These guys went above and beyond what most developers would've done, which would have been to contact support until they get a clear answer.
This only alienates the extension ecosystem. And this was the primary reason I switched to Firefox. Google is the new Microsoft. If I remember correctly, they started Chrome exactly so this very thing wouldn't happen.
Google deserve criticism for the lack of clarity in the communication, they deserve criticism for the lack of human touch, customer support and many other aspects.
They do not deserve criticism for calling out incorrect permissions usage and forcing developers to do better.
The fact that the extension has over broad permission asks isn't good but I think saying their communication lacks clarity is underselling just how opaque they were with their feedback. It also concerns me a bit because it looks like their opaqueness might be an attempt at security via obscurity by trying to cloak what the rules actually are - which is a generally bad approach to trying to fight malevolent actors.
Alternatively it could be vague to restrict the possibility of bad actors circumventing the letter of the rules without adhering to the spirit of them, or even just protecting themselves from legal repercussions (perceived or real).
And, when you get right down to it, any rule that isn't well structured will be exploited by bad actors, people looking to roll out malicious browser extensions have a strong motivation to try and discover those rules with a high level of accuracy by testing them - only the good actors remain uninformed.
> the concealment of relevant information over basic practicality and functionality.
It’s like I tell you get me a book on computer science or Ill fire you you, but I don’t tell you which one. Also I won’t response to any questions from you.
Whether OPs extension made him think about it is simply an entirely different matter.
a) the extension had been operating for years, unmolested by the Googlebot, with the expanded permission set
b) tightening up the permissions did _not_ solve the problem, indicating clearly that whatever the Googlebot was selecting for, it wasn't an incorrect use of permissions.
Did they, though? The email seemed pretty clear that the problem was requesting more permissions than necessary.
I'm no Google fan, by any means, but if it's that hard for the developer to check which permissions their own app is requesting, I don't know if it's Google's fault.
The issue I have is that it's not clear if I'm even addressing the correct issue(s). If I don't make the Correct change, all other changes are irrelevant since they'll never get published.
Ultimately you know your extension, codebase, and use-case, far better than Google does, so it may not really be possible for them to give you the detail that you're looking for – you may be the only person who can do that.
I hope that they provide the support you need in understanding the problem to the point where the extension can continue to live on the Chrome store.
You're missing the point here. The developer isn't given any guidance on what needs tightening. This shouldn't be guess and check. These rules impact this developer's livelihood. They should be well defined, documented, and communicated.
Let this be the millionth lesson of "the perils of building on a platform instead of on a protocol".
What do you think they should be providing? Honest question, I have some ideas but they all feel very tricky/error prone to implement.
For the record, I actually agree with you that this is a good policy and will be a positive outcome for users. But while you seem to agree that Google could have handled this better, you're not doing a good job of acknowledging just how developer-hostile Google was here, which is why you're getting a lot of pushback.
> At the very, very least, they could identify which of the permissions are in violation
If they've flagged this through user reports of the permissions being too wide then they may not actually know which permissions need to be changed. This is purely speculation though.
How can they not know? They decide whether the update is accepted or rejected, and there's somebody or something at google that makes that decision, so google has to know.
If they didn't know what permissions need to be changed, how is the accept/reject decision made? Something like "accept the fourth try if the developer makes it that far because it is probably an improvement?"
Sure, the first notice may have come from user flags, and the motivation for those flags is unknowable.
But it's been rejected again, after substantial permissions pruning.
Either they know why they rejected the update, in which case they should tell the developer; or they don't know why they rejected the update, in which case they're holding developers hostage to an inscrutable black box.
Both scenarios are shitty.
You are certainly within your rights to state things divisively if it pleases you. I was merely suggesting how you might make your point in a way people will agree with you.
If they've flagged this through user reports of the permissions being too wide then they may not actually know which permissions need to be changed.
Even if this were true,
1) what about the update that narrowed the permissions, surely Google knew which permissions remained in violation? Remember, it was the rejection of that update that prompted this post
2) user reports of permissions being too wide should also be required to identify the specific permission that is in violation. That would not only help the developer, but also help Google make the decision on whether to ultimately ban the extension
3) Google should have clearly stated in the initial message that they hadn't actually verified that the alleged violations are occurring
OK fair enough, but why aren't the big violators held to this? (I realize this example isn't Chrome, but it is Google Calendar -- ever try to add a Zoom meeting invitation to your Google calendar? Zoom wants access to read and write all events ever on your entire calendar!
I love that Google is starting to solve this problem, and from my perspective an extension that is sending and receiving SMS messages should not be requesting the ability to read and change all data on all websites that I access.
They aren't solving the problem. They are making sure only they can get all the user information.
I would rather give all my information to everyone rather than giving all my information to google.
Do You have an android phone? Do You use google for anything? Gmail? Google docs/drive? Youtube? Chrome? ChromeOS? Anything google owns? Then they're selling your data.
Try reading all those fun TOS agreements that come with using any of the aformentioned products, or heck, visiting sites that use google analytics.that won't tell you how much or what data google gets from you, but it'll tell you that you agreed to it.
I think it's important to remember that while PushBullet is known to many of us, is posting on Hacker News, is a valued part of "the community" in some respect, at Google scale this fact is not know. PushBullet is obviously good to _us_, and maybe just needs to tweak permissions a little, but to a reviewer at Google it probably looks very similar to the hundreds of extensions they may review a day, many of which may contain malware.
They have to use certain metrics to sort the good from the bad, and abuse of the permission system – intentional or not – is a pretty good one when you care about the end user.
> We do not need to request access to data on https://*/* and http://*/*.
Was this not determined before, or they changed their minds now that Google is threatening to pull their product? Either they thought that was appropriate before, or they didn't think about it at all. Inexcusable either way.
Why are they asking for https://*.pushbullet.com/*, http://*.pushbullet.com/*, and http://localhost/* read permissions? I suspect it's the localhost permission request that is currently blocking them.
And why in the world are they asking for the cookies permission? That's a big, fat nope for me. It's as if they don't understand what they are asking for and the potential implications of passing that data around so haphazardly.
These folks need to take another hard look in the mirror before they point the finger, because their own house is way out of order.
- if G has the ability to automatically audit necessary permissions, they'd do it when you upload to the plugin store
- if they're doing this manually for popular plugins, then (1) they'd publicly certify safe plugins and (2) the interaction would be way more high touch
Plugins are inherently unsafe + require trusting the developer.
Could be malicious, or G may not even have a reason for this (it may be some forgotten dinosaur instinct to knock over other people's stuff when it gets too big).
If they added it more recently then they are just back-applying it to an already existing extension.
Alternatively, you can report plugins as requesting incorrect permissions – I've done this. Perhaps that's what's happened here, lots of reports triggering an investigation.
1. The article contains more relevant information that you did not show in your point.
2. Those relevant information made your point void
3. I think your point make no sense on the relevant information.
Is banning someone's entire Google account across all services a proportionate response to a developmer having trouble with Google's confusing permissions API?
Likely there is some automated system running these checks.
Edit - this is a basic principle of security: https://en.wikipedia.org/wiki/Security_through_obscurity
As a metaphor, there’s a damn good reason you can’t just pay an Olympic anti-doping facility to test your urine; it would be trivial to develop protocols that evade the tests if you could do that.
There are certainly less cheaters than if there were no anti-cheat methods. To use OP's example, an open source urine testing procedure would be trivial to game. The same thing goes for open-source multiplayer games.
If it's trivial to evade the tests, then the tests are inadequate in the first place, and should not be trusted to be accurate.
Likewise, if an anti-cheat system relies on obscurity in order to not be bypassed, then it's a crappy anti-cheat system (and, mind you, would be far less necessary if multiplayer games didn't have a fetish for trusting the client to do potentially-exploitable things instead of insisting upon server-side validation, but I digress).
And likewise, if making your policy publicly-known will result in people skirting around the spirit of that policy, then the policy is poorly-written and should be rewritten to better reflect the intent.
Security through obscurity is not security. Full stop.
They were completely in the wrong there, and posing a huge security risk to all of their users.
What was the impact of fewer permissions?
Let's assume PushBullet was doing something bad with some of those permissions and gathering data? Do they no longer have access to that data? I'm not sure that's the case, permissions alone don't determine that.
If PushBullet wasn't doing anything bad, did anything change?
Is it a positive thing for users when the extension disappears in a few days?
I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved. As long as it results in permissions being more correct this is a very positive thing for users because for every PushBullet there's hundreds of attempts at malicious Chrome extensions that are abusing permissions.