Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Chrome Extension Is Safe

blog.pushbullet.com

Post reply on HN
Print view View original

51–60 of 206 posts

Re: Our Chrome Extension Is Safe

#51

Post by Guzba »

archon810 wrote: post #43
RHSeeger wrote: post #7

> All of that attention resulted in our issue being resolved. This is good for us. It is not yet clear if the attention will help other developers that are struggling with similar vague rejections. I think it's been made abundantly clear that Google will not, in fact, improve anything from experiences like this. They happen over and over and every single time it's the same; if it gets publicity, someone helps resolve…

Have a look at this https://twitter.com/ArtemR/status/1261159338170658816 and the surrounding discussion. This is basically the only person at Google who can make things happen if there's a problem with Chrome extensions.

This was low-key shocking to learn. What if this all happened while he was on vacation?

Re: Our Chrome Extension Is Safe

#52

Post by ufmace »

aspenmayer wrote: post #28
TheArcane wrote: post #20

Earlier quoted context omitted.

They unpublished it after refusing to allow a "Sign in with Apple" option on their login page. https://old.reddit.com/r/PushBullet/comments/eirc1m/not_avai... The dev said the iOS side of things are irrelevant for them anyway since most of their users are on Android, which is frankly disheartening since there's no alternative for iPhone users with linux desktops now

Wow. That's pretty lame of them. I don't agree with their logic, but I do agree with following the user base. I will continue to use the version I have. I could probably find a way to share the .app if anyone needs it. Found pushover.net which seems like a decent (paid) alternative. We need an open-source version of this kind of functionality, maybe using ActivityPub? Self-hosted option with Google integration for a…

Not so sure about lame of PushBullet. It feels more lame of all of the major tech players to be essentially fighting over how much they can extort out of developers using their monopoly powers.

Facebook seems to say, you have 1 week to update your sign-in integration code to the latest version (or I guess they get cut off from Facebook API or something?).

Apple says you must support Apple sign-in, or you won't be allowed on our App Store, without with it's nearly impossible to get your app on an iPhone.

Google says guess what we want based on our vague emails and meaningless responses, or we remove your extension/app from the store, making it nearly impossible to use on Chrome.

Geez, it's like Microsoft is the good guy of the tech majors here.

Re: Our Chrome Extension Is Safe

#53

Post by riedel »

gnicholas wrote: post #33
_fat_santa wrote: post #25

You know this wouldn't be so much of an issue if Chrome didn't disable the ability to install extensions outside of the web store. As an extension developer its absolutely infuriating to realize that: 1. There is no way to install extensions outside the web store 2. Google won't approve anything to the web store. 3. The vast majority of people use Chrome vs other browsers. ------ I get it, Chrome is Google's browser…

At least it’s possible to side load extensions in Chrome. I’ve been more disappointed in Firefox, which doesn’t allow this at all, even in the developer release. The only thing similar to side loading that is allowed is a temporary debug process, which loads an addon but only until the browser is restarted.

There is an unbranded build of Firefox that allows this even provided by Mozilla.

Re: Our Chrome Extension Is Safe

#54

Post by [deleted] »

Guzba wrote: post #51
archon810 wrote: post #43

Earlier quoted context omitted.

Have a look at this https://twitter.com/ArtemR/status/1261159338170658816 and the surrounding discussion. This is basically the only person at Google who can make things happen if there's a problem with Chrome extensions.

This was low-key shocking to learn. What if this all happened while he was on vacation?

[deleted]

Re: Our Chrome Extension Is Safe

#55

Post by riedel »

riedel wrote: post #53
gnicholas wrote: post #33

Earlier quoted context omitted.

At least it’s possible to side load extensions in Chrome. I’ve been more disappointed in Firefox, which doesn’t allow this at all, even in the developer release. The only thing similar to side loading that is allowed is a temporary debug process, which loads an addon but only until the browser is restarted.

There is an unbranded build of Firefox that allows this even provided by Mozilla.

https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...

Re: Our Chrome Extension Is Safe

#56

Post by csours »

oefrha wrote: post #45
rapind wrote: post #35

Earlier quoted context omitted.

The end result being a far less permissive extension. The permissions they required were insane but our entire focus is on Google's customer service. Now that we all agree that Google's process sucks, can we talk about how insane it is to even have this level or permissions available for request in the first place?

It’s not insane to have a *://*/* permission, since things like generic content blockers have to be able to modify any page (you definitely need to take great care when installing these extensions, which unfortunately most users aren’t equipped to assess, which is why extension security is such a headache and stringent review is welcome). On the other hand, this particular extension requesting this access just becaus…

It might be difficult to impossible to currently implement, but perhaps if you have access to :///* you should lose access to pretty much every other permission.

Re: Our Chrome Extension Is Safe

#57

Post by oefrha »

asdf21 wrote: post #13
schoolornot wrote: post #9

Can someone from Google use a throwaway to explain why the hell their support is garbage. From the Chrome store, to G-Suite, to Pixel Support. It's just awful.

Always has been for 10+ years now. As a former Call Center Director, it's pretty amazing to me how much bad-will these massive companies are willing to foment by not running their support correctly. It's not that hard / expensive guys... you can hire great support employees for $20 / hour all across America.

Are these great $20/hr support engineers the kind I often deal with over email or phone, who usually employ canned responses, can’t solve off-script problems, tend to repeat the same unhelpful responses, and are sometimes indistinguishable from bots?

Re: Our Chrome Extension Is Safe

#58

Post by aspenmayer »

ufmace wrote: post #52
aspenmayer wrote: post #28

Earlier quoted context omitted.

Wow. That's pretty lame of them. I don't agree with their logic, but I do agree with following the user base. I will continue to use the version I have. I could probably find a way to share the .app if anyone needs it. Found pushover.net which seems like a decent (paid) alternative. We need an open-source version of this kind of functionality, maybe using ActivityPub? Self-hosted option with Google integration for a…

Not so sure about lame of PushBullet. It feels more lame of all of the major tech players to be essentially fighting over how much they can extort out of developers using their monopoly powers. Facebook seems to say, you have 1 week to update your sign-in integration code to the latest version (or I guess they get cut off from Facebook API or something?). Apple says you must support Apple sign-in, or you won't be all…

Look, there's more than enough lame decisions to go around in this case. :P

I agree with Apple's stance. The landscape has changed. To be a tech superpower is to have your own pull, and to be able to make unilateral decisions on behalf of your business and your customers/users. That is what Apple has done here. I happen to agree because I already like Apple's implementation of Sign in with Apple specifically, even though I have never used it. I also agree with Apple's stance on privacy generally.

I don't like that Apple forced this decision in this way, but I am fine with the outcome in general, but am saddened to see that it negatively affected a developer whose product I use. However, I question the Pushbullet dev's dedication to the iOS platform. Mobile development is a moving target. To single out Apple for blame for changing the App Store conditions for apps is silly. You could just as well blame the dev for not keeping up with the times.

Re: Our Chrome Extension Is Safe

#59

Post by oefrha »

csours wrote: post #56
oefrha wrote: post #45

Earlier quoted context omitted.

It’s not insane to have a *://*/* permission, since things like generic content blockers have to be able to modify any page (you definitely need to take great care when installing these extensions, which unfortunately most users aren’t equipped to assess, which is why extension security is such a headache and stringent review is welcome). On the other hand, this particular extension requesting this access just becaus…

It might be difficult to impossible to currently implement, but perhaps if you have access to :// /* you should lose access to pretty much every other permission.

That’s not how permissions work in Chrome extensions. You pretty much can’t do anything with the URL matching permission alone, however broad your pattern (including ).

Take a look at

https://developer.chrome.com/apps/declare_permissions

https://developer.chrome.com/extensions/api_index

Edit: I should mention that content script permissions declaration works differently: https://developer.chrome.com/extensions/content_scripts

Re: Our Chrome Extension Is Safe

#60

Post by iudqnolq »

csours wrote: post #56
oefrha wrote: post #45

Earlier quoted context omitted.

It’s not insane to have a *://*/* permission, since things like generic content blockers have to be able to modify any page (you definitely need to take great care when installing these extensions, which unfortunately most users aren’t equipped to assess, which is why extension security is such a headache and stringent review is welcome). On the other hand, this particular extension requesting this access just becaus…

It might be difficult to impossible to currently implement, but perhaps if you have access to :// /* you should lose access to pretty much every other permission.

That wouldn't help much. For example, with read/write access to your banking website a malicious extension could inject a script tag that exfiltrated data to their server.
Post reply on HN