4 ms·

Yeah, I agree it's definitely a good security practice of Chrome. On the developer side of this, though, it definitely can lose you a lot of users pretty quickl

Yeah, I agree it's definitely a good security practice of Chrome. On the developer side of this, though, it definitely can lose you a lot of users pretty quickly if you add new permissions at any point, so I think it's important to carefully consider permissions before launching an extension. For my Chrome extension[1], a change[2] in the Airbnb URLs that it runs on caused a significant spike in uninstalls[3] just because it probably scared people a bit. Not a huge deal or anything. Just wanted to share my experience with this stuff. [1] https://chrome.google.com/webstore/detail/airbnb-price-per-night-co/lijeilcglmadpkbengpkfnkpmcehecfe https://chrome.google.com/webstore/detail/airbnb-price-per-n... [2] https://github.com/davidsawyer/airbnb-price-per-night-correcter/commit/732d84ac1ba0b1608cecd10d3a3bf9af6f374308 https://github.com/davidsawyer/airbnb-price-per-night-correc... [3] https://i.imgur.com/JBBolM1.png https://i.imgur.com/JBBolM1.png

dschep 8y ago
Interesting. I'll probably add some form of github and/or reddit support in the future, and I don't feel comfortable adding those URLs unnecessarily, so at somepoint there will be permissions updates anyway ¯\_(ツ)_/¯
- davidsawyer 8y ago
  Yeah, I think that's the right way to do it. You don't really want to add entire domains that your extension does nothing with yet. Though in hindsight, I should have just found all the Airbnb subdomains, TLDs, etc. up front because my extension was intended to be used throughout all of Airbnb, if that makes sense.
- dessant 8y ago
  Being able to display a custom message along the permission update request would be great, just like how GitHub does it for apps. Requesting additional permissions without an explanation accompanying it can cause confusion, users may think that the request is unwarranted, or that there is something wrong with the extension. They may also decline it out of habit, given how extensions are auto-updated during the browser session, and the request seemingly pops out of nowhere. See the version adoption[0] for one of my extensions, 1.1.0 has requested additional permissions. This may be problematic when you are trying to deliver a critical update that requires new permissions. [0] https://i.imgur.com/hiKLyYT.png https://i.imgur.com/hiKLyYT.png
  - foota 8y ago
    I think chrome has an API for requesting permissions, instead of having them part of the extensions manifest. This means you can present custom prompts and such before the chrome prompt.

dschep 8y ago

Interesting. I'll probably add some form of github and/or reddit support in the future, and I don't feel comfortable adding those URLs unnecessarily, so at somepoint there will be permissions updates anyway ¯\_(ツ)_/¯

davidsawyer 8y ago
Yeah, I think that's the right way to do it. You don't really want to add entire domains that your extension does nothing with yet. Though in hindsight, I should have just found all the Airbnb subdomains, TLDs, etc. up front because my extension was intended to be used throughout all of Airbnb, if that makes sense.
dessant 8y ago
Being able to display a custom message along the permission update request would be great, just like how GitHub does it for apps. Requesting additional permissions without an explanation accompanying it can cause confusion, users may think that the request is unwarranted, or that there is something wrong with the extension. They may also decline it out of habit, given how extensions are auto-updated during the browser session, and the request seemingly pops out of nowhere. See the version adoption[0] for one of my extensions, 1.1.0 has requested additional permissions. This may be problematic when you are trying to deliver a critical update that requires new permissions. [0] https://i.imgur.com/hiKLyYT.png https://i.imgur.com/hiKLyYT.png
- foota 8y ago
  I think chrome has an API for requesting permissions, instead of having them part of the extensions manifest. This means you can present custom prompts and such before the chrome prompt.