27 ms·
Google to developers: We take down your extension because we can
- Boulth 8y agoIt's interesting to observe current landscape of app delivery, previously it was just binaries or sources on developer's site now it's shifting to centralized model in the name of protecting users from malicious actors. I wonder if there is a way to have a cookie (developers don't need to worry about random behavior of your centralized owner) and eat it too (fight malware).
- LoSboccacc 8y agowell the solution is sandboxed temporary runtime environment with user controlled session duration, user managed permissions and strong profile siloes, also known as: your browser.
- millstone 8y agoHow would browser extensions fit into this model?
- LoSboccacc 8y agoThey aren’t application they extend the environment on which the untrusted application run, as such they’re more like kernel modules in regard of security and threat modelling
- seangrogg 8y agoIn this case the centralized owner is the Chrome Web Store; you're leasing space in their list of offerings at their terms, for better or worse. It's worth noting that the Chrome Web Store is just an easy (and highly visible, of course) way of installing extensions but not the only one; developer mode and self-installing is totally possible (though admittedly higher friction). Protecting users from malicious actors serves in the best interests of the Chrome Web Store, certainly, but there's nothing stopping users from running their own security software. In a more ideal world a developer would distribute an extension from their own platform and the user would run a security check against it (and all future versions). Until we get to that world, though, a store that is focused on integrity of security and expresses its right to remove things that don't fit it's model is convenient.
- dannyw 8y agoSelf installation is disabled on Windows. And Developer Mode pops up constant nag warnings, to users asking if they want to disable the plugin.
- justinclift 8y agoMaybe something along the lines of having Firefox/Chrome/etc allowing people to specfiy "extra" extension/addon repos to query? That'd let external places create collections of extensions/addon's, which would probably open things up enough.
- palant 8y agoFirefox still allows installation from third party websites, they merely require add-ons to be signed by AMO. This allows Mozilla to revoke a signature for malicious add-ons, not sure how often this happens in practice.
- superkuh 8y agoAnd in the end the malicious actors are the centralized hosts. Even if they don't start that was centralization leads to perverse incentives for censorship.
- jerrac 8y agoIsn't signing supposed to solve some of that? You sign the binaries you host on your site, and the OS checks to make sure the signature is valid. (Maybe against a non-profit "Let's Sign".) If it's a valid signature, then you know it was signed by someone your OS trusts. Ideally, the OS would not trust signatures from malicious actors. I've never been involved with that kind of thing, so I'm just guessing. Feel free to correct me.
- pjmlp 8y agoThere have been cases where malware authors were able to change package contents while keeping the signature.
- Dylan16807 8y agoWhat kind of package? That probably means the signing is way too complicated. There's not much to get wrong in doing a single hash of an entire zip package and then appending a simple signature of that hash.
- palant 8y agoQuite remarkably, they are only moderately successful in keeping malicious actors out of Chrome Web Store. Centralizing deployment won't give you that automatically, you also need the manpower to enforce policies. And Google isn't even acting when extensions are flagged.
- stephengillie 8y ago> Anyway, dear users of my Google search link fix extension. If you happen to use Google Chrome, I sincerely recommend switching to Mozilla Firefox. No, not only because of this simple extension of course. But Addons.Mozilla.Org policies happen to be enforced in a transparent way, and appealing is always possible. Mozilla also has a good track record of keeping out malicious extensions, something that cannot be said about Chrome Web Store (a recent example). It's interesting to hear this, when Firefox Mobile keeps uninstalling uMatrix and uBlock Origin, while these keep running on Chrome without issue.
- master-litty 8y agoEspecially interesting with the whole Looking Glass ordeal.
- opencl 8y agoThey certainly don't keep running on the mobile version of Chrome. Have you filed a bug report with Mozilla? They're obviously not intentionally getting rid of uMatrix and uBlock.
- AdmiralAsshat 8y agoI had UBO disappear once or twice from my desktop Firefox, but that appeared to be a bug of some kind. Never vanished from my mobile version, and AFAIK it's never been removed from Mozilla's add-ons store. Mozilla also doesn't stand to gain anything by forcing you to view ads. Google does. That's why Firefox Mobile has historically been the mobile browser that lets you install add-ons and ablockers, while Chrome for Android has not.
- deleted 8y ago[deleted]
- ethelward 8y ago> when Firefox Mobile keeps uninstalling [...] uBlock Origin What? I'm using it without issue of any kind for several years...
- pitaj 8y agoAre you saying that Firefox mobile has uninstalled add-ons from your browser multiple times? I've been running Nightly mobile for more than a year and never had that happen. It sounds like a very strange bug, maybe it had something to do with Sync?
- ikeboy 8y agoI've had similar stories, accounts banned, extensions denied because they didn't understand what it did, one was denied because it had minified code, the review process could use more work.
- ghazak 8y agoIt’s a tough situation, because the amount of access that these extensions have to users’ actions can be extreme. Malware is a much greater concern than, say, the AppStore, as access to sensitive information is far less controlled.
- Jacq5 8y agoAgreed. Until extensions as itself get some guidelines - it needs to be inspected closely.
- CryoLogic 8y agoThey somehow have the man power to ban your extension in 2 hours and 30 minutes without an explanation as to why, but than when I get a fake copyright claim on my most popular YouTube video somehow it takes three months, 12 emails and I still don't get the ~$900 lost revenue back.
- deleted 8y ago[deleted]
- segmondy 8y agoThey optimize for their own profit, not yours. ;)
- ozim 8y agoCannot upvote this enough. People complaining about such things think that "customer is always right" where reality is "customer is always right if he pays enough for us to care". Have some reality check. Every company does what is in their best interest not particular customer.
- grigjd3 8y agoI would guess this was automated somehow.
- TheAceOfHearts 8y agoMirror your videos to other services. If you want to make sure your content is preserved you can upload it to archive.org. There's also a huge difference in scale. There's not that many browser extensions to consider, but they have millions of videos on YouTube. It's not really comparable.
- scrollaway 8y agoThese are good suggestions but don't help the parent poster's lost revenue.
- joering2 8y ago
- tomatotomato37 8y agoIn another thread[1] on HN today there was discussion over developers selling out their web extensions to marketing corporations which end up filling them with tracking scripts and malware. Someone suggested that google should be much more aggressive at filtering out said extensions, and one of the responses was a sarcastic comment over a future article about Google attacking extension developers and the free web. And less than 24 hours later, here we are. [1] https://news.ycombinator.com/item?id=17447816 https://news.ycombinator.com/item?id=17447816
- AznHisoka 8y agoI find it kind of frustrating that Google does nothing about extensions tracking your browser history, and quickly takes action against extensions like these. I hope Google has their Cambridge moment soon.
- majewsky 8y ago> quickly The "Google search link fix" extension by Wladimir Palant has existed for many years. (Source: I use it in Firefox.)
- palant 8y agoFor reference, the Chrome version was released in January 2017. So - yes, they had plenty of time to object.
- brazzledazzle 8y agoI have no doubt Google ruthlessly takes advantage of tracking data but that’s for them, not for third parties. Anything is possible but I think they’d see giving up data like that to a company like Cambridge to be surrendering a competitive advantage.
- megous 8y agoA slight irony is that this extension actually removes tracking capability from Google itself in the search. (I suppose only really if you have JS disabled, otherwise they can capture the click event in JS instead of handling links via a special redirect tracker). To the author: Thanks for the extension. I'm a happy user on FF for a long time.
- internet_user 8y agoanother StallmanWasRight moment?
- deleted 8y ago[deleted]
- fwdpropaganda 8y agoYes. And because of that I cannot empathise with this developer. It's not longer a case of "don't put your time into a closed ecosystem, for your own sake", but "you have the moral duty not to contribute to a closed ecosystem, for everyone's sake". The developer was doing something imoral and something bad happened to him. It's karma, Kramer.
- throwawaymaroon 8y agoWell said. Though I don't expect that to fly with the corporate authoritarians around here.
- gnicholas 8y agoSame thing happened to me [1], with a slightly different rationale for pulling the extension. This happened despite tens of thousands of users, years of good reviews, and an extension so useful that Google's own accessibility team demos it at conferences. I was only able to get the situation sorted because I know people who work at Google on the Chrome team. Even with all this, it took weeks to get the previous version restored, and after that weeks more before we could push an update without having it get automatically rejected. The only "good" news is they didn't uninstall our existing user base. 1: https://medium.com/@BeeLineReader/google-yanked-my-chrome-extension-this-sunday-d9c481e285cb https://medium.com/@BeeLineReader/google-yanked-my-chrome-ex...
- dvfjsdhgfv 8y agoAnother good option is posting your story on HN: if it gets to the front page, you have good chances of solving your problem.
- gnicholas 8y agoI did post at the time. Didn’t get much attention.
- dvfjsdhgfv 8y agoWell, it worked in this case (see the updates to the original post).
- e40 8y agoDid you ever find out why this all happened?
- gnicholas 8y agoI did not, and hearing this guy’s story means that the problem hasn’t been completely solved. For us, this was triggered by a question about our privacy policy (which we have, and always have had). I assumed that it was just a glitch in their review and follows-up software — specifically, that it didn’t give the full 7 day grace period. But it sounds like it’s a bigger problem than this. One of the big frustrations for me was that their system was run from an anonymous mailbox, and seemed to have different folks responding different times. Also, if they sent you a message and you replied immediately, you might not hear back for days. At times, it seemed like I was either corresponding with a bot or someone with very bad English. Maybe a tech journalist can write a story about what’s going on, and actually get some answers from them?
- lowercaseman 8y ago#DeleteGoogle
- bdcravens 8y agoProbably far more difficult than #DeleteFacebook
- Animats 8y agoNot really. I don't use a Google account.
- cosarara 8y agoAnd you can't live without a Facebook account?
- cm2187 8y agoYou can live but you can’t date!
- bdcravens 8y agoThat's the thing that makes Google a more challenging beast than Facebook: you don't have to have an account to be an asset for Google, and you likely feed them more data all the time.
- pgeorgi 8y agoAll those like buttons on the net can be used by Facebook to create shadow profiles, too.
- bdcravens 8y agoDefinitely, though between search, communicating with the many Gmail users, AdWords, YouTube, and Android's marketshare, Google Map's dominance, etc, Google is IMO far more ubiquitous
- dvfjsdhgfv 8y agoI'm very curious to see how this plays out. Obviously, the reason for banning the extension is that it prevents Google from tracking our clicks (I'm surprised it took them so long!) But they can't clearly spell out the reason as it would make them look bad, so they just used some template and try to sweep it under the carpet. Now that it's on HN it's no longer so easy to ignore, so I'm really curious to see what happens next.
- duskwuff 8y agoThere's a much more obvious reason: the OP's extension presumably requested permissions to inject scripts to google.com. This is a very common pattern for malicious extensions, which can use that permission to hijack the user's Google session, or to inject third-party ads into Google search result pages. Coupled with the lack of information on the extension page, it looked risky.
- dvfjsdhgfv 8y agoIf it's really so, and it's just an "AI mistake", let's see how quickly Google discovers it and apologizes to the author.
- palant 8y agoNo, the reason isn't obvious. The extension wasn't popular enough on Chrome, Google simply wouldn't bother doing anything about it. This might be a trademark issue, the extension's name has "Google" in it - then it's a major messup then, failing to spell out the correct reason. Or maybe it was flagged by some automated tool and whoever checked output of that tool didn't properly validate it. Impossible to tell from the outside.
- dvfjsdhgfv 8y agoIt seems that they quietly brought it back without explaining the reasons. So yes, we'll never know.
- bitL 8y agoIsn't that extension going straight against Google's ability to track what users are clicking on, i.e. against their core business? Maybe the warning wording is cumbersome or opaque, but what would the author expect? Company not protecting their turf? The only surprising thing is that they did it in this unimaginative hidden fashion, not fitting their friendly progressive image.
- threeseed 8y agoThe surprising thing is that they let the extension exist for so long. Google makes most of their money from ads. If you interfere with that then of course you'll be in trouble.
- palant 8y agoNowhere in the Chrome Web Store policies does it say: "Extensions aren't allowed to violate Google's business interests." Supposedly, acceptance in CWS depends on user value, and the policies protect the user rather than Google.
- deleted 8y ago[deleted]
- joshschreuder 8y agoMy extension, which was just a script block and some CSS tweaks was banned as it was a paywall bypass for a popular news site in Australia. Fair enough according to their policy but I couldn’t help feeling disappointed when I got the email as the extension was quite popular at the time.
- dannyw 8y agoAdblock: OK. Paywall bypass: Not OK. Hmm...
- joshschreuder 8y agoYeah I know right? The reason given was: > We don't allow products or services that facilitate unauthorized access to content on websites that circumvents paywalls. The functionality from the extension was roughly possible with a set of adblock rules anyway, I just packaged it up for the less technically inclined.
- edhelas 8y agoIt's funny because my app just got removed from the Play Store for similar (weird) reasons https://twitter.com/edhelas/status/1014265845940441088 https://twitter.com/edhelas/status/1014265845940441088. Basically I'm also providing a link to F-Droid on the home screen. The app is blocked and I can only resubmit a new one…
- foobarbazetc 8y agoMeanwhile there’s an extension on there with our company name and logo (both trademarked) that might be stealing peoples data and Google have done nothing about it after many submissions of their trademark infringement form.
- busterarm 8y agoLegal demand letter time.
- adiusmus 8y agoCreate an extension with similar name then cite the other for something. When they challenge you reference your trademark etc... or take them to court in front of a judge.
- vageli 8y agoThank goodness that Google is not a court of law and you can engage the legal system for restitution. I mean, wouldn't you want to go that route anyway given the potential damage to your brand by a third-party abusing your trademark? Would pulling the extension undo all the harm the infringement caused you?
- palant 8y agoGiven that these copycat extensions usually aren't giving you a way to find their creator - good luck with the legal system. And even if you can find them, what will you do about them if they are located somewhere in China? The legal route is only good enough to force Google into removing infringing extensions. For you, it means more effort and money wasted. And these malicious extensions get more time to catch unsuspecting users. Of course, after being taken down they will immediately resubmit their extension and you start from scratch. All while Google has a way to report such cases but won't act on the reports.
- justinzollars 8y agoIts their sandbox.
- snarfybarfy 8y agobut, but, they are NOT evil, are they?
- guscost 8y agoWhat does the user story look like for installing a Chrome app locally? Do you need to go through tons of menus or is it just dev mode + easy/scriptable setup process?
- csomar 8y ago> I guess, Mountain View must be moving at extreme speeds, which is why time goes by way faster over there — relativity theory in action. The other way around. The OP must be the one moving at extreme speeds.
- palant 8y agoIf you remember special relativity theory, it's the same thing - merely depends on your point of view. From my point of view, Mountain View is moving. But if you are a Google employee, then I must be moving of course.
- userbinator 8y agoI've never really been a fan of the whole "browser extensions" thing, with perhaps the exception of UI mods, and things like this only serve to reinforce that notion. I prefer to use a MITM filtering proxy, which works in all browsers and is independent of, so isn't beholden to, the authoritarian institutions which control them. Incidentally I also have a filter which does the same thing as his extension, and I probably added it the same day Google decided to mess with those links.
- Godel_unicode 8y agoGood luck with that once hsts, cert pinning, and TLS 1.3 become more common.
- jwilk 8y agoMiTM proxying TLS 1.3 connections works just fine. Browsers ignore cert pinning when the CA certificate was manually installed, so this is not a problem either. I have no idea what HSTS is doing on your list.
- Godel_unicode 8y ago> I have no idea what HSTS is doing on your list. https://moxie.org/software/sslstrip/ https://moxie.org/software/sslstrip/
- jwilk 8y agoWe're talking about voluntarily installed proxy. Why would anyone want to mount an HTTPS stripping attack against themselves?
- walterbell 8y agoWhich local proxy do you use?
- jamieb007 8y agoHow carefully have you analyzed the MITM proxy you are using? Many have security holes and you may be opening yourself up to attacks. Modern browsers have placed a lot of effort into security, you may be undoing a lot of the transport security.
- deleted 8y ago[deleted]
- actionowl 8y agoSide rant: I have an extension which has been published for about 6 years now. They've broken the extension several times due to removing or changing the APIs. I have a couple of bad reviews due to having to remove features from the app because they removed functionality or APIs. The past couple of years things have been more stable, but still, it's been painful.
- davidmurdoch 8y agoBack when Facebook didn't support linked hashtags I made an extension that removed them from posts on facebook.com (they just annoyed me). It still worked perfectly even after Facebook added native support. It was active for many years with great reviews and a few hundred users. Google pulled it early this year because Facebook asked them to... They claimed it violated copyright. There was no option to appeal. Not trying to make a point here. Just offering another anecdote.
- pure-awesome 8y agoNice. If I had known about this extension I might have used it. When people started hashtagging on FB, I thought it was the stupidest thing. Then, when FB made it a feature, I just had to shrug and go "I guess the hashtaggers are the ones in the right, now..."
- sickmate 8y agoI'd guess that the warning period was set to 168 minutes (2hrs 48 minutes) instead of 168 hours (7 days).
- asserttrue 8y agoMy google apps account is being shut down the same way. Apparently using it everyday doesn’t constitute activity for 365 days...
- kevingadd 8y agoA fun related issue with the Chrome Web Store is that you can submit random gibberish to their DMCA takedown form and they'll pull an extension down anyway. Then they take upwards of 4 weeks to process counter-notices and refuse to fulfill their obligation to provide the identity of the reporter so you can sue them.
- geza 8y agoHappened to my own extension this week too ( https://habitlab.stanford.edu https://habitlab.stanford.edu ), except without warning - especially frustrating since I've been developing it for nearly 2 years and Chrome no longer allows users to easily install anything from sources other than their Chrome store. May end up having to port it to Firefox, except there's so much inconsistencies in CSS and webextensions between the browsers it would take a month or more. It's quite frustrating how these walled gardens can easily destroy years of work at someone's whim.
- edoceo 8y agoI almost lost a Google account because the Amdroid App I uploaded was I violation of their Terms. I had to work a few emails/calls with Google to demonstrate it wasn't a violation, but it was a very close call.
- subsubsub 8y agoSomeone should set up a website listing plugins banned by Google for reasons that fall in a gray area or for reasons that are just outright indefensible. Banning extensions in this manner is a signal of value to the end user. Could also list extensions available on Firefox but not Chrome. Something similar to hiddenfromgoogle.com but for extensions (doesn't appear to work anymore) [1] [1] https://www.bbc.com/news/technology-28311217 https://www.bbc.com/news/technology-28311217
- vackosar 8y agoalso create third party store focused on foss. Somwthing like fdroid
- roadbeats 8y agoThey took down my bookmarking extension with no notice, replied none of my e-mails. Although @GoogleChrome gives support on Twitter, they completely ignored my and also some user tweets. We had good description, many screenshots and a screencast, our extension is even open source (https://github.com/kozmos/browser-extensions https://github.com/kozmos/browser-extensions). I don't even know the reason why they took it down. I just had to re-publish my extension: https://chrome.google.com/webstore/detail/daababmdfacmmkokdfikciemmddhpche/publish-accepted?authuser=0&hl=en https://chrome.google.com/webstore/detail/daababmdfacmmkokdf... Tweets from users: https://twitter.com/JesMullins/status/1014085292133888002 https://twitter.com/JesMullins/status/1014085292133888002 Tweets I sent; https://twitter.com/getkozmos/status/1013511183519879168 https://twitter.com/getkozmos/status/1013511183519879168
- yani 8y agoGoogle is terrible at support. I had to wait 2 months to get my oAuth application reviewed. I had to write an email in all capitals to get their attention.
- rasz 8y agoIm a bit confused: - https://chrome.google.com/webstore/detail/google-search-link-fix/cekfddagaicikmgoheekchngpadahmlf https://chrome.google.com/webstore/detail/google-search-link... is still in the store - it IS missing the picture
- palant 8y agoOh, that's nice - it was restored without giving me any kind of notification. Developer Dashboard says that the screenshot is there, not sure why it doesn't show. Edit: Got a mail now, supposedly the issue here was an internal miscommunication resulting in a rejection. So all is good again and all I have to do is resubmit that screenshot.
- jlpom 8y agoA similar situation happened to the ublock origin maintainer: https://twitter.com/gorhill/status/997206089132400641?s=09 https://twitter.com/gorhill/status/997206089132400641?s=09 https://twitter.com/gorhill/status/997162260199075840?s=09 https://twitter.com/gorhill/status/997162260199075840?s=09
- norswap 8y agoHow to get tech support from Google: get a lot of upvotes on HN. Sad.
- lgats 8y agoI had an extension, NoBing which redirected Bing searches to Google. Removed due to copyright so I rebranded it as "Bongle" removed again due to copyright despite no mention of Bing. Gave up.
- crobertsbmw 8y agoI had similar problems with an extension that I am developing. They threatened to take it down because it didn't have a privacy policy attached, although their developer guidelines state that you only need a privacy policy if you collect personal or sensitive user data, which I am not. It took me several resubmissions (each time I was scared I would be banned from all google products), before they finally approved my extension. The clincher was that my extension was marked as unlisted the whole time; it wasn't even open to the public.