Don't relies on the Google to distribute the browser extension.
Let's guess what Google requires in 14 days or they kill our extension
621–630 of 811 posts
Re: Let's guess what Google requires in 14 days or they kill our extension
#622Earlier quoted context omitted.
I'm not sure I get your point, yes that permission was overreaching but they fixed that and were still rejected and left in limbo without Google's system giving them enough specific information to reliably mitigate whatever it is the system did not like.
They haven't fixed the localhost thing which is in a roughly similar category. Google's response was vague and poor but the problems this extension had are quite serious. More serious than, say, Zoom's recent ones.
The theoretical problems that are also hypothetical because the browser vendor isn't specifically saying that it's what they take issue with here even after the developer tried to mitigate it? And which is apparently pretty common with the prescribed best practice being buggy and badly documented as per the thread below? I'm fine with putting some blame on the extension developers here but this communication by Google is pretty abysmal and for all practical purposes more worrying to me than overreaching permissions that have apparently not impacted security in the real world at this point. The thread below indicates that the localhost thing was/is pretty standard for some use cases, if Google wants that changed they could just communicate it clearly, openly, and with a good upgrade path. Not with vague, unspecific "do something or you're out" messages. Even a few links to documentation that likely didn't exist when this was first implemented would be fine here to change the odd messaging to something actionable.
Re: Let's guess what Google requires in 14 days or they kill our extension
#623Earlier quoted context omitted.
> But is it more or less anti-social than running a huge software platform that advertises the ways to exploit itself? Security through obscurity is no security at all. Google is not doing its user a favor by hiding the criteria it uses to determine whether an extension is malicious or not. Also, just because Google won't publish the criteria, it does not mean that it can't be discovered by someone with enough determ…
It seems likely to me that it's impossible to have an extension system that allows useful extensions that users want while also being completely secure against malicious actors. Security by obscurity is an important tool in the abuse fighting toolbox, because it allows you to have cheap heuristics while increasing the costs for malicious actors.
But this is not email, where literally everybody can send things. Raise up the barrier at submission level - where you must be authenticated - to get rid of automated trial/error attempts, I bet they can.
But when an extension/developer is there, when it has a long history in the store and used by 1M users, hey, give some human feedback. It won't break your automated anti-spam/scam rules.
Re: Let's guess what Google requires in 14 days or they kill our extension
#624We spend a quite a bit on Google Ads yet they seem to refuse devoting even a few minutes of a knowledgable support staff’s time to our account—even when we’re trying to figure out how to give them more money. For 1-2 years our product shopping ads never displayed and we couldn’t get anyone to tell us why. One day, it just started working by itself (perhaps some engineer pushed a fix). Contrast this with their sales s…
Have you tried telling the salesperson?
Yes I in fact did. One of the only reasons I took the call. He said he would check internally. Nothing came of that. Technically they weren't sales but were doing a free account review (but purely focused on how to increase my spend).
Re: Let's guess what Google requires in 14 days or they kill our extension
#625A bit late to this thread but this is happening to my chrome extension right now. No idea why, I have 10,000+ users and the chrome support team just keeps emailing me the same statement with different items highlighted in bold, saying it doesn't work and the description isn't accruate.
a) It does work
b) The description is accurate
I have no idea what they want me to do and I don't have time to try and guess.
I don't get paid for my extension, so I'm just going to redirect everyone to the FireFox version now. The Chrome store will be poorer without it and that's on them.
Re: Let's guess what Google requires in 14 days or they kill our extension
#626Earlier quoted context omitted.
We use localhost to communicate with our desktop application which is commonly installed alongside our extension by users. An example of how we use this communication channel is preventing both our extension and desktop apps from showing notifications on the same computer. Our apps are all about notifications so this would get unacceptable very fast. We ping our local desktop app via localhost to see if it can manage…
Can’t you setup a DNS entry on your domain that resolves to 127.0.0.1 that you reference instead of localhost?
Your resolver may not always permit this sort of thing, and that would just obfuscate what they're doing a step further which may come across as sneaky.
I doubt it is at all common in end user environments, but unbound for instance can be configured to prevent local IPs from being resolved in other domains. It's a good practice to follow in a datacenter environment if you're connecting out to hostnames you resolve from DNS you don't control.
Re: Let's guess what Google requires in 14 days or they kill our extension
#627I'm also an extension developer, and Google has done this to me a few times too. We request permissions specifically for what we need, and our extension is unlisted and can only be installed from our website. Google is a bully, and they use their size and the threat of permanently removing access to your Google Account (and family photos) to terrorize small players without cause. How many people would Google need to…
Not exactly to your point, but you raise an excellent reason to never ever use your "personal" account for business things. Google, Amazon, YouTube, it's all the same.
It's all very convenient, until you lose access 10 years of e-mail because of a Chrome extension review.
Re: Let's guess what Google requires in 14 days or they kill our extension
#628I love pushbullet and I'm happy it works fine on firefox. And that's at least partially the fix - install firefox, depend less on google chrome.
Hopefully that will give a signal to google that make them cherish the developers that create great functionality for them a bit more.
Re: Let's guess what Google requires in 14 days or they kill our extension
#629I'm in the same boat. My open source chrome extension[1] has just been taken down[2] after several years of no complaints because it apparently violated content policies related to nudity and pornography. Say what? Well, I guess you could view _any_ image using my extension, including nudes. Isn't that the problem with most other extensions which could be used on porn sites, like editing cookies, etc? I've submitted…
""js": ["plugins/imagefap.js"], "matches": [" :// .imagefap.com/*"]" This line and others like this, are probably the issue.
probably, and that also make the situation so much more stupid.
I’m so glad to not have to rely on chrome extensions.
Re: Let's guess what Google requires in 14 days or they kill our extension
#630Earlier quoted context omitted.
They haven't fixed the localhost thing which is in a roughly similar category. Google's response was vague and poor but the problems this extension had are quite serious. More serious than, say, Zoom's recent ones.
The theoretical problems that are also hypothetical because the browser vendor isn't specifically saying that it's what they take issue with here even after the developer tried to mitigate it? And which is apparently pretty common with the prescribed best practice being buggy and badly documented as per the thread below? I'm fine with putting some blame on the extension developers here but this communication by Googl…
The theoretical problems that are also hypothetical
I have some trouble following this. These are real, exploited capabilities. How are they theoretical and also hypothetical?