
Google Killing Chrome Extensions with 1 Week Publishing Delays - getpolarized
https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-Extension-Innovation.html
======
ocdtrekkie
Given how much malware the Chrome Web Store pushes, and how sensitive of data
extensions have access to, actually taking the time to properly review updates
is absolutely warranted.

~~~
burtonator
For a typo? Did you read the post?

If I update the text or change a typo they take a week to release the update.
During this time I can't release another version of my app.

~~~
maccio92
They don't know you only fixed a typo until they've had time to review it

~~~
burtonator
Yes they do. I'm not actually releasing code. This is just the images and text
associated with the store. Not the actual app

------
MattSteelblade
A "5 line diff" is absolutely enough code to add something malicious.

~~~
burtonator
Why does it take a week to accept/deny that...?

Note that they aren't actually DOING anything in this week.

The Polar extension is literally just sitting waiting for someone to approve
it because I updated the images.

~~~
vec
Presumably they are doing something during that week; namely code reviewing
all the patches in front of yours in the queue.

Don't get me wrong. I, too, wish that other developers would drop whatever
they're doing on demand to prioritize my immediate needs. I would also prefer
that they waive their normal security concerns because, after all, I already
know that I am trustworthy. I've got enough self awareness not to publish a
blog post about it, though.

------
knoepfle
While this might be highly burdensome for developers, I much prefer the world
where Google reviews even single-line changes to extensions.

~~~
conanbatt
You do this by having a "Chrome reviewed" store that gives everyone what they
want.

------
slg
There are a lot pronouns used in this article referring to a "permission".
What permission are they referring to? I pushed out an update to a Chrome
extension a few days ago and it was live in a matter of hours. Is there some
specific permission that triggers this review?

~~~
jonas21
They seem to be asking for:

    
    
          "permissions": [
            "activeTab",
            "fileBrowserHandler",
            "webRequest",
            "webRequestBlocking",
            "webNavigation",
            "<all_urls>",
            "storage",
            "tabs",
            "tabCapture",
            "cookies",
            "http://localhost:8500/rest/v1/capture/trigger",
            "contextMenus",
            "unlimitedStorage",
            "declarativeContent",
            "idle",
            "storage"
        ],
    
    

I think <all_urls> is the scary one that lets it read and change all data on
any website you visit.

~~~
slg
Yeah, that set of permissions is basically handing over all control of the
browser. It also isn't just the content of the websites you visit. It gives
the extension the ability to read cookies and local storage plus read, modify,
and block all web requests. I think it is completely reasonable for Google to
give extra scrutiny to an extension requesting these permissions.

------
necovek
While you are, of course, welcome to call upon Google to improve the review
speed, there are obvious things you can do on your side as well.

First up: improve the QA process on your extension to avoid having to do
5-line diffs every few days.

In the meantime, you can offer your users to switch to "developer mode" and
install the extension manually.

I personally would be against the centralized nature of Chrome extensions
world anyway (which, by definition, leads to bottlenecks, for dubious
benefits), but at one point Google claimed there were 180,000+ extensions in
the web store, and if only 0,1% of those get updated every week, that's 180
extensions to be reviewed every week.

~~~
burtonator
> First up: improve the QA process on your extension to avoid having to do
> 5-line diffs every few days.

Are you a developer? This is literally the definition of continuous delivery.

~~~
chris_mc
I already don't like how you constantly push your product on HN, but now
you're acting like an entitled asshole to boot. Maybe chill out and don't
attack possible users?

~~~
pwinnski
Previously-possible users, maybe. After this, I'm guessing uptake from here is
lower.

------
tantalor
Clickbait title, no extensions are "killed".

------
pwinnski
Between the attitude of the poster and the green-labeled accounts taking their
side or talking up the product in question (!), any sympathy I might have had
has evaporated.

Perhaps someone else could make this point in a way that would be better-
received.

------
haberdasher
Does anyone else feel that the Chrome Webstore is completely neglected?
[https://presentio.us/view/c3c537](https://presentio.us/view/c3c537)

------
burtonator
I think there's a miscommunication here.

When I say typo or image I'm talking about the _appstore_ assets... not the
binary.

There's the actual binary you push out to you chrome uses.

Then there is the text and images in the app store. This is NOT part of the
app.

IF you fix a typo in the app store description, it causes a one week review.

Even when you didn't actually update the app AT ALL.

The exact same binary - bit for bit.

That's part of the the issue.

The other is that changing a small amount of code shouldn't require a full
week to re-audit.

------
CaveTech
This also appears to be selectively enforced. We have two different extensions
with global permissions, but only one requires a 1-week review. For the other
we can still push out updates in < 30 minutes.

------
WrtCdEvrydy
Welcome to Walled Gardens... we should all read 'Carry On by Bruce Scheiner'

------
daybreak
Slightly off-topic, but does anyone use this app as an ebook manager?

I'm looking to switch away from Calibre (which has a cluttered user interface)
and if Polar supports common ebook formats it might be worth trying.

------
gpm
Since when are apps allowed hn accounts?

------
herohamp
I really hope this gets changed as this currently makes fixing small changes a
massive, and wanting to release a feature at the same time on a website and
extension means the chrome version must be done a week in advance. This is
really killing productivity

~~~
geoah
This delay seems to be only when requesting specific permissions such the “all
url” one. So most extensions shouldn’t need to wait that long.

