My experience of the Chrome Extension submission process | Hacker News Reader

My experience of the Chrome Extension submission process

meetingdolphin.com

53 pointslcmchris22 comments

> A good way to inform your users is to combine chrome.runtime.OnUpdateAvailable and chrome.tabs.create(<INSERT blog URL>) .

This is terrible behaviour.

I can't express how much it frustrates me that every extension and every service thinks it's a great idea to launch new tabs or overlay the screen I'm trying to use with their self promotion about some new update or change they rolled out.

Unless there is something I have to know about immediately because there will be significant side effects (data loss, monetary, physical danger, that sort of thing) don't do it.

I also dislike it but please blame/advocate for Chrome change rather than devs with zero good options. Google created and maintains these conditions.

It's pretty responsible for devs to at least let us know when they make changes.

Complain about it all you want in software where the user controls the update schedule, but extension devs don't have any other way to alert users to changes.

They could simply badge the extension icon.

I assume many hide their extension icons. I do agree with not popping up a new tab or whatever, though.

No, I really don’t care. I have hundreds of apps on my phone, most of which I use once every few months or even years. Imagine if they opened some random popup every time someone decided they made huge changes.

Same goes for some extensions, which most likely don’t have (or shouldn’t have) fundamental changes that require immediate action.

Don’t bug your users.

Note: I’m a Web Extension developer too.

I think I am convinced, my wording here definitely does not help ('good' -> 'possible'). For sure a new feature does not warranty intrusive browser behaviour. Will make some edits.

As someone who always has a billion tabs open, I really wanted a tab search. I built one, "Tabasco"[1] a number of years now.

Chrome has a sort of built-in search now, but it doesn't support fancy things like quotes or a ! Not operator.

Submitting updates almost always take between a couple minutes and an hour to get approved. Been REALLY quick. I wonder if having the absolutely minimal permissions helps with the process.

Then a couple years ago I hit

> Item has a blank description field, or missing icons or screenshots, and appears to be suspicious.

After a couple rounds of beefing up my screenshots and description, I was still getting rejected. Each rejection took a couple days.

Eventually, I contacted support asking what I could do. I never even got a response, my extension just got passed out of nowhere.

I haven't hit any rejections in the time since. In hindsight, my suspicious of someone thought the name "Tabasco" may I have implied connection to the brand? I thought it was generic enough when I chose it because of the pepper.

https://chrome.google.com/webstore/detail/tabasco/apnefdpgai...

Interesting! I concur with your suspicion. In the official docs, it mentioned that the name has to be quite unique.

Google Support has never been good so getting no response is also to be expected... Glad you got it fixed though.

"However, sometimes I find that it does not update properly. On days when I physically see a friend install it, the numbers don’t go up."

I have a hard time decoding the statistics dashboard. Every day my extension gets uninstalled more times than installed but the user count remains stable. Why?

The review process seems quite intimidating as described by the OP. Things like use of localStorage is almost like a given in any extension these days and they ask justification for every permission you ask.

So they should - extensions are very popular with consumers, and are a notoriously effective means of spreading malware. There’s a few current stories on the topic, which is odd, because the problem has been a problem for nearly ten years now.

Google spend a lot of money developing extremely effective security research capabilities, while completely ignoring the dumpster fire that is their app and extension stores.

> while completely ignoring the dumpster fire that is their app and extension stores.

This is one of the factors that keeps me away from trying Android phones. I don’t trust Google for anything other than search. And even that has become somewhat questionable over the years. I do trust Apple. Even though I own a couple of them, I don’t care for their computers. As far as phones though, I will not consider anything other than iPhone.

Search has become a rotting dumpster that will be fully ablaze soon enough. Works great as a calculator and spell checker though.

Thing is... There is pretty much nothing malicious one can do with localstorage.

This isn't accurate. There are any number of XSS attacks that can be performed, which then allow you to look at secrets or tokens in localStorage, for example.

I stopped supporting Chrome for an extension when Google started acting like they were in charge of a walled garden. At one point, I had identical code working as an extension for both Firefox and Chrome, and didn't have to do anything extra for Chrome. But Google added new requirements, and it wasn't worth dealing with Google to support an old no-revenue extension.

My experience publishing "HNRelevant" was also straight forward. It was my first time too, and reading others previous experiences had me worried.

Last update was approved almost instantly, I had to douple check. Propably because it's quite simple.

Related: Another cluster of potentially malicious Chrome extensions (2 days ago) https://news.ycombinator.com/item?id=36240652

On the flip side, I've never had any serious issues across a bunch of extensions, but sometimes I hear stories.

Btw your extension looks really professional — nice job! Are you trying to monetize it?

I am (at some point)! I actually built this as a somewhat hack to get users whom I can interview. There were 2 existing extensions that had similar features and I built this to replace them.

Oh nice! Maybe you'd be interested in the tool I built to take payments in extensions: https://extensionpay.com

Reply on news.ycombinator.com