7 ms·

That's what you got out of it? Google doing a good job? They sent an email with no guidance whatsoever. These guys went above and beyond what most developers w

That's what you got out of it? Google doing a good job? They sent an email with no guidance whatsoever. These guys went above and beyond what most developers would've done, which would have been to contact support until they get a clear answer. This only alienates the extension ecosystem. And this was the primary reason I switched to Firefox. Google is the new Microsoft. If I remember correctly, they started Chrome exactly so this very thing wouldn't happen.

megablast 6y ago
This is an unsafe extension that had access to every website but did not need it. Yes, that is what I got too.
danpalmer 6y ago
As mentioned, I think Google have handled it poorly, but their fundamental position – that this extension is incorrectly using permissions – was significantly correct and may prove to be fully correct. Google deserve criticism for the lack of clarity in the communication, they deserve criticism for the lack of human touch, customer support and many other aspects. They do not deserve criticism for calling out incorrect permissions usage and forcing developers to do better.
- munk-a 6y ago
  It's confusing because whatever system (whether human or automated) they're using to flag permission issues has more precise detection abilities than they chose to expose with a simple "Permission is too wide - fix it". The fact that the extension has over broad permission asks isn't good but I think saying their communication lacks clarity is underselling just how opaque they were with their feedback. It also concerns me a bit because it looks like their opaqueness might be an attempt at security via obscurity by trying to cloak what the rules actually are - which is a generally bad approach to trying to fight malevolent actors.
  - danpalmer 6y ago
    It's possible that the flagging has come from user submitted reports. In that case if Google trust the reports (and they have enough data about users to know if reports are likely to be genuine) then they don't necessarily need to know any more details. Alternatively it could be vague to restrict the possibility of bad actors circumventing the letter of the rules without adhering to the spirit of them, or even just protecting themselves from legal repercussions (perceived or real).
    - munk-a 6y ago
      Your later point is the one that concerns me. Organizations like governments have issues where the spirit of the law is valued over the letter due to inertial restrictions over revising the law - when it comes to private corporations the ability to restructure rules remains unless it's explicitly surrendered. In these cases keeping the set of rules exposed to the public (and even demoing changes) can allow revisions to those rules to increase their accuracy. And, when you get right down to it, any rule that isn't well structured will be exploited by bad actors, people looking to roll out malicious browser extensions have a strong motivation to try and discover those rules with a high level of accuracy by testing them - only the good actors remain uninformed.
- tedivm 6y ago
  That may have been true for the first round, but after they fixed those permissions their extension was still rejected.
- prox 6y ago
  Do it properly or don’t do it all is my motto. They could have been more forthcoming from the start. This is mystery meat communication. > the concealment of relevant information over basic practicality and functionality.
  - dan-robertson 6y ago
    I agree mostly. But why shouldn’t the OP extension also be required to “do it properly”? Where should one draw the line?
    - prox 6y ago
      My gripe is that you should always be specific making requests, especially if you dangle something like a complete block of your account towards op but then you don’t say what needs to be done to prevent it. It’s like I tell you get me a book on computer science or Ill fire you you, but I don’t tell you which one. Also I won’t response to any questions from you. Whether OPs extension made him think about it is simply an entirely different matter.
- gwerbret 6y ago
  The problems with your argument are these: a) the extension had been operating for years, unmolested by the Googlebot, with the expanded permission set b) tightening up the permissions did _not_ solve the problem, indicating clearly that whatever the Googlebot was selecting for, it wasn't an incorrect use of permissions.
jlarocco 6y ago
> They sent an email with no guidance whatsoever. Did they, though? The email seemed pretty clear that the problem was requesting more permissions than necessary. I'm no Google fan, by any means, but if it's that hard for the developer to check which permissions their own app is requesting, I don't know if it's Google's fault.
will4274 6y ago
Google sent an email saying they were asking for too many permissions. Pushbullet was asking to observe all website traffic. Google's email was objectively correct. I agree that the second rejection is more surprising, but yes, the first email seems like a case of Google doing a good job. I have very little sympathy for apps that ask for too many permissions.
mrits 6y ago
14 days is an absolutely egregious duration to get a response for a software change. A developer could be out on vacation for that long. Encouraging fast fixes is also irresponsible from a security perspective, which is what they are trying to fix to begin with.

megablast 6y ago

This is an unsafe extension that had access to every website but did not need it. Yes, that is what I got too.

danpalmer 6y ago

As mentioned, I think Google have handled it poorly, but their fundamental position – that this extension is incorrectly using permissions – was significantly correct and may prove to be fully correct. Google deserve criticism for the lack of clarity in the communication, they deserve criticism for the lack of human touch, customer support and many other aspects. They do not deserve criticism for calling out incorrect permissions usage and forcing developers to do better.

munk-a 6y ago
It's confusing because whatever system (whether human or automated) they're using to flag permission issues has more precise detection abilities than they chose to expose with a simple "Permission is too wide - fix it". The fact that the extension has over broad permission asks isn't good but I think saying their communication lacks clarity is underselling just how opaque they were with their feedback. It also concerns me a bit because it looks like their opaqueness might be an attempt at security via obscurity by trying to cloak what the rules actually are - which is a generally bad approach to trying to fight malevolent actors.
- danpalmer 6y ago
  It's possible that the flagging has come from user submitted reports. In that case if Google trust the reports (and they have enough data about users to know if reports are likely to be genuine) then they don't necessarily need to know any more details. Alternatively it could be vague to restrict the possibility of bad actors circumventing the letter of the rules without adhering to the spirit of them, or even just protecting themselves from legal repercussions (perceived or real).
  - munk-a 6y ago
    Your later point is the one that concerns me. Organizations like governments have issues where the spirit of the law is valued over the letter due to inertial restrictions over revising the law - when it comes to private corporations the ability to restructure rules remains unless it's explicitly surrendered. In these cases keeping the set of rules exposed to the public (and even demoing changes) can allow revisions to those rules to increase their accuracy. And, when you get right down to it, any rule that isn't well structured will be exploited by bad actors, people looking to roll out malicious browser extensions have a strong motivation to try and discover those rules with a high level of accuracy by testing them - only the good actors remain uninformed.
tedivm 6y ago
That may have been true for the first round, but after they fixed those permissions their extension was still rejected.
prox 6y ago
Do it properly or don’t do it all is my motto. They could have been more forthcoming from the start. This is mystery meat communication. > the concealment of relevant information over basic practicality and functionality.
- dan-robertson 6y ago
  I agree mostly. But why shouldn’t the OP extension also be required to “do it properly”? Where should one draw the line?
  - prox 6y ago
    My gripe is that you should always be specific making requests, especially if you dangle something like a complete block of your account towards op but then you don’t say what needs to be done to prevent it. It’s like I tell you get me a book on computer science or Ill fire you you, but I don’t tell you which one. Also I won’t response to any questions from you. Whether OPs extension made him think about it is simply an entirely different matter.
gwerbret 6y ago
The problems with your argument are these: a) the extension had been operating for years, unmolested by the Googlebot, with the expanded permission set b) tightening up the permissions did _not_ solve the problem, indicating clearly that whatever the Googlebot was selecting for, it wasn't an incorrect use of permissions.

jlarocco 6y ago

> They sent an email with no guidance whatsoever. Did they, though? The email seemed pretty clear that the problem was requesting more permissions than necessary. I'm no Google fan, by any means, but if it's that hard for the developer to check which permissions their own app is requesting, I don't know if it's Google's fault.

will4274 6y ago

Google sent an email saying they were asking for too many permissions. Pushbullet was asking to observe all website traffic. Google's email was objectively correct. I agree that the second rejection is more surprising, but yes, the first email seems like a case of Google doing a good job. I have very little sympathy for apps that ask for too many permissions.

mrits 6y ago

14 days is an absolutely egregious duration to get a response for a software change. A developer could be out on vacation for that long. Encouraging fast fixes is also irresponsible from a security perspective, which is what they are trying to fix to begin with.