9 ms·

But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with th

But you're completely ignoring the point that even without the all http(s) permission they will still be kicked off the store, so that has nothing do do with the issue at hand. If localhost is the issue, Google could literally respond exactly the way you did and the problem is gone, "why do you need http://localhost/?" http://localhost/?" This isn't about permissions at all. This is about communication and whether it's worth putting effort and trust into a company that acts like this as SOP.

geofft 6y ago
That's the thing I'm sympathetic to - having fixed the bug, it's frustrating that it's not clear what the next steps are. But given that they had the bug, Chrome was absolutely in the right to deny them the first time. And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong, if extensions that go "oh hey, we don't actually need access to literally every website, imagine that, oops!" is what you expect out of good, competent, non-malicious extension authors, I have a lot of trouble disagreeing with their conclusion, in practice. (Would it be better if Chrome said "There are 200,000 extensions on the Chrome store, each and every one of them deserves attention, we need to spend at least 30 minutes looking at each one and composing a response, we have a ten-person team, we'll get back to you within 5 years?")
- csours 6y ago
  The tool could tell them what the problem is. There are fine grained permissions, and Google could say which of those fine grained permissions are used badly. OR, they could just restrict those permissions themselves in the browser.
  - Filligree 6y ago
    If it did, it'd be easy for malware authors to work around the scanner. The system we've got right now isn't great, but I've yet to see any better ideas.
    - bentcorner 6y ago
      Couldn't malware authors start from the other direction? Create a no-op extension with no permissions and gradually add things until it's no longer approved.
      - IG_Semmelweiss 6y ago
        No. This gets you banned.
        mirimir 6y ago
        Is that really true?
        thejynxed 6y ago
        Only years later, as in the case of a certain Vietnamese hacking group that did exactly this starting at the end of 2015 and didn't have their apps yanked until Nov & Dec of 2019 and another batch located & yanked only last month, well after any and all damage was already done to those who used the apps.
        mirimir 6y ago
        Well, I meant for devs who are doing it innocently ;) The fact that it took four years in your example implies that permission shaving isn't hugely risky for devs.
        labawi 6y ago
        Malware authors can register a dozen or thousand throwaway accounts (probably not super easy but not hard either). It's the honest developers that get their meaningful accounts banned.
    - laughinghan 6y ago
      I don't understand what you're talking about. If the scanner looks for extension with permissions for all your web browsing activity, so malware authors stop asking for permissions for all your browsing activity...isn't that great news?
- moron4hire 6y ago
  Google could afford to hire more than 10 people, and I doubt there are 200,000 unique ways extensions could be wrong.
- deleted 6y ago
  [deleted]
- kelnos 6y ago
  I can only assume that this isn't the result of a human flagging Pushbullet like this; I expect it's an automated system. And if that automated system can make a decision to flag the extension, it could also include in the email specifically what caused that flagging to happen. At this point I'm really starting to become unsympathetic to the idea that they can't tell you what you're doing wrong because it'll enable people to figure out ways to work around the flagging algorithm. I kinda just don't care anymore. If you're going to run a platform like this and capriciously threaten to kick people off of it, it's pretty antisocial to hide the reasons why. (And yes, I know, Google has no obligation to do anything differently here. But I can perfectly well think they suck for their current practices.)
  - tomlagier 6y ago
    Sure, it's anti-social. But is it more or less anti-social than running a huge software platform that advertises the ways to exploit itself? I think it's a very interesting question. Who is more deserving of a good experience - uninformed users who might get taken advantage of by malicious extensions, or developers for the platform, who definitely do get taken advantage of by virtue of running afoul of rules they can't read? Even if the average damage to a user is very low, the ratio of users to developers is massive.
    - SftwrSvior81 6y ago
      > But is it more or less anti-social than running a huge software platform that advertises the ways to exploit itself? Security through obscurity is no security at all. Google is not doing its user a favor by hiding the criteria it uses to determine whether an extension is malicious or not. Also, just because Google won't publish the criteria, it does not mean that it can't be discovered by someone with enough determination. I think that a malicious actor is more likely to spend the necessary time and effort to do so than a developer who is more interested in creating an extension that will serve its users well. If anything, these types of policies drive away developers who act in good faith and leave the marketplace with more developers who are looking to exploit the users.
- arcticbull 6y ago
  > That's the thing I'm sympathetic to - having fixed the bug, it's frustrating that it's not clear what the next steps are. That may not have been the bug, your guess is as good as literally anyone's right now. That's the issue at hand.
  - geofft 6y ago
    By "the bug" I mean the fact that they're asking for permissions on any site when they don't need them - which is a bug (and a serious one) whether or not Chrome notices.
    - tastroder 6y ago
      I'm not sure I get your point, yes that permission was overreaching but they fixed that and were still rejected and left in limbo without Google's system giving them enough specific information to reliably mitigate whatever it is the system did not like.
      - pvg 6y ago
        They haven't fixed the localhost thing which is in a roughly similar category. Google's response was vague and poor but the problems this extension had are quite serious. More serious than, say, Zoom's recent ones.
        tastroder 6y ago
        The theoretical problems that are also hypothetical because the browser vendor isn't specifically saying that it's what they take issue with here even after the developer tried to mitigate it? And which is apparently pretty common with the prescribed best practice being buggy and badly documented as per the thread below? I'm fine with putting some blame on the extension developers here but this communication by Google is pretty abysmal and for all practical purposes more worrying to me than overreaching permissions that have apparently not impacted security in the real world at this point. The thread below indicates that the localhost thing was/is pretty standard for some use cases, if Google wants that changed they could just communicate it clearly, openly, and with a good upgrade path. Not with vague, unspecific "do something or you're out" messages. Even a few links to documentation that likely didn't exist when this was first implemented would be fine here to change the odd messaging to something actionable.
- pdonis 6y ago
  > given that they had the bug, Chrome was absolutely in the right to deny them the first time Sure, but if that bug gets fixed, why reject the fix? Also, if that's the bug that was the concern, it would certainly be nice to have something in the email along the lines of "We don't want extensions to ask for access to every website anywhere on the Internet, so please narrow your http and https permission request." > they're too busy to explain to everyone what they're doing wrong If a human flagged this, how much longer would it have taken to add the sentence above to the email? Or even write that instead of the useless generic boilerplate that's in the email? If, OTOH, an automated bot flagged this (which is what I suspect, and what others seem to suspect too), why didn't whoever wrote the automated bot put at least some kind of clue in the script that writes the email? Something like "if bad thing #6 is found, add text XYZ to the email".
- TallGuyShort 6y ago
  >> That's the thing I'm sympathetic to - having fixed the bug, it's frustrating that it's not clear what the next steps are. Well therein lies the problem. We don't even know that's what they had a problem with in the first place. It's not clear that it IS "the bug".
- zobzu 6y ago
  Honestly i wouldnt give them the excuse. they have more than anyone else to be able to either: - automate this with a message that tells you what thing is dangerous or at least: - automatically push to a human that will spend 30 real minutes on it for extensions that have many users/popular (that sounds like the basic thing any business would do!)
- pineaux 6y ago
  Would it be better if Chrome said "There are 200,000 extensions on the Chrome store, each and every one of them deserves attention, we need to spend at least 30 minutes looking at each one and composing a response, we have a ten-person team, we'll get back to you within 5 years?" Yeah, but with 100 people it would take only a few months and after that it would take far less people to maintain everything. Also, they could just have their algorithm do the flagging and then have a team of 10/20 people to handle users. It's just that they don't care (enough) Not all 200.000 extensions are being killed in the next 14 days. Also if this is done for security reasons then put this responsibility with your security team and make that team bigger.
  - kolinko 6y ago
    Apple manages to do it somehow - when you get rejected, you can discuss the rejection reason if I remember correctly. Also, from 200k extensions probably most have less than five users, so they could prioritize those that have traction.
    - creato 6y ago
      I see a lot of threads on HN discussing complaints about how locked down Apple is. I suspect many of the extensions that are problematic for Google never would have even been allowed into Apple's ecosystem in the first place. In general, Safari's extension system is more restricted than Chrome's, and changes that Chrome is attempting to make to be more similar to Safari's approach result in fierce backlash exactly like this thread (e.g. https://www.wired.com/story/google-chrome-ad-blockers-extensions-api/ https://www.wired.com/story/google-chrome-ad-blockers-extens...).
  - SparklingCotton 6y ago
    Well of course they are using some sort of "lint" system and they know the reason. Why not give the information to the user? There is no need to use any manual labor here.
- sam_goody 6y ago
  > we have a ten-person team, we'll get back to you within 5 years? It is TOTALLY not OK to have a ten person team (and I have no way to know if they even have that). Considering the fact that the browser platform is now a real service required by billions of people, they should be responsible to have enough staff to handle extensions properly. Aside from the amount of money the Chrome extensions make them, the amount of influence it buys them, and the amount of damage it can do, it should be required of them to have a real team to handle it. Imagine if the I ran a private airlines that provided service for 4 billion people around the world, and the entire team that inspects, approves, and monitors the pilots and co-pilots had ten people. Would you think that is acceptable, or would you expect multiple governments to intervene?
  - creato 6y ago
    > Considering the fact that the browser platform is now a real service required by billions of people, they should be responsible to have enough staff to handle extensions properly. Extentions don't have to exist at all. At least for a very long time, there were no extensions for Chrome on Android (not sure about now but that may still be the case). I suspect google would love to just deprecate all extensions entirely, they're probably a massive headache for them (as this thread shows). A lot of things Google used to do that attracted geeks like us are really a problematic thing when the average masses of people are using them. Google is learning that the hard way, and the process of fixing that pisses off us geeks. Apple took a different path of locking things down more aggressively earlier, and a lot of geeks (myself included) hated them for it. Now, after we're seeing how the modern world is so incredibly tech illiterate and how security issues are affecting the world, I think Apple got this right and Google got it wrong, and Google knows it and is trying to fix it, which is pissing us off in the same way Apple used to piss us off (but we apparently got over it).
    - CathedralBorrow 6y ago
      > Extentions don't have to exist at all. This feels like an empty statement. Browsers don't have to exist at all. Computers don't either. If Chrome dropped all extension support, I would drop Chrome. It's a valuable feature for me and millions of users.
- RNCTX 6y ago
  > we have a ten-person team, we'll get back to you within 5 years?" I'm of the opinion that a company with revenues > 30 billion dollars per quarter could afford to increase the ten person team ten-fold to get the response time to a reasonable number.
- eastendguy 6y ago
  I think most commercial extension authors would be happy to pay 99US$/year to get real support when they need it. Just like in the iOS app store.
- tripzilch 6y ago
  > But given that they had the bug, Chrome was absolutely in the right to deny them the first time. This is not a given at all. Google's communication was and is absolutely unclear on what is their problem. And if you'd take their communication on their word (dumb idea), they have been pretty clear that this was in fact not, "the bug", and that is has in fact not "been fixed". Regardless of your (and my) opinion about apps requiring access to every site on the www -- Google did exactly the opposite of indicating that this was the problem why PushBullet is threatened to get kicked off the Play Store.
- vpmpaul 6y ago
  How many of those extensions have 1mil+ users though. Its called prioritizing. The fact that they treat popular extensions just like one that tom wrote for him and his family to share pictures is poor mgmt. They are making money so there should be more accountability on Google's part even if they dont "have" to .
- outworlder 6y ago
  > But given that they had the bug, Chrome was absolutely in the right to deny them the first time. Except they didn't and the extension was sitting at the store for a long time now. > And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong Maybe not, but after a couple of instances of back and forth they should take 1 minute to write a couple of sentences. There are limits to automation.
lucideer 6y ago
Google's customer service is pretty terrible across the board and it seems their review process is no exception, but even so, reading the account of the above issue with domain access does not imbue in me a sense that the developer of this extension is competent. It would not surprise me in the slightest if there are many many other issues with this extension's code.

geofft 6y ago

That's the thing I'm sympathetic to - having fixed the bug, it's frustrating that it's not clear what the next steps are. But given that they had the bug, Chrome was absolutely in the right to deny them the first time. And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong, if extensions that go "oh hey, we don't actually need access to literally every website, imagine that, oops!" is what you expect out of good, competent, non-malicious extension authors, I have a lot of trouble disagreeing with their conclusion, in practice. (Would it be better if Chrome said "There are 200,000 extensions on the Chrome store, each and every one of them deserves attention, we need to spend at least 30 minutes looking at each one and composing a response, we have a ten-person team, we'll get back to you within 5 years?")

csours 6y ago
The tool could tell them what the problem is. There are fine grained permissions, and Google could say which of those fine grained permissions are used badly. OR, they could just restrict those permissions themselves in the browser.
- Filligree 6y ago
  If it did, it'd be easy for malware authors to work around the scanner. The system we've got right now isn't great, but I've yet to see any better ideas.
  - bentcorner 6y ago
    Couldn't malware authors start from the other direction? Create a no-op extension with no permissions and gradually add things until it's no longer approved.
    - IG_Semmelweiss 6y ago
      No. This gets you banned.
      - mirimir 6y ago
        Is that really true?
        thejynxed 6y ago
        Only years later, as in the case of a certain Vietnamese hacking group that did exactly this starting at the end of 2015 and didn't have their apps yanked until Nov & Dec of 2019 and another batch located & yanked only last month, well after any and all damage was already done to those who used the apps.
        mirimir 6y ago
        Well, I meant for devs who are doing it innocently ;) The fact that it took four years in your example implies that permission shaving isn't hugely risky for devs.
      - labawi 6y ago
        Malware authors can register a dozen or thousand throwaway accounts (probably not super easy but not hard either). It's the honest developers that get their meaningful accounts banned.
  - laughinghan 6y ago
    I don't understand what you're talking about. If the scanner looks for extension with permissions for all your web browsing activity, so malware authors stop asking for permissions for all your browsing activity...isn't that great news?
moron4hire 6y ago
Google could afford to hire more than 10 people, and I doubt there are 200,000 unique ways extensions could be wrong.
deleted 6y ago
[deleted]
kelnos 6y ago
I can only assume that this isn't the result of a human flagging Pushbullet like this; I expect it's an automated system. And if that automated system can make a decision to flag the extension, it could also include in the email specifically what caused that flagging to happen. At this point I'm really starting to become unsympathetic to the idea that they can't tell you what you're doing wrong because it'll enable people to figure out ways to work around the flagging algorithm. I kinda just don't care anymore. If you're going to run a platform like this and capriciously threaten to kick people off of it, it's pretty antisocial to hide the reasons why. (And yes, I know, Google has no obligation to do anything differently here. But I can perfectly well think they suck for their current practices.)
- tomlagier 6y ago
  Sure, it's anti-social. But is it more or less anti-social than running a huge software platform that advertises the ways to exploit itself? I think it's a very interesting question. Who is more deserving of a good experience - uninformed users who might get taken advantage of by malicious extensions, or developers for the platform, who definitely do get taken advantage of by virtue of running afoul of rules they can't read? Even if the average damage to a user is very low, the ratio of users to developers is massive.
  - SftwrSvior81 6y ago
    > But is it more or less anti-social than running a huge software platform that advertises the ways to exploit itself? Security through obscurity is no security at all. Google is not doing its user a favor by hiding the criteria it uses to determine whether an extension is malicious or not. Also, just because Google won't publish the criteria, it does not mean that it can't be discovered by someone with enough determination. I think that a malicious actor is more likely to spend the necessary time and effort to do so than a developer who is more interested in creating an extension that will serve its users well. If anything, these types of policies drive away developers who act in good faith and leave the marketplace with more developers who are looking to exploit the users.
arcticbull 6y ago
> That's the thing I'm sympathetic to - having fixed the bug, it's frustrating that it's not clear what the next steps are. That may not have been the bug, your guess is as good as literally anyone's right now. That's the issue at hand.
- geofft 6y ago
  By "the bug" I mean the fact that they're asking for permissions on any site when they don't need them - which is a bug (and a serious one) whether or not Chrome notices.
  - tastroder 6y ago
    I'm not sure I get your point, yes that permission was overreaching but they fixed that and were still rejected and left in limbo without Google's system giving them enough specific information to reliably mitigate whatever it is the system did not like.
    - pvg 6y ago
      They haven't fixed the localhost thing which is in a roughly similar category. Google's response was vague and poor but the problems this extension had are quite serious. More serious than, say, Zoom's recent ones.
      - tastroder 6y ago
        The theoretical problems that are also hypothetical because the browser vendor isn't specifically saying that it's what they take issue with here even after the developer tried to mitigate it? And which is apparently pretty common with the prescribed best practice being buggy and badly documented as per the thread below? I'm fine with putting some blame on the extension developers here but this communication by Google is pretty abysmal and for all practical purposes more worrying to me than overreaching permissions that have apparently not impacted security in the real world at this point. The thread below indicates that the localhost thing was/is pretty standard for some use cases, if Google wants that changed they could just communicate it clearly, openly, and with a good upgrade path. Not with vague, unspecific "do something or you're out" messages. Even a few links to documentation that likely didn't exist when this was first implemented would be fine here to change the odd messaging to something actionable.
pdonis 6y ago
> given that they had the bug, Chrome was absolutely in the right to deny them the first time Sure, but if that bug gets fixed, why reject the fix? Also, if that's the bug that was the concern, it would certainly be nice to have something in the email along the lines of "We don't want extensions to ask for access to every website anywhere on the Internet, so please narrow your http and https permission request." > they're too busy to explain to everyone what they're doing wrong If a human flagged this, how much longer would it have taken to add the sentence above to the email? Or even write that instead of the useless generic boilerplate that's in the email? If, OTOH, an automated bot flagged this (which is what I suspect, and what others seem to suspect too), why didn't whoever wrote the automated bot put at least some kind of clue in the script that writes the email? Something like "if bad thing #6 is found, add text XYZ to the email".
TallGuyShort 6y ago
>> That's the thing I'm sympathetic to - having fixed the bug, it's frustrating that it's not clear what the next steps are. Well therein lies the problem. We don't even know that's what they had a problem with in the first place. It's not clear that it IS "the bug".
zobzu 6y ago
Honestly i wouldnt give them the excuse. they have more than anyone else to be able to either: - automate this with a message that tells you what thing is dangerous or at least: - automatically push to a human that will spend 30 real minutes on it for extensions that have many users/popular (that sounds like the basic thing any business would do!)
pineaux 6y ago
Would it be better if Chrome said "There are 200,000 extensions on the Chrome store, each and every one of them deserves attention, we need to spend at least 30 minutes looking at each one and composing a response, we have a ten-person team, we'll get back to you within 5 years?" Yeah, but with 100 people it would take only a few months and after that it would take far less people to maintain everything. Also, they could just have their algorithm do the flagging and then have a team of 10/20 people to handle users. It's just that they don't care (enough) Not all 200.000 extensions are being killed in the next 14 days. Also if this is done for security reasons then put this responsibility with your security team and make that team bigger.
- kolinko 6y ago
  Apple manages to do it somehow - when you get rejected, you can discuss the rejection reason if I remember correctly. Also, from 200k extensions probably most have less than five users, so they could prioritize those that have traction.
  - creato 6y ago
    I see a lot of threads on HN discussing complaints about how locked down Apple is. I suspect many of the extensions that are problematic for Google never would have even been allowed into Apple's ecosystem in the first place. In general, Safari's extension system is more restricted than Chrome's, and changes that Chrome is attempting to make to be more similar to Safari's approach result in fierce backlash exactly like this thread (e.g. https://www.wired.com/story/google-chrome-ad-blockers-extensions-api/ https://www.wired.com/story/google-chrome-ad-blockers-extens...).
- SparklingCotton 6y ago
  Well of course they are using some sort of "lint" system and they know the reason. Why not give the information to the user? There is no need to use any manual labor here.
sam_goody 6y ago
> we have a ten-person team, we'll get back to you within 5 years? It is TOTALLY not OK to have a ten person team (and I have no way to know if they even have that). Considering the fact that the browser platform is now a real service required by billions of people, they should be responsible to have enough staff to handle extensions properly. Aside from the amount of money the Chrome extensions make them, the amount of influence it buys them, and the amount of damage it can do, it should be required of them to have a real team to handle it. Imagine if the I ran a private airlines that provided service for 4 billion people around the world, and the entire team that inspects, approves, and monitors the pilots and co-pilots had ten people. Would you think that is acceptable, or would you expect multiple governments to intervene?
- creato 6y ago
  > Considering the fact that the browser platform is now a real service required by billions of people, they should be responsible to have enough staff to handle extensions properly. Extentions don't have to exist at all. At least for a very long time, there were no extensions for Chrome on Android (not sure about now but that may still be the case). I suspect google would love to just deprecate all extensions entirely, they're probably a massive headache for them (as this thread shows). A lot of things Google used to do that attracted geeks like us are really a problematic thing when the average masses of people are using them. Google is learning that the hard way, and the process of fixing that pisses off us geeks. Apple took a different path of locking things down more aggressively earlier, and a lot of geeks (myself included) hated them for it. Now, after we're seeing how the modern world is so incredibly tech illiterate and how security issues are affecting the world, I think Apple got this right and Google got it wrong, and Google knows it and is trying to fix it, which is pissing us off in the same way Apple used to piss us off (but we apparently got over it).
  - CathedralBorrow 6y ago
    > Extentions don't have to exist at all. This feels like an empty statement. Browsers don't have to exist at all. Computers don't either. If Chrome dropped all extension support, I would drop Chrome. It's a valuable feature for me and millions of users.
RNCTX 6y ago
> we have a ten-person team, we'll get back to you within 5 years?" I'm of the opinion that a company with revenues > 30 billion dollars per quarter could afford to increase the ten person team ten-fold to get the response time to a reasonable number.
eastendguy 6y ago
I think most commercial extension authors would be happy to pay 99US$/year to get real support when they need it. Just like in the iOS app store.
tripzilch 6y ago
> But given that they had the bug, Chrome was absolutely in the right to deny them the first time. This is not a given at all. Google's communication was and is absolutely unclear on what is their problem. And if you'd take their communication on their word (dumb idea), they have been pretty clear that this was in fact not, "the bug", and that is has in fact not "been fixed". Regardless of your (and my) opinion about apps requiring access to every site on the www -- Google did exactly the opposite of indicating that this was the problem why PushBullet is threatened to get kicked off the Play Store.
vpmpaul 6y ago
How many of those extensions have 1mil+ users though. Its called prioritizing. The fact that they treat popular extensions just like one that tom wrote for him and his family to share pictures is poor mgmt. They are making money so there should be more accountability on Google's part even if they dont "have" to .
outworlder 6y ago
> But given that they had the bug, Chrome was absolutely in the right to deny them the first time. Except they didn't and the extension was sitting at the store for a long time now. > And while I don't like Chrome's position that they're too busy to explain to everyone what they're doing wrong Maybe not, but after a couple of instances of back and forth they should take 1 minute to write a couple of sentences. There are limits to automation.

lucideer 6y ago

Google's customer service is pretty terrible across the board and it seems their review process is no exception, but even so, reading the account of the above issue with domain access does not imbue in me a sense that the developer of this extension is competent. It would not surprise me in the slightest if there are many many other issues with this extension's code.