5 ms·

The only reason that this was resolved was because ublock is a popular project. The other projects linked there did not have as much luck. Just the fact that t

The only reason that this was resolved was because ublock is a popular project. The other projects linked there did not have as much luck. Just the fact that they reply in this way on issues is disgusting: https://github.com/uBlockOrigin/uBlock-issues/issues/745#issuecomment-539962215 https://github.com/uBlockOrigin/uBlock-issues/issues/745#iss... https://github.com/dessant/search-by-image/issues/57#issuecomment-511465393 https://github.com/dessant/search-by-image/issues/57#issueco...

dessant 7y ago
Armin here, the developer of Search by Image. After that experience I felt it's necessary to share the entire discussion. That is how Google treats developers in exchange for enriching their platform, with a list of nonsense allegations, and if you speak up, retaliation. This practice is well documented at this point, and the best way out for those targeted is to hold your head down and maybe plead for help on social media. So yes, Google will eventually be forced to open up Chrome to third-party extension stores. Google will not get to decide what software the majority of humans can install in their browsers, the same way Microsoft is not allowed to block you for arbitrary reasons from installing software on your Windows devices.
- lend000 7y ago
  On the other hand, blindly accepting browser extension upgrades is a huge security vulnerability. There was a post some time ago about how popular extension projects often get bought by adware/spyware companies and they were able to publish malicious changes directly to user's browsers without any validation.
  - dessant 7y ago
    > On the other hand, blindly accepting browser extension upgrades is a huge security vulnerability. That argument can be applied to any software, being allowed to run code on your devices comes not just with the freedom, but also the risks. I don't think restricting people's freedoms is the right way to somewhat reduce the occurrence of malware. > There was a post some time ago about how popular extension projects often get bought by adware/spyware companies and they were able to publish malicious changes directly to user's browsers without any validation. I think you're referring to one of my blog posts. :) https://news.ycombinator.com/item?id=20587440 https://news.ycombinator.com/item?id=20587440 https://armin.dev/blog/2019/08/supporting-browser-extension-developers/ https://armin.dev/blog/2019/08/supporting-browser-extension-...
  - dependenttypes 7y ago
    The solution for that would be to subscribe to specific repositories, similar to how Debian does it for example. Anyway, even if they just let people to manually download and install unsigned extensions the risk would only fall on the people who chose to do that. These that wish to do so could still continue and use google's walled garden.
  - catalogia 7y ago
    This is the same company that operates the android 'Play Store', host to half a million spyware "flashlight" apps. I find it hard to take their expressed concern for my security seriously.
    - mav3rick 7y ago
      Right, if they don't try you blame them, if they do try you blame them. You clearly have a grudge to bury.
      - catalogia 7y ago
        I would never hold it against Google if they purged malware from Play Store. Particularly since android makes it easy for alternative appstores to exist, most notably the superb F-Droid, which mitigates some of the risk of Google getting it wrong. When alternative sources are not readily available, the calculus changes. When the platform is a walled garden, the matter of banning the wrong script/app becomes more serious. Apple's appstore, Mozilla's firefox extension platform and Google's chrome extension platform fall into this category. Because they make it difficult to install apps/extensions from other sources, they have a moral responsibility to perform to be more careful with what they ban. (Also, I do not accept the premise that Google is actually trying in a meaningful way.)
  - soup10 7y ago
    Modern tech companies enjoy maintaining the delusion that developers that make apps and content on their platforms are extensions of their employees and contractors and they have the right to dictate and control their development. This is obviously bullshit. The security argument is a red herring since a third party can maintain a trusted software list without all the conflicts of interest.
  - Stevvo 7y ago
    Many crytocurrency users have a browser extension based "wallet". A malicious update pushed to Metamask, the most popular ethereum wallet application, could end very badly.
  - vxNsr 7y ago
    This is a situation of their own making. They're the ones that pushed for invisible automatic extension upgrades. Firefox's old system of you needing to manually initiate upgrades was much more secure, and encouraged user responsibility for the code running on their machines. Google wants to infantilize the user, take away all choice, claim users can't make good decisions and then claim anything control they remove is for the user's benefit. They're a bunch of stinking liers. At this point anyone claiming to be a platform needs to regulated just like we regulate platforms before the internet. I have a friend who works in the compliance department of one of the big international commodity exchanges. They are responsible for regulating the platform (his words) and preventing anything untoward happening, but that also means the company itself cannot "double deal" it can't participate in the markets in anyway. In addition they have two fed watchdogs that do regular invasive audits to ensure that they're actually following the laws and regulations. It's time for internet companies to be put to the same standard: If you call yourself a platform get ready to be treated as such. If you don't wanna be a platform and you have 70%+ of the market get ready to get broken up.
    - rileymat2 7y ago
      > Google wants to infantilize the user, take away all choice, claim users can't make good decisions and then claim anything control they remove is for the user's benefit. As a developer with 18 years experience, I am not sure I have the time to make good decisions. I am not going to audit the code of everything I install by reputation. An average user has no hope.
      - Santosh83 7y ago
        No offence but you seem to have just done exactly what GP accuses Google (and most other big s/w corps to be honest) of doing. I am an average user (in the sense I'm not a professional s/w dev although I do know coding and have a more than normal interest in the inner workings of computers, but most youth are similar anyway. No one is dumb unless they've been trained to relinquish thought), and in two decades of using computers and the Internet I have to say I did not get hoodwinked into installing a single malware or getting a single virus. And uptil at least the last decade s/w wasn't as controlling and infantilising as it has lately become, and I got along just fine. In fact the slight difficulty actually enabled me to learn interesting stuff which modern UX almost totally stonewalls with its opaque "let me hold your hand" interfaces.

dessant 7y ago

Armin here, the developer of Search by Image. After that experience I felt it's necessary to share the entire discussion. That is how Google treats developers in exchange for enriching their platform, with a list of nonsense allegations, and if you speak up, retaliation. This practice is well documented at this point, and the best way out for those targeted is to hold your head down and maybe plead for help on social media. So yes, Google will eventually be forced to open up Chrome to third-party extension stores. Google will not get to decide what software the majority of humans can install in their browsers, the same way Microsoft is not allowed to block you for arbitrary reasons from installing software on your Windows devices.

lend000 7y ago
On the other hand, blindly accepting browser extension upgrades is a huge security vulnerability. There was a post some time ago about how popular extension projects often get bought by adware/spyware companies and they were able to publish malicious changes directly to user's browsers without any validation.
- dessant 7y ago
  > On the other hand, blindly accepting browser extension upgrades is a huge security vulnerability. That argument can be applied to any software, being allowed to run code on your devices comes not just with the freedom, but also the risks. I don't think restricting people's freedoms is the right way to somewhat reduce the occurrence of malware. > There was a post some time ago about how popular extension projects often get bought by adware/spyware companies and they were able to publish malicious changes directly to user's browsers without any validation. I think you're referring to one of my blog posts. :) https://news.ycombinator.com/item?id=20587440 https://news.ycombinator.com/item?id=20587440 https://armin.dev/blog/2019/08/supporting-browser-extension-developers/ https://armin.dev/blog/2019/08/supporting-browser-extension-...
- dependenttypes 7y ago
  The solution for that would be to subscribe to specific repositories, similar to how Debian does it for example. Anyway, even if they just let people to manually download and install unsigned extensions the risk would only fall on the people who chose to do that. These that wish to do so could still continue and use google's walled garden.
- catalogia 7y ago
  This is the same company that operates the android 'Play Store', host to half a million spyware "flashlight" apps. I find it hard to take their expressed concern for my security seriously.
  - mav3rick 7y ago
    Right, if they don't try you blame them, if they do try you blame them. You clearly have a grudge to bury.
    - catalogia 7y ago
      I would never hold it against Google if they purged malware from Play Store. Particularly since android makes it easy for alternative appstores to exist, most notably the superb F-Droid, which mitigates some of the risk of Google getting it wrong. When alternative sources are not readily available, the calculus changes. When the platform is a walled garden, the matter of banning the wrong script/app becomes more serious. Apple's appstore, Mozilla's firefox extension platform and Google's chrome extension platform fall into this category. Because they make it difficult to install apps/extensions from other sources, they have a moral responsibility to perform to be more careful with what they ban. (Also, I do not accept the premise that Google is actually trying in a meaningful way.)
- soup10 7y ago
  Modern tech companies enjoy maintaining the delusion that developers that make apps and content on their platforms are extensions of their employees and contractors and they have the right to dictate and control their development. This is obviously bullshit. The security argument is a red herring since a third party can maintain a trusted software list without all the conflicts of interest.
- Stevvo 7y ago
  Many crytocurrency users have a browser extension based "wallet". A malicious update pushed to Metamask, the most popular ethereum wallet application, could end very badly.
- vxNsr 7y ago
  This is a situation of their own making. They're the ones that pushed for invisible automatic extension upgrades. Firefox's old system of you needing to manually initiate upgrades was much more secure, and encouraged user responsibility for the code running on their machines. Google wants to infantilize the user, take away all choice, claim users can't make good decisions and then claim anything control they remove is for the user's benefit. They're a bunch of stinking liers. At this point anyone claiming to be a platform needs to regulated just like we regulate platforms before the internet. I have a friend who works in the compliance department of one of the big international commodity exchanges. They are responsible for regulating the platform (his words) and preventing anything untoward happening, but that also means the company itself cannot "double deal" it can't participate in the markets in anyway. In addition they have two fed watchdogs that do regular invasive audits to ensure that they're actually following the laws and regulations. It's time for internet companies to be put to the same standard: If you call yourself a platform get ready to be treated as such. If you don't wanna be a platform and you have 70%+ of the market get ready to get broken up.
  - rileymat2 7y ago
    > Google wants to infantilize the user, take away all choice, claim users can't make good decisions and then claim anything control they remove is for the user's benefit. As a developer with 18 years experience, I am not sure I have the time to make good decisions. I am not going to audit the code of everything I install by reputation. An average user has no hope.
    - Santosh83 7y ago
      No offence but you seem to have just done exactly what GP accuses Google (and most other big s/w corps to be honest) of doing. I am an average user (in the sense I'm not a professional s/w dev although I do know coding and have a more than normal interest in the inner workings of computers, but most youth are similar anyway. No one is dumb unless they've been trained to relinquish thought), and in two decades of using computers and the Internet I have to say I did not get hoodwinked into installing a single malware or getting a single virus. And uptil at least the last decade s/w wasn't as controlling and infantilising as it has lately become, and I got along just fine. In fact the slight difficulty actually enabled me to learn interesting stuff which modern UX almost totally stonewalls with its opaque "let me hold your hand" interfaces.