4 ms·

> You need to re-examine your review policies, and figure out why Chrome can manage to approve extensions in a few days, when you take weeks to review the same

by shock 12y ago

> You need to re-examine your review policies, and figure out why Chrome can manage to approve extensions in a few days, when you take weeks to review the same code. AFAIK Chrome extensions don't go through a review process. That's why I know of two Chrome extensions that were spying on their users and submitted the visited urls to third party servers (Smooth Gestures and a Diigo extension having something to do with screenshots). So while it's important to be able to iterate quickly, I don't think the Chrome team have made the best choice. The damn spying by extensions is the primary reason I recommend Firefox instead of Chrome to anyone who asks.

fitoria 12y ago
I have made extensions and this review process is a total pain, but remember that mozilla is a volunteer based project and they seem to need help on that aspect, maybe they should invite people to join their reviewer team, they have local users groups that can make that happen.
- shock 12y ago
  Please submit your feedback and ideas about the review process to Mozilla, I'm sure they would work harder to improve the review process if more people would let them know how painful it is. EDIT: I just asked on #mozilla IRC and was told that https://lists.mozilla.org/listinfo/dev-extensions https://lists.mozilla.org/listinfo/dev-extensions would be one way to send that feedback.
masklinn 12y ago
And an other component is Firefox extensions have significantly more power available than Chrome ones, so they would need more review to be trusted even if Chrome extensions had any. Firebug could be built for Firefox (however hard and painful that was). You can't build anything similar for Chrome.
general_failure 12y ago
I disagree. Reviewing should never have been part of software culture but sadly is becoming a norm. Just because some extensions are bad, don't make everyone suffer and provide a bad experience. Maybe provide a proper review system where people can downvote and moderators can ban such extensions. They are so many choices available instead of a highly dramatized review process.
- smacktoward 12y ago
  But how is the general user supposed to be able to evaluate technical questions like whether their new extension is spying on them? If it appears to be doing what it said it would do, they aren't going to pop the hood and see if it's doing anything else. All you'll get is 10,000 variations of "I downloaded the More Smilies extension and got a bunch of smilies! 5 stars."
  - general_failure 12y ago
    If the problem is spying specifically, then build a proper sandbox for network traffic. Make sure the user knows if they want the sandbox disabled (or extensions seek specific permissions). Like I said, there are many options here. Approval process should just do some automated scans but that's about it.
    - shock 12y ago
      > then build a proper sandbox for network traffic Such a sandbox can't be done for this use case. How would the sandbox know what is legitimate traffic for that extension and what is traffic related to spying?
  - the8472 12y ago
    How do you know it's safe to install 7zip on your computer?
- shock 12y ago
  By having a review process for extensions just a few suffer (the extension developers) and many (the users) benefit, because they can trust the browser. By not having a review process a few don't suffer (the extension developers) and many (the users) suffer, because they can't trust their browser. I'm firmly in the "I want to be able to trust my browser" camp but perhaps a balance can be found where the benefit of the many can be only slightly reduced while the pain of the few can be greatly reduced. Here's to that!
  - 12y ago
jaredsohn 12y ago
Some kind of review or moderation in the Chrome webstore would be pretty useful. A couple of months ago I noticed that the Unfriend Notify for Facebook extension (https://chrome.google.com/webstore/detail/unfriend-notify-for-faceb/ahigpjeolkfgjdaeodlmaceggigbpeoh/reviews?hl=en https://chrome.google.com/webstore/detail/unfriend-notify-fo...) with 200,000 users is doing the same thing (a good clue is that it asks for access to all sites but doesn't do anything useful outside of facebook.com). I wrote a note via the webstore's "Report Abuse" that I am pretty sure referenced the bad code but the extension is still in the store.
math0ne 12y ago
Agree people in my company have been negatively affected by chrome addons that "went bad" ie they were at one point legitimate but got sold to adware companies. Shady shit right there.
iza 12y ago
They have started moving toward a review process over the last few months. Extensions now go through an automated review and can be flagged for manual review if they appear suspicious.

by shock 12y ago

fitoria 12y ago

I have made extensions and this review process is a total pain, but remember that mozilla is a volunteer based project and they seem to need help on that aspect, maybe they should invite people to join their reviewer team, they have local users groups that can make that happen.

shock 12y ago
Please submit your feedback and ideas about the review process to Mozilla, I'm sure they would work harder to improve the review process if more people would let them know how painful it is. EDIT: I just asked on #mozilla IRC and was told that https://lists.mozilla.org/listinfo/dev-extensions https://lists.mozilla.org/listinfo/dev-extensions would be one way to send that feedback.

masklinn 12y ago

And an other component is Firefox extensions have significantly more power available than Chrome ones, so they would need more review to be trusted even if Chrome extensions had any. Firebug could be built for Firefox (however hard and painful that was). You can't build anything similar for Chrome.

general_failure 12y ago

I disagree. Reviewing should never have been part of software culture but sadly is becoming a norm. Just because some extensions are bad, don't make everyone suffer and provide a bad experience. Maybe provide a proper review system where people can downvote and moderators can ban such extensions. They are so many choices available instead of a highly dramatized review process.

smacktoward 12y ago
But how is the general user supposed to be able to evaluate technical questions like whether their new extension is spying on them? If it appears to be doing what it said it would do, they aren't going to pop the hood and see if it's doing anything else. All you'll get is 10,000 variations of "I downloaded the More Smilies extension and got a bunch of smilies! 5 stars."
- general_failure 12y ago
  If the problem is spying specifically, then build a proper sandbox for network traffic. Make sure the user knows if they want the sandbox disabled (or extensions seek specific permissions). Like I said, there are many options here. Approval process should just do some automated scans but that's about it.
  - shock 12y ago
    > then build a proper sandbox for network traffic Such a sandbox can't be done for this use case. How would the sandbox know what is legitimate traffic for that extension and what is traffic related to spying?
- the8472 12y ago
  How do you know it's safe to install 7zip on your computer?
shock 12y ago
By having a review process for extensions just a few suffer (the extension developers) and many (the users) benefit, because they can trust the browser. By not having a review process a few don't suffer (the extension developers) and many (the users) suffer, because they can't trust their browser. I'm firmly in the "I want to be able to trust my browser" camp but perhaps a balance can be found where the benefit of the many can be only slightly reduced while the pain of the few can be greatly reduced. Here's to that!
- 12y ago

jaredsohn 12y ago

Some kind of review or moderation in the Chrome webstore would be pretty useful. A couple of months ago I noticed that the Unfriend Notify for Facebook extension (https://chrome.google.com/webstore/detail/unfriend-notify-for-faceb/ahigpjeolkfgjdaeodlmaceggigbpeoh/reviews?hl=en https://chrome.google.com/webstore/detail/unfriend-notify-fo...) with 200,000 users is doing the same thing (a good clue is that it asks for access to all sites but doesn't do anything useful outside of facebook.com). I wrote a note via the webstore's "Report Abuse" that I am pretty sure referenced the bad code but the extension is still in the store.

math0ne 12y ago

Agree people in my company have been negatively affected by chrome addons that "went bad" ie they were at one point legitimate but got sold to adware companies. Shady shit right there.

iza 12y ago

They have started moving toward a review process over the last few months. Extensions now go through an automated review and can be flagged for manual review if they appear suspicious.