Hacker News Reader

Comment by victorhooi | Hacker News Reader

If you're referring to the recent controversy around Pushbullet - I thought that was revealed to be them asking for all access to any HTTP/HTTPS websites you viewed...which is a major security breach.

They removed that permission to limit it to only Pushbullet, and then were able to get back on.

I'm not saying there couldn't have been more hand-holding - but it wasn't exactly like it wasn't for a fairly egregious security breach.

(Disclaimer: I work for Google, but not in any Chrome/Android/Store team, or anything even vaguely related to that - this is purely my own opinion).

View on HN

They removed that permission and were denied again. Only after the story got a lot of publicity did Google decide to accept it.

Did PB fall through the cavernous CS cracks or are they competition?

Chrome + Android are busy building a competing feature and that's part of the narrative about Pushbullet - this was seen as an attempt by Google to kill a competitor through nebulous "rules violations".

If the PB team hadn't gotten it to be as visible as it was, they very likely would have gotten away with it.

I believe Pushbullet needed it's permissions for the features it offered, they even tried removing features and permissions just to appease Google.

Regardless of that, just tell people what they've done wrong, developers are surely jaded by being told absolutely nothing about what or why some faceless mega corp is trampling all over their day.

Is it any wonder people like OP lash out in frustration and just pull all of their work when one has no means to obtain a straight answer? The man has a young child, and that is work enough, but it also puts things into perspective, and honestly, as a father of a months old child, I'd probably respond to this in the same way and think "fuck it, one less frustration" and just pull it too.

I believe Pushbullet needed it's permissions for the features it offered

The PB post describes them removing permissions they realized they didn't need, you can check their writeup. Google's handling of this was poor but PB had real problems.

In this extension's case, we haven't even seen what notices Google sent.

I'm all for enforcing strong privacy rules, in fact, I stopped using PB very quickly after trying it for the first time, because of the _feeling_ of a lack of privacy/security it gave me (based on no actual evidence), so I'm not defending PB.

That said, calling Google heavy handed is an understatement, and there have been several cases which have made it clear that kicking up a fuss online and being big enough to get some attention is the only means for recourse.

I didn't call it 'heavy handed'. I'm just correcting your assertion that PB didn't have unnecessary and overly-broad permissions. This is in their writeup.

This might be okay as long as you give clear and specific points to correct.

But Google just said "you're asking too much permissions". After the first fixes the extension got rejected again, without explanation.

I'm not really trying to re-litigate the whole PB thing. It's just not the case that they got dinged for nothing which is what the comment I replied to was suggesting.

And the other (I think more important) point was that we know even less about whatever happened to Kozmos.

Oh, I understand your point. I was calling Google heavy handed.

FWIW, someone workin on things related to it felt like it was something that needed apologizing for: https://twitter.com/DotProto/status/1261047663669084161

Rejecting a fixed version is not lack of "hand-holding", and far-reaching permissions are not by default a "major security breach" (unless Google has a policy of shipping products with major security breaches built in?)

They were only allowed back on after they've turned it into a big story online.

Reply on news.ycombinator.com