4 ms·
If you don't like the risk this poses, don't use the extension. Your ability to make informed decisions about risk vs reward keeps getting chipped away when Goo
by fbelzile 6y ago
If you don't like the risk this poses, don't use the extension. Your ability to make informed decisions about risk vs reward keeps getting chipped away when Google pulls this kind of stuff off. Google should warn you about the security risks (edit: or just remove it from the public facing store and only keep the hard to guess URL active) but don't tell me what extensions I'm allowed to use or not. Even adding local extensions I make myself are treated like a security threat with a popup every time I open Chrome.
Stop the helicopter computing. People keep saying they want the old Internet back, this is why.
- SamBam 6y agoI disagree with this stance. Pulling extensions that have a large potential for abuse is absolutely in Google's prerogative, in my opinion. Suppose our single maintainer decided to finally sell the extension, and the person who bought it made it so that all those links hijacked information or exposed you to malware. This would happen in one day without warning. How many people would be saying that was Google's fault for allowing this to happen? You say people should determine for themselves based on risk, but most users of Chrome extensions are naive when it comes to understanding risk.
- throwaway2048 6y agoSurely if this was the reason Google pulled the extension, they would say so. They wouldn't be making it about the description being too detailed. While this may be bad, I think it is merely incidental.
- SamBam 6y agoFair point.
- jimmaswell 6y agoGoogle's perogative is to make as much money as possible, not make the web a better place.
- zepto 6y agoYou can level this charge at almost anyone. It might be true in certain ways, but it’s not an informative criticism.
- stjohnswarts 6y agoWith google it's especially true since their entire existence is centered around gathering intelligence on people and then selling ads with it (and also hoarding it for future use)
- zepto 6y agoThat description fits Facebook just as well, which means it doesn’t tell us much about Google.
- fbelzile 6y agoI agree, maybe removing the extension from the public facing web store is a better solution. But at the very least, allow the extension to be installed if you have the "hard to guess" URL. I do this with my app that requires a desktop app to be installed since it requires native app messaging.
- jonas21 6y agoIf you really want to use the extension, you can clone the extension's repo, enable Developer Mode on the extensions page in Chrome, and then load the extension. You can probably do this in under 30 seconds, but it's enough of a barrier to keep naive users from doing it.
- stjohnswarts 6y agoYou're getting downvoted but I agree. It's one thing if the maintainer abuses his power as an extension provider. Quite another if they have a history of putting out a perfectly good extension and google acting like they're guilty before proven innocent.
- dessant 6y agoI don't think you understand the issue. There is an accidental backdoor in the extension. The maintainer can manipulate and access the pages you visit at will, without needing to release a malicious update. All these features can be implemented without the maintainer being able to hack you without a trace, there is no loss of functionality if the security issue is patched.
- fbelzile 6y agoSo you're saying Apple should pull Chrome's permission to run on macOS anytime there's an accidental zero day or vulnerability? If Google wants to act like a platform, it should have some form of escalation with the developer to fix issues instead of complete removal without warning.
- dessant 6y agoNo, I'm not saying that, and the potential issue I have shared has nothing to do with the current takedown of the extension.