9 ms·

Google discards extensions that force feed users ads in Chrome

57 points by RougeFemme 13y ago

nav1 13y ago
I think it would be really helpful if Google disabled automatic updates for extensions. Letting third parties to push modified code to clients without any user intervention is just so insecure that I can't believe it actually is a feature. Just the fact that Chrome updates automatically is bad enough.
- smtddr 13y ago
  >>Just the fact that Chrome updates automatically is bad enough. Don't agree with that. As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I'd rather have a few people angry at me than deal with another IE update-style browser that just gets lost out there with nearly zero hope of updating. For example, I applauded Mozilla for this[1] move. 1. http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitto,news-11209.html http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitt... >>"We don't think self-selection will ultimately get us to the place we need to be," he said. "We will force 3.6 on 3.5 stragglers not choosing to update to Firefox 4 or 3.6 (give them the stick). We feel comfortable making the major update choice for users because a) the versions are very similar and b) we'd rather lose a small amount of miffed users than leave a large amount of users vulnerable." Keeping an old browser version is something I wish a user could not do unless they went out of their way to install a nightly by themselves and that nightly should nag them to death after 15 days to stop using it. The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser.
  - username223 13y ago
    > As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I hope someone starts force-updating your terminal and editor/IDE, introducing all sorts of random changes. Maybe then you would understand why it is bad to make your users' lives worse to make your own life marginally easier.
    - philwelch 13y ago
      I would love if all my software autoupdated itself. Including my editor.
      - username223 13y ago
        You'll love getting new versions of the Ask toolbar every time Flash force-updates... More seriously, I have a software setup that I have configured to be secure and useful. Switching to a newer version of $whatever might help or hurt in either category, but it's a change I want to make deliberately. I don't see why changes preferred by $randomBrowserVendor or $adCompany will automatically be in my interest.
      - omaranto 13y ago
        Do you mean you wish it received just bug fixes automatically? Or are random unsolicited UI changes OK too?
        philwelch 13y ago
        Realistically speaking, older versions aren't going to receive bug fixes and I'm going to always want the newest version anyway, so yes. But perhaps that's cheating because so far vim hasn't developed too many strange UI changes :)
        tomswartz07 13y ago
        To be honest, we're talking about Google Chrome. the UI for Chrome hasn't changed that much (except for the Wrench/3lines menu button) since version 10.
  - userbinator 13y ago
    > The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser. This sort of attitude really, really disgusts me, as an end-user (and webpage-writer). Many of the things that are being pushed on us, many of us do not need nor want. We want stability, not constant change. Breaking things that used to work is one of the worst things to do. Requiring users to use (and in many cases relearn) newer, more resource-consuming software just creates waste, in the physical and chronological sense.
    - smtddr 13y ago
      >>This sort of attitude really, really disgusts me The idea that you have an environment that relies on an out-dated browser really, really disgusts me! :) What if instead of actually fixing the real problem, everyone decides to just freeze on whatever version of a browser fits their needs at a specific moment? Fragmentation happens... and that's bad for everyone. I rather have people like you upset at me for forcefully upgrading your system than dealing with all the support tickets of "My IE6 and Firefox 3.5 show a blank page during checkout". There are major advances happening in webdevelopment and they'd move even faster if webdevs didn't have to worry about people who refuse to let go of some old browser. If it's an old version of TurboTax, fine. That's your thing. It only effects you. But the percentage of different browsers out there has an effect on everyone. It's like the way I was holding on to an out-dated at&t SIM card. They mailed me 4 new SIM cards but I refused to upgrade. Eventually, they just cut my service and I had to go into the shop to upgrade. When they're trying to support all the cellphones out there and upgrading the infrastructure, they can't have people dragging their feet with old SIMs they need to support. There is a very real cost to supporting old SIM cards that don't fit into the infrastructure they're trying to build out for new phones & SIMs. There is real cost in supporting old web-browsers when technology in web-development is moving ahead in leaps. I stand by what I said; if you think you've solved an issue by staying on an old browser version, you've made a mistake somewhere upstream that needs to be fixed there. If you truly can't move forward for some reason - go download some developer/nightly branch and install that. I'd want that branch to update itself to production path every month though because holding an old browser version is not a valid solution. It's just delaying the fix to whatever is really wrong in your environment.
- timothya 13y ago
  I agree that automatically-updating extensions has the potential to be somewhat insecure. However, I don't see how the alternative could be a better alternative. If they didn't auto-update, then the majority of users would likely never update their extensions, and the ones that do would be unlikely to audit the extensions that they update for malware. Do you audit the apps on your phone before you update them? To mitigate the problem, Chrome does have the permissions model to limit what extensions can do, and if an extension requires more permissions after an update, Chrome will give you a warning, along with an option to remove the extension. Your best defence is to not grant overly broad permissions when you first install the extension. Regarding your comment about Chrome's automatic updates being "bad", I disagree wholeheartedly - the web platform would not be able to move forward at the same rate that it can today. One of the biggest problems with IE was simply that it was updated so infrequently that it was really hard to support the large percentage of outdated versions. We'd be in the same situation with Chrome if it didn't auto-update. Furthermore, I trust Chrome to make good decisions for my security. I'd rather have my browser updated quickly so that vulnerabilities in the browser can be fixed quickly before they affect me.
- jordsmi 13y ago
  I would love a popup when I start up chrome that gives a prompt with which extensions need updated and if you want to allow it or not.
  - higherpurpose 13y ago
    I like that, but maybe instead of several pop-ups it would be just one local Chrome page showing you the extensions that got the updates along with details. Google also needs to make developers put the change log in there, too. At the very least offer them a box for the change log, even if all they put there is "New stuff". If they do that you can decide to stop using the extension if you lose trust in them.
  - tomswartz07 13y ago
    They currently 'hold' updates that have changed permissions. You must click through the menu to install them.
lcovington 13y ago
Is this one of the first malware to run on a Chromebook?
- jordsmi 13y ago
  You could run dirty extensions on chromebooks from day one.
- Grue3 13y ago
  No, Chrome was.
octref 13y ago
Why extensions that hijack your search engine like Window Resizer are not removed?
- makomk 13y ago
  The only reason these two extensions were pulled was because they were causing bad PR for Google. Until that article on Ars Technica, Google had consistently taken the position that there was nothing wrong with what those extensions were doing.
malandrew 13y ago
"Do not create an extension that requires users to accept bundles of unrelated functionality, such as an email notifier and a news headline aggregator. If two pieces of functionality are clearly separate, they should be put into two different extensions, and users should have the ability to install and uninstall them separately," Kudos to Google. Now if only they applied the same logic to the advertisements between the search box and the actual results. Search results and advertisements only represent the same functionality when my search query expresses my intent to purchase something. I know advertising is Google's business model, so before anyone points that out, let me point out that I've also never been offered the opportunity to purchase the ability to use Google's search without advertising. They should follow their own policy here and give us the ability to uninstall advertising from Google even if it does come with a monthly subscription fee to do so.
- jrockway 13y ago
  Wait until you hear about how The New York Times works. You pay a monthly subscription fee and have to look at ads.
  - hrrsn 13y ago
    See also: Cable TV.
  - anon1385 13y ago
    When you snarkily reply to people criticising Google's business model you should probably mention that you work for Google.
    - jrockway 13y ago
      Why? To create unnecessary Internet controversy? The fact of the matter is: I'm happy getting Google search for free, and I've been a loyal paid subscriber to the Times since I've moved to New York. The business model of ads seems to work, otherwise there would be no Google or New York Times to complain about. Furthermore, the comment I replied to has nothing to do with the article. Web pages and Chrome extensions are totally different things. Web pages present you with what the content creator wants you to see. Chrome extensions as documented in this article change that out from under you without telling you. Do you see the difference? (Compare that to an extension like AdBlock, which makes clear that it removes ads from pages you visit, so if you install it, you won't wonder why you aren't seeing ads anymore.)
PhasmaFelis 13y ago
That's nice. Maybe they could see to the other end of the equation and stop making me jump through hoops to install non-approved extensions when I choose to.
nl 13y ago
This is a good move by Google. Back when extensions were first released I wrote one, and over the years it became pretty popular and built up a good (200k plus) install base. I foolishly took some money for it last year, and the buyers stuck ads in it. The rating have declined from 4.5 stars to 2.5, but I still feel bad for the users. Somewhat ironically, it is actually open source, and the code is available for anyone to fork. I beleive there is a fork out there now too, so hopefully that will do better.
- ToastyMallows 13y ago
  Would love to know what extension it is, or Github repository?
  - nl 13y ago
    The GitHib code is https://code.google.com/p/chrome-reload/ https://code.google.com/p/chrome-reload/. Not linking to the extension itself.
    - ToastyMallows 13y ago
      Thanks for the link. I've actually used this extension before! Kudos for putting it on Github
  - deleted 13y ago
    [deleted]
nisa 13y ago
How privacy invasive can an extension be? If the extension can modify webpages could the extension MITM my surfing? E.g. harvesting login data, any form data, cookies and other stuff? I did not saw a discussion about these aspects but from the distance (Never developed an extension) it looks like this all these things are possible?
- pornel 13y ago
  Yes, extensions can have full access to pages you browse and they could potentially read any data from pages you have access to and perform actions as you.
WaterSponge 13y ago
Why not add the human element? Just a bit of passive moderation by a humans like students or amazon turks in app-stores/extension libraries for fake and malicious apps would go such a long way.

57 points by RougeFemme 13y ago

nav1 13y ago

I think it would be really helpful if Google disabled automatic updates for extensions. Letting third parties to push modified code to clients without any user intervention is just so insecure that I can't believe it actually is a feature. Just the fact that Chrome updates automatically is bad enough.

smtddr 13y ago
>>Just the fact that Chrome updates automatically is bad enough. Don't agree with that. As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I'd rather have a few people angry at me than deal with another IE update-style browser that just gets lost out there with nearly zero hope of updating. For example, I applauded Mozilla for this[1] move. 1. http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitto,news-11209.html http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitt... >>"We don't think self-selection will ultimately get us to the place we need to be," he said. "We will force 3.6 on 3.5 stragglers not choosing to update to Firefox 4 or 3.6 (give them the stick). We feel comfortable making the major update choice for users because a) the versions are very similar and b) we'd rather lose a small amount of miffed users than leave a large amount of users vulnerable." Keeping an old browser version is something I wish a user could not do unless they went out of their way to install a nightly by themselves and that nightly should nag them to death after 15 days to stop using it. The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser.
- username223 13y ago
  > As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I hope someone starts force-updating your terminal and editor/IDE, introducing all sorts of random changes. Maybe then you would understand why it is bad to make your users' lives worse to make your own life marginally easier.
  - philwelch 13y ago
    I would love if all my software autoupdated itself. Including my editor.
    - username223 13y ago
      You'll love getting new versions of the Ask toolbar every time Flash force-updates... More seriously, I have a software setup that I have configured to be secure and useful. Switching to a newer version of $whatever might help or hurt in either category, but it's a change I want to make deliberately. I don't see why changes preferred by $randomBrowserVendor or $adCompany will automatically be in my interest.
    - omaranto 13y ago
      Do you mean you wish it received just bug fixes automatically? Or are random unsolicited UI changes OK too?
      - philwelch 13y ago
        Realistically speaking, older versions aren't going to receive bug fixes and I'm going to always want the newest version anyway, so yes. But perhaps that's cheating because so far vim hasn't developed too many strange UI changes :)
      - tomswartz07 13y ago
        To be honest, we're talking about Google Chrome. the UI for Chrome hasn't changed that much (except for the Wrench/3lines menu button) since version 10.
- userbinator 13y ago
  > The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser. This sort of attitude really, really disgusts me, as an end-user (and webpage-writer). Many of the things that are being pushed on us, many of us do not need nor want. We want stability, not constant change. Breaking things that used to work is one of the worst things to do. Requiring users to use (and in many cases relearn) newer, more resource-consuming software just creates waste, in the physical and chronological sense.
  - smtddr 13y ago
    >>This sort of attitude really, really disgusts me The idea that you have an environment that relies on an out-dated browser really, really disgusts me! :) What if instead of actually fixing the real problem, everyone decides to just freeze on whatever version of a browser fits their needs at a specific moment? Fragmentation happens... and that's bad for everyone. I rather have people like you upset at me for forcefully upgrading your system than dealing with all the support tickets of "My IE6 and Firefox 3.5 show a blank page during checkout". There are major advances happening in webdevelopment and they'd move even faster if webdevs didn't have to worry about people who refuse to let go of some old browser. If it's an old version of TurboTax, fine. That's your thing. It only effects you. But the percentage of different browsers out there has an effect on everyone. It's like the way I was holding on to an out-dated at&t SIM card. They mailed me 4 new SIM cards but I refused to upgrade. Eventually, they just cut my service and I had to go into the shop to upgrade. When they're trying to support all the cellphones out there and upgrading the infrastructure, they can't have people dragging their feet with old SIMs they need to support. There is a very real cost to supporting old SIM cards that don't fit into the infrastructure they're trying to build out for new phones & SIMs. There is real cost in supporting old web-browsers when technology in web-development is moving ahead in leaps. I stand by what I said; if you think you've solved an issue by staying on an old browser version, you've made a mistake somewhere upstream that needs to be fixed there. If you truly can't move forward for some reason - go download some developer/nightly branch and install that. I'd want that branch to update itself to production path every month though because holding an old browser version is not a valid solution. It's just delaying the fix to whatever is really wrong in your environment.
timothya 13y ago
I agree that automatically-updating extensions has the potential to be somewhat insecure. However, I don't see how the alternative could be a better alternative. If they didn't auto-update, then the majority of users would likely never update their extensions, and the ones that do would be unlikely to audit the extensions that they update for malware. Do you audit the apps on your phone before you update them? To mitigate the problem, Chrome does have the permissions model to limit what extensions can do, and if an extension requires more permissions after an update, Chrome will give you a warning, along with an option to remove the extension. Your best defence is to not grant overly broad permissions when you first install the extension. Regarding your comment about Chrome's automatic updates being "bad", I disagree wholeheartedly - the web platform would not be able to move forward at the same rate that it can today. One of the biggest problems with IE was simply that it was updated so infrequently that it was really hard to support the large percentage of outdated versions. We'd be in the same situation with Chrome if it didn't auto-update. Furthermore, I trust Chrome to make good decisions for my security. I'd rather have my browser updated quickly so that vulnerabilities in the browser can be fixed quickly before they affect me.
jordsmi 13y ago
I would love a popup when I start up chrome that gives a prompt with which extensions need updated and if you want to allow it or not.
- higherpurpose 13y ago
  I like that, but maybe instead of several pop-ups it would be just one local Chrome page showing you the extensions that got the updates along with details. Google also needs to make developers put the change log in there, too. At the very least offer them a box for the change log, even if all they put there is "New stuff". If they do that you can decide to stop using the extension if you lose trust in them.
- tomswartz07 13y ago
  They currently 'hold' updates that have changed permissions. You must click through the menu to install them.

lcovington 13y ago

Is this one of the first malware to run on a Chromebook?

jordsmi 13y ago
You could run dirty extensions on chromebooks from day one.
Grue3 13y ago
No, Chrome was.

octref 13y ago

Why extensions that hijack your search engine like Window Resizer are not removed?

makomk 13y ago
The only reason these two extensions were pulled was because they were causing bad PR for Google. Until that article on Ars Technica, Google had consistently taken the position that there was nothing wrong with what those extensions were doing.

malandrew 13y ago

"Do not create an extension that requires users to accept bundles of unrelated functionality, such as an email notifier and a news headline aggregator. If two pieces of functionality are clearly separate, they should be put into two different extensions, and users should have the ability to install and uninstall them separately," Kudos to Google. Now if only they applied the same logic to the advertisements between the search box and the actual results. Search results and advertisements only represent the same functionality when my search query expresses my intent to purchase something. I know advertising is Google's business model, so before anyone points that out, let me point out that I've also never been offered the opportunity to purchase the ability to use Google's search without advertising. They should follow their own policy here and give us the ability to uninstall advertising from Google even if it does come with a monthly subscription fee to do so.

jrockway 13y ago
Wait until you hear about how The New York Times works. You pay a monthly subscription fee and have to look at ads.
- hrrsn 13y ago
  See also: Cable TV.
- anon1385 13y ago
  When you snarkily reply to people criticising Google's business model you should probably mention that you work for Google.
  - jrockway 13y ago
    Why? To create unnecessary Internet controversy? The fact of the matter is: I'm happy getting Google search for free, and I've been a loyal paid subscriber to the Times since I've moved to New York. The business model of ads seems to work, otherwise there would be no Google or New York Times to complain about. Furthermore, the comment I replied to has nothing to do with the article. Web pages and Chrome extensions are totally different things. Web pages present you with what the content creator wants you to see. Chrome extensions as documented in this article change that out from under you without telling you. Do you see the difference? (Compare that to an extension like AdBlock, which makes clear that it removes ads from pages you visit, so if you install it, you won't wonder why you aren't seeing ads anymore.)

PhasmaFelis 13y ago

That's nice. Maybe they could see to the other end of the equation and stop making me jump through hoops to install non-approved extensions when I choose to.

nl 13y ago

This is a good move by Google. Back when extensions were first released I wrote one, and over the years it became pretty popular and built up a good (200k plus) install base. I foolishly took some money for it last year, and the buyers stuck ads in it. The rating have declined from 4.5 stars to 2.5, but I still feel bad for the users. Somewhat ironically, it is actually open source, and the code is available for anyone to fork. I beleive there is a fork out there now too, so hopefully that will do better.

ToastyMallows 13y ago
Would love to know what extension it is, or Github repository?
- nl 13y ago
  The GitHib code is https://code.google.com/p/chrome-reload/ https://code.google.com/p/chrome-reload/. Not linking to the extension itself.
  - ToastyMallows 13y ago
    Thanks for the link. I've actually used this extension before! Kudos for putting it on Github
- deleted 13y ago
  [deleted]

nisa 13y ago

How privacy invasive can an extension be? If the extension can modify webpages could the extension MITM my surfing? E.g. harvesting login data, any form data, cookies and other stuff? I did not saw a discussion about these aspects but from the distance (Never developed an extension) it looks like this all these things are possible?

pornel 13y ago
Yes, extensions can have full access to pages you browse and they could potentially read any data from pages you have access to and perform actions as you.

WaterSponge 13y ago

Why not add the human element? Just a bit of passive moderation by a humans like students or amazon turks in app-stores/extension libraries for fake and malicious apps would go such a long way.