Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's guess what Google requires in 14 days or they kill our extension

blog.pushbullet.com

Post reply on HN
Print view View original

481–490 of 811 posts

Re: Let's guess what Google requires in 14 days or they kill our extension

#481

Post by legitster »

geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

It seems like the majority of plugins will need to access all websites. Just looking at my list of plugins:

- EditThisCookie

- ResourceOverride

- Ad blocker

- Grammarly

- LastPass

I absolutely expect these to work regardless of website. It seems perfectly reasonable for this to be the default behavior.

Re: Let's guess what Google requires in 14 days or they kill our extension

#482

Post by WarOnPrivacy »

ocdtrekkie wrote: post #338
skinnymuch wrote: post #32

Earlier quoted context omitted.

Can you give a few examples of how Mozilla/Firefox have changed? We all know about FF Quantum. Yeah it sucks what happened. Maybe there was an alternative, but any one saying Firefox should’ve just stuck to not being compatible with Chromium extensions is kidding themselves on how badly that would’ve continued hurting Firefox’s market share. The XUL powered extension I’m sure were powerful so the outcry in certain pl…

DNS-over-HTTPS was the big one for me. Mozilla betrayed us here. They've pushed something browsers shouldn't do into the browser, and in my case, started to roll it out to my browsers despite my network device being set to block it. They actually managed to implement a policy that respects user choice and freedom less than Chrome, which only implements DoH if your set DNS provider supports it.

> DNS-over-HTTPS was the big one for me. Mozilla betrayed us here.

Betrayal indicates some intent to harm users; the intent of DoH is clearly to safeguard users. However, the rollout was absolutely hamfisted & shortsided.

It's notable that the DoH deployment is about the only example here of Firefox harming users. Compare that with Google rewriting Chrome's code to hobble uBlock Origin & leave users more vulnerable to nefarious ad tech.

The former was Mozilla putting user safety first (in a poorly handled way) while the latter was clearly Google doing the opposite.

Re: Let's guess what Google requires in 14 days or they kill our extension

#483

Post by rossjudson »

wegs wrote: post #219

I just want to mention this is why I believe Google will never be able to compete with AWS, or otherwise be credible in the B2B space. You're relying on automated systems which can take down your business on a whim, with no recourse. Where I work uses Office 365, which is a horrible, horrible technology compared to Google Suite, but I can't, in good faith, argue for switching to Google. It's not a company I'd ever re…

Invoiced billing is available for businesses.

https://cloud.google.com/billing/docs/how-to/invoiced-billin...

Re: Let's guess what Google requires in 14 days or they kill our extension

#484

Post by Baeocystin »

wegs wrote: post #219

I just want to mention this is why I believe Google will never be able to compete with AWS, or otherwise be credible in the B2B space. You're relying on automated systems which can take down your business on a whim, with no recourse. Where I work uses Office 365, which is a horrible, horrible technology compared to Google Suite, but I can't, in good faith, argue for switching to Google. It's not a company I'd ever re…

I had a terrible, deep-history bug cause problems with one of my Office 365-using clients about six months ago. It was a genuine PITA to troubleshoot.

Once we figured out the source of the problem, I was on the phone with someone from Microsoft who knew exactly what I was talking about, and the available workarounds, within the hour.

My clients continue to use Office 365.

Re: Let's guess what Google requires in 14 days or they kill our extension

#485

Post by JaggedJax »

geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with the issue at hand.

If localhost is the issue, Google could literally respond exactly the way you did and the problem is gone, "why do you need http://localhost/?"

This isn't about permissions at all. This is about communication and whether it's worth putting effort and trust into a company that acts like this as SOP.

Re: Let's guess what Google requires in 14 days or they kill our extension

#486

Post by chc »

_jal wrote: post #474
seanwilson wrote: post #84

For people focusing their comments on this particular extension + the permissions it asks for, please take a quick look at the numerous recent posts in the official forum for Chrome extension developers to see it's not an isolated issue: https://groups.google.com/a/chromium.org/forum/#!forum/chrom... It's a systematic issue that isn't specific to anything Pushbullet is doing and it's been like this before the pandemi…

The rule still applies: if you build your business on someone else's property, don't act surprised when they they casually destroy you. It has happened again and again and again. Building for FB or Google is you making yourself their serf, and you will be allowed to exist at their whim.

This isn't very actionable advice, though, since there is basically no such thing as a software product that isn't built on somebody else's property.

You might think, "Ah-ha, web apps!" But no, Google can still casually destroy you there. Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there.

Re: Let's guess what Google requires in 14 days or they kill our extension

#488

Post by geofft »

legitster wrote: post #481
geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

It seems like the majority of plugins will need to access all websites. Just looking at my list of plugins: - EditThisCookie - ResourceOverride - Ad blocker - Grammarly - LastPass I absolutely expect these to work regardless of website. It seems perfectly reasonable for this to be the default behavior.

And both Grammarly and LastPass have had security bugs that let any website worm their way into the extension and access all the data from the extension (anything you've ever typed, for Grammarly, and all your passwords, for LastPass). Extensions with wide-ranging access are useful, and there's a reason Chrome has support for it, but they're also very very hard to get right, even if your entire business is writing a security-focused browser extension.

You could go the approach Firefox is going on mobile where there are currently six vetted extensions. As it turns out, they all need access to every website (or fine-grained APIs, perhaps). But... there are six of them. https://blog.mozilla.org/addons/2020/04/14/april-extensions-...

Re: Let's guess what Google requires in 14 days or they kill our extension

#489

Post by p2t2p »

unknown2374 wrote: post #420
nikanj wrote: post #168

Earlier quoted context omitted.

Google is the new Microsoft. Using it is mandatory, liking it is optional.

Using it is not mandatory, using it is convenient.

To me it is far less convenient. I have to establish some kind of system that makes regular backups in case google elects into banning me.

With Apple ecosystem that is not a problem because every single cloud tool they have supports “download everything locally” option

Re: Let's guess what Google requires in 14 days or they kill our extension

#490

Post by tony101 »

seanwilson wrote: post #480
_jal wrote: post #474

Earlier quoted context omitted.

The rule still applies: if you build your business on someone else's property, don't act surprised when they they casually destroy you. It has happened again and again and again. Building for FB or Google is you making yourself their serf, and you will be allowed to exist at their whim.

How can you realistically avoid this for certain products though? For mobile for example, you've got the iOS and Android store policies to go through, the iOS and Android SDKs, and whatever restrictions Safari (e.g. no proper PWAs) and Chrome have. Not everything can be a website that just needs basic browser capabilities.

At least Android allows sideloading without using the Play Store. Chrome used to allow this, and I believe they've made it much more difficult.
Post reply on HN