4 ms·
> more often than not, the extensions are also embedding third-party scripts which are gathering all your browser traffic. As someone who writes a lot of chrom
by oelmekki 11y ago
> more often than not, the extensions are also embedding third-party scripts which are gathering all your browser traffic.
As someone who writes a lot of chrome extensions, I find that annoying, not to mention a bit insulting. Please provide the complete list of bad behaving extensions instead of implying we're mostly writing extensions to lure users into a trap.
There are so many cool things you can do with chrome extensions, which are largely unexplored yet. Actually, it reminds me the state of javascript in the early 2000. It was not uncommon then too to say javascript developers were only in to write malwares and javascript should be avoided as much as possible. What would the web look like today if we listened to them?
Now, the state of chrome permissions is indeed very bad. It is very restrictive by essence (you wouldn't have that many restrictions writing a desktop app, and you could do way more harm), but it makes everything looks suspicious. Do you need to access something to build a feature? Now user, when installing the extension, will catalog all the bad things you could do with this permission.
Worst part is, the perimeter of permissions is often poorly delimited. Do you want user to be able to use an extension that enhance their experience on a website of their choice? You have to ask to be able to edit just any website. You often reach the "this extension can read all your browser history" state when you couldn't care less.
I would gladly pay google to review my extension code and mark it as trusted. The confusion between good and bad developers must stop.
- karunadg 11y agoHair Transplant Clinic in India @ http://topservice4u.in/hair-transplant.html http://topservice4u.in/hair-transplant.html Bangalore Hair Transplant @ http://topservice4u.in/hair-transplant-surgeons-bangalore/ http://topservice4u.in/hair-transplant-surgeons-bangalore/
- karunadg 11y agoHair Transplant Clinic in India @ http://topservice4u.in/hair-transplant.html http://topservice4u.in/hair-transplant.html Bangalore Hair Transplant @ http://topservice4u.in/hair-transplant-surgeons-bangalore/ http://topservice4u.in/hair-transplant-surgeons-bangalore/
- shawn-furyan 11y agoThe problem with appending a list to this article is that this issue is presumed to be wide spread[1]. Creating a long list might give the illusion of exhaustiveness when the aim of the project isn't exhaustive identification of offenders, but to demonstrate the problem clearly with strong evidence. This at least empowers the Chrome developers to attack a defined problem, and it gives chrome users a tangible, clearly defined set of in-the-wild attacks to point to when complaining about Chrome's extension permission shortcomings. It also is an amount of work that is achievable by a small team, where an exhaustive outing would probably require the resources of a large organization. [1] Particularly since they seem to have found evidence that these tracking companies are actively reaching out to Chrome extension developers on the dl and offering them commissions.
- 4ad 11y ago> It was not uncommon then too to say javascript developers were only in to write malwares and javascript should be avoided as much as possible. What would the web look like today if we listened to them? A much better place.
- krapp 11y agoNothing was ever going to prevent webpages from becoming more than a slightly uglier imitation of rich text. Without one unavoidably ubiquitous scripting language, (which, if it hadn't been javascript, would have been vbscript through Microsoft's sheer force of will) you still would have been left with proprietary embeds like flash, java applets and inevitably browser plugins, but probably written entirely in C or C++.
- makomk 11y agoThey can't provide a list not just because it's widespread, but because extensions can silently add this through automatic updates. Even if your extension is clean right now, and even if you wouldn't add anything like this yourself, you could sell your extension to someone a year or two down the line and the buyer could start tracking all your users' browsing with no notification to them.
- oelmekki 11y agoI get your point, but the same argument could be made to say we should avoid having computers, or at least avoid connecting them to a network :) (any hardware or software company could be sold to bad people who will find clever ways not to be detected) There is a trust issue here, not sure why it hits chrome extensions harder (although, I'm pretty sure the whole permissions system made people turn paranoid). We will probably need some kind of trusted party audit system to get further. Also, the list of extensions they have should be published, IMO, even (and especially) if developers are not aware about it. This should be treated as vulnerabilities and disclosed so there's a chance to take action on it.
- Excavator 11y agoIt can also happen due to third-party scripts, in the following example an opt-in ad to support the developer: https://www.reddit.com/r/firefox/comments/3pwcey/firefox_extension_download_manager_s3_asks_for/cwaguao https://www.reddit.com/r/firefox/comments/3pwcey/firefox_ext...
- conceit 11y ago> What would the web look like today if we listened to them Oh so horrid, like HN for example? I know! I'm only here because I'm forced to, too.
- oelmekki 11y agoHN uses javascript for upvotes. Also, HN is not "the web".