10 ms·

You know this wouldn't be so much of an issue if Chrome didn't disable the ability to install extensions outside of the web store. As an extension developer it

You know this wouldn't be so much of an issue if Chrome didn't disable the ability to install extensions outside of the web store. As an extension developer its absolutely infuriating to realize that: 1. There is no way to install extensions outside the web store 2. Google won't approve anything to the web store. 3. The vast majority of people use Chrome vs other browsers. ------ I get it, Chrome is Google's browser and they can do what they please with it. However Chromium is open source and it's still impossible to do so. Like thanks Google. I spent months developing an extension only to realize that as it stands today for the majority of developers, the chrome web store is closed for new submissions. And Google didn't even have the courtesy of telling us it's essentially closed, they just string us along with "pending reviews" (for context I've been trying to get my extension approved since February).

servercobra 6y ago
Is it closed to all types of new extensions? Or just certain kinds requiring certain permissions or in certain groups? I hadn't heard about this.
- dmix 6y ago
  You can still install them on Chrome by downloading a directory and loading it via the extensions page (you have to keep the directory around though). Firefox allows you to install .xpi packages directly, just by opening the xpi and clicking "install", after enabling the option to do so in about:debugging (unless you use a development version of Firefox then it's automatically supported). No directory/zips extraction required.
gnicholas 6y ago
At least it’s possible to side load extensions in Chrome. I’ve been more disappointed in Firefox, which doesn’t allow this at all, even in the developer release. The only thing similar to side loading that is allowed is a temporary debug process, which loads an addon but only until the browser is restarted.
- deleted 6y ago
  [deleted]
- riedel 6y ago
  There is an unbranded build of Firefox that allows this even provided by Mozilla.
  - riedel 6y ago
    https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...
- coffeefirst 6y ago
  You can! It's far more annoying, but I've been running a few that I've made for myself In `about:config`, set `xpinstall.signatures.required` to false, and then you can an unsigned bundled extension locally and they'll persist like normal extensions.
  - tacotime 6y ago
    If this is not in the MDN refs anywhere yet, it really should be. I’ve been battling with web-ext for a week now after something mysterious broke that I’ve not yet been able to fix. I’m so glad you posted!
  - gnicholas 6y ago
    It looks like that doesn’t work in the regular version of Firefox – only Nightly, Developer, or one of the unbranded versions. Is that true in your experience?
    - fireattack 6y ago
      You're correct, this doesn't work on stable or beta releases.
    - coffeefirst 6y ago
      Yes, I forgot about this but I'm using the Developer version as my main browser because of that.
ocdtrekkie 6y ago
It's worth noting that the Chrome Web Store is currently full of malware and most malware I see on PCs was installed via the Chrome Web Store. By design, HTTPS does not protect your privacy at all if you have extensions that violate it, since they see what you see after TLS termination. So this is a huge deal, Google is already bad at it, but I can't fault them for heavily restricting extension install: Currently they are way too lax.
- woofie11 6y ago
  You're confusing two things: laxness <--> strictness scale carefulness/competence <--> carelessness / incompetence scale Google tries to do this with automated processes and minimum wage drones, which results in both million dollar extensions being bump AND widespread malware being let through.
  - thephyber 6y ago
    > Google tries to do this with automated processes and minimum wage drones Do you have an alternative suggestion for how they could do it better?
    - ncallaway 6y ago
      Yes, but it involves spending more money.
      - x0x0 6y ago
        Not necessarily? Eg you could sell developer support at $10k/annum with a 3h SLA for escalation to a senior eng. Serious companies with business that rely on chrome plugins would purchase in a second.
    - miohtama 6y ago
      $1000 yearly subscription for the store membership for human curated content.
graham_paul 6y ago
Maybe just maybe, you will consider Firefox. 1. Same or better performance 2. Open source for real not just (pretending to be) Open Source 3. More transparent process 4. No business conflicts Support Firefox if you care about the open web
- wintermutestwin 6y ago
  I use firefox as my primary browser, but I have recently ran into issues with several sites that I need to use. Whenever I contact support, they tell me their site requires Chrome. As it is, I have a Winblows box for gaming only that I put Chrome on, but one day, I am going to be remote and needing Chrome. I don't want google's tentacles on my work laptop, but am starting to worry that I have no choice...
  - driverdan 6y ago
    Which sites? Name and shame. If you absolutely must use Chromium you can use Brave instead. It doesn't solve the extensions issue discussed here but at least it cuts out most of the Google garbage.
    - wintermutestwin 6y ago
      I don't remember them all, but coveredca is one. I thought Brave was yet another scammy project that was showing ads (albeit selectively)
      - simcop2387 6y ago
        I haven't tried it with that site, but I generally find that chromium + changed useragent usually gets passed most checks like that.
      - bsder 6y ago
        Definitely shame coveredca since that is a public service website. Put that one out to some local media, social media, etc.
7ewis 6y ago
Funnily enough, I was actually trying to figure this out today. I created a very basic Extension, to modify the new tab page (as it's something you can't set in G Suite the way we'd like it). I wanted to deploy it our G Suite users, and saw there was an option to deploy via a URL. So I packaged it up in Chrome, put the .crx in an public S3 bucket and set it to force install. Unfortunately it did nothing... is this not possible? Why is it even an option? Eventually ended up paying for a developer account and submitting it for approval (which was actually super fast).
- renewiltord 6y ago
  You can’t have your users “Load Unpacked...”? That always works for me.
  - 7ewis 6y ago
    For testing sure, but this needs to go to just over 1000 people. The only example I can find online on deploying via URL is this: https://support.securly.com/hc/en-us/articles/360036540753-How-to-set-Google-Admin-to-force-load-the-ChromeTools-extension-for-students https://support.securly.com/hc/en-us/articles/360036540753-H... Can't see many official docs on it at all. Now I've gone the Developer route I can see you can create internal apps without having to get them approved so think that's my best option now.
    - compuguy 6y ago
      You have to get it signed and deployed as a internal app first.
    - dotproto 6y ago
      This white paper may help https://support.google.com/chrome/a/answer/9296680?hl=en https://support.google.com/chrome/a/answer/9296680?hl=en At some point I want to put together a simple Node.js server and ExtensionSettings policy to demo a basic working setup, but unfortunately that's back-of-the-bus level backseat at the moment. https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings https://cloud.google.com/docs/chrome-enterprise/policies/?po...
fireattack 6y ago
> There is no way to install extensions outside the web store > The vast majority of people use Chrome vs other browsers. Can you even do it with Firefox any more?
- skykooler 6y ago
  Yes, you can do so through the about:debugging page.
  - fireattack 6y ago
    But you can do the same for Chrome in Developer Mode. What's the difference?
    - kelnos 6y ago
      Unsigned extensions only work on Firefox Nightly and Developer, not Stable or Beta, regardless of what you set in about:config.
tw04 6y ago
Switch to edge? You can install extensions from outside of the store.
aasasd 6y ago
> However Chromium is open source and it's still impossible to do so. I don't know if it's true that the official Chromium or Chrome don't allow sideloading at all—but the rather popular ‘Ungoogled Chromium’ build certainly does (in fact, it probably still doesn't work with the web store directly): https://ungoogled-software.github.io/ungoogled-chromium-binaries/ https://ungoogled-software.github.io/ungoogled-chromium-bina... However, the security of these builds may be questionable.
- Avamander 6y ago
  You can absolutely load unpacked extensions on Chrome, it's just not as convenient.
  - ajayyy 6y ago
    Previously, you could load self-signed crx files as well. This doesn't require developer mode. This was removed around a year ago.
jeroenhd 6y ago
This was made particularly clear to me when I tried to install AdNauseam [1] on Chrome. Google removed the extension from their web store (imagine doing something the user wants, like messing with Google ads, terrible!) so you have to sideload it via the developer options. Now I get a popup every time I open Chrome telling me that there's a dangerous extension with a single click uninstall button. Firefox has its issues (the signing requirements because of malware and invasive antivirus companies suck but I can understand why they exist) but their addons aren't discriminated against. There's addons listing porn sites on there, something for which Google would remove the extension on sight, there's addons that mess with Google and their ads, and the list goes on. The browser is no longer independent from Mozilla, but it still remains much more free than Chrome. [1]: https://adnauseam.io/ https://adnauseam.io/, it's an addon that clicks every ad while still hiding them to fight back against advertisements and break the profile ad companies construct around your interests.
- asquabventured 6y ago
  On chrome you can actually create your own signing key, and then self sign the unpacked extension directory using your key. To remove the pop-up you then need to set up a group policy (on Windows) to trust your self signed extensions. End result is this popup doesn't come up at launch. I think this is so hidden (and not really documented well) as a "fix" that must have been added for companies that use their own internal extensions that don't publish them on the web store. If you can't figure it out from that description I can try to publish a step-by-step on how to accomplish this
jmhyer123 6y ago
edit: nvm
aboodman 6y ago
I think it's just closed for new submissions of apps, right? I hadn't heard anything about extensions.
- dotproto 6y ago
  Correct, apps are depreciated and you can still upload new extensions.
dotproto 6y ago
What's your extension ID?

servercobra 6y ago

Is it closed to all types of new extensions? Or just certain kinds requiring certain permissions or in certain groups? I hadn't heard about this.

dmix 6y ago
You can still install them on Chrome by downloading a directory and loading it via the extensions page (you have to keep the directory around though). Firefox allows you to install .xpi packages directly, just by opening the xpi and clicking "install", after enabling the option to do so in about:debugging (unless you use a development version of Firefox then it's automatically supported). No directory/zips extraction required.

gnicholas 6y ago

At least it’s possible to side load extensions in Chrome. I’ve been more disappointed in Firefox, which doesn’t allow this at all, even in the developer release. The only thing similar to side loading that is allowed is a temporary debug process, which loads an addon but only until the browser is restarted.

deleted 6y ago
[deleted]
riedel 6y ago
There is an unbranded build of Firefox that allows this even provided by Mozilla.
- riedel 6y ago
  https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...
coffeefirst 6y ago
You can! It's far more annoying, but I've been running a few that I've made for myself In `about:config`, set `xpinstall.signatures.required` to false, and then you can an unsigned bundled extension locally and they'll persist like normal extensions.
- tacotime 6y ago
  If this is not in the MDN refs anywhere yet, it really should be. I’ve been battling with web-ext for a week now after something mysterious broke that I’ve not yet been able to fix. I’m so glad you posted!
- gnicholas 6y ago
  It looks like that doesn’t work in the regular version of Firefox – only Nightly, Developer, or one of the unbranded versions. Is that true in your experience?
  - fireattack 6y ago
    You're correct, this doesn't work on stable or beta releases.
  - coffeefirst 6y ago
    Yes, I forgot about this but I'm using the Developer version as my main browser because of that.

ocdtrekkie 6y ago

It's worth noting that the Chrome Web Store is currently full of malware and most malware I see on PCs was installed via the Chrome Web Store. By design, HTTPS does not protect your privacy at all if you have extensions that violate it, since they see what you see after TLS termination. So this is a huge deal, Google is already bad at it, but I can't fault them for heavily restricting extension install: Currently they are way too lax.

woofie11 6y ago
You're confusing two things: laxness <--> strictness scale carefulness/competence <--> carelessness / incompetence scale Google tries to do this with automated processes and minimum wage drones, which results in both million dollar extensions being bump AND widespread malware being let through.
- thephyber 6y ago
  > Google tries to do this with automated processes and minimum wage drones Do you have an alternative suggestion for how they could do it better?
  - ncallaway 6y ago
    Yes, but it involves spending more money.
    - x0x0 6y ago
      Not necessarily? Eg you could sell developer support at $10k/annum with a 3h SLA for escalation to a senior eng. Serious companies with business that rely on chrome plugins would purchase in a second.
  - miohtama 6y ago
    $1000 yearly subscription for the store membership for human curated content.

graham_paul 6y ago

Maybe just maybe, you will consider Firefox. 1. Same or better performance 2. Open source for real not just (pretending to be) Open Source 3. More transparent process 4. No business conflicts Support Firefox if you care about the open web

wintermutestwin 6y ago
I use firefox as my primary browser, but I have recently ran into issues with several sites that I need to use. Whenever I contact support, they tell me their site requires Chrome. As it is, I have a Winblows box for gaming only that I put Chrome on, but one day, I am going to be remote and needing Chrome. I don't want google's tentacles on my work laptop, but am starting to worry that I have no choice...
- driverdan 6y ago
  Which sites? Name and shame. If you absolutely must use Chromium you can use Brave instead. It doesn't solve the extensions issue discussed here but at least it cuts out most of the Google garbage.
  - wintermutestwin 6y ago
    I don't remember them all, but coveredca is one. I thought Brave was yet another scammy project that was showing ads (albeit selectively)
    - simcop2387 6y ago
      I haven't tried it with that site, but I generally find that chromium + changed useragent usually gets passed most checks like that.
    - bsder 6y ago
      Definitely shame coveredca since that is a public service website. Put that one out to some local media, social media, etc.

7ewis 6y ago

Funnily enough, I was actually trying to figure this out today. I created a very basic Extension, to modify the new tab page (as it's something you can't set in G Suite the way we'd like it). I wanted to deploy it our G Suite users, and saw there was an option to deploy via a URL. So I packaged it up in Chrome, put the .crx in an public S3 bucket and set it to force install. Unfortunately it did nothing... is this not possible? Why is it even an option? Eventually ended up paying for a developer account and submitting it for approval (which was actually super fast).

renewiltord 6y ago
You can’t have your users “Load Unpacked...”? That always works for me.
- 7ewis 6y ago
  For testing sure, but this needs to go to just over 1000 people. The only example I can find online on deploying via URL is this: https://support.securly.com/hc/en-us/articles/360036540753-How-to-set-Google-Admin-to-force-load-the-ChromeTools-extension-for-students https://support.securly.com/hc/en-us/articles/360036540753-H... Can't see many official docs on it at all. Now I've gone the Developer route I can see you can create internal apps without having to get them approved so think that's my best option now.
  - compuguy 6y ago
    You have to get it signed and deployed as a internal app first.
  - dotproto 6y ago
    This white paper may help https://support.google.com/chrome/a/answer/9296680?hl=en https://support.google.com/chrome/a/answer/9296680?hl=en At some point I want to put together a simple Node.js server and ExtensionSettings policy to demo a basic working setup, but unfortunately that's back-of-the-bus level backseat at the moment. https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings https://cloud.google.com/docs/chrome-enterprise/policies/?po...

fireattack 6y ago

> There is no way to install extensions outside the web store > The vast majority of people use Chrome vs other browsers. Can you even do it with Firefox any more?

skykooler 6y ago
Yes, you can do so through the about:debugging page.
- fireattack 6y ago
  But you can do the same for Chrome in Developer Mode. What's the difference?
  - kelnos 6y ago
    Unsigned extensions only work on Firefox Nightly and Developer, not Stable or Beta, regardless of what you set in about:config.

tw04 6y ago

Switch to edge? You can install extensions from outside of the store.

aasasd 6y ago

> However Chromium is open source and it's still impossible to do so. I don't know if it's true that the official Chromium or Chrome don't allow sideloading at all—but the rather popular ‘Ungoogled Chromium’ build certainly does (in fact, it probably still doesn't work with the web store directly): https://ungoogled-software.github.io/ungoogled-chromium-binaries/ https://ungoogled-software.github.io/ungoogled-chromium-bina... However, the security of these builds may be questionable.

Avamander 6y ago
You can absolutely load unpacked extensions on Chrome, it's just not as convenient.
- ajayyy 6y ago
  Previously, you could load self-signed crx files as well. This doesn't require developer mode. This was removed around a year ago.

jeroenhd 6y ago

This was made particularly clear to me when I tried to install AdNauseam [1] on Chrome. Google removed the extension from their web store (imagine doing something the user wants, like messing with Google ads, terrible!) so you have to sideload it via the developer options. Now I get a popup every time I open Chrome telling me that there's a dangerous extension with a single click uninstall button. Firefox has its issues (the signing requirements because of malware and invasive antivirus companies suck but I can understand why they exist) but their addons aren't discriminated against. There's addons listing porn sites on there, something for which Google would remove the extension on sight, there's addons that mess with Google and their ads, and the list goes on. The browser is no longer independent from Mozilla, but it still remains much more free than Chrome. [1]: https://adnauseam.io/ https://adnauseam.io/, it's an addon that clicks every ad while still hiding them to fight back against advertisements and break the profile ad companies construct around your interests.

asquabventured 6y ago
On chrome you can actually create your own signing key, and then self sign the unpacked extension directory using your key. To remove the pop-up you then need to set up a group policy (on Windows) to trust your self signed extensions. End result is this popup doesn't come up at launch. I think this is so hidden (and not really documented well) as a "fix" that must have been added for companies that use their own internal extensions that don't publish them on the web store. If you can't figure it out from that description I can try to publish a step-by-step on how to accomplish this

jmhyer123 6y ago

edit: nvm

aboodman 6y ago

I think it's just closed for new submissions of apps, right? I hadn't heard anything about extensions.

dotproto 6y ago
Correct, apps are depreciated and you can still upload new extensions.

dotproto 6y ago

What's your extension ID?