
Google will block local extensions in Chrome 33 for Windows - this_user
http://thenextweb.com/google/2014/02/12/google-will-block-local-extensions-chrome-33-windows-disable-existing-ones-chrome-web-store/
======
judah
This is a smart move. Crapware vendors have started installing Chrome
extensions bundled with their crapware installers, hijacking browser home page
and search page.

The end result of this is that many of my non-technical family members end up
with a hijacked Chrome experience. I've seen this only in the last year,
increasingly so in the last few months.

This move to outlaw extensions not in the Chrome Store will halt this
behavior.

~~~
graylights
The problem with this is crapware vendors existed before extensions were
available. They were dirty hack modifications to the programs. They would
introduce all sorts of bugs and since they modified the actual software they
were a pain to uninstall.

If your cabin in the woods is getting broken into, you won't secure it by
putting a lock on the front door. You'll just get robbed and have a broken
window.

The real problem is users accepting and running installers that install
crapware. You effectively give it permission to do anything it wants.

------
iambateman
Browser extensions are under-used. The average consumer could do so much more
with their browsers than just install Adblock.

Edit: I mean to say the development community hasn't explained the benefits or
come up with interesting use-cases. Or at least not very loudly. ;)

~~~
dm2
Dev tools, password manager, chrome-to-phone, adblock, edit-this-cookie are
all I've ever needed, and many of those I use with another Chrome profile
(wonderful new feature if you haven't used it yet).

Do you really want things like an FTP, file manager, text editor, or other
extensions installed? They could easily introduce security vulnerabilities and
will slow down your browsing experience (something that you want to be fast).

I leave about 500 tabs open so more extensions are not something that I want
to have locking up my browser.

Many browser extensions ask for permissions such as viewing all web history,
no thanks...

~~~
JasonFruit
I don't understand why anyone would have that many tabs open. It's the
internet, man — bookmark it and go back if you need to.

~~~
dm2
Haha, you should see my bookmarks... no less than 10,000 right now (probably
more) and I export and clean them every 6 months. The thing is they are all
quality sites or pages and interesting information that I would like to read
or will need sometime soon. I've tried all of the major bookmarking sites and
have even planned on rolling my own a couple of times (didn't have enough time
to build it out though).

500 tabs is probably an exaggeration, but unless I recently restarted my
computer or Chrome so it will update I always have over 100 open.

Does anyone know of an open-source bookmark manager that can be self-hosted?
The bookmarklet is easy to create and archiving a copy of the site would be a
really nice feature (but not required). There are also several scripts to pull
out summaries or body text from pages, but those could always be processed
later.

~~~
merrua
I'd recommend just adding them to an email to yourself or a textfile. Its low
tech but more durable than most methods.

~~~
dm2
Yeah, that's a good idea.

I'd like to eventually import all the bookmarks into some kind of bookmark
manager once I figure out the best way to handle it. The XML files that Chrome
creates when you export them are a very nice storage format for processing
later.

------
higherpurpose
Why is this needed? Wasn't the move to only install local extensions by
dragging and dropping on the extensions tab enough to prevent the vast
majority of "installing infected extensions by mistake"? What security
advantage does having to check a box for Developer Mode on the extension page
offer over how it's done now, other than making it slightly harder and more
confusing for the user himself to install local extensions?

Google is just _one step_ away from making me quit using Chrome. If they ban
external extensions for good with a future Chrome release, that's it, I'm
done. I'll start using either Firefox or Opera, and then convince everyone I
know to use them, too, just like I did before with Chrome.

~~~
royprins
The advantage should be more in user experience, since this would essentially
put a halt to bundled crapware.

People who are willing to move to "Developer mode" will not be the people who
will be confused in any way.

~~~
higherpurpose
And how were people confused into _dragging and dropping_ the extensions on
the extension page before? That's what I'm saying. I see no security benefit
over how it already works.

------
zaraflan
Extensions are still a big malware vector so I can't see this as anything but
a net win as long as developer mode remains available for power users.

~~~
dmart
Yep. I understand the resentment towards this decision, but anything that cuts
down on the 10+ Conduit adware extensions I find myself uninstalling from
clients' computers every day is fine by me. Some of these infected extensions
already show up as being installed by enterprise policy, though, which the
article states will not be affected. So I'm not sure how effective this will
be in the long run.

------
evilmoo
Only this morning HN was going crazy over the 'walled garden' at Apple...

~~~
eli
This approach is a lot closer to Android. You actually can still run whatever
you want... just the default security settings don't allow it.

~~~
archgrove
Which, for 99.99999% of actual users will mean they are blocked. Digging
around in the guts to enable "Developer mode", with all the scary
consequences, is not something users will (or should have to) do.

~~~
andybak
Clicking through a few pages of options is EXACTLY the level of discouragement
needed for users who really shouldn't be touching such things.

~~~
Houshalter
That's a terrible idea. Menus shouldn't intentionally be designed to be user
hostile. Instead just give a warning message, preferably one that is actually
informative and appropriately scary looking.

There is a middle ground between letting any malware on the machine install
whatever extensions it wants with no user consent, and banning users from
installing extensions entirely.

------
Spittie
I agree, Chrome shouldn't allow external application to automatically install
extensions. There are few (none outside of the business/enterprise area?)
cases where it's done for a good reason, and a lot of cases where it's done to
install some adware/spyware.

If I'm reading the article right, they'll also disable any extension that the
user manually installed from a local .crx. I don't agree with this, just add a
warning and allow it. To me, it feels like some sort of DRM.

It doesn't help that developers have to pay a $5 fee to publish extensions in
the Chrome Web Store. It's small, but not everyone is willing to/can pay it.

~~~
Houshalter
Also Google removes apps from the chrome store they don't like. Like Youtube
Center and Uneddit Reddit. And even if the amount of money it costs is small,
it's still a relatively large tax for something that could be free.

------
MadManE
This seems to me to be an interesting comparison to the political world. In
this instance, we have Google and Apple, both doing essentially the same thing
in different ways, but one of them is doing it _slightly_ less than the other
and demonizing their opponent over it.

In the (U.S.) political world, we have Democrats and Republicans both doing
essentially the same thing in a different way, and demonize the other for
taking some aspect of it "too far".

Maybe if we got used to having more than two choices, we wouldn't have to
worry about this as much.

------
Morphling
Can someone tell me what this changes? You can still run them in developer
mode, right? Otherwise we couldn't develop our extensions, right?

~~~
yonran
I believe local extensions will be disallowed on stable and beta _channel_ on
Windows, according to the blog post. I think this means that on the stable
channel on Windows, there will no longer be a “Developer mode” in
chrome://extensions. This is because Developer mode is simply a registry
setting that malware on Windows can modify, so Chrome will no longer trust
this setting.

To develop extensions on Windows, I think you will have to switch to the dev
or canary channel [http://www.chromium.org/getting-involved/dev-
channel](http://www.chromium.org/getting-involved/dev-channel)

Edit: changed “now” to “will be” for clarity. Thanks Navarr.

~~~
Navarr
I believe this is misinformation.

At the moment, there's a way for software to install Chrome extensions (not
developer mode). They're removing this capability. You will probably still be
able to run developer mode extensions

------
Houshalter
Is there any way to stop this from happening? I have a lot of unofficial
extensions. Should I just switch to another browser?

------
wudf
The grip tightens...

~~~
andybak
Oh please.

------
atonse
Maybe AdBlock is putting a dent in their numbers enough that they're willing
to do this?

~~~
octopus
AdBlock is in Chrome Store ... so it will keep running as before.

~~~
rquirk
When/if Google remove AdBlock from the extension store, then you'll know it
was the plan all along.

------
moron4hire
Aaaaand I just took Chrome off my list of browsers for a POS project I'm
working on.

~~~
izzydata
Thanks for sharing. Should probably read the article before getting bothered
by the thread title.

------
mathnode
Thankfully "Cloud to Butt" is now in the chrome web store.

------
viach
There seems to be a plan to start monetizing chrome extensions. That's good,
i'm in the process of writing one.

------
davidgerard
Note that Google already removed AdBlockPlus from the Android store; don't
expect it in the Chrome browser one.

~~~
spindritf
What do you mean? It's in the chrome webstore
[https://chrome.google.com/webstore/detail/adblock-
plus/cfhdo...](https://chrome.google.com/webstore/detail/adblock-
plus/cfhdojbkjhnklbpkdaibdccddilifddb)

I'm Firefox all the way but let's not spread FUD.

~~~
davidgerard
That is good to see. I don't expect it to last.

~~~
Navarr
It's been there for months if not years at this point.

------
batoure
Fixed article title: Here is a topic that will impact you for 20 seconds until
you google the problem and switch your browser to developer mode here are some
words that will draw you in; Google!! Chrome!! Doom!!

~~~
eterm
Don't be an ass, defaults matter.

~~~
ehutch79
they do, but this is a good one. If you don't know how to switch to developer
mode, you probably should not be running random extensions.

~~~
eterm
What about extensions that I've had installed for a long time, installed from
the webstore but have since been removed or updated to versions I don't want?

It's not about not knowing how to switch to developer mode, it's about the
fact that everywhere is putting up higher and higher walled gardens. Sure, it
makes sense for most people, but it's not the direction I like to see the
internet go in.

~~~
andybak
Then switch on developer mode?

