply on HN