7 ms·
Google to reject Chrome extensions outside of Chrome Web Store
- signed0 13y agoJust for Windows users.
- lowboy 13y agoSo far. I believe that part of Goog's motivation is to stop malware, but part of their motivation is platform control. I just don't know the proportion.
- magicalist 13y agoactual source instead of useless techcrunch filler: http://blog.chromium.org/2013/11/protecting-windows-users-from-malicious.html http://blog.chromium.org/2013/11/protecting-windows-users-fr... Wasn't this already largely the case? You have to manually download extensions and then drag them into the extensions manager to install them outside the store right now, don't you? The only change here seems to be that now you need a checked "Developer mode" box in order for that to work. I guess that discourages randomly checking the box, but if they had just labelled it "Allow third party extensions" it would make the change seem less overbearing.
- Oletros 13y agoDeveloper mode only allows installing unpacked extensions, no?
- recuter 13y agoNo. If that's the case I think that's new.
- hayksaakian 13y agothis was the case at least a year ago when I was making a chrome app/extension
- throwaway2048 13y agothe most obnoxious part about this is extensions will not update automatically or otherwise. you are forced unpack and drag in the extension for every change.
- splatzone 13y agoAnother day, another step closer to Apple.
- Touche 13y agoPresumably Chromium has no such restriction.
- msujaws 13y agoThere's a Chromium Web Store? I'm not sure I follow :)
- jack-r-abbit 13y agoI'll admit I don't fully understand the Chromium <=> Chrome relationship. (I believe that Chrome is Google's browser built on the open-source Chromium code.) But isn't this an announcement made on the Chromium blog? It would appear to me that this is going to be in the Chromium source... not just Chrome. Am I missing something?
- Touche 13y agoNot sure if the Chromium binaries have this restriction turned on but it doesn't matter as someone will compile it without it (probably the official Linux channels, for instance).
- Karunamon 13y agoAt least Apple's extension system for Safari explicitly has adblock as one of the top downloads. This just sucks.
- 3JPLW 13y agoDoesn't Apple's Safari take the approach that Zikes proposes[0]? As far as I know, all you need to publish extensions is to sign up for a free developer certificate key, and then you sign the extension yourself. [0]. https://news.ycombinator.com/item?id=6692656 https://news.ycombinator.com/item?id=6692656
- makomk 13y agoNaturally, extensions that block certain kinds of Google ads (such as Youtube ads) are not allowed in the Chrome Web Store.
- thesnider 13y agoSeriously? What about https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb https://chrome.google.com/webstore/detail/adblock-plus/cfhdo... (AdBlock Plus), for instance?
- dingaling 13y agoAdblock Plus by default whitelists Google ads. https://easylist-downloads.adblockplus.org/exceptionrules.txt https://easylist-downloads.adblockplus.org/exceptionrules.tx...
- JohnTHaller 13y agoLet's start betting on when Google starts to squeeze ad blockers through feature changes or right out of the web store.
- winslow 13y agoAnd Firefox will be there with open arms :)
- throwaway2048 13y agoFunded almost solely by Google.
- Encosia 13y agoMicrosoft would probably be more than happy to take Google's place there, even if Firefox does compete with IE.
- Zikes 13y agoThere's a comment on the Chromium blog [1] (via magicalist's comment [2]) that nails this: if security is all they cared about, a signed certificate is all that's necessary. Knowing that option exists and persisting with their store-only approach means they must have an ulterior motive of some sort, most likely control and money. Ad blockers that target Google Ads will be no more, as well as anything else that the user might want to use to subvert or circumvent. Extensions will also have to adhere to Google's moral code, and developers will once again be beholden to a greater authority in order to operate their business. Just like with Facebook and the Apple app store, if you build a business on Google Chrome Extensions you now face having the plug pulled at any time for any reason, with absolutely no recourse. [1] http://blog.chromium.org/2013/11/protecting-windows-users-from-malicious.html http://blog.chromium.org/2013/11/protecting-windows-users-fr... [2] https://news.ycombinator.com/user?id=magicalist https://news.ycombinator.com/user?id=magicalist
- deleted 13y ago[deleted]
- jfoster 13y agoWould a signed certificate approach allow them to deny extensions, or not? If yes, they could still deny ad blockers that way. If no, it is a weaker form of security than this is.
- Zikes 13y agoThe alleged reasoning is to stop malware. A signed certificate must come from an authority willing to put their own reputation on the line, but Google does not need to be the only such authority.
- jfoster 13y agoSo the extension being installed on some malicious site would have a popup talking about security certificates and such, and asking the user whether they want to proceed? You and I might think twice, but most users just click "Yes". Signed certificates would not be adequate to protect the average user.
- jack-r-abbit 13y agoSomeone called "Google OS" posted[1] this about installing extensions not in the web store: The developer option will still work: replace the crx extension with zip, extract the files to a new folder, go to the Chrome extensions page, enable developer mode, load unpacked extension and select the folder you've created. Sounds like a huge pain in the ass but at least people doing this are less likely to be in the same group of people that are complaining about malware. [1] http://blog.chromium.org/2013/11/protecting-windows-users-from-malicious.html http://blog.chromium.org/2013/11/protecting-windows-users-fr...
- hexis 13y agoToday's serving of feudal security is brought to you by...
- Joona 13y agoI'm guessing it's time for alternatives then. Has anyone tried the new Opera, and what other browsers are out there? Or maybe I'm just overreacting.
- zobzu 13y agoFirefox, Chromium.
- SudoNick 13y agoI think Mozilla may be headed in the same direction. Add-on File Registration System: http://www.ghacks.net/2013/11/01/mozillas-add-file-registration-system-serious-consequences-developers/ http://www.ghacks.net/2013/11/01/mozillas-add-file-registrat... Merging of AMO with Firefox Marketplace: http://www.ghacks.net/2013/10/26/thunderbird-seamonkey-kicked-mozilla-amo/ http://www.ghacks.net/2013/10/26/thunderbird-seamonkey-kicke...
- jeorgun 13y agoIn Firefox's case, at least, it's clear that the only motive in doing so would be genuine concern for the safety of their users— Mozilla wouldn't have any incentive to stop people installing extensions that hurt their own business model.
- io45900 13y agoFirefox Marketplace is open source. It's based on Django and you can host your own. Source: https://github.com/mozilla/zamboni https://github.com/mozilla/zamboni
- kibwen 13y agoDoubtful. Mozilla has repeatedly gone out of their way to ensure that their services aren't strictly reliant on a centralized source. Firefox Sync allows you to set up your own sync server. Persona allows you to set up your own authentication server. Firefox OS allows you to set up your own first-class app store. Locking down Firefox add-ons in the same manner as Chrome would be highly out-of-character.
- zobzu 13y agoSurprise surprise. Closed garden mode.
- dustywusty 13y agoFinding it very strange that this change is presented under the guise of safety, as there are absolutely very malicious extensions currently circulating on the Chrome Web Store.
- jfoster 13y agoThey do seem to have very little policing of the Chrome Web Store. It's actually annoying to have an app on there that is legit, as so many of the top places in the store are taken up by unscrupulous rip-offs of Super Mario Bros and Sonic the Hedgehog. I could make some money too by putting classic games into a javascript emulator, plastering the page with ads, and submitting a few hundred apps (one for each game) to the Chrome Web Store. I'd rather play by the rules and have Google properly run their marketplace, though.
- taway2012 13y agoI am displeased by this change. Although the Firefox version of my extension is more work to develop, I will be pouring most of my resources into that in the future. I currently have a product that uses a Chrome extension to work. I am privately beta'ing it out by hosting it on my own website. Because I don't want to be killed with negative reviews of my unpolished first version in the Chrome store. Now I am forced to show my work and suffer brickbats in public even before I finish it. WTF. Second ======= And post-Snowden, the Chrome web store publication process is LESS secure for my users than me hosting the app myself. In the Chrome store, you send Google your raw source (possibly minimized) files. They will sign it and push a blob to the end user. https://developers.google.com/chrome/web-store/docs/publish https://developers.google.com/chrome/web-store/docs/publish AFAIK, there is no way for the end user to have any assurance that the file being pushed by Google was the file that the developer intended to push. With a privately-served version, the equivalent of a secret key created by the developer needs to be compromised to push updates. Please correct me if I'm mistaken about this.
- ender7 13y agoIIRC, the CWS allows you to distribute alphas and betas to a specific set of users.
- taway2012 13y agoYeah, I looked into that. There doesn't seem to be a way to have a "hidden" extension whose URL isn't public, but which can be downloaded without signing into a Google account. That sucks for people in my network who are being kind enough to test my software. Instead of just messaging them on Facebook/Twitter/Skype/Email/SMS/iMessage/Linkedin with a URL, I need to find out their Google account and add it to a dashboard and they need to be logged in before they download.
- SudoNick 13y agoSnowden or no Snowden, a security focused developer wouldn't want someone else signing on their behalf or someone else controlling availability and updating. A security focused user wouldn't want to see that either.
- Newky 13y agoSo for normal (non-admin) users there is no way to opt-in to this. I can't understand that. I don't think anyone would have a problem if this was a simple opt-in system like downloading unofficial apk's on android. Only a select few would be opting in, and those are not the core audience that Google is pretending to be security conscious about. Giving no ability to switch on this ability for a normal user makes Google lose face with the general tech community. I don't understand the reasons behind this.
- itcmcgrath 13y agoAgreed. You would think for security you would stop driving technical people to have to use admin for everything... 1 step forwards, 2 steps back.
- Jochim 13y agoDon't you usually want to limit non-admin users from installing things you don't know about anyway?
- Newky 13y agoIf this was something that a lot of admin users wanted to restrict from their users surely Google could have made the complete disabling of this feature from all users available in the admin panel. But that should be an opt in feature for the admin.
- mtgx 13y agoThe security excuse is BS. Show me the numbers for what an enormous problem this is, to justify why such an extreme measure is needed, Google! And even if it does affect a ton of users, I'm sure there are other ways for Google to fix this, even if not completely. But assuming for a moment this wasn't a malicious move from Google's part, I'm still angry with the lazy decision to "just close off non-store extensions" to fix the problem. Should I expect side-loading to be gone from Android soon, too, Google? Don't you dare! The way Android handles this issue is the best possible compromise (there will always be a compromise between security and freedom - and that's a great thing). In Android sideloading is disabled by default, and if a user knows what he's doing, he'll enable it and do whatever he wants. So why can't Google do the same with Chrome?! Disable sideloading by default, but still keep the option in settings somewhere. What's the big deal? Unless they have a completely different agenda behind this... Also, I'm not sure, but do Chrome extensions work in Opera or Safari? I think it's about time we call Google on this and ask them to open up the format, so other browsers can use the same extensions. The browser shouldn't be another vector for "lock-in".
- kmfrk 13y agoAmazing, an actual reason to consider the Blink build of Opera.
- Deeehem 13y agoThis has made me very, very irritated. I was quite upset at the initial change to preventing installation of third party extensions via a download, but then I realised it was for the best. However, to fully remove the ability to install third party extensions is just ludicrous. I develop a small Chrome application for internal use at my workplace. The staff love it, it helps them do their jobs a lot quicker. I don't see any easy way other than (as mentioned), building Chromium to remove this limit, as has been done before with crx files. Might just move to Firefox and take my workforce following with me!
- deleted 13y ago[deleted]
- zmmmmm 13y agoVery disappointing if there is no workaround available to the "ordinary" user. Enough to make me fully question whether I want to use Chrome at all. Question: what is the situation with ChromeOS? If this applies to ChromeOS then it is essentially in the same locked down, anti-competitive state that the Apple app store is in. It is the main reason I avoid Apple devices and would pretty much put ChromeOS devices on the same blacklist as well for me.
- chestnut-tree 13y ago"Question: what is the situation with ChromeOS?" I don't know, but why would anyone even consider running ChromeOS? The fact that you have to sign in (with a Google account) gives Google unprecedented opportunity to track your activity in the OS. Even something as simple as printing to your desktop printer requires sending your documents via Google's cloud print service. Imagine having to sign in to Windows or your Mac with your email address and having to remain signed in always to use the OS. Most of us would be horrified. I'm just astonished by how little comment is made of Google's insatiable appetite to track and record online behaviour.
- cloudwalking 13y agoBeing constantly signed in also gives you a lot of advantages. Not everybody has a huge distain for being signed in. There are plenty of people who PREFER a simpler OS with a simpler UI that doesn't get viruses or trojans, running on hardware cheaper than an iPad.
- zmmmmm 13y agoI am not concerned about "tracking" very much. I'm not sure what the giant issue is that you and others have with that (ie: exactly where and what is the harm you perceive, in concrete terms?). Btw, new versions of Windows all but force users to sign in with an email address and then proceed store all documents by default in SkyDrive. Skype is turned on and signing out is not allowed, thus you are every minute constantly advertising your presence and activity to Microsoft. Plus even searching your hard drive sends the query to Bing and shows ads to you as a result. So I am not sure Windows is on track to be much better than ChromeOS in that regard. But while I don't mind the "tracking", I consider freedom essential. An operating system must allow the freedom to develop applications that are hostile to the interests of the platform owner. That is the only defence against a descent into a monopolistic kind of dark ages. Eg: imagine if FireFox had never been allowed to run on Windows? We'd probably still be using IE6. New disruptive technologies can only develop when they have the freedom to do so, and it is rarely in the interests of the incumbents for it to happen. So this is what I care about far more than the implications for privacy and tracking etc.
- BrianEatWorld 13y agoDoes this really solve the problem? I imagine most of these complaints come from people who pick up the extensions via bundling (not opting out of something when installing software). As those bundles run off of executables with admin privileges in Windows, the last change was circumvented simply by altering some files in the user's chrome directory and the registry. I imagine a similar tactic will defeat this measure. At least before the removal of the third party installation route, Chrome was able to control the messaging and generate warnings. These changes are simply pushing the malevolent even further underground.
- quasque 13y agoDoes anyone know if this will include Greasemonkey-style scripts as well? (e.g. like the ones from userscripts.org)
- fiatjaf 13y agoPeople who commented until now don't know how blessed is this measure. If you're a programmer, you probably don't get lots of malware in your computer, but if you ever had to use the same Windows PC as your uncle, mother or brother-in-law, even for a short time, you would know how bad it is to see huge amounts of malware and changed home pages, new tab pages, default search engines, everything messed up inside Chrome. I don't know how these people get all these malwares, but is a fact that they get them installed. And if you don't have a better solution, Google at least has a temporary potentially good one.