Hacker News Reader

Comment by burtonator | Hacker News Reader

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform.

Chrome for example has a ton of limitations:

https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E...

If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates.

You can't just push an update immediately that gets sent out. They take a week to approve your extension.

This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year.

ESPECIALLY if something is broken.

Imagine if you had a bug that destroys data and you need to rush out a fix. Nope.. You need to wait one week for that to go out.

View on HN

"This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year.

ESPECIALLY if something is broken."

I get what you are saying, but this is more of an artifact of people being used to unregulated platform as a service and the - being blunt here - terrible quality practices that are rampant there. If a week is an "eternity" then try internally iterating a few times and shore up that test coverage if that extremely mild release cadence constraint is more than you can bear. Browser extensions are risk in security, authenticity of content, a new avenue for phishing (look alikes in low volume/poorly curated areas), and browser stability.

It isn't Chrome's fault if someone pushes a bug that destroys data, it's the development teams fault. There responsibility is the the user of Chrome.

Personal anecdote here, I have a Chrome extension with a few thousand users that has never been subject to this wait. That seems to be because I have a narrowly defined scope for my extension and therefore the permissions I request are relatively innocuous.

That exact article you linked was posted to HN a few months back. I remember someone dug into it and found the permissions it requested. The full list was rather broad and as a result the extension could have basically hijacked the entire browsing experience. A malicious extension with those permissions would have been a potential goldmine. I think it is perfectly reasonable for Google to want to review extensions like that.

> This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year.

Not so long ago, people distributed software on physical media. Time to update was counted in months to years. This had a nice side benefit of people not being able to "test in production"; software either worked mostly well, or it didn't sell. That wasn't a bad thing, because it forced companies to do actual QA - something that today is increasingly being pawned off to end-users, with help of deeply invasive telemetry.

The same applies for my own fork of SingleFile, called SingleFileZ. I can publish any update of SingleFile in 1 hour. For SingleFileZ, which requires less permissions, I have to wait 7 days for exactly the same update. That's very demotivating.

I experience the same one week delay with an extension. The publishing delay is always about a week, and that is highly unusual.

They state that the extension update is under compliance review, which may take several business days, though the similar approval times indicate that this is actually an arbitrary publishing delay, and that no human review takes place in all cases, otherwise there would be more variation between approval times.

It's always a week AND it's also applied at a week even if you change an image. They don't need to audit an image.

I'm suspicious that they might be doing this for other reasons more likely to punish people for more aggressive permissions.

That has been the reality for the Apple AppStore for many years. Seems to not have hurt them. And Chrome has a much larger market share (or browser share) than iOS has.

As long as you have that, you can pretty much do whatever you like to the devs as long as you don't piss off the users

Oh? How many billions of users are on Chrome?

Are you waiting for google to release a mobile operating system and put their browser on it?

That'd show Apple.

At least one, as of 2016.

at least in firefox, updates typically roll out immediately while any manual review happens asynchronously

While I disagree with the 1-week review times that google imposes, doesn't the firefox approach defeat the purpose of the review in the first place?

While async review is better than no review, if someone pushed a malicious update and it got caught in the async review a few days later, the damage has already been done. Just a trade-off to think about.

its a tradeoff for sure; i tend to think the risk of unpatched software outweighs the risk of software hijacked from the author, so i prefer the moz model. iirc, there are automatic checks (ie permission changes, certain api calls, etc) which trigger a manual review before publishing. that said even the manual review is no guarantee malicious software doesnt get published (from my experience the reviewers are not always experts)

Reply on news.ycombinator.com