Comment by seanwilson | Hacker News Reader

Comment by seanwilson | Hacker News Reader

For people focusing their comments on this particular extension + the permissions it asks for, please take a quick look at the numerous recent posts in the official forum for Chrome extension developers to see it's not an isolated issue:

https://groups.google.com/a/chromium.org/forum/#!forum/chrom...

It's a systematic issue that isn't specific to anything Pushbullet is doing and it's been like this before the pandemic:

- Reviews can take up to 3 weeks. This in alone would be crazy enough if you have an urgent bug to fix.

- Rejection emails are vague and don't tell you what to fix.

- After you guess at what to fix, you've then got to join the up to 3 weeks review queue again.

- If you try too many times, your extension gets pulled.

- On top of this, they've recently disabled new Chrome Web Store paid items, and user reviews.

Can anyone from Google escalate this and help extension developers? I can't speak for everyone but there's lots of complaints in the forum and little action beyond "we hear you and are looking to improve things".

The rule still applies: if you build your business on someone else's property, don't act surprised when they they casually destroy you.

It has happened again and again and again. Building for FB or Google is you making yourself their serf, and you will be allowed to exist at their whim.

How can you realistically avoid this for certain products though? For mobile for example, you've got the iOS and Android store policies to go through, the iOS and Android SDKs, and whatever restrictions Safari (e.g. no proper PWAs) and Chrome have.

Not everything can be a website that just needs basic browser capabilities.

At least Android allows sideloading without using the Play Store. Chrome used to allow this, and I believe they've made it much more difficult.

I believe you can only do it on the dev channel now and it still makes a fuss.

> How can you realistically avoid this for certain products though?

You can't. It seems like if you're in business of mobile/web-apps which are not large enough to have paid, direct contacts with your relevant platforms, you should have more than one business.

I'm not saying it's a reasonable expectation or a good thing. But if you can pull off either 2 ok apps, or 1 main app and some set of simple things, it may be preferable to one perfect product from the business continuity perspective.

This isn't very actionable advice, though, since there is basically no such thing as a software product that isn't built on somebody else's property.

You might think, "Ah-ha, web apps!" But no, Google can still casually destroy you there. Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there.

Maybe this means that software shouldn't be distributed as products, but as code. Maybe people should be free to run code of their choice on their computers.

I am not helping my parents compile Gentoo Linux.

Not that they should, but the only ability that is required for installing Gentoo is to read and follow instructions.

People have been complaining about $dominant_player's power to destroy forever. It was IBM, then it was Microsoft, now we have new overlords. (For that matter, Sun was big enough to be a little obnoxious for a bit.)

That's unfortunate, but it is how the software market has worked thus far. Platform owners have massive power over those who build on them. For it to change, the market fundamentals will have to change. People thought the internet would change things, and it did - instead of one monster, we now have several, each with much more reach and control.

As far as actionable advice, well, starting a company isn't easy or formulaic. All I can recommend is look for niches where you'll be hard to dislodge and avoid situations where you have asymmetrical dependence on an entity that has no reason to care about you.

Invest in more open platforms. Not a great short term solution, but not many alternatives.

Microsoft threw in the towel, discontinued their web browser development and became a Chromium fork. How are these extension developers supposed to invest enough in platforms that complete with Chrome to succeed?

Their platform still does compete, it's a separate web store run by a separate entity and in fact for extension developers it makes ports even easier.

This is actionable advice. The action is to create an offer that is not entirely depeneent on a single platform provider. Don't build browser extensions for just a single browser. Don't build an app based business solely around an iOS or Android app - support both platforms. And so on.

This implies that a company could generally survive 50% of their revenue disappearing overnight. This may be true for 1-3 employee companies but past that I doubt it. Also generally the large majority of your revenue still comes from one of your platforms, making that one still likely an existential risk.

> Don't build browser extensions for just a single browser.

That won't matter if 60–70 % of the users are on that single browser.

Which is one big reason, why having one browser dominating the market is a bad thing. Use firefox or something else, people.

> Or you might think, "Ah-ha, desktop apps!" But the OS vendor can casually destroy you there.

Casually? The amount of effort and goodwill, say, Microsoft would need to spend to prevent me from installing $PROGRAM on my computer is significantly higher than the amount of non-effort a single extension reviewer would need to expend to click "no" arbitrarily because they are having a bad day.

How would Microsoft do it? Add legit software to Defender? Ship a Win10 update that disables a key API call $PROGRAM uses? Add "if program == $PROGRAM then exit" to the CreateProcess code? All possible, none casual. To the best of my knowledge they've never done something like this. I'm less deep into Apple land but I expect something similar holds on macos.

Microsoft could add the software to Defender's database of signatures. Or just probably revoke your certificate.

Have they ever done such a thing for legit software (akin to Pushbullet?)

My point is not that they can't do it, my point is that they can't casually do it. It would be Real Work and it would risk major backlash.

The OS vendor could "destroy" you by making changes to the OS that affect your app, right? The Old New Thing[0] is full of stories of apps that exploited undocumented implementation details of the OS, and were surprised that those aspects were in fact changed in a later OS version.

To its credit (though not everyone agrees), MS has spent a lot of effort making compatibility shims, basically doing other people's work for them, but they have no such obligation.

0. https://devblogs.microsoft.com/oldnewthing/

This strikes me as a different class of problem. Of course software developers are at the mercy of other software and hardware, and have been since the days of yore. And even in that case, you could still potentially debug the issue.

This is a different class of problem. In this case, a gatekeeper is asking you to use their service to distribute software through their channel, and that channel is governed by vague rules that may, in fact, be enforced on a whim. Further, the gatekeeper isn't being clear with the rules, and why you may have run afoul of them.

> The OS vendor could "destroy" you by making changes to the OS that affect your app, right?

You sound like someone who's made the mistake of supporting Apple

That's a software problem for any language. Will the authors break compatibility? They sure can and do all the time. You are always at someone else's mercy in computer science.

> I'm less deep into Apple land but I expect something similar holds on macos.

Well, considering how hard Apple tries lately to make sure every piece of macOS software goes through them one way or another...

Here's some actionable advice. Go to your local president / prime minister. Preferably a populist. Tell them how you see the dominance of a few megacorps as a threat to national security. This argument is especially strong if from your point of view they are foreign megacorps. Throw in something about colonialism if it would help your case. Express your wish that they do something.

What? Are you being sarcastic?

This is seems like a good advice to increase competition by using nationalist sentiments. The problem is that many of these nationalist countries would outright ban competition. So people who demanded local alternative will end up with less competition.

Technically, yes, you are right. But let's burn that bridge when we get to it.

At the moment the issue is the app store concept; it is designed to be a choke point, it is designed to be obscure, and it is designed to casually destroy software the store owner doesn't approve of.

(What is the status of Microsoft's app store, by the way?)

What business short of The Principality of Sealand's data warehousing is not "built on someone else's property"? Even a brick-and-mortar business needs to appease the taxman.

It's a matter of degree, I imagine. Some approaches expose one to this risk to a greater degree than others. The highest risk might be placing an app or extension into a walled-off store controlled by a single company with sole authority over what is listed there.

I’m torn here.

1. I agree as to the need to get off the Google lands.

2. Being able to create business relationships to build on other people’s property and work without fear of their yanking the rug out is an incredibly important part of a working society.

Their business isn’t solely built on google. Part of it relies on browsers and google have a dominant position in browsers. Should no one build a business related to browsers until google is toppled? I wouldn’t follow your “rule”, as most successful businesses started out by violating that rule.

Except chrome isn't really a "property app" so much as a "proprietary OS"; it's the platform in which ~70% of desktop users spend >10 hours a day. This is different from eg Facebook, in that FB's valueprop is being "full stack" (content + controls + ads); while Chrome's design is open-ended -running other people's websites, with other people's extensions.

The other side of the issue is tough, though: Chrome extensions are regularly purchased & have ads embedded into them ( https://superuser.com/questions/1551266/how-to-track-down-wh... ), so Google's chrome extension team (couple of ~hundred person?) is essentially held accountable by ~1 billion users to the behavior of ~10s of thousands of extensions.

Google's 2014 net income was $14B. Chrome is one of the most valuable properties that Google owns, as it allows them to control a large fraction of advertising on the desktop, and advertising is their core business. They can afford to hire thousands more developers to vet Chrome extensions, yet they don't - implying that at least the upper levels of the Google command hierarchy don't consider this to be a problem or don't care about fixing it.

This is not a useful comment. You are suggesting a world where no platform is extensible, which isn't realistic nor desirable.

When you are building for an extensible platform it's entirely reasonable to be surprised when the vendor sabotages you. Platforms like this are good because they help both parties, so there is an expectation that one side won't sabotage the other in general. When it happens it's surprising, and usually not a great outcome for the platform provider.

>We hear you and are eagerly looking to improve things.

Joking aside, isn't this just what people should come to expect from the company that has always tried to normalize the "no support and no service" model?

If these antics start causing GOOG to lose share in the browser market then they may review these policies, but I highly doubt it. At the end of the day GOOG is an ad company and publicly-traded at that. They have a bottom-line and a lot of shareholders watching it.

Support channels/forums are probably not the way to go, in other words. Stop using their browser, stop using their search. That's probably the only way they will be incentivized to change.

> Stop using their browser, stop using their search.

The more people that do this in general, the better. We've given Google entirely too much power to control what people see and read (and it follows, control over what they say and think).

They don't have our best interests at heart, they have financial interests at heart, and everything else flows from there. I'm not saying this is evil, but it's certainly not _good_.

What should I use for search? I tried switching to DDG for a month but I kept finding myself manually typing in Google.com to make the more obscure searches.

That is my exact habit now - DDG for the easy/lazy stuff, google for more obscure. I'm still giving them some search info to profile me, but hopefully it's skewed enough that it's value is lower. And I'm definitely giving them less ad views.

I actually prefer DDG in a few fronts, like configuration of language and region.

Well, quit typing google.com, for one. Use DDG’s !g feature. Or !sp, which is like Google results without the Google frontend.

https://duckduckgo.com/bang

Couldn't find !sp. What is it?

StartPage

If you have all the adblockers and stuff, and open a fresh private browser, nothing wrong with taking advantage of Google's still-superior search for finding things.

> "no support and no service" model?

this is one of the reasons why Google cloud will lose to AWS in the long run.

AWS is customer obsessed, Google is not.

At Amazon the most important person is the customer. At Google the most important person is the Google engineer. I firmly believe that's why they suck at selling enterprise products.

I’ve emailed and sent Linkedin msgs to 3 people who work at gcp for cloud credits. They didn’t care. AWS gave us credits + support in less than 3 days. I wish Google best of luck with their 5yr strategy. Hope their enterprise game is better than their startup one.

... so you're upset that you didn't get a service for free?

If you're serious about spending a lot on the cloud it's reasonable to expect a taste. Just like an ice cream store.

the free tier is for that, isn't it ?

You don't get much in terms of performance and capacity in the free tier preventing you from testing anything beyond the tiniest workloads.

If you need to pre-arrange expenses with the finance department, it's much faster to test drive with credits.

ah, i see. in that case i think it's okay that you should pay.

its not like ice cream.

if you messaged random people it's quite reasonable that they didn't bother answering you. i wouldn't have done it either.

you should get in contact with sales people via the proper channels and arrange testing (whether paid or not) with them.

If you message random "people that work at gcp" then "not caring" is probably one of the most polite things they could do.

It's so difficult to imagine a) getting ahold of someone at Google who can actually help you, and b) having some sense of assurance that they will actually help you.

"Google deleted my X" posts always rise to the top on HN because they elicit a strong emotional response from developers. I think it's worthwhile to reflect on why that happens. For me, it's because I absolutely despise seeing an algorithm have control over an individual's livelihood. This may be part of the Google mythos? Or it may simply be that they make their real money selling ads, and allocate support resources accordingly.

> This may be part of the Google mythos?

They officially dropped the "don't be evil" motto some time ago, so yes.

> they make their real money selling ads, and allocate support resources accordingly

Of course. Every company allocates support resources the same way: to their paying customers.

YouTube content creators can relate too. Lots of videos about YouTubers getting randomly demonetized or removed from search results for no reason.

I can confirm that the support on for example displayvideo360 (one of google ad products) is absolutely stellar even for very low revenue players. Meaning live chat with well trained support persons, and quick escalation if needed. Resolution rate : 100% within a couple day in our case.

I don't understand how people work for these companies as developers and implement these policies and systems and aren't just as angry about it and don't stand up to their supervisors over it: if frankly makes me have a really low opinion of people who work for Google, Apple, etc. :/.

They get a few hundred thousand dollars a year to do it. If you're working for a global surveillance ad tech company, you're obviously not there for the good things they do, you want the money. And they give them the money.

The interview process is made intentionally annoying so people self-select towards only obeying marionettes actually applying for the job.

As result, you get a whole company of yes-men who have no spine.

I definitely agree. Microsoft Azure also, I feel customers have a very big part in the direction. (And right from day 1, long before azure, Microsoft focused on having “partner networks” which meant that although you weren’t dealing with Bill Gates directly you were part of a chain of motivated people all the way through to Bill.) Google’s way is not gonna last.

I want to share my opinion on this as it's something that I've spent a lot of time thinking and talking to the Chrome Web Store team about.

The very core of the issue here is less about the manual review process (although that sucks) and more about how the review process is necessary due to how extension permissions work in browsers to-date. The current process works similar to how Android and IOS permissions worked back in the day by requiring the user to grant all permissions up front (equivalent to giving an extension sudo permission to your browser).

The feedback you'll most likely get from Google on this isue is that the solution to this is to narrow down what URLs your extension works on... but that comes with a pretty big assumption that an extension can declare that information up front. Many extensions (including developer tooling) don't need to run on EVERY page - they need to run on specific pages where some extension-specific code is running (this is the case with Urql, Preact, React, Rexux devtools). Narrowing down by URL just isn't possible and an ad-hoc solution where extension-specific code on the webpage can trigger permission requests (similar to how a website requests access to your camera) is needed.

I've written up a proposal for this case which I think addresses 90% of use cases where "sudo permissions" are being requested up front and in reality, could be requested on an ad-hoc basis. Whether it's an agreement or some criticism, anyone who is able to get involved in this discussion - please do! Every other platform is using ad-hoc permissions and we need to push for the same with browser extensions.

Here's the proposal: https://groups.google.com/a/chromium.org/forum/#!topic/chrom...

Here's my rant on Twitter about this problem (see retweeted comment): https://twitter.com/andyrichardsonn/status/12529205656960040...

I guess the solution is to stop using Chrome.

I blamed the Chrome Web Store team at first but I can understand why they're anxious about allowing extensions onto the store which basically access everything on your browser.

The issue is the outdated permission spec for browser extensions (I've gone into more detail on another comment on this thread)

Reply on news.ycombinator.com