4 ms·

What the bloody hell is Google doing with the $5 we're supposed to pay them for review and submission to the Chrome store if they're not catching this stuff? I'

What the bloody hell is Google doing with the $5 we're supposed to pay them for review and submission to the Chrome store if they're not catching this stuff? I'm a vociferous Chrome user, but one thing I have to give Mozilla credit for above Google is that their add-on review process is free and quick. The unnecessary cost and additional process (e.g. requiring screenshots) are all reasons LikeBuster (https://addons.mozilla.org/en-US/firefox/addon/likebuster-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/likebuster-fo...) is available on Mozilla's Firefox add-on site but needs to be manually installed (http://github.com/relwell/LikeBuster http://github.com/relwell/LikeBuster) for Chrome. Knowing that the extra b.s. doesn't actually accomplish anything for user security really grinds my gears as someone who would like to make it as easy as possible for people to download my extension.

quaunaut 14y ago
It's obvious what it's for. $5 keeps people from quickly and easily just spamming the store with thousands of extensions, while still keeping it cheap enough that anyone can afford. It isn't for doing security screening, there's no way $5 would be worth the time of someone professional enough to look at your code for 20 or 30 minutes, God forbid if it's longer than that.
- tptacek 14y ago
  You're obviously right (by approximately a factor of 50) but let me add: There is a way to make app review "for safety" scale at this price point: be ultra restrictive about what apps are allowed to do, and review them not as much for security as for compliance to API guidelines. •Cough•.
  - jaredsohn 14y ago
    >be ultra restrictive about what apps are allowed to do Chrome does this on some level via host permissions (http://developer.chrome.com/extensions/manifest.html#permissions http://developer.chrome.com/extensions/manifest.html#permiss...) and a content security policy (http://developer.chrome.com/extensions/contentSecurityPolicy.html http://developer.chrome.com/extensions/contentSecurityPolicy...) and is setting a more strict default security as manifest v2 gets phased in.
  - saurik 14y ago
    I would love to hear what restrictions you think you can place on a Turing complete brower extension (a model that already has tons of permissions that apparently aren't enough) would let you know that a sufficiently large subset are sufficiently safe to allow $5/app to be enough to subsidize screening the rest. In this case, this is a browser extension, and the goal is to edit the page: there are tons of such extensions; while a couple of these had obvious "talks to the wrong server" problems, various of them were correctly only editing pages on Facebook, but were doing so maliciously. The price point we are talking about here is simply so low: $5 is only going to purchase 40 minutes of a minimum wage employee... we aren't even talking a junior supervisor at a fast food restaurant, we are talking about the entry-level "try to get the orders in the computer right" position. At these prices, even just reading the description and figuring out "oh, this should only be able to edit pages on this one website" is already going to be expensive. Figuring out "should only be using DOM to remove nodes and not add script elements" is impossible.
    - tptacek 14y ago
      Honestly, I was just making a snarky point about the iOS App Store.
janardanyri 14y ago
Who out there has the tools, time, and expertise to build browser add-ons of general merit but finds $5 and some screenshots to be an insurmountable hurdle? edit: On perusal, I see it's not even $5 per add-on or publish, it's a one-time fee to register as a developer.
- languagehacker 14y ago
  Obstinate people like myself who find pulling out their credit card for unnecessary crap annoying.

quaunaut 14y ago

It's obvious what it's for. $5 keeps people from quickly and easily just spamming the store with thousands of extensions, while still keeping it cheap enough that anyone can afford. It isn't for doing security screening, there's no way $5 would be worth the time of someone professional enough to look at your code for 20 or 30 minutes, God forbid if it's longer than that.

tptacek 14y ago
You're obviously right (by approximately a factor of 50) but let me add: There is a way to make app review "for safety" scale at this price point: be ultra restrictive about what apps are allowed to do, and review them not as much for security as for compliance to API guidelines. •Cough•.
- jaredsohn 14y ago
  >be ultra restrictive about what apps are allowed to do Chrome does this on some level via host permissions (http://developer.chrome.com/extensions/manifest.html#permissions http://developer.chrome.com/extensions/manifest.html#permiss...) and a content security policy (http://developer.chrome.com/extensions/contentSecurityPolicy.html http://developer.chrome.com/extensions/contentSecurityPolicy...) and is setting a more strict default security as manifest v2 gets phased in.
- saurik 14y ago
  I would love to hear what restrictions you think you can place on a Turing complete brower extension (a model that already has tons of permissions that apparently aren't enough) would let you know that a sufficiently large subset are sufficiently safe to allow $5/app to be enough to subsidize screening the rest. In this case, this is a browser extension, and the goal is to edit the page: there are tons of such extensions; while a couple of these had obvious "talks to the wrong server" problems, various of them were correctly only editing pages on Facebook, but were doing so maliciously. The price point we are talking about here is simply so low: $5 is only going to purchase 40 minutes of a minimum wage employee... we aren't even talking a junior supervisor at a fast food restaurant, we are talking about the entry-level "try to get the orders in the computer right" position. At these prices, even just reading the description and figuring out "oh, this should only be able to edit pages on this one website" is already going to be expensive. Figuring out "should only be using DOM to remove nodes and not add script elements" is impossible.
  - tptacek 14y ago
    Honestly, I was just making a snarky point about the iOS App Store.

janardanyri 14y ago

Who out there has the tools, time, and expertise to build browser add-ons of general merit but finds $5 and some screenshots to be an insurmountable hurdle? edit: On perusal, I see it's not even $5 per add-on or publish, it's a one-time fee to register as a developer.

languagehacker 14y ago
Obstinate people like myself who find pulling out their credit card for unnecessary crap annoying.