Slashdot Mirror
Google Is Too Slow At Clearing Junkware From the Chrome Extension Store
Mark Wilson writes Malware is something computer users — and even mobile and tablet owners — are now more aware of than ever. That said, many people do not give a second thought to installing a browser extension to add new features to their most frequently used application. Despite the increased awareness, malware is not something a lot of web users think of in relation to extensions; but they should.
Since the beginning of 2015 — just over three months — Google has already received over 100,000 complaints from Chrome users about 'ad injectors' hidden in extensions. Security researchers have also discovered that a popular extension — Webpage Screenshot — includes code that could be used to send browsing history back to a remote server. Google is taking steps to clean up the extension store to try to prevent things like this happening, but security still needs to be tightened up.
Since the beginning of 2015 — just over three months — Google has already received over 100,000 complaints from Chrome users about 'ad injectors' hidden in extensions. Security researchers have also discovered that a popular extension — Webpage Screenshot — includes code that could be used to send browsing history back to a remote server. Google is taking steps to clean up the extension store to try to prevent things like this happening, but security still needs to be tightened up.
It looks like the ones behind Nada software were right: the only bug free software is the most useless one.
Please reckon with your failure!!!!
Malware is something computer users are now more aware of than ever.
You might say we're... *sunglasses* mal-aware of it.
YEEEAAAAH!
systemd is Roko's Basilisk.
it's an application you store all your passwords in and yet you install extensions coded by some anonymous stranger you have never met with a web based email address? and you wonder why things go wrong?
Partway through writing a small browser extension last year, and realizing how much access they have to everything you look at, I stopped using all but a couple trusted browser extensions. Seriously, it was like 15 lines of code to take a screenshot of whatever page you're looking at and send it to a server every 2 seconds with no indication that anything is happening.
Granted, you have to accept a permissions dialog, but most extensions ask for way too many permissions. That cloud-to-butt extension? It already has all the permissions it needs to send the text on every page to a database somewhere, and unless you carefully audit the source of every extension you install (obviously google isn't), you'd never notice, you're just trusting some extension author.
Why do we need Google to be our App Nanny?
Because they run the repository. It's not Google saying, "only these extensions may install", it's them having a centralized location for the ones they've approved.
The faster they remove bad stuff, the more false positives they get in their removal process
As long as the appeals process is clear and genuine false positives are handled in a timely manner, this isn't necessarily a bad thing.
and independent developers will lose out in the process.
Github, Sourceforge, and "a Godaddy domain with the free-tier hosting" will happily enable independent developers to avail their Chrome extensions for download. If that's not okay, Firefox still has a viable market share, even IE supports add-ons. Depending on 1.) Google, 2.) Chrome, and 3.) the first party Chrome repo to distribute one's browser extension seems foolish, especially when it's still perfectly viable to take any combination of those away from the equation and still get a browser extension into the hands of end users. When Chrome sections off the greater internet...then we can talk.
Also, if I sound crabby and one sided about this, it's because half the users who have browser extensions have the malware-based ones that I need to remove because it keeps hijacking their search providers and home pages, injecting ads, and generally making a mess. I see this across every browser that supports extensions. While users should indeed be more vigilant about what they allow on their computer, I'll be okay with any measure to mitigate this problem that doesn't involve removing a manual override.
At what point did these monkeys "increase" their "awareness" about anything that didn't involve some cultural grievance? The only reason they aren't still opening every single word doc they receive is because the MUAs impede them enough to allow laziness to dominate.
Maw! Fire up the karma burner!
The really bad thing about Chrome is the way it is impossible to stop extensions from automatically updating.
An extension can be perfectly good, when first installed, but if the author goes rogue, has a security breach or just sells the extension to a third party, there is no way to stop it from automatically updating.
worldmobilenet.com -- World Prepaid Wireless Internet plans
The puzzle from an ad buyer's point of view is trying to figure out who to serve their ads to... Television does this by putting together shows that appeal to different people, so sponsors can figure out who their product is for and match them up. Web ad services compile what you've looked at recently in order to show you offers that you're more likely to accept. Privacy is nice, but something's got to fuel commerce or there's nothing left to protect.
It's not Google saying, "only these extensions may install"
Did you miss the Slashdot article titled Google Starts Blocking Extensions Not In the Chrome Web Store from May of last year?
Because they run the repository. It's not Google saying, "only these extensions may install", it's them having a centralized location for the ones they've approved.
Given you need to enable Developer Mode to install them from any source other than the Chrome extension store, they kind of are saying that.
There's a Windows tool called adwcleaner that takes less than five minutes to run and does a marvelous job of cleaning crap out of browser installations. It's usually the first step I take in cleaning off a Windows machine, but it works beautifully for getting irritating but not genuinely malicious stuff out of the way.
I've actually made a document that I print out and hand to people whose machines I clean off. Probably 90% of the people I talk to have no idea that there's any such thing as a browser add-on or search extension.
I've found that configuring Adblock+ with a decent set of subscription lists and Spybot's Immunizations (basically hosts file entries) do more to stop problems than probably any other steps I could take to stop problems on Windows machines.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
Perhaps the advantage found in the garden with lower walls is the ability to do something outside the plans of the people in charge of the platform. One of my biggest turn-offs with iOS is its keyboard. The screen doesn't change to indicate upper or lower case characters. I have no idea who thinks that's a good idea, but on iOS there wasn't until very recently any ability to charge that. In the Android world, there are of great on screen keyboards. The idea that someone might want something else was simply outside Apple's vision.
There are all kinds of tools that exist on Android because the whole thing is open to development. There are plenty of things that can't be done on iOS and Windows Mobile because no one considered the possibility that someone might want to do them. I believe that Android is the primary place where innovation is occurring in mobile devices at this point and most of that is because everything is open to be changed.
-- I wanna decide who lives and who dies - Crow T. Robot, MST3K
Not true.
You need Developer mode to install "unpacked" extensions, which essentially means "in development", with no auto-update.
On Windows, they disabled the ability to install packaged extensions from other sources, Developer mode or not. unless you have a domain-level enterprise policy to whitelist some.
On other platforms, you're free to install extensions from any source.
On any platform, you're free to install Chrome Apps from any source. The reasoning being that apps do not silently run in parallel and with access to your browsing.
is still faster than Microsoft. The windows phone store is damn sad.
tried to report an extension once. No chance, without logging in to a google (plus?) account.
Your problem, google.
You can install non-Store extensions in Developer Mode, but Google Chrome will automatically uninstall them when you close and reopen Google Chrome. There exists a workaround, but this workaround requires editing Group Policy, and editing Group Policy appears to require a Pro version of Windows. So you end up paying around $100 to Microsoft to have the ability to use a non-Store Chrome extension more than once.