6 ms·

Here's the issue: https://code.google.com/p/chromium/issues/detail?id=128748 https://code.google.com/p/chromium/issues/detail?id=128748 I'm a former add-ons pr

Here's the issue: https://code.google.com/p/chromium/issues/detail?id=128748 https://code.google.com/p/chromium/issues/detail?id=128748 I'm a former add-ons product manager for Firefox. I never would have considered something this drastic (after all, Firefox is about choice, so it wouldn't have even been an option), however fake/malicious/rogue add-ons are a massive problem. If Chrome has a kill switch on every single add-on (and not just the ones uploaded to their site), they can do a better job of stopping malicious add-ons. Add-ons can do a ton of damage, and you'd be amazed how many people click through the install warnings without thinking.

jamesaguilar 14y ago
Hell, I'm a techie and even I've caught myself only a few moments before accidentally installing a random extension that for all I know would steal everything including the pots and pans. I can understand why Chrome team is doing this because if I've been close, I shudder to think of what non-tech people have done.
- eps 14y ago
  Do give an example.
  - jamesaguilar 14y ago
    Well, one time I was browsing this website and an extension install link for something I'd never heard of popped up and I almost clicked it. You mean like that? Or?
magicalist 14y ago
Yeah, this isn't a great solution, but it's been surprising the number of Mozilla folks that have come out and said, "this may be the only real solution". They've all said they won't be doing the same thing, but there has sometimes been a strong suggestion of a "yet..." there. I don't think: a) most people realize that extension permissions are not exactly analogous to phone permissions. When you give browser extensions even fairly standard permissions, they can arbitrarily interact with and alter every single thing you see and do in your browser (meanwhile phones are still somewhat protected by their isolated app architectures). There are some mitigation strategies, but the reality is that the only real difference between many userscripts and a keylogger, for instance, is intent on the part of the developer. And how do you detect that? b) I don't think many people reacting to this change (like in this thread) realize how many people are actively installing malware in the form of extensions and are being screwed by them. These aren't hypothetical problems, it is quite widespread (check out the many Mozilla conversations about this). This is the reason Mozilla has been so sympathetic to (and muted about) Google's change here, I think. A dropdown bar and a "are you sure?" are not sufficient. I wish Google would do more (and the "I intend to polish this UI a bit" comment in that bug thread should tell them exactly where they should be focusing their efforts first, not just ignoring it for now), but browser extensions are way too dangerous right now. Downloading the folder and dragging it in kind of sucks, but it's really not that bad in almost all cases (I'm sympathetic to the drop in installations you'll face if you don't want to kowtow to the chrome webstore/mozilla addon approval process, though).
- aboodman 14y ago
  I don't understand your 'focusing their efforts first' comment. I implemented all the things I mentioned in that comment.
  - magicalist 14y ago
    I can't edit my post now, but I was wrong, sorry. I was basing this off the last time I tried it, which either I have a bad memory of or was before it was added in its current form. I actually quite like the warning bar and the link for more info, which makes what is happening obvious. The expando on the help page for how to install is kind of tucked away visually, though. There are some unfortunate side effects of this move, like the only available installable extension source being the same vendor as the main producer of the browser, but another source that vets chrome extensions independently of their developers is only hypothetical at this point. Maybe someday if Mozilla and Google agree on a standard app format.... As I said above, though, this appears to be the only actually viable solution at this point. Glad to be wrong on the UI-front.
fakjshflaskjhf 14y ago
This guy has open sourced his, albeit messy, browser rat[1]. Fork it because he sometimes deletes repos without warning. [1] https://github.com/christopherwoodall/Browser-RAT https://github.com/christopherwoodall/Browser-RAT
- jamesaguilar 14y ago
  I'm not sure how this is relevant, and it seems to be malware, so I'm flagging this.
ANTSANTS 14y ago
I'm aware of the security problems that making Google the Chrome browser extension/userscript gatekeeper could solve, but this change is still an inconvenience to users with common sense about computer security (do I download AdBlock Plus from adblockplus.org, chrome.google.com, or free-browser-extensions.biz?) and want software that won't be available on the web store (anything that doesn't gel with the TOS/Google doesn't like, developers who aren't willing to pay $5 for a webstore developer account [before anyone asks, that includes people who wish to remain anonymous and minors who lack easy access to online payment services], beta versions of extensions, etc) from developers they trust. A hidden opt-in setting in chrome://flags that the kind of people who download obviously malicious extensions are never going to learn about would have been a much more convenient first step than inconveniencing installation for and completely removing auto-update functionality from unregistered extensions. As a first step, it might have mostly fixed the problem or not, but now we'll never know. I don't think we have to worry about Google ever removing the ability to manually install unregistered extensions from Chrome, as extension developers need that functionality to actually, you know, develop their extensions, and charging money for a "developer account" for an open source web browser would be ridiculous, but the industry-wide trend towards walled gardens is very troubling.
ianox 14y ago
>> Add-ons can do a ton of damage, and you'd be amazed how many people click through the install warnings without thinking That reminds me of the bit in 'Windows Vista Airlines' from 'If Operating Systems Ran The Airlines...'[1]: "After answering yes to so many questions, you are punched in the face by some stranger who when he asked "Are you sure you want me to punch you in the face? Cancel or Allow?" you instinctively say "Allow"." [1] http://www.tensionnot.com/jokes/operating_systems_and_airlines http://www.tensionnot.com/jokes/operating_systems_and_airlin...

jamesaguilar 14y ago

Hell, I'm a techie and even I've caught myself only a few moments before accidentally installing a random extension that for all I know would steal everything including the pots and pans. I can understand why Chrome team is doing this because if I've been close, I shudder to think of what non-tech people have done.

eps 14y ago
Do give an example.
- jamesaguilar 14y ago
  Well, one time I was browsing this website and an extension install link for something I'd never heard of popped up and I almost clicked it. You mean like that? Or?

magicalist 14y ago

Yeah, this isn't a great solution, but it's been surprising the number of Mozilla folks that have come out and said, "this may be the only real solution". They've all said they won't be doing the same thing, but there has sometimes been a strong suggestion of a "yet..." there. I don't think: a) most people realize that extension permissions are not exactly analogous to phone permissions. When you give browser extensions even fairly standard permissions, they can arbitrarily interact with and alter every single thing you see and do in your browser (meanwhile phones are still somewhat protected by their isolated app architectures). There are some mitigation strategies, but the reality is that the only real difference between many userscripts and a keylogger, for instance, is intent on the part of the developer. And how do you detect that? b) I don't think many people reacting to this change (like in this thread) realize how many people are actively installing malware in the form of extensions and are being screwed by them. These aren't hypothetical problems, it is quite widespread (check out the many Mozilla conversations about this). This is the reason Mozilla has been so sympathetic to (and muted about) Google's change here, I think. A dropdown bar and a "are you sure?" are not sufficient. I wish Google would do more (and the "I intend to polish this UI a bit" comment in that bug thread should tell them exactly where they should be focusing their efforts first, not just ignoring it for now), but browser extensions are way too dangerous right now. Downloading the folder and dragging it in kind of sucks, but it's really not that bad in almost all cases (I'm sympathetic to the drop in installations you'll face if you don't want to kowtow to the chrome webstore/mozilla addon approval process, though).

aboodman 14y ago
I don't understand your 'focusing their efforts first' comment. I implemented all the things I mentioned in that comment.
- magicalist 14y ago
  I can't edit my post now, but I was wrong, sorry. I was basing this off the last time I tried it, which either I have a bad memory of or was before it was added in its current form. I actually quite like the warning bar and the link for more info, which makes what is happening obvious. The expando on the help page for how to install is kind of tucked away visually, though. There are some unfortunate side effects of this move, like the only available installable extension source being the same vendor as the main producer of the browser, but another source that vets chrome extensions independently of their developers is only hypothetical at this point. Maybe someday if Mozilla and Google agree on a standard app format.... As I said above, though, this appears to be the only actually viable solution at this point. Glad to be wrong on the UI-front.

fakjshflaskjhf 14y ago

This guy has open sourced his, albeit messy, browser rat[1]. Fork it because he sometimes deletes repos without warning. [1] https://github.com/christopherwoodall/Browser-RAT https://github.com/christopherwoodall/Browser-RAT

jamesaguilar 14y ago
I'm not sure how this is relevant, and it seems to be malware, so I'm flagging this.

ANTSANTS 14y ago

I'm aware of the security problems that making Google the Chrome browser extension/userscript gatekeeper could solve, but this change is still an inconvenience to users with common sense about computer security (do I download AdBlock Plus from adblockplus.org, chrome.google.com, or free-browser-extensions.biz?) and want software that won't be available on the web store (anything that doesn't gel with the TOS/Google doesn't like, developers who aren't willing to pay $5 for a webstore developer account [before anyone asks, that includes people who wish to remain anonymous and minors who lack easy access to online payment services], beta versions of extensions, etc) from developers they trust. A hidden opt-in setting in chrome://flags that the kind of people who download obviously malicious extensions are never going to learn about would have been a much more convenient first step than inconveniencing installation for and completely removing auto-update functionality from unregistered extensions. As a first step, it might have mostly fixed the problem or not, but now we'll never know. I don't think we have to worry about Google ever removing the ability to manually install unregistered extensions from Chrome, as extension developers need that functionality to actually, you know, develop their extensions, and charging money for a "developer account" for an open source web browser would be ridiculous, but the industry-wide trend towards walled gardens is very troubling.

ianox 14y ago

>> Add-ons can do a ton of damage, and you'd be amazed how many people click through the install warnings without thinking That reminds me of the bit in 'Windows Vista Airlines' from 'If Operating Systems Ran The Airlines...'[1]: "After answering yes to so many questions, you are punched in the face by some stranger who when he asked "Are you sure you want me to punch you in the face? Cancel or Allow?" you instinctively say "Allow"." [1] http://www.tensionnot.com/jokes/operating_systems_and_airlines http://www.tensionnot.com/jokes/operating_systems_and_airlin...