Google discards extensions that force feed users ads in Chrome

http://news.cnet.com/8301-1023_3-57617467-93/google-discards-extensions-that-force-feed-users-ads-in-chrome/

by RougeFemme • 13 years ago

57 48 13 years ago

news.cnet.com

nav1• 13 years ago

I think it would be really helpful if Google disabled automatic updates for extensions. Letting third parties to push modified code to clients without any user intervention is just so insecure that I can't believe it actually is a feature. Just the fact that Chrome updates automatically is bad enough.

smtddr2• 13 years ago

>Just the fact that Chrome updates automatically is bad enough.

Don't agree with that. As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I'd rather have a few people angry at me than deal with another IE update-style browser that just gets lost out there with nearly zero hope of updating.

For example, I applauded Mozilla for this[1] move.

1. http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitt...

>"We don't think self-selection will ultimately get us to the place we need to be," he said. "We will force 3.6 on 3.5 stragglers not choosing to update to Firefox 4 or 3.6 (give them the stick). We feel comfortable making the major update choice for users because a) the versions are very similar and b) we'd rather lose a small amount of miffed users than leave a large amount of users vulnerable."

Keeping an old browser version is something I wish a user could not do unless they went out of their way to install a nightly by themselves and that nightly should nag them to death after 15 days to stop using it. The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser.

username2232• 13 years ago

As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book.

I hope someone starts force-updating your terminal and editor/IDE, introducing all sorts of random changes. Maybe then you would understand why it is bad to make your users' lives worse to make your own life marginally easier.

userbinator4• 13 years ago

The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser.

This sort of attitude really, really disgusts me, as an end-user (and webpage-writer). Many of the things that are being pushed on us, many of us do not need nor want. We want stability, not constant change. Breaking things that used to work is one of the worst things to do. Requiring users to use (and in many cases relearn) newer, more resource-consuming software just creates waste, in the physical and chronological sense.

timothya• 13 years ago

I agree that automatically-updating extensions has the potential to be somewhat insecure. However, I don't see how the alternative could be a better alternative. If they didn't auto-update, then the majority of users would likely never update their extensions, and the ones that do would be unlikely to audit the extensions that they update for malware. Do you audit the apps on your phone before you update them?

To mitigate the problem, Chrome does have the permissions model to limit what extensions can do, and if an extension requires more permissions after an update, Chrome will give you a warning, along with an option to remove the extension. Your best defence is to not grant overly broad permissions when you first install the extension.

Regarding your comment about Chrome's automatic updates being "bad", I disagree wholeheartedly - the web platform would not be able to move forward at the same rate that it can today. One of the biggest problems with IE was simply that it was updated so infrequently that it was really hard to support the large percentage of outdated versions. We'd be in the same situation with Chrome if it didn't auto-update. Furthermore, I trust Chrome to make good decisions for my security. I'd rather have my browser updated quickly so that vulnerabilities in the browser can be fixed quickly before they affect me.

jordsmi2• 13 years ago

I would love a popup when I start up chrome that gives a prompt with which extensions need updated and if you want to allow it or not.

higherpurpose• 13 years ago

I like that, but maybe instead of several pop-ups it would be just one local Chrome page showing you the extensions that got the updates along with details. Google also needs to make developers put the change log in there, too. At the very least offer them a box for the change log, even if all they put there is "New stuff". If they do that you can decide to stop using the extension if you lose trust in them.

tomswartz072• 13 years ago

They currently 'hold' updates that have changed permissions. You must click through the menu to install them.

lcovington• 13 years ago

Is this one of the first malware to run on a Chromebook?

jordsmi2• 13 years ago

You could run dirty extensions on chromebooks from day one.

Grue3• 13 years ago

No, Chrome was.

octref• 13 years ago

Why extensions that hijack your search engine like Window Resizer are not removed?

makomk• 13 years ago

The only reason these two extensions were pulled was because they were causing bad PR for Google. Until that article on Ars Technica, Google had consistently taken the position that there was nothing wrong with what those extensions were doing.

malandrew2• 13 years ago

    "Do not create an extension that requires users to accept 
    bundles of unrelated functionality, such as an email 
    notifier and a news headline aggregator. If two pieces of 
    functionality are clearly separate, they should be put 
    into two different extensions, and users should have the 
    ability to install and uninstall them separately,"

Kudos to Google. Now if only they applied the same logic to the advertisements between the search box and the actual results. Search results and advertisements only represent the same functionality when my search query expresses my intent to purchase something.

I know advertising is Google's business model, so before anyone points that out, let me point out that I've also never been offered the opportunity to purchase the ability to use Google's search without advertising. They should follow their own policy here and give us the ability to uninstall advertising from Google even if it does come with a monthly subscription fee to do so.

jrockway4• 13 years ago

Wait until you hear about how The New York Times works. You pay a monthly subscription fee and have to look at ads.

hrrsn• 13 years ago

See also: Cable TV.

anon13852• 13 years ago

When you snarkily reply to people criticising Google's business model you should probably mention that you work for Google.

cynwoody• 13 years ago

Configure your browser to drop nytimes.com cookies on exit. Works for me.

I never visit the site deliberately, but I do land there occasionally by following links. However, since I restart my browser at least once a day, I rarely come close to the limit of 10 free NY Times articles in a month in a browser session.

jasonlotito2• 13 years ago

It's been like that forever. As far back as I remember.

dhugiaskmak• 13 years ago

  Do not create an extension that requires users to accept bundles of unrelated functionality

Oh god the irony.

/clicks 'No' for the umpteen thousandth goddamned time on some Google property trying to trick me into using G+

PhasmaFelis• 13 years ago

That's nice. Maybe they could see to the other end of the equation and stop making me jump through hoops to install non-approved extensions when I choose to.

nl3• 13 years ago

This is a good move by Google.

Back when extensions were first released I wrote one, and over the years it became pretty popular and built up a good (200k plus) install base. I foolishly took some money for it last year, and the buyers stuck ads in it.

The rating have declined from 4.5 stars to 2.5, but I still feel bad for the users.

Somewhat ironically, it is actually open source, and the code is available for anyone to fork. I beleive there is a fork out there now too, so hopefully that will do better.

ToastyMallows2• 13 years ago

Would love to know what extension it is, or Github repository?

nl3• 13 years ago

The GitHib code is https://code.google.com/p/chrome-reload/. Not linking to the extension itself.

nisa• 13 years ago

How privacy invasive can an extension be?

If the extension can modify webpages could the extension MITM my surfing? E.g. harvesting login data, any form data, cookies and other stuff? I did not saw a discussion about these aspects but from the distance (Never developed an extension) it looks like this all these things are possible?

pornel• 13 years ago

Yes, extensions can have full access to pages you browse and they could potentially read any data from pages you have access to and perform actions as you.

WaterSponge• 13 years ago

Why not add the human element?

Just a bit of passive moderation by a humans like students or amazon turks in app-stores/extension libraries for fake and malicious apps would go such a long way.

Google discards extensions that force feed users ads in Chrome

Related Stories