How Google obliterated my 4 year old Chrome extension with 24k+ users (2016) | Hacker News Reader

How Google obliterated my 4 year old Chrome extension with 24k+ users (2016)

by.graffino.com

142 pointsFiveplus124 comments

Ran a online retail business for 12 years. One day, Adwords account suspended. Some generic 'voilation' email. No way to resolve, no person to speak to, no comment on the issue.

Tried to resolve for months.

Fired 15 staff, gave up. Basically the internet = Google when you run online retail.

Was there no way to create a new adwords account?

Pretty sure that's against tos..

And.... Who cares? Given Google's absurdly shitty behavior to so many users, its opacity, frequent mendacity, casual indifference to small organizations and let's not even go into all the gory details of its globe-spanning not-even-disregard-but-outright-hatred for any notion of privacy, I'd say anyone who can subvert its TOS and get away with doing so simply to save their livelihood deserves applause much more than scorn.

Even if I don't care about the morality/legality of it, I probably wouldn't bother. Google knows every profile and IP address I've ever used. It would be trivial for them to detect this, and close it down again. It's just not worth the effort.

The irony is that the honest users won't expend a lot of effort evading, while the scummier users will (and have a much easier time of it, since they've done it 100 times before).

In this way anti-fraud filters sometimes act as pro-fraud filters: False positives kill honest use, and dishonest use finds a way.

You need stability to run a business. Google would most likely eventually find and shut down the account; it would just be a matter of when. It’s not a sustainable plan to try to operate in that kind of precarious situation.

Not according to my analysis [1]. Also if you take a look at sites that specialize in e-commerce founder interviews, you’ll see that they use all sorts of acquisition channels/strategies (partnerships with mini influencers, FB/Instagram Ads, SEO, affiliate programs and so on) and they work really well.

I would understand if you said “the internet = Google for MY retail store”, but saying it applies for all online retail is simply incorrect.

[1] https://zerotousers.com [2] https://www.starterstory.com/

I've watched people start moving (already successful) businesses to be more dependent on google and it freaked me out because of stuff like this.

You get a lot of stuff in the short term but you have to remember your long term survival means absolutely nothing at all to the organizations that run these massive platforms and eventually they'll do something that can wipe you out.

Not sure when this happened. But Adwords does have a phone number and companies have their own agent.

I understood you have your own agent when you spend large amounts of money; i'm not sure what large is in this case, but maybe larger than most people spend?

Is your state atterney general part of the antitrust suit? Can you contact them and join in somehow?

Notably absent, the generic details about the company.

I'm removing Google from my life as we speak, but whenever you prod further about these you find out they did violate TOS and are just unhappy.

Even if that's true in this specific case (it's certainly not true in all cases, like you say), it doesn't excuse the lack of options to appeal.

We had all of our business listings on Google Maps/Business suspended a month ago because I had our GSUITE admin account suspended (due to some confusion with enabling/disabling 2FA repeatedly while doing a GSUITE Data Export), and it cascade suspended the company's Google Maps/Business listings.

The Google account was unsuspended in minutes, but there is no way to unsuspend Google Maps/Business listings, even though we are PAYING customers of Google.

GSUITE support says they don't own Google Map listings (they only support the core apps), so they can't help, and Google Business listings support has a canned response that says because of Covid they aren't responding to requests.

We are already hurting because of the pandemic and now we're not even listed anymore. This is exactly how it was dealing with 1980s telecom monopolies.

To be expected of a company where you get better support from their cloud service employees on reddit rather than on their actual website or emails.

They're in the short list of companies that practice shame-based support.

What's that?

It's where you have to shame them by publishing an article on HN/reddit/wherever about how they screwed you before they'll fix your problem.

Ahh yes, the way I have to deal with my cloud provider, as well as my local fast food outlet's delivery service. Very high tech.

Thanks for the heads-up

It's where you can't get support except by getting a successful post on social media that shames the company into dealing with your issue.

Thanks

You publicly shame them via twitter,reddit,medium,hackernews for a support response.

Thanks

I'm tempted to give you the same answer just to make you say thanks again... But I won't. Thank _you_ for being a nice person!

Doing justice to everyone :)

But it still befuddles me how that simple explanation never crossed my mind.

And thanks for calling me a nice person - I don't really deserve that.

As a user paying extra for google storage the constant flow of stories of people having issues with google and nobody to contact scare me. What happens if I loose access to my account and loose gmail/photos/drive. What do people use to backup Google?

Leave Google, use separate services. I solved it by purchasing my own domain address, moving from Gmail to Fastmail, replaced Android with iOS, replaced Chrome with Firefox, moved my passwords to 1Password, moved from Google Photos to iCloud (it automatically downloads all your pictures to your desktop as backup. There is no such thing for Google Photos).

I similarly purchased my own domain (an absolutely crucial step for everyone), moved to Fastmail (which I like much better than Gmail, it's just so much faster!), use BitWarden, replaced Chrome with Firefox, and use Nextcloud for photo backup. You can also use rclone to copy your Google Drive to another storage every night.

Did pretty much the same although replace Fastmail with Protonmail. I use S3Glacier storage for backups, costs virtually nothing. I keep the gmail account around as something to hand out to spammy websites and other services or forms IRL.

Almost did the same, except I went towards Syncthing for document sync, KeePassXC for passwords, and Sailfish / degoogled android for mobile phone (because the apple ecosystem is imho much worse, especially in terms of software durability. Got two perfectly working ipads just sitting around because apple said fuck the devs and users. At least, with SOS and android, I can still develop for them).

The problem is that Google Photos is so good, there is nothing out there for free with the same offering. ICloud is extremely limited compared to it without paying ( remember not every one lives in the US and $5 can be a lot of money )

It's understandable that 5$ is a lot to some people. Yet at the same time I hope you do understand the realities of what it costs to take even 15 minutes of a support person's time - how much service can you expect for free or 5$ a month?

I moved to Microsoft, but the story is the same.

Own your domain name, with that you can go anywhere.

Once you become a paying customer the options are so much better and more comprehensive. And owning your domain let’s you do far more flexible things. Rent a VPS, install ftpd. No longer live with San Francisco imposed choices.

You should never have a single backup of anything. Google storage is nice, but you should duplicate everything you put there (also true for any other storage service).

I was in the exact same position a few years ago. I ended up building an email backup app.

https://thehorcrux.com/about/

I download regular backups of my Google data from https://takeout.google.com/ it works pretty well. It won't help you keep your email address if Google decide to nuke your account but at least you've still got your emails, photos, etc.

Can confirm, I have used this to grab all my Google Music data before they nuked that. Turns out there's a json file for every single track in your library, and it contains metrics like play count, start / stop position, playlists, etc. Kinda creepy, but in hindsight it's not unexpected.

I use both Google and Dropbox. Photos, for instance, are backed up on both services. Full resolution on Dropbox and whatever resolution on GPhotos. Dropbox is my real backup because it syncs to my PCs, and Photos is my convenient AI searchable backup for when I'm looking for a photo quickly.

And since Gmail's inception, I've been using a forwarded pop (edit: I meant imap) address from a custom domain. I've been accessing my forwarded mail through Gmail for 15-ish years now. I remember there's some fiddling in the settings and you have to make sure when you respond to an email that it responds with your custom address. But I've never had an issue all these years, and if Gmail were to drop tomorrow, I still have all my mail.

I have an automated Google Takeout > AWS Glacier workflow. I'm trying to de-google myself as much as possible though.

Yeah, it scares me too. I am considering moving to Next Cloud, but for now I am using spanning.com to backup Google drive.

I back it all up from google takeout every now and then.

https://takeout.google.com/settings/takeout

Ah yes, typical Google support strikes again. Filled us with so much confidence we left Google Cloud.

I can find 100k examples of people angry with Amazon. Does that invalidate AWS?

It's a question of trust not anger.

Why do you think they are angry? You don’t think those people have lost trust in Amazon?

I think people are angry because Google is really perceived to have been more trustworthy before than they are today. Hence there's a betrayal factor.

Amazon is like CPS: everybody's known you cannot trust them to properly handle and care for a plastic cactus and they were told this when they were 5 year old.

Just about everyone now has at least one example of a service they loved being killed off by google.

I am not worried that Amazon would shut down all of AWS any time soon.

Can you honestly say it would be a complete surprise, however, if Google announced an EOL for GCP?

Yes. I can honestly say this would be extremely surprising given the tenants, and the rate of change of the core kubernetes model. I do not believe the dead products list typically has either this paying customer base, or code change.

Who are the notable GCP tenants? Just curious.

Tbh, the only reason I use GCP is Firebase, and the only reason I use Firebase is because it's usable for my (limited) purposes in a neat format. I'm currently in the process of migrating some functions to AWS, but it's so clunky, almost 2005-esque.

https://cloud.google.com/customers

> Can you honestly say it would be a complete surprise, however, if Google announced an EOL for GCP?

Of course. Anyone who thinks otherwise has just bought into a virulent meme and isn't actually thinking.

Yeah, I mean, I get their huge history shutting down small ancillary projects that they didn't see as strategic advantages, but GCP isn't one of those, and probably not for the foreseeable future.

Wave wasnt small ancillary, Google+ wasnt small ancillary. Google Hangouts wasnt small ancillary, reader wasnt small ancillary.

By that bar GCP is in the same boat. Good luck with that!

Wave was, Google+ failed, Hangouts got merged into Duo or whatever they call it now, Reader was.

> Can you honestly say it would be a complete surprise, however, if Google announced an EOL for GCP?

All of GCP? That would surprise me. Any particular GCP offering I may depend on that they decided to deprecate or replace? Absolutely.

Even if they did, for such a big service there would be a long transition period. E.g. 2 years, so you could move somewhere else.

That assumes that you can move off the system and that’s enough notice. Not to mention that it blows up your roadmap.

What’s the point of outsourcing heavy lifting if the vendor is just going to surprise drop it back on your at an in opportune time?

That would be reasonable, yes. But not expected from Google.

Wow, 2 years, such a long time

Yep.

In matters of opinion there is little of absoluteness. There is just preference.

Amazon is pretty customer centric.

I wonder how long before we start hearing stories like "How chrome obliterated my 4 year old website"

On a serious note though, why do we keep getting trapped in this cycle so many times? Company walled garden(WG) comes up with a WG, developers build for that WG. WG forgets about the people who made the WG a fun place for everyone to be in. WG screws over the old developers who's hard work it build itself on. And the developers complain about the walled garden being a walled garden. Like what the hell, is there really a solution to this?

I dunno, I for one hope developers build sites according to standards (instead of Chrome-only features), and Chrome has a big test suite to test said features.

I mean 20 year old websites still work just fine in Chrome. It's only those that do nonstandard things - like IE's tech, Flash, Java applets - that they no longer work. Famously, the old Space Jam website seems to work just fine: https://www.spacejam.com/

I think the parent post is alluding to scenarios where Google uses their market position to stop loading websites based on other factors. i.e. a website that does or doesn't implement a certain API. It's a very dystopian view, though.

>>It's a very dystopian view, though.

When you see this cycle of developers flocking to a walled garden and then the same developers who helped uplift the platform get burned repeat enough times you start to lose a bit of hope in the way things are working. But I do have to agree with you, my original post does sound dystopian.

When building web games the browser differences can bite you even if you're following the standard. Firefox is currently rolling out WebRender which hopefully will solve the performance issues I'm facing (https://bugzilla.mozilla.org/show_bug.cgi?id=925025).

Money. A new walled garden is a new opportunity for developers to make money, with little competition (at first). Then when it gets big and there’s tons of competition, the company can stop caring about the developers and still make a pile of money.

It’s going to keep happening because walled gardens appeal to human nature. Everyone (users, developers) wants the immediate benefits, but only the company reaps long-term. The only solution is to fix human nature.

Failing that, maybe change some laws and regulations.

>>change some laws and regulations.

but then we are in another loop where people who don't understand technology will bring in laws that both fix an issue but creates a whole set of new issues, that might even hinder progress. So I am not a fan of politicians getting involved with things they don't have a good idea about.

Personally I choose to believe in the whole decentralized internet idea that's starting to taking off. 10 years ago bitcoin, smart contracts, decentralized payment systems, decentralized video platforms etc were not that popular or didn't exist and now there's so much progress made in that direction. So I believe there's some good that will come out of the blockchain space. Problem is, only time will tell ha.

Yeah the internet being so predominantly web pages with html on them that you have little power to customize ad a user may seem antiquated one day. The internet should simply beam you data on demand, and you can visualize it any way you like client side

So, apis with multiple non-browser native clients?

Basically the current app model, but decoupling the owners of the client ant the api?

I think it could work, but you'd probably have to mix ads directly into the return values for it to be at all profitable.

Then again, if clients are one time download, and the owner of the api doesn't have to deliver 5-10 meg of JS every single time, you might be able to get away with less ads.

currently the web doesn't let you mix data from sites very easily. Like maybe I want to cross reference my google calendar with my bank spendings on a particular day or something. We also get stuck with crappy UIs all the time (often from banks in particular). Dunno about how ads would work if sites just provided data, but I can imagine an intermediate step where we have a tool that can real time scrape a site for only what we are interested in and discard the rest. Then present it to the user using custom real time presentation

I'd be happy with just no autoplaying videos and no messing with my scrollbars. Oh, and no popups or popunders.

Laws and Regulations are themselves a Walled Garden with all the same problems with the added problem of a monopoly on the initiation of violence to enforce the rules

We're already starting to see "website works best in Chrome" type messages around the internet so I assumed it's only a matter of time before people stop testing in other browsers entirely.

Recently my employer started limited internal resources (intranet) to chrome/edge/IE. As a Firefox user, it makes me so angry every time I click a link and get served a page that says I need to switch browsers.

> I wonder how long before we start hearing stories like "How chrome obliterated my 4 year old website"

March 2021 is that date, when Google will entirely drop all content that is not made for mobile phones: https://www.searchenginejournal.com/google-mobile-index-news...

Seriously, fuck that shit. Google is the gatekeeper to the Internet for many people, they should not be allowed to essentially throw away two and a half decades of Internet history to all but vanish.

It's not quite that scary. They're removing content that the site operator explicitly made unavailable to mobile phones. Old pre-mobile sites will be fine. I would direct the "fuck that shit" to those websites that actively decide to give mobile users less information, lower resolution images (even when you zoom in @&@#!), text that goes off the screen while scrolling is disabled, so you can never see it, etc.

> Old pre-mobile sites will be fine

Who can guarantee this? What are the criteria that Google uses to determine "the site operator made the site explicitly unavailable to mobile phones"?

> those websites that actively decide to give mobile users lower resolution images

Mobile internet is a joke even in developed countries such as Germany, and data caps on mobile are absurdly low. It's annoying that zoom does not work, yes, but I hate sites with a passion that think it's ok to waste 3 MB of my precious 2GB data volume for a single fucking pageview.

They crawl it with a phone bot so they won't collect things that aren't provided to phone users. Old fashioned HTML+CSS works on phones. It might not be a good size but at least it's all there. I guess it doesn't matter if the search results show a mobile-resolution image. You can still click through to the site to see the desktop resolution version.

It’s already happening with forced ssl, and then the constant pushing for AMP.

Google used to share what brought people to your site to give you hints of what was engaging people.

So I end up getting all my analytics from bing and baidu.

Not to mention the ddosing from monsters and you effectively have no choice but cloud flare.

It's really disappointing for me to hear this, considering that I have been releasing chrome extensions for the past year. [1,2,3]

One thing I've noticed is that Chrome's extension search is absolute garbage, and even typing the exact name of my extensions, for example "Wikipedia Section Links" [3], doesn't yield my extension, not even on the first page, and the second page is rather hidden and not obvious. Pretty terrible discovery... Why should we develop for such a hostile ecosystem?

Perhaps I lucked out by developing all my extensions as cross-browser web extensions. I've been submitting them all to as many repositories as I can - Chrome, Mozilla, Edge, and Opera.

I feel bad for the author who doesn't have the ability to move their extension to a different browser. Chrome lock-in is a travesty.

[1] https://churchofthought.org/blog/2020/10/17/coursera-quiz-pr...

[2] https://churchofthought.org/blog/2020/10/15/coursera-playbac...

[3] https://churchofthought.org/blog/2020/01/20/a-simple-webexte...

I did. It’s avaliable for Safari. https://apps.graffino.com

I’m the original author. It happens a while back ago though. I never developed for Chrome again.

Ah, glad to hear that - its our duty to support better browsers!

You would think a Google project like Google Chrome would benefit from Google Search.

Indeed. Here are the relevant links by the way:

Chrome extension search: https://chrome.google.com/webstore/search/wikipedia%20links

Extension page: https://chrome.google.com/webstore/detail/wikipedia-links/mn...

In the final update post[0] the author says

There isn’t any option left to circumvent the Chrome Store. Starting with Chrome 53, extensions cannot be side-loaded anymore.

Is it possible that Firefox will undergo such a restriction in the future?

[0] https://graffino.com/web-development/after-my-post-went-vira...

Firefox already has a similar restriction on Windows, and I think MacOS, but not Linux.

On the normal version of firefox for those platforms you can't permanently sideload an extension, you need to reload it on each restart.

The Developer Edition still lets you sideload addons normally, however.

It's present on Linux too, and probably MacOS. Aside from Developer Edition there's an Unbranded Firefox you can get from Mozilla in English only which will allow it. Or you can compile it yourself with the MOZ_REQUIRE_SIGNING flag disabled, which is not too hard. On Arch Linux it's just download the firefox-nightly-hg AUR package and delete the MOZ_REQUIRE_SIGNING line, then makepkg -s.

https://the-pwner224.neocities.org/compiling-firefox/index.h...

This also provides a good security benefit - for extensions that aren't continually updated you can download them with the "Extension source viewer" extension and then change their ID in the manifest and manually sideload them to prevent them from auto updating and using invasive permissions - malicious buyouts by ad companies are not unheard of in both the Chrome and FF app stores.

And also important, you can tweak the extension code as desired. For example the Old Reddit Redirect extension, which automatically switches reddit.com to old.reddit.com also changes new.reddit.com to the old one, so if you ever want to actually visit the new design then you have to disable the addon. There's no way to change this aside from editing the extension and then loading it unsigned.

> On the normal version of firefox for those platforms you can't permanently sideload an extension ...

Are you sure about that?

I am using Firefox on Windows and I currently have no problem sideloading extensions. They stay enabled and even update automatically.

Try, for example, installing this [1] bypass paywall extension via the "Download and install the latest version" link. Works flawless. ... or am I getting something wrong?

[1] https://github.com/iamadamdev/bypass-paywalls-chrome/blob/ma...

It looks like this is happening because the bypass paywall extension is still signed by mozilla, but not distributed through their normal addon website, which I just now learned is possible.

Still not great, but it is good to learn that it is just a little less restrictive than I thought.

>Starting with Chrome 53, extensions cannot be side-loaded anymore

    Source
    Unpacked extension
    Loaded from: ~\AppData\Local\Vivaldi\User Data\Default\Extensions\...

Reminds me of how Mozilla once permanently obliterated every single extension at once except for a really tiny accept-list...

On mobile, that is.

On desktop they just shot themselves in the foot by removing some off their competitive advantage. (On desktop they are still way ahead of Chrome when it comes to extensions, but it is nothing compared to before when they was in another league completely.)

Reminds me of how I turned off autoupdate on my mobile browser...

Seriously this Firefox update was a massive bait-and-switch for me.

I was on holiday and out of the loop on how big of change this Phoenix upgrade would be, got a notification on Android to update firefox and went through without realizing the massive UX and functionality downgrade this Firefox version is.

Apart from the non-starter of missing add-ons, the whole UX overhaul is insane, so many things that use to be frequent single tap are now two, three, tabs plus swipe up/down business.

With the risk of not sounding constructive, I don't know who in their right mind proposed this but it's crazy to me that it went through hundreds of beta-testers without nobody complaining, or that nobody accepted feedback against this if it existed.

I've been using it from day 1 since it was known as Firefox Preview (way before it landed in nightly) and I have very little to complain about.

uBO, Privacy Badger, and DecentralEyes are all the extensions I need. Stuff renders quicker, I can swipe between tabs, reader mode is there. Sure, it might take one additional tap to open a new tab, but I'm fine with that.

I'm now using nightly, so I experience an occasional bug here and there, but I don't care.

> uBO, Privacy Badger, and DecentralEyes are all the extensions I need.

I want Stylus.

> Sure, it might take one additional tap to open a new tab, but I'm fine with that.

Why? Why regress? What possible use did it serve?

I think it’s usually the latter. Either the feedback wasn’t heard or wasn’t sought.

> You can still find the ad blocker extension here. However, you will not be able to run it. Chrome made changes so that extensions cannot be side-loaded without an enterprise profile.

You can currently sideload extensions in Chrome by turning on Developer Mode, right?

Which I think lasts only until you restart the browser? Hardly a good user experience..

Why not use Ungoogled Chromium [1] instead? Developer Mode is active forever, and no Google-centric integrations.

[1] https://github.com/Eloston/ungoogled-chromium

> Why not use Ungoogled Chromium [1] instead?

Why not use Firefox instead? Then you've solved the problem for good.

The same restriction applies on Firefox. Sideloaded extensions disappear after every restart. Only Developer Edition allows sideloaded extensions to persist.

> Sideloaded extensions disappear after every restart

No. I have 2-3 extensions installed directly from Github. You can't do that on chrome.

That's a weird way to spell Firefox...

Firefox has a shitload of tracking features integrated if you don't use the Librefox Profile template. If you don't believe this, add an MITM proxy to verify what's happening on the newtab page.

Personal note: From google analytics in the about:addons view that can only be deleted with physical deletion of the profile folder, to digicert's OCSP service and Google Safebrowsing getting all your cookies, to detectportal.firefox.com tracking all your Geolocation data on every restart... these are all reasons for me to not use Firefox anymore.

That is not privacy respecting. It's what I expect from Google, not Mozilla.

It works forever, but every time you launch the browser you get a popup asking you if you know what you are doing.

The new Firefox mobile is really bad for extensions too... they block them all except about 20 of them... I switched back to Firefox v68/Fennec

I'm just curious. Is AWS similar? I never heard an AWS horror story.

We had an issue with getting a new Android app we wrote that accessing the call logs for a legit business case (something that would benefit the user alone, not in any case sent to us) reviewed and it took months to resolve it. The best thing was emailing and waiting for another week or so, hoping the case would be picked up by a human being that would take the effort to really look into the issue.

Now Apple doesn't even allow you to access the logs to begin with and even if they would they can be royal dicks during the review process, but I was always under the assumption I was dealing with a human at every step from the initial rejection and once I een simply could explain what my business case was over the phone with one of their people instead of endlessly mailing back and forth. Nothing has been stuck for more than a week.

Apple actually handled my situation a lot better and didn’t block me. I am the original author.

That's what I tried to say, Apple can be problematic at times but you're always dealing with humans instead of something that seems like an unstoppable machine.

This kind of matter needs support from government agencies. Unfortunately I don’t know that any government agencies that would be either willing or knowledgeable about what needs to be done to support users and software developers on online platforms. How helpless are developers and users when faced with what is essentially unregulated corporate behaviour.

How anyone can trust Google as a business partner is beyond me. Amazon too. Bunch of tech fools.

previous discussion from 2016

https://news.ycombinator.com/item?id=12442048

The author infringed on Facebook name and possibly the logo too. Facebook sent a notice to Google. Google complied with the law and removed the extension. Yet the author blames Google for all this.

Thank you for this background detail! So actually instead of google, it was FB who with trademark protection legislation took down the app.

It was Google who complied. They didn't have to (there was no jurisprudence); they chose to.

Is Mozilla going to comply with a C&D for removal of Facebook Container for Firefox [1]? I think not.

[1] https://news.ycombinator.com/item?id=24849452

An important question is, did Google ever tell the author who made the complaint so he could contact them or countersue? From the mails that are shown they don’t reveal anything apart from ‘a third party acting on behalf of Facebook’.

It's clearly stated in the email, it was company called Appdetex on behalf of Facebook. It even has a name of the person who submitted the claim.

Reply on news.ycombinator.com