4 ms·

If Google actually gave a crap about security, they would let you disable extensions. As it is, I have to routinely delete malicious extensions from every famil

by pkulak 5y ago

If Google actually gave a crap about security, they would let you disable extensions. As it is, I have to routinely delete malicious extensions from every family member's Chromebook. Lord knows how they get there, but they always do. Since this new standard still lets extensions observe everything, I don't see what the point is.

technobabbler 5y ago
Point is they get to make ad blocking harder.
- pkulak 5y ago
  lol, well, yeah.
izacus 5y ago
Chrome allows you to disable installation of extensions via Group Policy for a looong time now: https://security.stackexchange.com/questions/66239/how-to-prevent-installation-of-google-chrome-extensions/192332 https://security.stackexchange.com/questions/66239/how-to-pr...
- wumpus 5y ago
  That's windows-only, right?
  - judge2020 5y ago
    IIRC you can apply it on macOS via MDM / configuration profiles, but that's not as simple as gpedit.msc.
  - izacus 5y ago
    I've seen these restrictions enabled on macOS and ChromeOS as well, so there is a way to manage them.
- pkulak 5y ago
  I'm just not smart enough to figure that out. That first answer references steps that don't exist on any Chromebook I've ever seen. So I assume I have to enroll the machine in a group policy externally? I have no idea. Never been able to figure it out. I usually just end up installing an extension (oh, the irony) that blocks the extensions domain. :/
  - mkl 5y ago
    > That first answer references steps that don't exist on any Chromebook I've ever seen. That's because Group Policies are a Windows-only thing.
    - hda2 5y ago
      So there isn't a way to disable extension installation on anything other than windows?
  - jeroenhd 5y ago
    Chromebooks don't run Windows, so Group Policies won't work for you. You can get the same (and more) control with an Enterprise subscription from Google which seems to cost about $50 per year, per device.
- oliverulerich 5y ago
  but sadly Group Policy is not available on Windows Home edition
  - jeroenhd 5y ago
    In most cases, you can get group policies like these to work if you manually create the registry keys that GPO would create for you. It's more complicated, but it can work.
    - throwawaycuriou 5y ago
      works about as well as taking a pair of scissors to your nightlamp's electrical cable to go to sleep
rektide 5y ago
This post carries a lot of water for user-hating user-blaming anti-extensions. I'm sorry that your family are... having such a hard time making reasonable choices for themselves. I have literally never seen this anywhere, or heard any coworker ever report their family rampantly adding shitty extensions. I tend to see pretty clear & obvious signals about what extensions are good & ok when I go to consume. Bad extensions seem to be discovered fairly quickly & taken down. The world seems no where near as grimdark as you project to me. Alas I think it requires a paid Google Enterprise account, but your family sounds like their need external management of their browsers. That they should, like a school computer, have an administrator & a denylist or perhaps even allowlist of what extensions they can use. This post spreads so much Fear Uncertainty and Doubt. Trying to justifying ending a good thing because some creative user keeps finding a way to misuse, to not listen to sense, to not make good judgement... I find it unfortunate that such heavy fearmongering, such terror at the world is allowed to sway us so heavily. Ultimately I want 3rd party sites hosting extensions. Not Google. And I want moderation teams able to surface claims that some extensions are bad. We need more choice, more democracy, more ability to help each other. Sunlight is the best disinfectant. Simply giving in to the bed-wetting terror of, oh no, freedom & denying ourselves user-agency is intellectual suicide for the web.
- pkulak 5y ago
  > I'm sorry that your family are idiots. Stopped reading there, mate.
  - rektide 5y ago
    I very very quickly edited my words but thanks for sharing. Got flagged anyhow. I'm still absolutely mystified to hear about such huge sorry sad sappy stupid problems occuring with blitzing regularity. I cannot imagine how your people discover trouble so readily. It doesn't sound like you think your family is at all educateable in any way, you seem to think this is a horrible lost cause & that we must withdraw power & good for the world to protect your vulnerable unfortunate hapless brood. That's how defenseless your post makes your people sound, that's the impression you're giving off. And you're using that as a weapon against the world, against good, against freedom, against capabilities. This is extremely menacing a position you've made, using your own family's purported victimization a weapon against good.
jeroenhd 5y ago
You can only signed addons these days, so they must be sourced or at least signed by Google. Especially on Chromebooks which are more restrictive in the software they run. My guess would be that your family members got social engineered into installing that crap ("this web page only works with X, click here to install"), ort their browsers got exploited and hacked (very unlikely!). You'll probably need full MDM to prevent these websites from getting their users to enable extensions. The problem with disabling extensions is that whatever has the capability of pushing extensions into your browser also has the ability to change the settings for addons. The only solution I can think of is to create a Chromium build that cannot run extensions at all.
- dathinab 5y ago
  Remindes me one time one time a old person I sometimes help out got social engineered to enable desktop notifications for a website. And as a non windows user it took me a while to realize that this notifications come from the browser as desktop notifications and disable them. Its still a riddle for me how chrome managed to make it both very obvious and very unclear at the same time that this are websites desktop notifications. (As a counter example I used some sites which used desktop notifications on FF/Andriod instead of making a app just because notifications, that I loved)
NullPrefix 5y ago
This wouldn't happen with proper adblockers. Also, if a user or a malicious script has permission to install extensions, I assume it would also have permission to toggle "enable extensions" setting.
rektide 5y ago
This post carries a lot of water for user-hating user-blaming anti-extensions. I'm sorry that your family are... having such a hard time making reasonable choices for themselves. I have literally never seen this anywhere, or heard any coworker ever report their family rampantly adding shitty extensions. I tend to see pretty clear & obvious signals about what extensions are good & ok when I go to consume. Bad extensions seem to be discovered fairly quickly & taken down. I'm trying to imagine how folks even get to the Chrome Web Store in the first place if they have no idea what they are doing. The world to me seems no where near as grimdark as you project. Alas I think it requires a paid Google Enterprise account, but your family sounds like their need external management of their browsers. That they should, like a school computer, have an administrator & a denylist or perhaps even allowlist of what extensions they can use. This post spreads so much Fear Uncertainty and Doubt. Trying to justifying ending a good thing because some creative user keeps finding a way to misuse, to not listen to sense, to not make good judgement... I find it unfortunate that such heavy fearmongering, such terror at the world is allowed to sway us so heavily. Ultimately I want 3rd party sites hosting extensions. Not Google. And I want moderation teams able to surface claims that some extensions are bad. We need more choice, more democracy, more ability to help each other. Sunlight is the best disinfectant. Simply giving in to the bed-wetting terror of, oh no, freedom & denying ourselves user-agency is intellectual suicide for the web.
- deleted 5y ago
  [deleted]
rektide 5y ago
I'm absolutely mystified to hear about such huge sorry sad sappy stupid problems occuring with blitzing regularity in your tribe. I cannot imagine how your people discover trouble so readily. It doesn't sound like you think your family is at all educateable in any way, you seem to think this is a horrible lost cause & that we must withdraw power & good for the world to protect your vulnerable unfortunate tribe. You're using that as a weapon against the world, against good, against freedom, against capabilities. This is extremely menacing a position you've made, using your own family's purported victimization a weapon against good.

by pkulak 5y ago

technobabbler 5y ago

Point is they get to make ad blocking harder.

pkulak 5y ago
lol, well, yeah.

izacus 5y ago

Chrome allows you to disable installation of extensions via Group Policy for a looong time now: https://security.stackexchange.com/questions/66239/how-to-prevent-installation-of-google-chrome-extensions/192332 https://security.stackexchange.com/questions/66239/how-to-pr...

wumpus 5y ago
That's windows-only, right?
- judge2020 5y ago
  IIRC you can apply it on macOS via MDM / configuration profiles, but that's not as simple as gpedit.msc.
- izacus 5y ago
  I've seen these restrictions enabled on macOS and ChromeOS as well, so there is a way to manage them.
pkulak 5y ago
I'm just not smart enough to figure that out. That first answer references steps that don't exist on any Chromebook I've ever seen. So I assume I have to enroll the machine in a group policy externally? I have no idea. Never been able to figure it out. I usually just end up installing an extension (oh, the irony) that blocks the extensions domain. :/
- mkl 5y ago
  > That first answer references steps that don't exist on any Chromebook I've ever seen. That's because Group Policies are a Windows-only thing.
  - hda2 5y ago
    So there isn't a way to disable extension installation on anything other than windows?
- jeroenhd 5y ago
  Chromebooks don't run Windows, so Group Policies won't work for you. You can get the same (and more) control with an Enterprise subscription from Google which seems to cost about $50 per year, per device.
oliverulerich 5y ago
but sadly Group Policy is not available on Windows Home edition
- jeroenhd 5y ago
  In most cases, you can get group policies like these to work if you manually create the registry keys that GPO would create for you. It's more complicated, but it can work.
  - throwawaycuriou 5y ago
    works about as well as taking a pair of scissors to your nightlamp's electrical cable to go to sleep

rektide 5y ago

This post carries a lot of water for user-hating user-blaming anti-extensions. I'm sorry that your family are... having such a hard time making reasonable choices for themselves. I have literally never seen this anywhere, or heard any coworker ever report their family rampantly adding shitty extensions. I tend to see pretty clear & obvious signals about what extensions are good & ok when I go to consume. Bad extensions seem to be discovered fairly quickly & taken down. The world seems no where near as grimdark as you project to me. Alas I think it requires a paid Google Enterprise account, but your family sounds like their need external management of their browsers. That they should, like a school computer, have an administrator & a denylist or perhaps even allowlist of what extensions they can use. This post spreads so much Fear Uncertainty and Doubt. Trying to justifying ending a good thing because some creative user keeps finding a way to misuse, to not listen to sense, to not make good judgement... I find it unfortunate that such heavy fearmongering, such terror at the world is allowed to sway us so heavily. Ultimately I want 3rd party sites hosting extensions. Not Google. And I want moderation teams able to surface claims that some extensions are bad. We need more choice, more democracy, more ability to help each other. Sunlight is the best disinfectant. Simply giving in to the bed-wetting terror of, oh no, freedom & denying ourselves user-agency is intellectual suicide for the web.

pkulak 5y ago
> I'm sorry that your family are idiots. Stopped reading there, mate.
- rektide 5y ago
  I very very quickly edited my words but thanks for sharing. Got flagged anyhow. I'm still absolutely mystified to hear about such huge sorry sad sappy stupid problems occuring with blitzing regularity. I cannot imagine how your people discover trouble so readily. It doesn't sound like you think your family is at all educateable in any way, you seem to think this is a horrible lost cause & that we must withdraw power & good for the world to protect your vulnerable unfortunate hapless brood. That's how defenseless your post makes your people sound, that's the impression you're giving off. And you're using that as a weapon against the world, against good, against freedom, against capabilities. This is extremely menacing a position you've made, using your own family's purported victimization a weapon against good.

jeroenhd 5y ago

You can only signed addons these days, so they must be sourced or at least signed by Google. Especially on Chromebooks which are more restrictive in the software they run. My guess would be that your family members got social engineered into installing that crap ("this web page only works with X, click here to install"), ort their browsers got exploited and hacked (very unlikely!). You'll probably need full MDM to prevent these websites from getting their users to enable extensions. The problem with disabling extensions is that whatever has the capability of pushing extensions into your browser also has the ability to change the settings for addons. The only solution I can think of is to create a Chromium build that cannot run extensions at all.

dathinab 5y ago
Remindes me one time one time a old person I sometimes help out got social engineered to enable desktop notifications for a website. And as a non windows user it took me a while to realize that this notifications come from the browser as desktop notifications and disable them. Its still a riddle for me how chrome managed to make it both very obvious and very unclear at the same time that this are websites desktop notifications. (As a counter example I used some sites which used desktop notifications on FF/Andriod instead of making a app just because notifications, that I loved)

NullPrefix 5y ago

This wouldn't happen with proper adblockers. Also, if a user or a malicious script has permission to install extensions, I assume it would also have permission to toggle "enable extensions" setting.

rektide 5y ago

This post carries a lot of water for user-hating user-blaming anti-extensions. I'm sorry that your family are... having such a hard time making reasonable choices for themselves. I have literally never seen this anywhere, or heard any coworker ever report their family rampantly adding shitty extensions. I tend to see pretty clear & obvious signals about what extensions are good & ok when I go to consume. Bad extensions seem to be discovered fairly quickly & taken down. I'm trying to imagine how folks even get to the Chrome Web Store in the first place if they have no idea what they are doing. The world to me seems no where near as grimdark as you project. Alas I think it requires a paid Google Enterprise account, but your family sounds like their need external management of their browsers. That they should, like a school computer, have an administrator & a denylist or perhaps even allowlist of what extensions they can use. This post spreads so much Fear Uncertainty and Doubt. Trying to justifying ending a good thing because some creative user keeps finding a way to misuse, to not listen to sense, to not make good judgement... I find it unfortunate that such heavy fearmongering, such terror at the world is allowed to sway us so heavily. Ultimately I want 3rd party sites hosting extensions. Not Google. And I want moderation teams able to surface claims that some extensions are bad. We need more choice, more democracy, more ability to help each other. Sunlight is the best disinfectant. Simply giving in to the bed-wetting terror of, oh no, freedom & denying ourselves user-agency is intellectual suicide for the web.

deleted 5y ago
[deleted]

rektide 5y ago

I'm absolutely mystified to hear about such huge sorry sad sappy stupid problems occuring with blitzing regularity in your tribe. I cannot imagine how your people discover trouble so readily. It doesn't sound like you think your family is at all educateable in any way, you seem to think this is a horrible lost cause & that we must withdraw power & good for the world to protect your vulnerable unfortunate tribe. You're using that as a weapon against the world, against good, against freedom, against capabilities. This is extremely menacing a position you've made, using your own family's purported victimization a weapon against good.