Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's guess what Google requires in 14 days or they kill our extension

blog.pushbullet.com

Post reply on HN
Print view View original

661–670 of 811 posts

Re: Let's guess what Google requires in 14 days or they kill our extension

#661

Post by efreak »

phire wrote: post #600
kevingadd wrote: post #472

Earlier quoted context omitted.

https://*/* being allowed at all without aggressive vetting is a big mistake. It's astonishing to me that they ever made it easy to do this.

The problem is that extension behaviour is very limited without the https://*/* permission. Say you have an extension that implements spelling check or grammar check. That need access to every single website to find the text fields it want to add functionality too. Same thing with a password manager extension, can't find the login boxes without the https://*/* permission. You want to read data off any page users are…

Pushbullet actually has a desktop application with a tray applet. But if you keep your browser running 24/7 it might well be worthwhile to use an extension instead of another piece of software that installs separately, and has more access to your computer.

Re: Let's guess what Google requires in 14 days or they kill our extension

#662

Post by ISL »

fauigerzigerk wrote: post #638
adrianN wrote: post #602

Earlier quoted context omitted.

I think it's more likely that their flagging is heuristic based and could easily defeated by a malicious extension author and giving detailed feedback makes reverse engineering the rules trivial.

Law enforcement has a solution for that: Do tell people what the rules are and what they are doing wrong. Don‘t tell them how they got caught and what methods were used to catch them. Telling people that they are going to be severely punished within days by a very powerful global entity, without telling them which specific rules they are in breach of or what they have to change is a dystopian nightmare.

Law enforcement also has to tell people how they were caught, perhaps not the entire story, but at least most of it. That, too, is a good thing.

Re: Let's guess what Google requires in 14 days or they kill our extension

#663

Post by freeone3000 »

IG_Semmelweiss wrote: post #555
geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

I agree. This is hackernews, so it is easy why devs would feel otherwise, but as a nondev, I represent the the end users. Why would anyone think it is appropriate for google to reveal their hand, and allow blackhat operators to build apps up to the max limit of permissions? (If they were revealed by google via white glove customer service). If goog did provide guidance on permissions, goog would literally have to aud…

If the max list of permissions is somehow objectionable, fix THAT, not keep the list secret.

Re: Let's guess what Google requires in 14 days or they kill our extension

#664

Post by creato »

sam_goody wrote: post #658
geofft wrote: post #494

Earlier quoted context omitted.

That's the thing I'm sympathetic to - having fixed the bug , it's frustrating that it's not clear what the next steps are. But given that they had the bug, Chrome was absolutely in the right to deny them the first time. And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong, if extensions that go "oh hey, we don't actually need access to literally every website,…

> we have a ten-person team, we'll get back to you within 5 years? It is TOTALLY not OK to have a ten person team (and I have no way to know if they even have that). Considering the fact that the browser platform is now a real service required by billions of people, they should be responsible to have enough staff to handle extensions properly. Aside from the amount of money the Chrome extensions make them, the amount…

> Considering the fact that the browser platform is now a real service required by billions of people, they should be responsible to have enough staff to handle extensions properly.

Extentions don't have to exist at all. At least for a very long time, there were no extensions for Chrome on Android (not sure about now but that may still be the case).

I suspect google would love to just deprecate all extensions entirely, they're probably a massive headache for them (as this thread shows).

A lot of things Google used to do that attracted geeks like us are really a problematic thing when the average masses of people are using them. Google is learning that the hard way, and the process of fixing that pisses off us geeks.

Apple took a different path of locking things down more aggressively earlier, and a lot of geeks (myself included) hated them for it. Now, after we're seeing how the modern world is so incredibly tech illiterate and how security issues are affecting the world, I think Apple got this right and Google got it wrong, and Google knows it and is trying to fix it, which is pissing us off in the same way Apple used to piss us off (but we apparently got over it).

Re: Let's guess what Google requires in 14 days or they kill our extension

#665

Post by csallen »

hedora wrote: post #535
AlphaWeaver wrote: post #268

Earlier quoted context omitted.

Are you making a good faith suggestion that it's possible to build a business around a browser extension and not support Google Chrome? They have something like 70% market share dude...

Chrome’s market share would drop if extension authors moved to an alternative. As it is, it sounds like Google’s doing this itself by breaking popular extensions.

There's no way that any of this is going to meaningfully affect Chrome's market share.

Re: Let's guess what Google requires in 14 days or they kill our extension

#666

Post by henearkr »

Just remove access to http://localhost. This is a huge overreach in permissions, and honestly as a user I would feel violated by that. I have shitloads of things that I can lauch myself on localhost on custom ports, and no-thank-you I do not need to open them to some app.

Re: Let's guess what Google requires in 14 days or they kill our extension

#667

Post by fauigerzigerk »

ISL wrote: post #662
fauigerzigerk wrote: post #638

Earlier quoted context omitted.

Law enforcement has a solution for that: Do tell people what the rules are and what they are doing wrong. Don‘t tell them how they got caught and what methods were used to catch them. Telling people that they are going to be severely punished within days by a very powerful global entity, without telling them which specific rules they are in breach of or what they have to change is a dystopian nightmare.

Law enforcement also has to tell people how they were caught, perhaps not the entire story, but at least most of it. That, too, is a good thing.

Yes, to a degree. But for instance, tax authorities don't have to reveal the algorithm they use to determine who gets audited.

Re: Let's guess what Google requires in 14 days or they kill our extension

#668

Post by prox »

dan-robertson wrote: post #379
prox wrote: post #358

Earlier quoted context omitted.

Do it properly or don’t do it all is my motto. They could have been more forthcoming from the start. This is mystery meat communication. > the concealment of relevant information over basic practicality and functionality.

I agree mostly. But why shouldn’t the OP extension also be required to “do it properly”? Where should one draw the line?

My gripe is that you should always be specific making requests, especially if you dangle something like a complete block of your account towards op but then you don’t say what needs to be done to prevent it.

It’s like I tell you get me a book on computer science or Ill fire you you, but I don’t tell you which one. Also I won’t response to any questions from you.

Whether OPs extension made him think about it is simply an entirely different matter.

Re: Let's guess what Google requires in 14 days or they kill our extension

#669

Post by C4stor »

dilandau wrote: post #530
znpy wrote: post #463

Earlier quoted context omitted.

> "no support and no service" model? this is one of the reasons why Google cloud will lose to AWS in the long run. AWS is customer obsessed, Google is not.

It's so difficult to imagine a) getting ahold of someone at Google who can actually help you, and b) having some sense of assurance that they will actually help you. "Google deleted my X" posts always rise to the top on HN because they elicit a strong emotional response from developers. I think it's worthwhile to reflect on why that happens. For me, it's because I absolutely despise seeing an algorithm have control o…

I can confirm that the support on for example displayvideo360 (one of google ad products) is absolutely stellar even for very low revenue players. Meaning live chat with well trained support persons, and quick escalation if needed. Resolution rate : 100% within a couple day in our case.

Re: Let's guess what Google requires in 14 days or they kill our extension

#670

Post by awill88 »

geofft wrote: post #403

Uh, yikes: > As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on https://*/* and http://*/* . Instead, we can simply request data access for https://*.pushbullet.com/* , http://*.pushbullet.com/* , and http://localhost/* . This is a huge reduction in the private data our extension…

Hit it right on the head. The localhost thing and coupled with the http thing make me cringe.

And to know they went from https://* to just one domain, yikes indeed. Then they left localhost. Hell, that probably made the case worker’s knee jerk even harder because of such a dramatic change, I can’t imagine they spend much time on each case.

Yes, 14 days is not a lot of time, but this is the ecosystem that needs to change. So the maintainer should have started out being more transparent on their architecture: period.

The fun is over, Google doesn’t care about loyalty or gestures of effort, this is an emotionless process. They care about provable, auditable compliance.

When you think about it, for Google, this is just a little sad story about an extension that didn’t make the cut. But it’s a small price to pay in exchange for evidence they are “enduring self-inflicted wounds” and using it as ammunition in avoiding billions of dollars in fines they face for violating user privacy laws.

Post reply on HN