4 ms·

Does Google not review the extenstions? Or is it using just some automated easily gameable review system?

by megous 8y ago

gruez 8y ago
AFAIK there's no review system, unlike firefox addons.
- jookyboi 8y ago
  Not true. With expanded permissions (like access to all browser tabs), you will be subject to a full code review. I've had to wait anywhere from 2-5 business days before a draft extension was allowed to be published.
Chris_Chambers 8y ago
There is no review system. There is a brief delay in publishing but only due to some sort of automated process. Not that it would matter if they reviewed it, since it’s easy to obfuscate things. I knew “someone” with a Chrome extension that had over 80k users and it would hijack the users’ reddit accounts to silently issue spaced out fake upvotes via commands issued by a C&C server. The users were being utilized as vote bots to force things to the front page. This went on for over a year and only stopped because the person lost interest in doing it. Any popular extension that asks for access to all site data can and will do terrible things without telling you. They can and will embed secret scripts in all your sites that do whatever they want. In 2008 we called this UXSS, now we call it a feature. The Hola bot net fiasco is a good example of this. Popular extensions like Grammarly are obviously doing something incredibly shady too, how else can a free spell checker afford a massive polished ad campaign and earn tens of millions of dollars. It’s okay though, they won’t get in trouble because a short phrase on page 1273 of their EULA grants them permission to do so. Anyone saying the solution is to pay close attention to the permissions dialog and refuse to install anything asking for full access to all sites is likely on the spectrum and has no clue how 99% of ordinary people think or act.

4 ms·

Does Google not review the extenstions? Or is it using just some automated easily gameable review system?

by megous 8y ago

Does Google not review the extenstions? Or is it using just some automated easily gameable review system?

gruez 8y ago
AFAIK there's no review system, unlike firefox addons.
- jookyboi 8y ago
  Not true. With expanded permissions (like access to all browser tabs), you will be subject to a full code review. I've had to wait anywhere from 2-5 business days before a draft extension was allowed to be published.
Chris_Chambers 8y ago
There is no review system. There is a brief delay in publishing but only due to some sort of automated process. Not that it would matter if they reviewed it, since it’s easy to obfuscate things. I knew “someone” with a Chrome extension that had over 80k users and it would hijack the users’ reddit accounts to silently issue spaced out fake upvotes via commands issued by a C&C server. The users were being utilized as vote bots to force things to the front page. This went on for over a year and only stopped because the person lost interest in doing it. Any popular extension that asks for access to all site data can and will do terrible things without telling you. They can and will embed secret scripts in all your sites that do whatever they want. In 2008 we called this UXSS, now we call it a feature. The Hola bot net fiasco is a good example of this. Popular extensions like Grammarly are obviously doing something incredibly shady too, how else can a free spell checker afford a massive polished ad campaign and earn tens of millions of dollars. It’s okay though, they won’t get in trouble because a short phrase on page 1273 of their EULA grants them permission to do so. Anyone saying the solution is to pay close attention to the permissions dialog and refuse to install anything asking for full access to all sites is likely on the spectrum and has no clue how 99% of ordinary people think or act.