Live data from Hacker News

Google purges bad extensions from Chrome

bbc.com

71–80 of 93 posts

Re: Google purges bad extensions from Chrome

#71
post #43

When the extensions are removed from the Chrome Web Store are they removed from everyone's browsers automatically? I didn't see it mentioned here or in the article.

No. Google uninstalling things from your computer without your permission? Now that would be news.

Re: Google purges bad extensions from Chrome

#72
post #9

This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…

Agh, damn. Just removed Awesome Screenshot due to your comment and I liked it as an extension too. Not enough to leak information to third parties though..

Re: Google purges bad extensions from Chrome

#73
post #9

This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…

Agh, damn. Just removed Awesome Screenshot due to your comment and I liked it as an extension too. Not enough to leak information to third parties though..

[deleted]

Re: Google purges bad extensions from Chrome

#74
post #9

This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…

Agh, damn. Just removed Awesome Screenshot due to your comment and I liked it as an extension too. Not enough to leak information to third parties though..

And this is why google sucks: even technically apt people can get suckered. Google bears responsibility for what's in the chrome web store, except they (as standard) duck it and dump all responsibility onto the users. If even sophisticated users can get fooled, what hope do most folks have?

The answer is for google to own what is in their store, but that costs money.

Re: Google purges bad extensions from Chrome

#75
post #58

Earlier quoted context omitted.

Right now extensions can provide a regex of the URLs that they will be enabled on. Obviously a malicious developer will just say "all" though.

Please tell me that it actually displays a regex to the end user during installation and asks them to read and approve it.

This has been there from the very beginning (as it was a part of GreaseMonkey/UserScripts), but it's not part of the permission system. This is the developer saying "only enable the extension on these pages." So the system to enforce this is in place, but it's not treated exposed to the end-user.

Re: Google purges bad extensions from Chrome

#76
post #43

When the extensions are removed from the Chrome Web Store are they removed from everyone's browsers automatically? I didn't see it mentioned here or in the article.

No. Google uninstalling things from your computer without your permission? Now that would be news.

Actually I think the answer is yes. Or at least they're disabled.

I forget the name but I had one that allowed for a custom new tab page. It had opt-out ads, but I otherwise loved it. It kept getting disabled after each fresh start of Chrome. Debated forking it but haven't yet.

It might matter that I do have my extensions sync between machines. Extension is eventually disabled on the others as well.

EDIT: "This extension violates the Chrome Web Store policy." The extension is Modern New Tab Page. The store page is gone, so no clue what policies are violated, what I need to fear, etcetera.

I can still enable it, but it will be disabled at some point.

Does it have questionable practices? Yes. There's a settings option but it's different than the settings I see by going to chrome://extensions/ as the sole option on the latter is to disable ads.

EDIT 2: To be clear, this extension was blocked late last year, and is not part of this recent batch. At that time there were questions about whether there was a list as well. There was, like this time, no notification to impacted users.

Re: Google purges bad extensions from Chrome

#77
post #64
post #33

Earlier quoted context omitted.

I think you can on regular Chrome. Just tick the 'Developer Mode' box at the top of the extensions page.

I don't think you can on Windows.

Developer Mode in Chrome is most definitely available on Windows.

Re: Google purges bad extensions from Chrome

#79

> "You would expect that an extension that injects or replaces advertisements is malicious, but then you have AdBlock that creates an ad-free browsing experience and is technically very similar." AdBlock is very clear in what it does and users install it because they want to block ads, whereas users are usually not aware when an extension injects ads. As a note, the Awesome Screenshot extension for Firefox asks you i…

Yeah, but ABP also has white listed ads: http://techcrunch.com/2013/07/06/google-and-others-reportedl... Ghostery has a bit of a different model, but they're no saints: http://www.technologyreview.com/news/516156/a-popular-ad-blo... I guess the lure of selling use data is just too great for any commercial entity to control the source of these as blockers. uBlock and PrivacyBadger are still clean AFAIK.

From what I've read, ABP are just plain extortionists: "those are nice 'acceptable' ads you have; shame if something were to happen to them." Ghostery's business model makes it a bit untrustworthy, but it works pretty well as far as I can tell. uBlock is "you get what you pay for" freeware, so you can trust it as long as not many people use it. PrivacyBadger is developed by a small number of honest-to-God privacy zealots (in the best possible sense), so it won't get sold out, but will probably lag behind the curve.

I use a couple of them at once, block most JavaScript, usually run with cookies disabled, and pay a bit of attention to what's going on in the privacy news. For less tech-savvy relatives, I just install Ghostery and disable third-party cookies, since that seems least likely to break websites, and blocks most of the worst tracking.

Oh, and hosts-block tynt. Those guys should drown in burning kerosene.

Re: Google purges bad extensions from Chrome

#80
Google needs a better way to notify users when extensions are superseded. For instance, I used to use the Google Voice extension even though it was buggy as hell, and kept using it for too long because I didn't know about the much better Hangouts extension that replaced it (I had been using Hangouts for a while but never had the Chrome extension).
Post reply on HN