4 ms·

This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions sho

by ufmace 13y ago

This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If I had to pick the one most annoying thing about running Windows, that would be it. The biggest appeal to me of Chromebooks is silent auto-update of everything. Don't bug me about updates, just make everything always run the latest, most feature-filled and bug-fixed versions. I'd lean towards using a finer-grained permission model for extensions, and javascript in general. As far as I know, most extensions now can only request permissions to run arbitrary JS on every page you visit, and send arbitrary AJAX to any URL. Perhaps we could do a better job of locking that down. Have no such thing as a permission to AJAX any URL, but instead make AJAXing any particular TLD a new permission. Maybe we can also only allow access to DOM elements originating from particular domains. Then you could keep auto-update, but require a new user authorization for any new URL/domain access that an extension needs. It'd probably get pretty complex, but I think we could put together something reasonable. But then the other problem is the pile of plugins out there already with those arbitrary permissions. Maybe you could let them stay, but not allow any updates without switching to the new permission model?

kzahel 13y ago
The problem is with users. They ignore the scary "access to all websites" dialogs and install extensions. Sites like pinterest have extensions that request these permissions, when they don't even need them. There's a way to have the extension only have access to the site you're on when you CLICK somewhere in your toolbar. There are fine grained permissions and optional permissions to specific hosts and ports and URL patterns. It's all very well thought out. The problem is with users. For example, I have an extension that enables autocomplete on all web pages: https://chrome.google.com/webstore/detail/autocomplete-on/gdhbgagnmhdafendedikgjimegoipbnk https://chrome.google.com/webstore/detail/autocomplete-on/gd..., and it has access to all data on all websites. People install it every day, I don't know why. I would never install or trust anybody else with such an extension. I have to manually clone any extension I like and upload it to the chrome web store; that way I know it's not going to auto update and do nefarious things.
- hayfield 13y ago
  Depending on how the extension developer feels future development may pan out, requesting access to all websites is the only reasonable way to do it. With how the update system works[1], when requesting new permissions the extension is disabled until manually reenabled. If there's even a slight possibility you may want to request access to additional sites in the future, you basically have to request "all websites" to prevent this from happening. Since Chrome 16 there have been optional permissions around (so you only request permissions when they're needed, preventing the extension from auto-disabling), although that introduces additional overhead beyond simply requesting everything in the manifest file. The extension update system should probably work more along the lines of that in Android - it auto-updates if the new version needs no additional permissions, but requires user input when new permissions are required. The current[1] state of auto-disable-on-update isn't ideal from either a developer or user position. [1] as of about a year ago when I last tested this
  - kzahel 13y ago
    You are right that adding new permissions will disable the extension until it is re-enabled. But android has a very similar behavior. Still, I feel that using optional permissions and pointing out to the user why they would want enable the new permissions is the best option. Yes, it's more work for the developer. I just released an extension to help identify high risk installed extensions: https://chrome.google.com/webstore/detail/privacy-guard/edcajbacgdcdeecojhlllbgingbjfbmk https://chrome.google.com/webstore/detail/privacy-guard/edca...
- ufmace 13y ago
  Looks like what we really need to do is to remove those universal permissions entirely, then. Say after some particular date, no new extensions or updates to existing ones are allowed unless they remove the universal permissions and switch to the site-specific ones. Of course, then you need a solid extension update system where there's some way to alert the user of when an extension needs new permissions, and have them see and authorize them before the update goes active. Hopefully something like the way that Chome updates work now - instead of throwing a modal dialog at the user at some random time, have a tick or light in the UI somewhere that they need to do something.
mjn 13y ago
Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating but with some kind of human quality assurance. Two systems that manage to pull that off from very different cultural/economic starting points are Apple's app store, and Debian's software repository. The Google model of an auto-updating but un-QA'd app store doesn't work for me, because it combines two things I really don't see as compatible: 1) low-friction updates; and 2) installation of arbitrary un-reviewed code from the internet. If you're going to do #2, then I want the friction of downloading a new executable. I want to go to a website, see if the company still exists, read the release notes, generally be cautious about installation of random executables off the internet. But if you're going to do #1, then since the updates are supposed to apply without significant review by me, someone else has to be vetting what goes into the repository for at least minimal non-evilness standards.
- MasterScrat 13y ago
  > Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating but with some kind of human quality assurance. I agree on this. The best solution for now would be a meta-extension that checks if you have compromised extensions installed and disable them. The blacklist could be compiled based on the Store feedbacks (ratings dropping sharply? disabled.), a reporting system from the app, and also using automatic testing. For example run the extension on a sandboxed machine and check for requests to known shady domains.
- bzbarsky 13y ago
  This is what happens with AMO-hosted Firefox extensions. Whenever the extension author pushes out an update, it first has to go through review as described at https://addons.mozilla.org/en-US/developers/docs/policies/reviews https://addons.mozilla.org/en-US/developers/docs/policies/re...
omaranto 13y ago
Minor nitpick: you're romanticizing what the autoupdate policy achieves, it does not give you the latest, most feature filled and bug fixed versions of things, just the latest.
deleted 13y ago
[deleted]
hackinthebochs 13y ago
I don't understand the appeal of updating software at all. Once a piece of code becomes feature complete for my purposes I don't ever want it to change. Change just means more things break, features disappear, or the app becomes bloated, and now apparently, may start injecting ads. I uninstalled noscript years ago when it started updating twice a week with apparently miniscule changes just to pop up its ad filled landing page. Its a fucking javascript blacklist/whitelist app, why on earth does it need to update? If I wanted a "browser security suite" (what noscript currently bills itself as) I'd download that specifically.
- esrauch 13y ago
  Every piece of software I use is broken in some way. Auto updates allow me to hope that they are a little less broken each day.
  - hackinthebochs 13y ago
    My philosophy is it's not broken if I don't notice it.
    - esrauch 13y ago
      My point was that I notice broken things roughly every day.

by ufmace 13y ago

kzahel 13y ago

The problem is with users. They ignore the scary "access to all websites" dialogs and install extensions. Sites like pinterest have extensions that request these permissions, when they don't even need them. There's a way to have the extension only have access to the site you're on when you CLICK somewhere in your toolbar. There are fine grained permissions and optional permissions to specific hosts and ports and URL patterns. It's all very well thought out. The problem is with users. For example, I have an extension that enables autocomplete on all web pages: https://chrome.google.com/webstore/detail/autocomplete-on/gdhbgagnmhdafendedikgjimegoipbnk https://chrome.google.com/webstore/detail/autocomplete-on/gd..., and it has access to all data on all websites. People install it every day, I don't know why. I would never install or trust anybody else with such an extension. I have to manually clone any extension I like and upload it to the chrome web store; that way I know it's not going to auto update and do nefarious things.

hayfield 13y ago
Depending on how the extension developer feels future development may pan out, requesting access to all websites is the only reasonable way to do it. With how the update system works[1], when requesting new permissions the extension is disabled until manually reenabled. If there's even a slight possibility you may want to request access to additional sites in the future, you basically have to request "all websites" to prevent this from happening. Since Chrome 16 there have been optional permissions around (so you only request permissions when they're needed, preventing the extension from auto-disabling), although that introduces additional overhead beyond simply requesting everything in the manifest file. The extension update system should probably work more along the lines of that in Android - it auto-updates if the new version needs no additional permissions, but requires user input when new permissions are required. The current[1] state of auto-disable-on-update isn't ideal from either a developer or user position. [1] as of about a year ago when I last tested this
- kzahel 13y ago
  You are right that adding new permissions will disable the extension until it is re-enabled. But android has a very similar behavior. Still, I feel that using optional permissions and pointing out to the user why they would want enable the new permissions is the best option. Yes, it's more work for the developer. I just released an extension to help identify high risk installed extensions: https://chrome.google.com/webstore/detail/privacy-guard/edcajbacgdcdeecojhlllbgingbjfbmk https://chrome.google.com/webstore/detail/privacy-guard/edca...
ufmace 13y ago
Looks like what we really need to do is to remove those universal permissions entirely, then. Say after some particular date, no new extensions or updates to existing ones are allowed unless they remove the universal permissions and switch to the site-specific ones. Of course, then you need a solid extension update system where there's some way to alert the user of when an extension needs new permissions, and have them see and authorize them before the update goes active. Hopefully something like the way that Chome updates work now - instead of throwing a modal dialog at the user at some random time, have a tick or light in the UI somewhere that they need to do something.

mjn 13y ago

Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating but with some kind of human quality assurance. Two systems that manage to pull that off from very different cultural/economic starting points are Apple's app store, and Debian's software repository. The Google model of an auto-updating but un-QA'd app store doesn't work for me, because it combines two things I really don't see as compatible: 1) low-friction updates; and 2) installation of arbitrary un-reviewed code from the internet. If you're going to do #2, then I want the friction of downloading a new executable. I want to go to a website, see if the company still exists, read the release notes, generally be cautious about installation of random executables off the internet. But if you're going to do #1, then since the updates are supposed to apply without significant review by me, someone else has to be vetting what goes into the repository for at least minimal non-evilness standards.

MasterScrat 13y ago
> Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating but with some kind of human quality assurance. I agree on this. The best solution for now would be a meta-extension that checks if you have compromised extensions installed and disable them. The blacklist could be compiled based on the Store feedbacks (ratings dropping sharply? disabled.), a reporting system from the app, and also using automatic testing. For example run the extension on a sandboxed machine and check for requests to known shady domains.
bzbarsky 13y ago
This is what happens with AMO-hosted Firefox extensions. Whenever the extension author pushes out an update, it first has to go through review as described at https://addons.mozilla.org/en-US/developers/docs/policies/reviews https://addons.mozilla.org/en-US/developers/docs/policies/re...

omaranto 13y ago

Minor nitpick: you're romanticizing what the autoupdate policy achieves, it does not give you the latest, most feature filled and bug fixed versions of things, just the latest.

deleted 13y ago

[deleted]

hackinthebochs 13y ago

I don't understand the appeal of updating software at all. Once a piece of code becomes feature complete for my purposes I don't ever want it to change. Change just means more things break, features disappear, or the app becomes bloated, and now apparently, may start injecting ads. I uninstalled noscript years ago when it started updating twice a week with apparently miniscule changes just to pop up its ad filled landing page. Its a fucking javascript blacklist/whitelist app, why on earth does it need to update? If I wanted a "browser security suite" (what noscript currently bills itself as) I'd download that specifically.

esrauch 13y ago
Every piece of software I use is broken in some way. Auto updates allow me to hope that they are a little less broken each day.
- hackinthebochs 13y ago
  My philosophy is it's not broken if I don't notice it.
  - esrauch 13y ago
    My point was that I notice broken things roughly every day.