4 ms·

I agree. This is hackernews, so it is easy why devs would feel otherwise, but as a nondev, I represent the the end users. Why would anyone think it is appropr

I agree. This is hackernews, so it is easy why devs would feel otherwise, but as a nondev, I represent the the end users. Why would anyone think it is appropriate for google to reveal their hand, and allow blackhat operators to build apps up to the max limit of permissions? (If they were revealed by google via white glove customer service). If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones. So, Im sorry. No. If its between 1 hacker's inconvenience or in extreme case , livelyhood....and the retirement savings bank account of many grandmas, i am going to side with grandmas. Google is doing many things wrong. Keeping the "red line" of allowable permissions secret, from data-hungry developers.... is not one of them.

laughinghan 6y ago
> If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones. This makes no sense. For the sake of the grandmas, Google already needs to audit every app in the store and separate bad actors from good ones. How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem?
- icer2312 6y ago
  > How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem? Unfortunately, information that helps the good guys get their extensions past the audit check is exactly the same information that helps the bad guys get their extensions in too. The bad guys simply move onto the next security flaw that Google hasn't anticipated. Maybe the bad guys use some common tactics to get their scam extensions in the store which good guys don't, which is easy for Google to detect and flag. If you release a list of known no-no's, the bad guys just get smarter and avoid them. This obviously skews in favour of refusing some good extensions to keep most bad ones out. In terms of Google already auditing every app, check out the source code for Dark Reader https://github.com/darkreader/darkreader https://github.com/darkreader/darkreader. It's fairly complex. I can only imagine how many extensions are as, or more, complex than that. I wonder how much auditing is done manually vs automated.
  - laughinghan 6y ago
    Unfortunately, information that helps the good guys get their extensions past the audit check is exactly the same information that helps the bad guys get their extensions in too. This is just an assertion I'm wrong. It can't possibly persuade me or the people upvoting me. Would you be persuaded by me just asserting you're wrong? In terms of Google already auditing every app, [e.g.] the source code for Dark Reader [is] fairly complex. Firstly, Apple is able to do it, there's no reason to make excuses for Google. See anecdotes elsewhere in the thread about how Apple attaches screengrabs, explains rejections by phone conversation, even decompiles apps to point to exact methods/lines of code in apps they reject from the iOS App Store, even small free ones: https://news.ycombinator.com/item?id=23170498 https://news.ycombinator.com/item?id=23170498 And anyway, without reading a single line of Dark Reader's source code, I can deduce plenty of permissions it shouldn't need, e.g. "cookies" (which it doesn't ask for). Without reading a single line of PushBullet's source code, one can easily deduce it shouldn't need access to "https://*/*" https://*/*", and indeed, it doesn't, yet it asked for it. Can you explain concretely (not just by pointing to unnamed "no-no's") how could harmful side-effects result from Google telling PushBullet that "https://*/*" https://*/*" specifically was in violation? If you release a list of known no-no's, the bad guys just get smarter and avoid them. Firstly, isn't bad guys avoiding no-no's exactly what we want? If you're saying that there may be some, probabilistic red flags that Google uses to find possible bad guys—sure, that could be true, I have no idea and you don't either, you admitted it was speculation. But in this case, "Request access to the narrowest permissions necessary to implement your product’s features or services." is not a probabilistic red flag, it's a hard rule. Again, concretely how could harmful side-effects result from Google pointing out the specific violation?
kd5bjo 6y ago
> If goog did provide guidance on permissions, goog would literally have to audit every app in the store You’re talking about vetting suppliers and products in order to ensure they’re selling safe products that consumers want. That sounds like an ordinary part of every retailer’s job to me.
- IG_Semmelweiss 6y ago
  Huh? How many products are sold at macys which allow its consumer to go perfectly bankrupt due to purchasing? How many products ask for permission to ask for visibility into your bank account info? Your personal travel history? and disclose insight on how they are using this info in a way you can understand. When devs start signing their apps with their full name and information where they live, lets talk.
- IG_Semmelweiss 6y ago
  Please read about convexity or asymetry before saying something like this.
freeone3000 6y ago
If the max list of permissions is somehow objectionable, fix THAT, not keep the list secret.
LorenPechtel 6y ago
As a developer I had the same thought. Revealing the rules tells them what they can get away with.

laughinghan 6y ago

> If goog did provide guidance on permissions, goog would literally have to audit every app in the store, or come up with a way to separate bad actors from good ones. This makes no sense. For the sake of the grandmas, Google already needs to audit every app in the store and separate bad actors from good ones. How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem?

icer2312 6y ago
> How in the world would making it more clear how to write more secure extensions possibly worsen the extension store's malware problem? Unfortunately, information that helps the good guys get their extensions past the audit check is exactly the same information that helps the bad guys get their extensions in too. The bad guys simply move onto the next security flaw that Google hasn't anticipated. Maybe the bad guys use some common tactics to get their scam extensions in the store which good guys don't, which is easy for Google to detect and flag. If you release a list of known no-no's, the bad guys just get smarter and avoid them. This obviously skews in favour of refusing some good extensions to keep most bad ones out. In terms of Google already auditing every app, check out the source code for Dark Reader https://github.com/darkreader/darkreader https://github.com/darkreader/darkreader. It's fairly complex. I can only imagine how many extensions are as, or more, complex than that. I wonder how much auditing is done manually vs automated.
- laughinghan 6y ago
  Unfortunately, information that helps the good guys get their extensions past the audit check is exactly the same information that helps the bad guys get their extensions in too. This is just an assertion I'm wrong. It can't possibly persuade me or the people upvoting me. Would you be persuaded by me just asserting you're wrong? In terms of Google already auditing every app, [e.g.] the source code for Dark Reader [is] fairly complex. Firstly, Apple is able to do it, there's no reason to make excuses for Google. See anecdotes elsewhere in the thread about how Apple attaches screengrabs, explains rejections by phone conversation, even decompiles apps to point to exact methods/lines of code in apps they reject from the iOS App Store, even small free ones: https://news.ycombinator.com/item?id=23170498 https://news.ycombinator.com/item?id=23170498 And anyway, without reading a single line of Dark Reader's source code, I can deduce plenty of permissions it shouldn't need, e.g. "cookies" (which it doesn't ask for). Without reading a single line of PushBullet's source code, one can easily deduce it shouldn't need access to "https://*/*" https://*/*", and indeed, it doesn't, yet it asked for it. Can you explain concretely (not just by pointing to unnamed "no-no's") how could harmful side-effects result from Google telling PushBullet that "https://*/*" https://*/*" specifically was in violation? If you release a list of known no-no's, the bad guys just get smarter and avoid them. Firstly, isn't bad guys avoiding no-no's exactly what we want? If you're saying that there may be some, probabilistic red flags that Google uses to find possible bad guys—sure, that could be true, I have no idea and you don't either, you admitted it was speculation. But in this case, "Request access to the narrowest permissions necessary to implement your product’s features or services." is not a probabilistic red flag, it's a hard rule. Again, concretely how could harmful side-effects result from Google pointing out the specific violation?

kd5bjo 6y ago

> If goog did provide guidance on permissions, goog would literally have to audit every app in the store You’re talking about vetting suppliers and products in order to ensure they’re selling safe products that consumers want. That sounds like an ordinary part of every retailer’s job to me.

IG_Semmelweiss 6y ago
Huh? How many products are sold at macys which allow its consumer to go perfectly bankrupt due to purchasing? How many products ask for permission to ask for visibility into your bank account info? Your personal travel history? and disclose insight on how they are using this info in a way you can understand. When devs start signing their apps with their full name and information where they live, lets talk.
IG_Semmelweiss 6y ago
Please read about convexity or asymetry before saying something like this.

freeone3000 6y ago

If the max list of permissions is somehow objectionable, fix THAT, not keep the list secret.

LorenPechtel 6y ago

As a developer I had the same thought. Revealing the rules tells them what they can get away with.