6 ms·

Chrome Killed UserScripts.org

158 points by twapi 14y ago

nuttendorfer 14y ago
Google also killed user scripts that are self-updating like 4chan x. Before you would just click OK on a popup informing you that there was a new version and you were done. Now you have to drag the downloaded file into a tab with chrome://extensions open. I don't know why Google hasn't left a switch in to deactivate this "security measure". Edit: security measure is between quotes because I don't think anybody on HN would fall for something like that easily.
- shardling 14y ago
  Chrome is generally not about maximizing user choice/control, so from their POV maybe it made more sense to excise the old code.
- danielweber 14y ago
  The scare quotes are unnecessary. This really is a security feature and will undoubtedly help vast numbers of people. A switch would be fine, though. You might submit a patch for that.
  - Karunamon 14y ago
    >This really is a security feature and will undoubtedly help vast numbers of people. This is the worst kind of "feature" (and a colossal personal annoyance), the kind that breaks functionality and/or convenience because some people don't know how to handle their browser. I know how to handle my browser. Why are you making my life harder? How about a switch for big kids who don't need their hands held? Note: If your answer begins with the word "fork", you lose.
    - mayanksinghal 14y ago
      > because some people don't know how to handle their browser Actually their argument is that most people cannot handle their browser. > How about a switch for big kids who don't need their hands held? I think the GP already gave an answer to that. He agrees that there can be a switch. And to submit a patch, you don't have to fork :)
    - deleted 14y ago
      [deleted]
    - Evbn 14y ago
      Actually, you lose. The vast majority of users win.
gkoberger 14y ago
Here's the issue: https://code.google.com/p/chromium/issues/detail?id=128748 https://code.google.com/p/chromium/issues/detail?id=128748 I'm a former add-ons product manager for Firefox. I never would have considered something this drastic (after all, Firefox is about choice, so it wouldn't have even been an option), however fake/malicious/rogue add-ons are a massive problem. If Chrome has a kill switch on every single add-on (and not just the ones uploaded to their site), they can do a better job of stopping malicious add-ons. Add-ons can do a ton of damage, and you'd be amazed how many people click through the install warnings without thinking.
- jamesaguilar 14y ago
  Hell, I'm a techie and even I've caught myself only a few moments before accidentally installing a random extension that for all I know would steal everything including the pots and pans. I can understand why Chrome team is doing this because if I've been close, I shudder to think of what non-tech people have done.
  - eps 14y ago
    Do give an example.
    - jamesaguilar 14y ago
      Well, one time I was browsing this website and an extension install link for something I'd never heard of popped up and I almost clicked it. You mean like that? Or?
- magicalist 14y ago
  Yeah, this isn't a great solution, but it's been surprising the number of Mozilla folks that have come out and said, "this may be the only real solution". They've all said they won't be doing the same thing, but there has sometimes been a strong suggestion of a "yet..." there. I don't think: a) most people realize that extension permissions are not exactly analogous to phone permissions. When you give browser extensions even fairly standard permissions, they can arbitrarily interact with and alter every single thing you see and do in your browser (meanwhile phones are still somewhat protected by their isolated app architectures). There are some mitigation strategies, but the reality is that the only real difference between many userscripts and a keylogger, for instance, is intent on the part of the developer. And how do you detect that? b) I don't think many people reacting to this change (like in this thread) realize how many people are actively installing malware in the form of extensions and are being screwed by them. These aren't hypothetical problems, it is quite widespread (check out the many Mozilla conversations about this). This is the reason Mozilla has been so sympathetic to (and muted about) Google's change here, I think. A dropdown bar and a "are you sure?" are not sufficient. I wish Google would do more (and the "I intend to polish this UI a bit" comment in that bug thread should tell them exactly where they should be focusing their efforts first, not just ignoring it for now), but browser extensions are way too dangerous right now. Downloading the folder and dragging it in kind of sucks, but it's really not that bad in almost all cases (I'm sympathetic to the drop in installations you'll face if you don't want to kowtow to the chrome webstore/mozilla addon approval process, though).
nthitz 14y ago
From the Chromium devs: "we're putting the power back in the user's hands by allowing them to control where extensions are installed from. By default, the Chrome Webstore is the only source, but users and administrators will be able to add other safe sources as they see fit." I don't know if the ability to add other sources has been implemented yet though.
- deleted 14y ago
  [deleted]
- gergles 14y ago
  >Enterprise Administrators: You can specify URLs that are allowed to install extensions, apps, and themes directly through the ExtensionInstallSources policy[1]. [1]: http://www.chromium.org/administrators/policy-list-3#ExtensionInstallSources http://www.chromium.org/administrators/policy-list-3#Extensi... EDIT: I just tried this on my Chrome 23 install and it appears to do nothing.
  - SafdarIqbal 14y ago
    What's the location of the policy file in Linux?
- abraham 14y ago
  Users can still install extensions from any source through drag and drop.
drivebyacct2 14y ago
This was done a while back, was it not? edit: I may not have been thinking clearly, I forget that I stay on the Dev channel.
- qntmfred 14y ago
  yes, i noticed it several weeks ago
ThomW 14y ago
I'm kind of annoyed how it nuked the userscripts I had already installed without any kind of warning. Would have been nice to have the choice before they were all removed.
mediocregopher 14y ago
>We suggest Chrome team to follow Opera’s approach, or at least whitelist UserScripts.org globally. I could be wrong, but I don't think userscripts does any significant culling of their catalog; downloading an arbitrary script from there is just as dangerous as anywhere else. This whole thing is just silly, you have to confirm the installation of a javascript extension. If you accept that it's your responsibility if it turns out to be a keylogger or what have you, not the Chrome team's. They're shooting everyone in the foot because someone might accidentally shoot their eye out.
- skybrian 14y ago
  It's more like adding a safety that actually works (unlike clickthrough warnings). If you know what you're doing, you can do a search and learn how to drag and drop. Anyone who needs handholding for this shouldn't be doing it.
grimgrin 14y ago
Is this not in effect on Chrome Canary? I use two two Hacker News related userscripts, and both are still working. Neither of them ever stopped working. http://userscripts.org/scripts/show/138469 http://userscripts.org/scripts/show/138469 http://userscripts.org/scripts/show/138037 http://userscripts.org/scripts/show/138037
- koenigdavidmj 14y ago
  They work; it's just more convoluted to install them at first.
chocolateboy 14y ago
There are at least two other ways of running userscripts in Chrome, neither of which impose this restriction: Tampermonkey: https://chrome.google.com/webstore/detail/dhdgffkkebhmkfjojejmpbldmpobfkfo https://chrome.google.com/webstore/detail/dhdgffkkebhmkfjoje... Blank Canvas: https://chrome.google.com/webstore/detail/pipnnjjknlabchljabhmnpdfpdobpnkk https://chrome.google.com/webstore/detail/pipnnjjknlabchljab...
- vacipr 14y ago
  Black Canvas hasn't been updated since last year and Tampermonkey seems like a privacy invader.
  - chocolateboy 14y ago
    > Tampermonkey seems like a privacy invader That's a serious allegation. Care to back it up?
    - vacipr 14y ago
      This. http://i.imm.io/E9zF.png http://i.imm.io/E9zF.png Seems like a lot of privileges for an userscript managing extension. Later edit: After a bit of searching I also found that FAQ. They should really put that information on the chrome web store.
      - chocolateboy 14y ago
        "Q300: Tampermonkey can access every page that I visit! Is TM evil?" http://forum.tampermonkey.net/viewtopic.php?t=78 http://forum.tampermonkey.net/viewtopic.php?t=78
      - charliesome 14y ago
        > This. http://i.imm.io/E9zF.png http://i.imm.io/E9zF.png Seems like a lot of privileges for an userscript managing extension. Well, no shit. How is TamperMonkey supposed to install extensions that require more privileges than itself? It needs full permissions because it allows scripts you install full access.
mrng 14y ago
You can easily unpack any extension you've downloaded, and install them manually (Check Developer mode > Load unpacked extension).
teh_klev 14y ago
"I’m very disappointed to find that users can’t install userscripts directly from the UserScripts.org – first they need to save the JS file locally and then drag the file onto the Extensions page (chrome://chrome/extensions/)." Bit of a misleading headline then?
- Nerdfest 14y ago
  Yes, hopefully they haven't pulled a full Apple, like Microsoft has with their 'Metro' store. I don't think I can ever forgive them for making that sort of lock-down acceptable.
DanielRibeiro 14y ago
Note that you still can use userscripts[1], however you have to drag the crx file into the extensions window, manually. But userscripts.org's convenience was killed with this change. A change I find to be very unfortunate. [1] https://github.com/defunkt/dotjs/issues/73 https://github.com/defunkt/dotjs/issues/73
jdechko 14y ago
An overreacting headline, no doubt. But reading the article, UserScripts.org hasn't been killed, but the convenience factor is severely neutered.
- humpolec 14y ago
  Also, userscripts are still perfectly usable under Firefox's Greasemonkey, as well as Opera.
mindslight 14y ago
Try for an actual solution whereby most scripts have a few fine-grained capabilities or can only modify specific sites? Better UIs so that people are informed of what an addon is capable of? nah... Security is hard; let's make shopping!
- aboodman 14y ago
  We have that: http://www.chromium.org/developers/design-documents/user-scripts http://www.chromium.org/developers/design-documents/user-scr.... See @match. Not enough users read or care about fine-grained capabilities.
  - mindslight 14y ago
    How good is the UI that points out the contraction of "Facebook style changer" wanting to modify all sites? And does this dialog include a warning for extensions that are able to record all activities and phone them home to third party servers, a combination of capabilities that most extensions should not need? There's certainly underlying work that needs to be done to make the latter a reality, but at least trying to solve the problem is better than giving up and falling back to centralized computing. It's true that users have been desensitized to important decisions through an onslaught of mswin uninformed-consent OK/Cancel dialogs, but at some point they have to be responsible for sensible security decisions (even if that just means downloading Chromium from google.com and not google.com.ojwqodkja.ru). The only way to completely protect a user from themselves is to revert their computer into an unmodifiable display terminal, an idea that should be appalling to anybody who values the concept of a personal computer.
rryan 14y ago
From the bug report it looks like they will allow users to choose safe software sources. Presumably this means you could add userscripts to this list and regain the old functionality. It's just not done yet. This change was made to protect users. Off-store extensions have become a popular attack vector for compromising users of larger sites (e.g. Facebook). Since the trend is only getting worse, we're putting the power back in the user's hands by allowing them to control where extensions are installed from. By default, the Chrome Webstore is the only source, but users and administrators will be able to add other safe sources as they see fit.
erichocean 14y ago
I wish there was a way for page authors to disable user scripts. Yes, I realize that users can easily open up a console. I'm not afraid of the users, I'm afraid of roque JavaScript being injected into a page that's reading sensitive data and using it for nefarious purposes.
- philfreo 14y ago
  That would suck! The whole point of user scripts is giving power users convenient control over ANY page in their browser - regardless of what the website owner thinks.
- Evbn 14y ago
  It is impossible for a site to defend a client against threats. That is the browser's job. Just imagine a malicious extension that could override the site's preferences.
ryankshaw 14y ago
Setting aside all of the political/philosophical objections to this decisions. from a practical perspective, I would be completely fine with this decision if they changed one thing: Make it dead simple for me to go to the 'developer dashboard' in crome web store and let me create a new extension by just uploading a whatever.user.js file. Don't make me package it up, don't make me know what a crx file is. Let me just hack together so JS to scratch my itch, and throw it up somewhere.
- Evbn 14y ago
  You would still need a manifest for security. But yeah, having a combined .JS format instead of a zipped folder would be nice.
benburton 14y ago
As someone who writes the occasional userscript in a github gist, I find this to be really annoying. I understand the security perspective, but I think it should be a bit easier to install your own scripts when you know what you're doing.
eschulte 14y ago
To keep you safe we've restricted your freedom.
- ams6110 14y ago
  That's generally how all safety efforts work.
fooey 14y ago
there's a switch to re-enable extra-store extensions that you can use for now --enable-easy-off-store-extension-install
_seininn 14y ago
what about people like me who can't or wont pay the 5$ webstore fee? I suppose the only option left for me (and people like me) is to do what mrng suggested and instruct users to download the unpacked version and install it manually via dev. mode. edit: it seems like there there is another way on http://support.google.com/chrome_webstore/bin/answer.py?hl=en&answer=2664769&p=crx_warning http://support.google.com/chrome_webstore/bin/answer.py?hl=e... (click on "Steps on adding extensions from other websites"). it makes things better, but it still complicates things for the user. way to go, google.
circa 14y ago
Kind of a bummer. I still use a few GreaseMonkey scripts in Firefox and one of the main reasons I still use some pages in FF. OinkPlus is still a great tool for finding new music and artists.
spyder 14y ago
So will they do this with the regular downloads too? Because you still can download malwares with Chrome isn't? And extension developers who aren't accepted in the Google "walled garden" can create a regular downloadable software which forces their extensions into Chrome.
rthprog 14y ago
I'm a bit disappointed that Google's alternative (the Chrome web store) requires a fee, even if it's only $5. It seems kind of silly for Google to ask for a fee to distribute a free extension, especially since there is no way for a developer to distribute it themselves.
inghoff 14y ago
Ironically, it sounds exactly like what Apple is doing with iOS/iPhone. "All our apps should come from the app store because we review them and blah" Considering Android's position of "you can install APKs, but at your risk," I find this bizarre. Is Google slowly becoming Apple?
- chmod775 14y ago
  You already have to tick a checkbox in the preferences before you can do so in android. I could imagine something similar in chromium.
franze 14y ago
i was also very, very pissed at this ... until i discovered tampermonkey https://chrome.google.com/webstore/detail/dhdgffkkebhmkfjojejmpbldmpobfkfo https://chrome.google.com/webstore/detail/dhdgffkkebhmkfjoje... they do userscripts right, and as userscripts are a "high end geek/nerd application" anyway (i would guess only <0.1%[0] of all online users use userscripts) i think it's justifiable to install this extension first (if there is a security win for the rest of the 99.9%) [0] if we guess that there are 2 279 709 629 wordwide internet users, then this means there are still 2 279 709 userscript users.
css771 14y ago
What's the big deal here? Anybody who wants to install other extensions can still do so. How often do you install extensions from other sources anyway? I think this is a good solution to the problem.
Groxx 14y ago
Or they could release an extension which would install and run scripts from UserScripts. Couldn't they? That would inline the whole process. But yeah, I completely think this is actually, sadly, the correct choice.
buster 14y ago
But userscrips.org is also for Firefox/Greasemonkey, is it not? I never recognized or used userscripts.org with chrome (i did once or twice with firefox). So, it still has the firefox users which it was created for.
crisnoble 14y ago
Well I learned something awesome from this article: "...userscripts are natively supported in Google Chrome without requiring third-party add-ons... first they need to save the JS file locally and then drag the file onto the Extensions page (chrome://chrome/extensions/).

158 points by twapi 14y ago

Google also killed user scripts that are self-updating like 4chan x. Before you would just click OK on a popup informing you that there was a new version and you were done. Now you have to drag the downloaded file into a tab with chrome://extensions open. I don't know why Google hasn't left a switch in to deactivate this "security measure". Edit: security measure is between quotes because I don't think anybody on HN would fall for something like that easily.

shardling 14y ago
Chrome is generally not about maximizing user choice/control, so from their POV maybe it made more sense to excise the old code.
danielweber 14y ago
The scare quotes are unnecessary. This really is a security feature and will undoubtedly help vast numbers of people. A switch would be fine, though. You might submit a patch for that.
- Karunamon 14y ago
  >This really is a security feature and will undoubtedly help vast numbers of people. This is the worst kind of "feature" (and a colossal personal annoyance), the kind that breaks functionality and/or convenience because some people don't know how to handle their browser. I know how to handle my browser. Why are you making my life harder? How about a switch for big kids who don't need their hands held? Note: If your answer begins with the word "fork", you lose.
  - mayanksinghal 14y ago
    > because some people don't know how to handle their browser Actually their argument is that most people cannot handle their browser. > How about a switch for big kids who don't need their hands held? I think the GP already gave an answer to that. He agrees that there can be a switch. And to submit a patch, you don't have to fork :)
  - deleted 14y ago
    [deleted]
  - Evbn 14y ago
    Actually, you lose. The vast majority of users win.

gkoberger 14y ago

Here's the issue: https://code.google.com/p/chromium/issues/detail?id=128748 https://code.google.com/p/chromium/issues/detail?id=128748 I'm a former add-ons product manager for Firefox. I never would have considered something this drastic (after all, Firefox is about choice, so it wouldn't have even been an option), however fake/malicious/rogue add-ons are a massive problem. If Chrome has a kill switch on every single add-on (and not just the ones uploaded to their site), they can do a better job of stopping malicious add-ons. Add-ons can do a ton of damage, and you'd be amazed how many people click through the install warnings without thinking.

jamesaguilar 14y ago
Hell, I'm a techie and even I've caught myself only a few moments before accidentally installing a random extension that for all I know would steal everything including the pots and pans. I can understand why Chrome team is doing this because if I've been close, I shudder to think of what non-tech people have done.
- eps 14y ago
  Do give an example.
  - jamesaguilar 14y ago
    Well, one time I was browsing this website and an extension install link for something I'd never heard of popped up and I almost clicked it. You mean like that? Or?
magicalist 14y ago
Yeah, this isn't a great solution, but it's been surprising the number of Mozilla folks that have come out and said, "this may be the only real solution". They've all said they won't be doing the same thing, but there has sometimes been a strong suggestion of a "yet..." there. I don't think: a) most people realize that extension permissions are not exactly analogous to phone permissions. When you give browser extensions even fairly standard permissions, they can arbitrarily interact with and alter every single thing you see and do in your browser (meanwhile phones are still somewhat protected by their isolated app architectures). There are some mitigation strategies, but the reality is that the only real difference between many userscripts and a keylogger, for instance, is intent on the part of the developer. And how do you detect that? b) I don't think many people reacting to this change (like in this thread) realize how many people are actively installing malware in the form of extensions and are being screwed by them. These aren't hypothetical problems, it is quite widespread (check out the many Mozilla conversations about this). This is the reason Mozilla has been so sympathetic to (and muted about) Google's change here, I think. A dropdown bar and a "are you sure?" are not sufficient. I wish Google would do more (and the "I intend to polish this UI a bit" comment in that bug thread should tell them exactly where they should be focusing their efforts first, not just ignoring it for now), but browser extensions are way too dangerous right now. Downloading the folder and dragging it in kind of sucks, but it's really not that bad in almost all cases (I'm sympathetic to the drop in installations you'll face if you don't want to kowtow to the chrome webstore/mozilla addon approval process, though).

nthitz 14y ago

From the Chromium devs: "we're putting the power back in the user's hands by allowing them to control where extensions are installed from. By default, the Chrome Webstore is the only source, but users and administrators will be able to add other safe sources as they see fit." I don't know if the ability to add other sources has been implemented yet though.

deleted 14y ago
[deleted]
gergles 14y ago
>Enterprise Administrators: You can specify URLs that are allowed to install extensions, apps, and themes directly through the ExtensionInstallSources policy[1]. [1]: http://www.chromium.org/administrators/policy-list-3#ExtensionInstallSources http://www.chromium.org/administrators/policy-list-3#Extensi... EDIT: I just tried this on my Chrome 23 install and it appears to do nothing.
- SafdarIqbal 14y ago
  What's the location of the policy file in Linux?
abraham 14y ago
Users can still install extensions from any source through drag and drop.

drivebyacct2 14y ago

This was done a while back, was it not? edit: I may not have been thinking clearly, I forget that I stay on the Dev channel.

qntmfred 14y ago
yes, i noticed it several weeks ago

ThomW 14y ago

I'm kind of annoyed how it nuked the userscripts I had already installed without any kind of warning. Would have been nice to have the choice before they were all removed.

mediocregopher 14y ago

>We suggest Chrome team to follow Opera’s approach, or at least whitelist UserScripts.org globally. I could be wrong, but I don't think userscripts does any significant culling of their catalog; downloading an arbitrary script from there is just as dangerous as anywhere else. This whole thing is just silly, you have to confirm the installation of a javascript extension. If you accept that it's your responsibility if it turns out to be a keylogger or what have you, not the Chrome team's. They're shooting everyone in the foot because someone might accidentally shoot their eye out.

skybrian 14y ago
It's more like adding a safety that actually works (unlike clickthrough warnings). If you know what you're doing, you can do a search and learn how to drag and drop. Anyone who needs handholding for this shouldn't be doing it.

grimgrin 14y ago

Is this not in effect on Chrome Canary? I use two two Hacker News related userscripts, and both are still working. Neither of them ever stopped working. http://userscripts.org/scripts/show/138469 http://userscripts.org/scripts/show/138469 http://userscripts.org/scripts/show/138037 http://userscripts.org/scripts/show/138037

koenigdavidmj 14y ago
They work; it's just more convoluted to install them at first.

chocolateboy 14y ago

There are at least two other ways of running userscripts in Chrome, neither of which impose this restriction: Tampermonkey: https://chrome.google.com/webstore/detail/dhdgffkkebhmkfjojejmpbldmpobfkfo https://chrome.google.com/webstore/detail/dhdgffkkebhmkfjoje... Blank Canvas: https://chrome.google.com/webstore/detail/pipnnjjknlabchljabhmnpdfpdobpnkk https://chrome.google.com/webstore/detail/pipnnjjknlabchljab...

vacipr 14y ago
Black Canvas hasn't been updated since last year and Tampermonkey seems like a privacy invader.
- chocolateboy 14y ago
  > Tampermonkey seems like a privacy invader That's a serious allegation. Care to back it up?
  - vacipr 14y ago
    This. http://i.imm.io/E9zF.png http://i.imm.io/E9zF.png Seems like a lot of privileges for an userscript managing extension. Later edit: After a bit of searching I also found that FAQ. They should really put that information on the chrome web store.
    - chocolateboy 14y ago
      "Q300: Tampermonkey can access every page that I visit! Is TM evil?" http://forum.tampermonkey.net/viewtopic.php?t=78 http://forum.tampermonkey.net/viewtopic.php?t=78
    - charliesome 14y ago
      > This. http://i.imm.io/E9zF.png http://i.imm.io/E9zF.png Seems like a lot of privileges for an userscript managing extension. Well, no shit. How is TamperMonkey supposed to install extensions that require more privileges than itself? It needs full permissions because it allows scripts you install full access.

mrng 14y ago

You can easily unpack any extension you've downloaded, and install them manually (Check Developer mode > Load unpacked extension).

teh_klev 14y ago

"I’m very disappointed to find that users can’t install userscripts directly from the UserScripts.org – first they need to save the JS file locally and then drag the file onto the Extensions page (chrome://chrome/extensions/)." Bit of a misleading headline then?

Nerdfest 14y ago
Yes, hopefully they haven't pulled a full Apple, like Microsoft has with their 'Metro' store. I don't think I can ever forgive them for making that sort of lock-down acceptable.

DanielRibeiro 14y ago

Note that you still can use userscripts[1], however you have to drag the crx file into the extensions window, manually. But userscripts.org's convenience was killed with this change. A change I find to be very unfortunate. [1] https://github.com/defunkt/dotjs/issues/73 https://github.com/defunkt/dotjs/issues/73

jdechko 14y ago

An overreacting headline, no doubt. But reading the article, UserScripts.org hasn't been killed, but the convenience factor is severely neutered.

humpolec 14y ago
Also, userscripts are still perfectly usable under Firefox's Greasemonkey, as well as Opera.

mindslight 14y ago

Try for an actual solution whereby most scripts have a few fine-grained capabilities or can only modify specific sites? Better UIs so that people are informed of what an addon is capable of? nah... Security is hard; let's make shopping!

aboodman 14y ago
We have that: http://www.chromium.org/developers/design-documents/user-scripts http://www.chromium.org/developers/design-documents/user-scr.... See @match. Not enough users read or care about fine-grained capabilities.
- mindslight 14y ago
  How good is the UI that points out the contraction of "Facebook style changer" wanting to modify all sites? And does this dialog include a warning for extensions that are able to record all activities and phone them home to third party servers, a combination of capabilities that most extensions should not need? There's certainly underlying work that needs to be done to make the latter a reality, but at least trying to solve the problem is better than giving up and falling back to centralized computing. It's true that users have been desensitized to important decisions through an onslaught of mswin uninformed-consent OK/Cancel dialogs, but at some point they have to be responsible for sensible security decisions (even if that just means downloading Chromium from google.com and not google.com.ojwqodkja.ru). The only way to completely protect a user from themselves is to revert their computer into an unmodifiable display terminal, an idea that should be appalling to anybody who values the concept of a personal computer.

rryan 14y ago

From the bug report it looks like they will allow users to choose safe software sources. Presumably this means you could add userscripts to this list and regain the old functionality. It's just not done yet. This change was made to protect users. Off-store extensions have become a popular attack vector for compromising users of larger sites (e.g. Facebook). Since the trend is only getting worse, we're putting the power back in the user's hands by allowing them to control where extensions are installed from. By default, the Chrome Webstore is the only source, but users and administrators will be able to add other safe sources as they see fit.

erichocean 14y ago

I wish there was a way for page authors to disable user scripts. Yes, I realize that users can easily open up a console. I'm not afraid of the users, I'm afraid of roque JavaScript being injected into a page that's reading sensitive data and using it for nefarious purposes.

philfreo 14y ago
That would suck! The whole point of user scripts is giving power users convenient control over ANY page in their browser - regardless of what the website owner thinks.
Evbn 14y ago
It is impossible for a site to defend a client against threats. That is the browser's job. Just imagine a malicious extension that could override the site's preferences.

ryankshaw 14y ago

Setting aside all of the political/philosophical objections to this decisions. from a practical perspective, I would be completely fine with this decision if they changed one thing: Make it dead simple for me to go to the 'developer dashboard' in crome web store and let me create a new extension by just uploading a whatever.user.js file. Don't make me package it up, don't make me know what a crx file is. Let me just hack together so JS to scratch my itch, and throw it up somewhere.

Evbn 14y ago
You would still need a manifest for security. But yeah, having a combined .JS format instead of a zipped folder would be nice.

benburton 14y ago

As someone who writes the occasional userscript in a github gist, I find this to be really annoying. I understand the security perspective, but I think it should be a bit easier to install your own scripts when you know what you're doing.

eschulte 14y ago

To keep you safe we've restricted your freedom.

ams6110 14y ago
That's generally how all safety efforts work.

fooey 14y ago

there's a switch to re-enable extra-store extensions that you can use for now --enable-easy-off-store-extension-install

_seininn 14y ago

what about people like me who can't or wont pay the 5$ webstore fee? I suppose the only option left for me (and people like me) is to do what mrng suggested and instruct users to download the unpacked version and install it manually via dev. mode. edit: it seems like there there is another way on http://support.google.com/chrome_webstore/bin/answer.py?hl=en&answer=2664769&p=crx_warning http://support.google.com/chrome_webstore/bin/answer.py?hl=e... (click on "Steps on adding extensions from other websites"). it makes things better, but it still complicates things for the user. way to go, google.

circa 14y ago

Kind of a bummer. I still use a few GreaseMonkey scripts in Firefox and one of the main reasons I still use some pages in FF. OinkPlus is still a great tool for finding new music and artists.

spyder 14y ago

So will they do this with the regular downloads too? Because you still can download malwares with Chrome isn't? And extension developers who aren't accepted in the Google "walled garden" can create a regular downloadable software which forces their extensions into Chrome.

rthprog 14y ago

I'm a bit disappointed that Google's alternative (the Chrome web store) requires a fee, even if it's only $5. It seems kind of silly for Google to ask for a fee to distribute a free extension, especially since there is no way for a developer to distribute it themselves.

inghoff 14y ago

Ironically, it sounds exactly like what Apple is doing with iOS/iPhone. "All our apps should come from the app store because we review them and blah" Considering Android's position of "you can install APKs, but at your risk," I find this bizarre. Is Google slowly becoming Apple?

chmod775 14y ago
You already have to tick a checkbox in the preferences before you can do so in android. I could imagine something similar in chromium.

franze 14y ago

i was also very, very pissed at this ... until i discovered tampermonkey https://chrome.google.com/webstore/detail/dhdgffkkebhmkfjojejmpbldmpobfkfo https://chrome.google.com/webstore/detail/dhdgffkkebhmkfjoje... they do userscripts right, and as userscripts are a "high end geek/nerd application" anyway (i would guess only <0.1%[0] of all online users use userscripts) i think it's justifiable to install this extension first (if there is a security win for the rest of the 99.9%) [0] if we guess that there are 2 279 709 629 wordwide internet users, then this means there are still 2 279 709 userscript users.

css771 14y ago

What's the big deal here? Anybody who wants to install other extensions can still do so. How often do you install extensions from other sources anyway? I think this is a good solution to the problem.

Groxx 14y ago

Or they could release an extension which would install and run scripts from UserScripts. Couldn't they? That would inline the whole process. But yeah, I completely think this is actually, sadly, the correct choice.

buster 14y ago

But userscrips.org is also for Firefox/Greasemonkey, is it not? I never recognized or used userscripts.org with chrome (i did once or twice with firefox). So, it still has the firefox users which it was created for.

crisnoble 14y ago

Well I learned something awesome from this article: "...userscripts are natively supported in Google Chrome without requiring third-party add-ons... first they need to save the JS file locally and then drag the file onto the Extensions page (chrome://chrome/extensions/).