4 ms·

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome for example has a ton of limitations: https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-Extension-Innovation.html https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E... If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates. You can't just push an update immediately that gets sent out. They take a week to approve your extension. This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. ESPECIALLY if something is broken. Imagine if you had a bug that destroys data and you need to rush out a fix. Nope.. You need to wait one week for that to go out.

dessant 7y ago
I experience the same one week delay with an extension. The publishing delay is always about a week, and that is highly unusual. They state that the extension update is under compliance review, which may take several business days, though the similar approval times indicate that this is actually an arbitrary publishing delay, and that no human review takes place in all cases, otherwise there would be more variation between approval times.
- burtonator 7y ago
  It's always a week AND it's also applied at a week even if you change an image. They don't need to audit an image. I'm suspicious that they might be doing this for other reasons more likely to punish people for more aggressive permissions.
gildas 7y ago
The same applies for my own fork of SingleFile, called SingleFileZ. I can publish any update of SingleFile in 1 hour. For SingleFileZ, which requires less permissions, I have to wait 7 days for exactly the same update. That's very demotivating.
throwaway5752 7y ago
"This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. ESPECIALLY if something is broken." I get what you are saying, but this is more of an artifact of people being used to unregulated platform as a service and the - being blunt here - terrible quality practices that are rampant there. If a week is an "eternity" then try internally iterating a few times and shore up that test coverage if that extremely mild release cadence constraint is more than you can bear. Browser extensions are risk in security, authenticity of content, a new avenue for phishing (look alikes in low volume/poorly curated areas), and browser stability. It isn't Chrome's fault if someone pushes a bug that destroys data, it's the development teams fault. There responsibility is the the user of Chrome.
modzu 7y ago
at least in firefox, updates typically roll out immediately while any manual review happens asynchronously
- filoleg 7y ago
  While I disagree with the 1-week review times that google imposes, doesn't the firefox approach defeat the purpose of the review in the first place? While async review is better than no review, if someone pushed a malicious update and it got caught in the async review a few days later, the damage has already been done. Just a trade-off to think about.
  - modzu 7y ago
    its a tradeoff for sure; i tend to think the risk of unpatched software outweighs the risk of software hijacked from the author, so i prefer the moz model. iirc, there are automatic checks (ie permission changes, certain api calls, etc) which trigger a manual review before publishing. that said even the manual review is no guarantee malicious software doesnt get published (from my experience the reviewers are not always experts)
dnate 7y ago
That has been the reality for the Apple AppStore for many years. Seems to not have hurt them. And Chrome has a much larger market share (or browser share) than iOS has. As long as you have that, you can pretty much do whatever you like to the devs as long as you don't piss off the users
- bradknowles 7y ago
  Oh? How many billions of users are on Chrome?
  - Quarrel 7y ago
    Are you waiting for google to release a mobile operating system and put their browser on it? That'd show Apple.
  - saagarjha 7y ago
    At least one, as of 2016.
TeMPOraL 7y ago
> This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. Not so long ago, people distributed software on physical media. Time to update was counted in months to years. This had a nice side benefit of people not being able to "test in production"; software either worked mostly well, or it didn't sell. That wasn't a bad thing, because it forced companies to do actual QA - something that today is increasingly being pawned off to end-users, with help of deeply invasive telemetry.
slg 7y ago
Personal anecdote here, I have a Chrome extension with a few thousand users that has never been subject to this wait. That seems to be because I have a narrowly defined scope for my extension and therefore the permissions I request are relatively innocuous. That exact article you linked was posted to HN a few months back. I remember someone dug into it and found the permissions it requested. The full list was rather broad and as a result the extension could have basically hijacked the entire browsing experience. A malicious extension with those permissions would have been a potential goldmine. I think it is perfectly reasonable for Google to want to review extensions like that.

dessant 7y ago

I experience the same one week delay with an extension. The publishing delay is always about a week, and that is highly unusual. They state that the extension update is under compliance review, which may take several business days, though the similar approval times indicate that this is actually an arbitrary publishing delay, and that no human review takes place in all cases, otherwise there would be more variation between approval times.

burtonator 7y ago
It's always a week AND it's also applied at a week even if you change an image. They don't need to audit an image. I'm suspicious that they might be doing this for other reasons more likely to punish people for more aggressive permissions.

gildas 7y ago

The same applies for my own fork of SingleFile, called SingleFileZ. I can publish any update of SingleFile in 1 hour. For SingleFileZ, which requires less permissions, I have to wait 7 days for exactly the same update. That's very demotivating.

throwaway5752 7y ago

"This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. ESPECIALLY if something is broken." I get what you are saying, but this is more of an artifact of people being used to unregulated platform as a service and the - being blunt here - terrible quality practices that are rampant there. If a week is an "eternity" then try internally iterating a few times and shore up that test coverage if that extremely mild release cadence constraint is more than you can bear. Browser extensions are risk in security, authenticity of content, a new avenue for phishing (look alikes in low volume/poorly curated areas), and browser stability. It isn't Chrome's fault if someone pushes a bug that destroys data, it's the development teams fault. There responsibility is the the user of Chrome.

modzu 7y ago

at least in firefox, updates typically roll out immediately while any manual review happens asynchronously

filoleg 7y ago
While I disagree with the 1-week review times that google imposes, doesn't the firefox approach defeat the purpose of the review in the first place? While async review is better than no review, if someone pushed a malicious update and it got caught in the async review a few days later, the damage has already been done. Just a trade-off to think about.
- modzu 7y ago
  its a tradeoff for sure; i tend to think the risk of unpatched software outweighs the risk of software hijacked from the author, so i prefer the moz model. iirc, there are automatic checks (ie permission changes, certain api calls, etc) which trigger a manual review before publishing. that said even the manual review is no guarantee malicious software doesnt get published (from my experience the reviewers are not always experts)

dnate 7y ago

That has been the reality for the Apple AppStore for many years. Seems to not have hurt them. And Chrome has a much larger market share (or browser share) than iOS has. As long as you have that, you can pretty much do whatever you like to the devs as long as you don't piss off the users

bradknowles 7y ago
Oh? How many billions of users are on Chrome?
- Quarrel 7y ago
  Are you waiting for google to release a mobile operating system and put their browser on it? That'd show Apple.
- saagarjha 7y ago
  At least one, as of 2016.

TeMPOraL 7y ago

> This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. Not so long ago, people distributed software on physical media. Time to update was counted in months to years. This had a nice side benefit of people not being able to "test in production"; software either worked mostly well, or it didn't sell. That wasn't a bad thing, because it forced companies to do actual QA - something that today is increasingly being pawned off to end-users, with help of deeply invasive telemetry.

slg 7y ago

Personal anecdote here, I have a Chrome extension with a few thousand users that has never been subject to this wait. That seems to be because I have a narrowly defined scope for my extension and therefore the permissions I request are relatively innocuous. That exact article you linked was posted to HN a few months back. I remember someone dug into it and found the permissions it requested. The full list was rather broad and as a result the extension could have basically hijacked the entire browsing experience. A malicious extension with those permissions would have been a potential goldmine. I think it is perfectly reasonable for Google to want to review extensions like that.