6 ms·

(EDIT: The extension is back up!) I used to work on Mozilla's Add-ons store, and god I hate the reviews. Mozilla used to do them manually. I WORKED there, and

(EDIT: The extension is back up!) I used to work on Mozilla's Add-ons store, and god I hate the reviews. Mozilla used to do them manually. I WORKED there, and wasn't able to get unblocked (for an extension used by almost everyone at Mozilla) because I was using jQuery... which was started by a guy who ALSO worked at Mozilla. So I feel ya completely. The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that. The source code is hidden and updates are pushed to users silently, so a compromised GitHub account could result in a huge hack of everyone's everything. They're far more dangerous than a malicious iPhone app in Apple's app store. Luckily, this seems automated, and seems like they'll fix it. Especially if it gets traction here.

rtpg 6y ago
What's the "good faith" reason for this stuff? Is it that the code itself gets manually reviewed and so you're not supposed to be hiding behind obfuscation?
- AaronFriel 6y ago
  There has been a rash of scurrilous people buying popular Chrome extensions and or paying owners to add malicious code. The malicious code can add third party script references which then behave differently depending on target user or time of access, and these can be credential thefts/keylogging, (very inefficient) cryptocurrency miners, ad injection or participation in click farms, or just general connivery. I'm very glad Google is starting to do source code review on extensions, it's long overdue given the access they have.
- gkoberger 6y ago
  At Mozilla (and this was 10 years ago), you couldn't minify or modify any library. (There were ways to include binaries, but it was complicated.) In this case, they flagged a pattern of unicode that Google felt nobody with good intentions would be using. Turns out, Lodash used that string for something, hence the blocking. It had nothing to do with obfuscation, but rather a good-faith attempt to block bad things. Similar to how you might trigger heavy ratelimits on a request like `wp-admin/index.php`, since it's clearly a bot trying to find vulnerabilities.
  - Dylan16807 6y ago
    > a string that Google felt nobody with good intentions would be using It looks like it triggered on text having too much entropy, which is really reckless on such short sequences. If there's no specific thing it's trying to block, there's less good faith to give credit for.
    - gkoberger 6y ago
      Well, we don't know what happened behind the scenes. Based on the fact that they took down an extension that hadn't been updated in a month, it makes me think a serious vulnerability was discovered behind the scenes in other extensions.
      - Dylan16807 6y ago
        Keep in mind that it triggered on three separate strings. The chance of them all being malware/vulnerability signatures seems pretty low, unless their method for generating those is particularly reckless.
- ajross 6y ago
  Yeah, pretty much. Extensions shouldn't be obfuscated. Would you choose to run code in a privileged context (and "the whole browser" is awfully privileged!) if you suspected the author was hiding something? Same principle. In this case, the review was pretty much correct. The code absolutely looked obfuscated, forcing the author to dig through a bunch of dependencies just to figure out where the offending strings (in HIS OWN EXTENSION!) were coming from. And the answer turned out to be benign. But it sure didn't look benign until a relatively deep analysis was done. Extension reviews aren't supposed to be for deep analysis.
kjrose 6y ago
It's pretty sad that getting any of these automated issues resolved requires this. I get the whole need to be able to properly review extensions before they are in the store. Its such a high security vulnerability. However. Banning an old app suddenly and not really providing any response to deal with it... that's not a good solution.
- ChuckMcM 6y ago
  You know, it sounds to me like a real pain point that could add customer value if it were addressable. As such it suggests that if someone were bright enough to come up with a solution to curating these sorts of things you could add real value that an enterprise customer would pay big money for. It has billion dollar startup written all over it.
  - kjrose 6y ago
    Oh absolutely. This is something I chew over all the time. How can we have a large corporation dealing with the number of users that Amazon/Google/etc are dealing with, as well as the number of malicious parties trying to break them without resorting to either systems that create excessive false negatives and provide little to no appeals process of any use, and without having a massive overhead cost for handling the appeals in a judicially reasonable way. Everytime I work on it, it turns into that it requires more people who are properly trained in almost legal theory, and then you end up quickly with the same problem that many policing and court systems have which is very quickly individuals with an axe to grind work to achieve regulatory capture.
- gkoberger 6y ago
  It's been fewer than 24 hours since this happened, and they send him an email immediately with steps to fix it. It sucks, but remember that Chrome Extensions have basically unlimited power, and Google is doing their best to protect users. [EDIT: And it's resolved! The extension is back]
  - kjrose 6y ago
    Well I'm glad they resolved it so fast. That's excellent.
LeoPanthera 6y ago
> Especially if it gets traction here. Only if gets traction here, history proves.
- dotproto 6y ago
  You're giving HN a bit too much credit.
ic0n0cl4st 6y ago
> The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that. I’ll second that. I worked for a group which was a startup acquired by AVG. They were a data science acquihire so that avg could better monetize the data they’d been collecting from their extensions over the previous decade. Once I found decade old content from my dead father’s browser, I decided to never use an extension again.
beaconstudios 6y ago
> Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that. Seems to me that the solution to that is to make permissions extremely granular and grade the level of review scrutiny an extension gets by its permission granularity. Then, only extensions that want to access or modify something truly sensitive would run the risk of getting smacked down randomly like this (as is always liable to happen with an automated process). Not just "read all websites" but "read the URL only", "read the visuals but not the HTML/CSS", "inject predefined code onto only website X". It also incentivises extensions to ask for less permissions so they can pass review more quickly.
- paultopia 6y ago
  Seriously. It is completely unacceptable that the default level of access has become "everything."
  - gkoberger 6y ago
    To be fair, Chrome has been really restricting access. The past year or two, they've gotten really fine-grained. You have to ask for every permission, and even explain to the reviewer why you need it.
  - JAM1971 6y ago
    > It is completely unacceptable that the default level of access has become "everything." Even on Android (and I presume iPhone) where apps ask for/document their permissions requirements, most people just say "Yes" and move along. Most people have neither the time nor the expertise to critically evaluate whether or not an extension needs any of a dozen permissions. I sympathize, but I have no idea how you can realistically solve this.
    - beaconstudios 6y ago
      it shouldn't be necessary for users to know this because the permission-granting relationship is potentially adversarial, so the user will always be on the back foot unless they're technical/power users. It should be Google's responsibility to ensure that extensions only request the permissions they need.
spideymans 6y ago
>The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that. Probably not going to be all that popular on HN, but this is why I'm very hesitant about using extensions on Firefox (and I suppose Chrome too, but it's been a while since I've used that browser). I'm not going to audit the source code of these extensions, so why should I trust them with privileges to essentially record every website I visit? I wish Chrome and Firefox would adopt a content blocking system similar to Safari, where the author of the ad blocker can essentially tell the browser what content to block, but the ad blocker itself doesn't get any information about user activity. This could exist alongside the existing extension system, in case additional capabilities are needed. Yes this is less powerful than giving the ad blockers content to all the user's browsing history, but I'd happily exchange less effective ad blocking in exchange for enhanced privacy
- MrPatan 6y ago
  I've stopped using extensions altoghether. And I used quite a few back in the day, even made a couple myself. "Hesitant" doesn't convey the level of fear everyone should feel after reading "Has acess to: All data on all websites". Same applies to apps, of course. By the way, I think a pi-hole is safer than an ad-blocker extension, but I'm not sure. What would I be opening myself to if it gets hacked and my DNS server is now the enemy?
  - knome 6y ago
    As long as you don't blithly accept new ssh connection end points or bypass certificate warnings, you should be fine. They could track where you go online via the DNS requests ( the sites at least ), and they could mess with anything unencrypted. Used to be if an HTTPS site loaded an HTTP script resource it provided a dangerous place middlemen could invade your secure session. chrome, IE ( presumably now Edge as well ) and firefox rightfully block mixed content by default, and have for some time https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_... ( the mentioned Firefox 23 came out in 2013, so like I said, a while )
LaundroMat 6y ago
Funnily enough, the MDN documentation about extensions mentions using jQuery. (See the paragraph above this: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_scripts#webextension_apis https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...)

rtpg 6y ago

What's the "good faith" reason for this stuff? Is it that the code itself gets manually reviewed and so you're not supposed to be hiding behind obfuscation?

AaronFriel 6y ago
There has been a rash of scurrilous people buying popular Chrome extensions and or paying owners to add malicious code. The malicious code can add third party script references which then behave differently depending on target user or time of access, and these can be credential thefts/keylogging, (very inefficient) cryptocurrency miners, ad injection or participation in click farms, or just general connivery. I'm very glad Google is starting to do source code review on extensions, it's long overdue given the access they have.
gkoberger 6y ago
At Mozilla (and this was 10 years ago), you couldn't minify or modify any library. (There were ways to include binaries, but it was complicated.) In this case, they flagged a pattern of unicode that Google felt nobody with good intentions would be using. Turns out, Lodash used that string for something, hence the blocking. It had nothing to do with obfuscation, but rather a good-faith attempt to block bad things. Similar to how you might trigger heavy ratelimits on a request like `wp-admin/index.php`, since it's clearly a bot trying to find vulnerabilities.
- Dylan16807 6y ago
  > a string that Google felt nobody with good intentions would be using It looks like it triggered on text having too much entropy, which is really reckless on such short sequences. If there's no specific thing it's trying to block, there's less good faith to give credit for.
  - gkoberger 6y ago
    Well, we don't know what happened behind the scenes. Based on the fact that they took down an extension that hadn't been updated in a month, it makes me think a serious vulnerability was discovered behind the scenes in other extensions.
    - Dylan16807 6y ago
      Keep in mind that it triggered on three separate strings. The chance of them all being malware/vulnerability signatures seems pretty low, unless their method for generating those is particularly reckless.
ajross 6y ago
Yeah, pretty much. Extensions shouldn't be obfuscated. Would you choose to run code in a privileged context (and "the whole browser" is awfully privileged!) if you suspected the author was hiding something? Same principle. In this case, the review was pretty much correct. The code absolutely looked obfuscated, forcing the author to dig through a bunch of dependencies just to figure out where the offending strings (in HIS OWN EXTENSION!) were coming from. And the answer turned out to be benign. But it sure didn't look benign until a relatively deep analysis was done. Extension reviews aren't supposed to be for deep analysis.

kjrose 6y ago

It's pretty sad that getting any of these automated issues resolved requires this. I get the whole need to be able to properly review extensions before they are in the store. Its such a high security vulnerability. However. Banning an old app suddenly and not really providing any response to deal with it... that's not a good solution.

ChuckMcM 6y ago
You know, it sounds to me like a real pain point that could add customer value if it were addressable. As such it suggests that if someone were bright enough to come up with a solution to curating these sorts of things you could add real value that an enterprise customer would pay big money for. It has billion dollar startup written all over it.
- kjrose 6y ago
  Oh absolutely. This is something I chew over all the time. How can we have a large corporation dealing with the number of users that Amazon/Google/etc are dealing with, as well as the number of malicious parties trying to break them without resorting to either systems that create excessive false negatives and provide little to no appeals process of any use, and without having a massive overhead cost for handling the appeals in a judicially reasonable way. Everytime I work on it, it turns into that it requires more people who are properly trained in almost legal theory, and then you end up quickly with the same problem that many policing and court systems have which is very quickly individuals with an axe to grind work to achieve regulatory capture.
gkoberger 6y ago
It's been fewer than 24 hours since this happened, and they send him an email immediately with steps to fix it. It sucks, but remember that Chrome Extensions have basically unlimited power, and Google is doing their best to protect users. [EDIT: And it's resolved! The extension is back]
- kjrose 6y ago
  Well I'm glad they resolved it so fast. That's excellent.

LeoPanthera 6y ago

> Especially if it gets traction here. Only if gets traction here, history proves.

dotproto 6y ago
You're giving HN a bit too much credit.

ic0n0cl4st 6y ago

beaconstudios 6y ago

> Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that. Seems to me that the solution to that is to make permissions extremely granular and grade the level of review scrutiny an extension gets by its permission granularity. Then, only extensions that want to access or modify something truly sensitive would run the risk of getting smacked down randomly like this (as is always liable to happen with an automated process). Not just "read all websites" but "read the URL only", "read the visuals but not the HTML/CSS", "inject predefined code onto only website X". It also incentivises extensions to ask for less permissions so they can pass review more quickly.

paultopia 6y ago
Seriously. It is completely unacceptable that the default level of access has become "everything."
- gkoberger 6y ago
  To be fair, Chrome has been really restricting access. The past year or two, they've gotten really fine-grained. You have to ask for every permission, and even explain to the reviewer why you need it.
- JAM1971 6y ago
  > It is completely unacceptable that the default level of access has become "everything." Even on Android (and I presume iPhone) where apps ask for/document their permissions requirements, most people just say "Yes" and move along. Most people have neither the time nor the expertise to critically evaluate whether or not an extension needs any of a dozen permissions. I sympathize, but I have no idea how you can realistically solve this.
  - beaconstudios 6y ago
    it shouldn't be necessary for users to know this because the permission-granting relationship is potentially adversarial, so the user will always be on the back foot unless they're technical/power users. It should be Google's responsibility to ensure that extensions only request the permissions they need.

spideymans 6y ago

>The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that. Probably not going to be all that popular on HN, but this is why I'm very hesitant about using extensions on Firefox (and I suppose Chrome too, but it's been a while since I've used that browser). I'm not going to audit the source code of these extensions, so why should I trust them with privileges to essentially record every website I visit? I wish Chrome and Firefox would adopt a content blocking system similar to Safari, where the author of the ad blocker can essentially tell the browser what content to block, but the ad blocker itself doesn't get any information about user activity. This could exist alongside the existing extension system, in case additional capabilities are needed. Yes this is less powerful than giving the ad blockers content to all the user's browsing history, but I'd happily exchange less effective ad blocking in exchange for enhanced privacy

MrPatan 6y ago
I've stopped using extensions altoghether. And I used quite a few back in the day, even made a couple myself. "Hesitant" doesn't convey the level of fear everyone should feel after reading "Has acess to: All data on all websites". Same applies to apps, of course. By the way, I think a pi-hole is safer than an ad-blocker extension, but I'm not sure. What would I be opening myself to if it gets hacked and my DNS server is now the enemy?
- knome 6y ago
  As long as you don't blithly accept new ssh connection end points or bypass certificate warnings, you should be fine. They could track where you go online via the DNS requests ( the sites at least ), and they could mess with anything unencrypted. Used to be if an HTTPS site loaded an HTTP script resource it provided a dangerous place middlemen could invade your secure session. chrome, IE ( presumably now Edge as well ) and firefox rightfully block mixed content by default, and have for some time https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_... ( the mentioned Firefox 23 came out in 2013, so like I said, a while )

LaundroMat 6y ago

Funnily enough, the MDN documentation about extensions mentions using jQuery. (See the paragraph above this: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_scripts#webextension_apis https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...)