5 ms·

My experience of the Chrome Extension submission process

53 points by lcmchris 3y ago

prahladyeri 3y ago
The review process seems quite intimidating as described by the OP. Things like use of localStorage is almost like a given in any extension these days and they ask justification for every permission you ask.
- greggsy 3y ago
  So they should - extensions are very popular with consumers, and are a notoriously effective means of spreading malware. There’s a few current stories on the topic, which is odd, because the problem has been a problem for nearly ten years now. Google spend a lot of money developing extremely effective security research capabilities, while completely ignoring the dumpster fire that is their app and extension stores.
  - robomartin 3y ago
    > while completely ignoring the dumpster fire that is their app and extension stores. This is one of the factors that keeps me away from trying Android phones. I don’t trust Google for anything other than search. And even that has become somewhat questionable over the years. I do trust Apple. Even though I own a couple of them, I don’t care for their computers. As far as phones though, I will not consider anything other than iPhone.
    - zenapollo 3y ago
      Search has become a rotting dumpster that will be fully ablaze soon enough. Works great as a calculator and spell checker though.
  - londons_explore 3y ago
    Thing is... There is pretty much nothing malicious one can do with localstorage.
    - jxf 3y ago
      This isn't accurate. There are any number of XSS attacks that can be performed, which then allow you to look at secrets or tokens in localStorage, for example.
Glench 3y ago
On the flip side, I've never had any serious issues across a bunch of extensions, but sometimes I hear stories. Btw your extension looks really professional — nice job! Are you trying to monetize it?
- lcmchris 3y ago
  I am (at some point)! I actually built this as a somewhat hack to get users whom I can interview. There were 2 existing extensions that had similar features and I built this to replace them.
  - Glench 3y ago
    Oh nice! Maybe you'd be interested in the tool I built to take payments in extensions: https://extensionpay.com https://extensionpay.com
lapcat 3y ago
Related: Another cluster of potentially malicious Chrome extensions (2 days ago) https://news.ycombinator.com/item?id=36240652 https://news.ycombinator.com/item?id=36240652
imadj 3y ago
My experience publishing "HNRelevant" was also straight forward. It was my first time too, and reading others previous experiences had me worried. Last update was approved almost instantly, I had to douple check. Propably because it's quite simple.
paranoidrobot 3y ago
> A good way to inform your users is to combine chrome.runtime.OnUpdateAvailable and chrome.tabs.create(<INSERT blog URL>) . This is terrible behaviour. I can't express how much it frustrates me that every extension and every service thinks it's a great idea to launch new tabs or overlay the screen I'm trying to use with their self promotion about some new update or change they rolled out. Unless there is something I have to know about immediately because there will be significant side effects (data loss, monetary, physical danger, that sort of thing) don't do it.
- lcmchris 3y ago
  I think I am convinced, my wording here definitely does not help ('good' -> 'possible'). For sure a new feature does not warranty intrusive browser behaviour. Will make some edits.
- wahnfrieden 3y ago
  I also dislike it but please blame/advocate for Chrome change rather than devs with zero good options. Google created and maintains these conditions.
- pcthrowaway 3y ago
  It's pretty responsible for devs to at least let us know when they make changes. Complain about it all you want in software where the user controls the update schedule, but extension devs don't have any other way to alert users to changes.
  - lapcat 3y ago
    They could simply badge the extension icon.
    - nazgulsenpai 3y ago
      I assume many hide their extension icons. I do agree with not popping up a new tab or whatever, though.
  - 3y ago
donatj 3y ago
As someone who always has a billion tabs open, I really wanted a tab search. I built one, "Tabasco"[1] a number of years now. Chrome has a sort of built-in search now, but it doesn't support fancy things like quotes or a ! Not operator. Submitting updates almost always take between a couple minutes and an hour to get approved. Been REALLY quick. I wonder if having the absolutely minimal permissions helps with the process. Then a couple years ago I hit > Item has a blank description field, or missing icons or screenshots, and appears to be suspicious. After a couple rounds of beefing up my screenshots and description, I was still getting rejected. Each rejection took a couple days. Eventually, I contacted support asking what I could do. I never even got a response, my extension just got passed out of nowhere. I haven't hit any rejections in the time since. In hindsight, my suspicious of someone thought the name "Tabasco" may I have implied connection to the brand? I thought it was generic enough when I chose it because of the pepper. https://chrome.google.com/webstore/detail/tabasco/apnefdpgaignkblccanndkelkjabjgjh https://chrome.google.com/webstore/detail/tabasco/apnefdpgai...
- lcmchris 3y ago
  Interesting! I concur with your suspicion. In the official docs, it mentioned that the name has to be quite unique. Google Support has never been good so getting no response is also to be expected... Glad you got it fixed though.
tppiotrowski 3y ago
"However, sometimes I find that it does not update properly. On days when I physically see a friend install it, the numbers don’t go up." I have a hard time decoding the statistics dashboard. Every day my extension gets uninstalled more times than installed but the user count remains stable. Why?
Animats 3y ago
I stopped supporting Chrome for an extension when Google started acting like they were in charge of a walled garden. At one point, I had identical code working as an extension for both Firefox and Chrome, and didn't have to do anything extra for Chrome. But Google added new requirements, and it wasn't worth dealing with Google to support an old no-revenue extension.

53 points by lcmchris 3y ago

The review process seems quite intimidating as described by the OP. Things like use of localStorage is almost like a given in any extension these days and they ask justification for every permission you ask.

greggsy 3y ago
So they should - extensions are very popular with consumers, and are a notoriously effective means of spreading malware. There’s a few current stories on the topic, which is odd, because the problem has been a problem for nearly ten years now. Google spend a lot of money developing extremely effective security research capabilities, while completely ignoring the dumpster fire that is their app and extension stores.
- robomartin 3y ago
  > while completely ignoring the dumpster fire that is their app and extension stores. This is one of the factors that keeps me away from trying Android phones. I don’t trust Google for anything other than search. And even that has become somewhat questionable over the years. I do trust Apple. Even though I own a couple of them, I don’t care for their computers. As far as phones though, I will not consider anything other than iPhone.
  - zenapollo 3y ago
    Search has become a rotting dumpster that will be fully ablaze soon enough. Works great as a calculator and spell checker though.
- londons_explore 3y ago
  Thing is... There is pretty much nothing malicious one can do with localstorage.
  - jxf 3y ago
    This isn't accurate. There are any number of XSS attacks that can be performed, which then allow you to look at secrets or tokens in localStorage, for example.

Glench 3y ago

On the flip side, I've never had any serious issues across a bunch of extensions, but sometimes I hear stories. Btw your extension looks really professional — nice job! Are you trying to monetize it?

lcmchris 3y ago
I am (at some point)! I actually built this as a somewhat hack to get users whom I can interview. There were 2 existing extensions that had similar features and I built this to replace them.
- Glench 3y ago
  Oh nice! Maybe you'd be interested in the tool I built to take payments in extensions: https://extensionpay.com https://extensionpay.com

lapcat 3y ago

Related: Another cluster of potentially malicious Chrome extensions (2 days ago) https://news.ycombinator.com/item?id=36240652 https://news.ycombinator.com/item?id=36240652

imadj 3y ago

My experience publishing "HNRelevant" was also straight forward. It was my first time too, and reading others previous experiences had me worried. Last update was approved almost instantly, I had to douple check. Propably because it's quite simple.

paranoidrobot 3y ago

> A good way to inform your users is to combine chrome.runtime.OnUpdateAvailable and chrome.tabs.create(<INSERT blog URL>) . This is terrible behaviour. I can't express how much it frustrates me that every extension and every service thinks it's a great idea to launch new tabs or overlay the screen I'm trying to use with their self promotion about some new update or change they rolled out. Unless there is something I have to know about immediately because there will be significant side effects (data loss, monetary, physical danger, that sort of thing) don't do it.

lcmchris 3y ago
I think I am convinced, my wording here definitely does not help ('good' -> 'possible'). For sure a new feature does not warranty intrusive browser behaviour. Will make some edits.
wahnfrieden 3y ago
I also dislike it but please blame/advocate for Chrome change rather than devs with zero good options. Google created and maintains these conditions.
pcthrowaway 3y ago
It's pretty responsible for devs to at least let us know when they make changes. Complain about it all you want in software where the user controls the update schedule, but extension devs don't have any other way to alert users to changes.
- lapcat 3y ago
  They could simply badge the extension icon.
  - nazgulsenpai 3y ago
    I assume many hide their extension icons. I do agree with not popping up a new tab or whatever, though.
- 3y ago

donatj 3y ago

As someone who always has a billion tabs open, I really wanted a tab search. I built one, "Tabasco"[1] a number of years now. Chrome has a sort of built-in search now, but it doesn't support fancy things like quotes or a ! Not operator. Submitting updates almost always take between a couple minutes and an hour to get approved. Been REALLY quick. I wonder if having the absolutely minimal permissions helps with the process. Then a couple years ago I hit > Item has a blank description field, or missing icons or screenshots, and appears to be suspicious. After a couple rounds of beefing up my screenshots and description, I was still getting rejected. Each rejection took a couple days. Eventually, I contacted support asking what I could do. I never even got a response, my extension just got passed out of nowhere. I haven't hit any rejections in the time since. In hindsight, my suspicious of someone thought the name "Tabasco" may I have implied connection to the brand? I thought it was generic enough when I chose it because of the pepper. https://chrome.google.com/webstore/detail/tabasco/apnefdpgaignkblccanndkelkjabjgjh https://chrome.google.com/webstore/detail/tabasco/apnefdpgai...

lcmchris 3y ago
Interesting! I concur with your suspicion. In the official docs, it mentioned that the name has to be quite unique. Google Support has never been good so getting no response is also to be expected... Glad you got it fixed though.

tppiotrowski 3y ago

"However, sometimes I find that it does not update properly. On days when I physically see a friend install it, the numbers don’t go up." I have a hard time decoding the statistics dashboard. Every day my extension gets uninstalled more times than installed but the user count remains stable. Why?

Animats 3y ago

I stopped supporting Chrome for an extension when Google started acting like they were in charge of a walled garden. At one point, I had identical code working as an extension for both Firefox and Chrome, and didn't have to do anything extra for Chrome. But Google added new requirements, and it wasn't worth dealing with Google to support an old no-revenue extension.