The “Report Abuse” link doesn't seem to produce results, obfuscated code doesn't seem to trigger red flags, and no one responds to user reviews.
[1]: https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-e...
Or it might be that humans are just reviewing top N apps, sorted by number of reports.
Compare this to Firefox which will sign your extension and let you distribute it directly through your website with a user-friendly experience.
Mozilla's stance on extension signing is hostile to users, there are several extensions that got remotely blocked for loading code from Google Translate [1]. This is software that you privately install for your own use, and Mozilla blocks it remotely in your browser.
They've also rolled out the new version of Firefox for Android which only supports a couple of extensions that they have whitelisted. I can no longer use the extensions I have developed and published on Firefox Addons, and I can only imagine the grief it is causing for less technical users that have suddenly lost the productivity tools that they've relied on.
They've also disabled about:config in the new version of Firefox for Android, you can no longer configure the browser that way.
[1] https://www.jeremiahlee.com/posts/page-translator-is-dead/
If you allow loading remote code into an extension there's no point in signing or review or any other security measures because the extension is just malware waiting to happen.
If you absolutely must load remote code, load it in the page context where it doesn't have access to dangerous extension-only APIs. This is my PoV as someone who maintained a 100k-weekly-user Chrome extension for 3 years: I hate the Chrome Web Store but the 'no remote code' policy is correct and Mozilla is correct to also enforce it.
For what it's worth (admittedly not very much), you can build the release version of Firefox yourself while allowing extension sideloading without even changing any code, it's just the "MOZ_REQUIRE_SIGNING" option.
Obviously this is not a real possibility for everyone, but I do it for this and getting rid of Pocket, along with a few other small changes.
Mozilla is in a tough spot as a browser vendor, since a sizable portion of their userbase is actually well served by the restrictions. Happily it's also open source, allowing true power users to do what they want with minimal fuss.
Most people can live with the restrictions you impose on them, but the restrictions can still be missguided or thoughtless.
I think one of the issues is that users aren't the only ones that can install extensions locally. I think Mozilla even introduced this as a response to Microsoft pushing its own extensions into Firefox.
I don't like the restriction either, however most users are dealing with an actively hostile OS and any setting that could be set at runtime instead of compile time would just look like an open invitation to the OS.
That seems generous, I just assumed you were filling out a form that just deleted itself when you clicked send.
It seems to be a rather important bullet point every time they need a reason to cripple ad blockers even more. Google solving this issue is like Nestle solving world hunger: directly counterproductive to its main goals.
Zero-days are often used by state actors, so their impact is larger, but less visible.
In my understanding, state-level actors are not exactly notorious for using exploits for mass surveillance (they use a little bit less controversial means to achieve this), zero-day stuff is typically for single valuable targets. Or am I wrong?
Hint to anyone working on security at Google: It actually doesn't matter what obscure zero-days you discover and patch when you distribute malware directly that relies on supported functionality. There's no need to exploit security holes when malware is simply permitted as-is.
Shut the Chrome Web Store down until you're prepared to take it seriously.