6 ms·

Do I understand correctly that Google Chrome is uninstalling software that the user has deliberately chosen to (not tricked into) install? This feels worse tha

Do I understand correctly that Google Chrome is uninstalling software that the user has deliberately chosen to (not tricked into) install? This feels worse than simply pulling the extension from the Chrome Web Store. Google certainly isn't obligated to host this thing, but outright uninstalling it against my will seems like crossing a line. There was a lot of hand-wringing when Chrome was released with automatic updates enabled by default, because it seemed reckless to grant Google the power to install (or uninstall) new software on our computers at their whim. Chickens might be roosting.

pelario 10y ago
I wonder if they will claim that "it was a mistake, a bug". Otherwise, it should backfire them heavily.
- sowbug 10y ago
  Nope, it's part of the plan: https://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html https://blog.chromium.org/2015/05/continuing-to-protect-chro...
cjhopman 10y ago
If 99.9% of software installed outside of the chrome web store were installed by adware would you feel differently? Your black and white view of the world bores me.
TorKlingberg 10y ago
I think they have been doing the same on Windows for a while. Linux users are still allowed to install what extensions we want.
bostand 10y ago
Why is this a bad thing? If average Joe had unsigned extensions (without dev mode enabled) it was most likely installed by adware to spy on him.
nothrabannosir 10y ago
I see the idealism in your post and I agree with you 100%. 100%! But every time I got to my grandmother's she has a thousand "default search ad engine this" and "ad injection improvement that" extensions that I need to remove. Those search engines have exactly the same homepage as google, to the colours, except the logo is square, not round. There is no way she can know. It might just be they ran the numbers and my grandmother's not the only one. I think maybe, just this once, reality should trump idealism. Let's keep a very close eye on them. But for now, "I'll allow it." Ps: I know that "if there are unsigned extensions on your computer, you have bigger problems", but it's my grandmother. Security is a moving target, this is the step we take in Jan 2017. If it keeps her safe for a month, that's fine with me. We'll see how the malware adapts in Feb, and react accordingly.
- ramingssss 10y ago
  Fuck your grandmother Why should I suffer because of her incompetence?
  - nothrabannosir 10y ago
    My grandmother is emblematic of "the typical user." It's easy to forget about them, the silent majority. But make no mistake about it: if you work in tech, you owe your life to them. They pay our salaries. We must not forsake them, for they have made us who we are. For every opsec genius such as yourself, there are a thousand opsec impaired such as my grandmother. It is up to us to provide them with a system they can use without having a MSc in computer science. To drive this point home: the real problem in my grandmother's case is not all her grandchildren are adults. They don't understand what "don't download games" means. What is she to do? Not let them use the computer? That would defeat the entire purpose of having one. When the best we can do to make our users use our products safely is to have them not use it at all, you know something is fundamentally wrong. And it's our job to fix that.
    - deleted 10y ago
      [deleted]
- 10y ago
pilif 10y ago
> Do I understand correctly that Google Chrome is uninstalling software that the user has deliberately chosen to (not tricked into) install? How would Chrome discern deliberately installed extensions from extensions the user has been tricked into installing?
- tlrobinson 10y ago
  Ask the user?
  - pilif 10y ago
    How do you make sure it's the user responding and not the installer that tricked the user that's sending keystrokes?
    - tlrobinson 10y ago
      I don't think Chrome extensions are omnipotent. They can't set arbitrary Chrome settings, for example, can they?
      - pilif 10y ago
        No. But the installer that wrapped around the thing the user actually wanted certainly can. You know. These adware "downloaders" that completely hose your browser unless you find the correc checkbox full of double negatives to check.
        tlrobinson 10y ago
        > But the installer that wrapped around the thing the user actually wanted certainly can. Then you're not talking about Chrome extensions and none of this applies.
        kiallmacinnes 10y ago
        Chrome extensions can be installed in many ways. Does a chrome extension need to be sourced from the chrome web store in order to be considered an chrome extension? One method to install an extension is the chrome web store.. the other methods are typically only used by developers (hence all the dev mode comments) and malware (hence all the "I can live with this" comments)

pelario 10y ago

I wonder if they will claim that "it was a mistake, a bug". Otherwise, it should backfire them heavily.

sowbug 10y ago
Nope, it's part of the plan: https://blog.chromium.org/2015/05/continuing-to-protect-chrome-users-from.html https://blog.chromium.org/2015/05/continuing-to-protect-chro...

cjhopman 10y ago

If 99.9% of software installed outside of the chrome web store were installed by adware would you feel differently? Your black and white view of the world bores me.

TorKlingberg 10y ago

I think they have been doing the same on Windows for a while. Linux users are still allowed to install what extensions we want.

bostand 10y ago

Why is this a bad thing? If average Joe had unsigned extensions (without dev mode enabled) it was most likely installed by adware to spy on him.

nothrabannosir 10y ago

I see the idealism in your post and I agree with you 100%. 100%! But every time I got to my grandmother's she has a thousand "default search ad engine this" and "ad injection improvement that" extensions that I need to remove. Those search engines have exactly the same homepage as google, to the colours, except the logo is square, not round. There is no way she can know. It might just be they ran the numbers and my grandmother's not the only one. I think maybe, just this once, reality should trump idealism. Let's keep a very close eye on them. But for now, "I'll allow it." Ps: I know that "if there are unsigned extensions on your computer, you have bigger problems", but it's my grandmother. Security is a moving target, this is the step we take in Jan 2017. If it keeps her safe for a month, that's fine with me. We'll see how the malware adapts in Feb, and react accordingly.

ramingssss 10y ago
Fuck your grandmother Why should I suffer because of her incompetence?
- nothrabannosir 10y ago
  My grandmother is emblematic of "the typical user." It's easy to forget about them, the silent majority. But make no mistake about it: if you work in tech, you owe your life to them. They pay our salaries. We must not forsake them, for they have made us who we are. For every opsec genius such as yourself, there are a thousand opsec impaired such as my grandmother. It is up to us to provide them with a system they can use without having a MSc in computer science. To drive this point home: the real problem in my grandmother's case is not all her grandchildren are adults. They don't understand what "don't download games" means. What is she to do? Not let them use the computer? That would defeat the entire purpose of having one. When the best we can do to make our users use our products safely is to have them not use it at all, you know something is fundamentally wrong. And it's our job to fix that.
  - deleted 10y ago
    [deleted]
10y ago

pilif 10y ago

> Do I understand correctly that Google Chrome is uninstalling software that the user has deliberately chosen to (not tricked into) install? How would Chrome discern deliberately installed extensions from extensions the user has been tricked into installing?

tlrobinson 10y ago
Ask the user?
- pilif 10y ago
  How do you make sure it's the user responding and not the installer that tricked the user that's sending keystrokes?
  - tlrobinson 10y ago
    I don't think Chrome extensions are omnipotent. They can't set arbitrary Chrome settings, for example, can they?
    - pilif 10y ago
      No. But the installer that wrapped around the thing the user actually wanted certainly can. You know. These adware "downloaders" that completely hose your browser unless you find the correc checkbox full of double negatives to check.
      - tlrobinson 10y ago
        > But the installer that wrapped around the thing the user actually wanted certainly can. Then you're not talking about Chrome extensions and none of this applies.
        kiallmacinnes 10y ago
        Chrome extensions can be installed in many ways. Does a chrome extension need to be sourced from the chrome web store in order to be considered an chrome extension? One method to install an extension is the chrome web store.. the other methods are typically only used by developers (hence all the dev mode comments) and malware (hence all the "I can live with this" comments)