Agreed. I really did see benefit to the changes I made that reduced our permissions requested based on the initial email we received from Google. When even that was rejected though, I kind of got slammed with a &quot;well.... what do I do now?&quot;.

Thanks for posting this publicly. I’m all for the general idea of reigning in unnecessary data collection&#x2F;prioritizing user privacy, but sometimes you just need certain features to make things work!

As a daily Pushbullet user, thank you for posting this!
It&#x27;s maddening that the best way to escalate a Google customer service issue is social media.

What&#x27;s more is that chat history is broken, I can&#x27;t see tons of messages on the web interface.You can still access some on the web.But your best option is to do a GDPR request to export you all your data.

Well this is my favorite Extension, If Google kills it then how will users gets its pushbullet chat data back.

I switched to Edge chromium when the first production release came out and I am extremely happy. I use all my extensions including unlock origin straight from chrome Web store and it feels a bit snappier than chrome itself.

How does Chrome prevent people from installing their own extensions? Download-and-unpack still works fine, last I checked.

No, they make every effort to ensure that installing extensions outside the store is annoying so that you can&#x27;t push your malware by just having users download and install it. This kind of malware plagued Firefox for years until they made extension signing mandatory

&gt; It&#x27;s a pity that Chrome doesn&#x27;t allow extensions to be installed from the new Edge storeWhy would anyone want to do that? What&#x27;s a real pity is that they make every effort to block users from installing their own extensions. App stores are terrible.

Makes me wonder how much of this is motivated by Googles Messages App now having a web interface...

It looks like they have a Firefox version of the extension.

Another happy PushBullet user here. Extremely useful for receiving text messages from my phone while on my laptop, especially for web apps that insist on sending security codes that way instead of TOTP.This sort of behavior from Google really is infuriating. How they can just decide to boot an app from the Chrome Store that is installed by over a million users is mind-boggling.It&#x27;s a pity that Chrome doesn&#x27;t allow extensions to be installed from the new Edge store, like Microsoft allow Edge to install extensions from the Chrome store. With both built on Chromium, that could&#x27;ve potentially been a workaround (though you may want to consider adding this extension to the Edge store anyway).Hopefully someone from Google will see this and stop the madness or be able to provide more details on exactly what needs to be done, though I wouldn&#x27;t bet on it.

<a href="https:&#x2F;&#x2F;twitter.com&#x2F;dotproto" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;dotproto</a>

This is concerning. Shouldn’t  Google’s store have a dedicated support rep for extensions above a certain threshold?

Well they responded saying:&gt; Although I am sure that this is not the correct place to reach out, I have reached out to the Chrome privacy team to see if they can give us some advice for PushBullet.Though I posted this before this article was on the front page of HN.

GCP and the rest of Google are separated from each other similarly to how YouTube and Google are separated. Unfortunately, the odds of that technique working are very low.

This is awful. I&#x27;m going to send GCP support a message with the small hope that someone can flag it up to the right team.

The answer is to run a campaign to work with Firefox and Safari only, and convert all users to either platform.Seriously, fuck google. I&#x27;m just done with them.

the corporate gorilla beats its chest, demanding you comply!But with what, it does not say ¯\_(-_-)_&#x2F;¯

And there&#x27;s also a Pushbullet add-on for Firefox: <a href="https:&#x2F;&#x2F;addons.mozilla.org&#x2F;en-US&#x2F;firefox&#x2F;addon&#x2F;pushbullet&#x2F;" rel="nofollow">https:&#x2F;&#x2F;addons.mozilla.org&#x2F;en-US&#x2F;firefox&#x2F;addon&#x2F;pushbullet&#x2F;</a>Not sure whether the functionality is the same.

While Firefox is better than Chrome...Mozilla is becoming more and more Google Like as time progresses, where a few years ago I would have believed it would be unthinkable for Mozilla do so something like this to an extension, today I am not so sure I would trust them either

I’m absolutely loving Firefox at the moment.I have temporary containers extension plus an extension to manage google and Facebook containers and the whole thing has become such a pleasurable experience. Combined with pihole it feels like I’m reclaiming the web back again. Such a blissful experience.

Switch to Firefox. It has gotten much better.

ProtonMail has come a long way as a replacement for Gmail as well. Suuuper happy with them, they&#x27;re really responsive to feature requests and support inquiries. I requested for an iOS feature to choose browsers so I could open all links from PM in Firefox. They had it implemented in a month or something... it a quick fix but that impressed me. hence me shilling here
They recently added ProtonCalendar too.

I&#x27;ve been using Fastmail for more than a decade and I don&#x27;t know why someone would trust something as important as email to a company like Google.

I transitioned to FFox myself. I occasionally have to use Chrome for work, and it&#x27;s nothing I find myself missing. If Chrome is messing up your day, it&#x27;s really easy to cut it out.

Sure, and I use it daily.  But my frustration isn&#x27;t about me particularly, it&#x27;s about Google&#x27;s increasingly hostile behavior.  They&#x27;re the 800-pound gorilla of the internet, and the way they behave affects all of us.

I&#x27;ve found the exact opposite to be true in my very specific experience. Five years ago I used every Google product under the sun, today the only Google product I use at all (even search) is Chrome because it&#x27;s the only one I haven&#x27;t been able to replace.I try Firefox with a fresh install on nearly every major release and I keep it installed as a secondary browser, but I can never manage to use it as my daily browser. For whatever reason, none of my company&#x27;s (major tech company but not a competitor to Mozilla in any way) internal web pages load in Firefox. No error, no warning, nothing in the console, just zero content. Blank page. I&#x27;ve tried it on two computers with the same result and just nothing. No extensions installed, nothing I&#x27;ve installed on my network or computer to block anything. It just doesn&#x27;t load anything.On the other hand I keep Firefox installed because Chrome refuses to load my dev environment with a self-signed certificate. Firefox will let me click &quot;I accept the risk&quot; but Chrome just refuses to load with a self-signed cert.I&#x27;d love to use just one (preferably Firefox) but I guess the web is still hard to get right.

The only Google product I still use is Android. I won&#x27;t switch to iOS, that&#x27;s like cutting off your nose to spite your face. Sadly, the FOSS alternatives do not support Blackberry phones, and for physical reasons I _greatly_ prefer a real keyboard.

I have a firewall appliance at home.One day I noticed that some of the stuff I blacklisted (mostly ads) started showing up again.Why? Firefox&#x27;s new DNS over HTTPS was bypassing all my firewall DNS rules.

I switched from Pushbullet to Join and one of the hurdle the dev is having is that something regarding push messaging was severely lacking in Firefox compared to Chrome, hence the lack of an extension for it on Firefox.

I switched when Google killed of ublock origin in Chrome. Firefox is quite nice these days. I just use chrome for development because I&#x27;m more familiar with their dev tools.I will very occasionally find a site that&#x27;s broken in Firefox and works in Chrome though.

Firefox is actually a significantly better browser on GNU&#x2F;Linux. Chrome is pretty awful.

Firefox’s security is a lot less than that of Chrome.

Chrome is a trivially easy product to switch off of compared to other Google properties like Gmail and YouTube. Have you tried Firefox recently?

Chrome&#x27;s Extension v3 API will remove the ability for uBlock Origin to filter web requests in code, instead the application will have to submit a list of URLs to filter to an internal API and this list has a maximum size and limits the flexibility of the URL filtering.See the uBlock Origin author&#x27;s post: <a href="https:&#x2F;&#x2F;github.com&#x2F;uBlockOrigin&#x2F;uBlock-issues&#x2F;issues&#x2F;338#issuecomment-496009417" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;uBlockOrigin&#x2F;uBlock-issues&#x2F;issues&#x2F;338#iss...</a>This is ironic, because uBlock implements an extremely efficient filter and is even looking into using WASM to speed it up even more. Google&#x27;s public position is that implementing functionality in JS or WASM is unacceptably slow. They say &quot;[Preventing or weakening ad blockers] is absolutely not the goal. In fact, this change is meant to give developers a way to create safer and more performant ad blockers.&quot;[1]Google&#x27;s public position is also that WASM is &quot;consistently fast&quot;[2], fast enough to rewrite Google Earth to target it[3], and &quot;It&#x27;s entirely feasible to build a complex code-base to run performantly in the browser using WebAssembly&quot;[4].So which is it? Is the Web Request API being deprecated because it&#x27;s not possible to write performant code in extensions using Chrome&#x27;s powerful JS and WASM engine, or is it possible but there might be some other, different reason that they&#x27;re blocking it?[1] <a href="https:&#x2F;&#x2F;blog.chromium.org&#x2F;2019&#x2F;06&#x2F;web-request-and-declarative-net-request.html" rel="nofollow">https:&#x2F;&#x2F;blog.chromium.org&#x2F;2019&#x2F;06&#x2F;web-request-and-declarativ...</a>[2] <a href="https:&#x2F;&#x2F;developers.google.com&#x2F;web&#x2F;updates&#x2F;2019&#x2F;02&#x2F;hotpath-with-wasm" rel="nofollow">https:&#x2F;&#x2F;developers.google.com&#x2F;web&#x2F;updates&#x2F;2019&#x2F;02&#x2F;hotpath-wi...</a>[3] <a href="https:&#x2F;&#x2F;blog.chromium.org&#x2F;2019&#x2F;06&#x2F;webassembly-brings-google-earth-to-more.html" rel="nofollow">https:&#x2F;&#x2F;blog.chromium.org&#x2F;2019&#x2F;06&#x2F;webassembly-brings-google-...</a>[4] <a href="https:&#x2F;&#x2F;developers.google.com&#x2F;web&#x2F;updates&#x2F;2018&#x2F;08&#x2F;wasm-av1#future_work_and_takeaways" rel="nofollow">https:&#x2F;&#x2F;developers.google.com&#x2F;web&#x2F;updates&#x2F;2018&#x2F;08&#x2F;wasm-av1#f...</a>

I&#x27;m assuming this [0] is what the commenters are referring to. Google is proposing changing web request api, which can break how ublock origin works.Also, this [1] happened.[0]: <a href="https:&#x2F;&#x2F;www.xda-developers.com&#x2F;google-chrome-manifest-v3-ad-blocker-extension-api&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.xda-developers.com&#x2F;google-chrome-manifest-v3-ad-...</a>
[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;uBlockOrigin&#x2F;uBlock-issues&#x2F;issues&#x2F;745" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;uBlockOrigin&#x2F;uBlock-issues&#x2F;issues&#x2F;745</a>

Context and receipts are here: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=23170485" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=23170485</a>

They&#x27;re going down the Safari line of limiting the number of rules an extension can use, significantly reducing the efficiency of adblockers.If it goes as planned, you won&#x27;t see ads on YouTube for sure, but there likely won&#x27;t be enough space to add rules for less mainstream ad networks and some of the specific sites you visit.

If Youtube ads mean that much to you, why not just pay for it?  I&#x27;m all for ad blocking (I use ublock too) but if I heavily use a site that offers me a way to pay a reasonable price, I think it&#x27;s the right thing to do. Uploaders with monetized videos still get paid that way (and I don&#x27;t want to bother with Patreon etc, that doesn&#x27;t nearly scale to everyone I watch videos from).

&gt; The recent nerfing of ublock origin has already had me feeling iffy on things.What did they do to ublock origin? The single best Chrome extension ever. If it stops working and I must suffer YouTube ads again, it&#x27;s bye bye Chrome.

Using it is not mandatory, using it is convenient.

Google is the new Microsoft. Using it is mandatory, liking it is optional.

I whole-heartedly agree and this is why I give money to AWS and Azure will not give any to GCP until the lack of transparency and random product killings stop.

So many people claim for change, but so few migrate to Firefox, DuckDuckGo, or another alternative.

I switched to Firefox because of Google banning Bypass Paywalls extension that is available as a Firefox add-on. When I was building my bootstraped company, Google really taunted us with emails like this, when our AdSense monthly earnings reached $10,000 and we&#x27;re my only source of income. We had 20 million user profile pages, and they were saying that something is wrong with some of them, without saying what, forcing us to &quot;review&quot; them all. We built sophisticated ML content filters, to receive more unspecified warnings and get the account shut down. I managed to reinstate the account, but it left a very evil taste. I am in the process of degoogling, using Bing as the default in Firefox.

It&#x27;s not about just me. I use a half-dozen different browsers during my work day. It&#x27;s how the provider of the world&#x27;s dominant browser is behaving, with ramifications that affect all of us.

You should have stopped using chrome years ago. What will it take for you to wake up?

&gt; I need functionality, of the type PushBullet has provided for years, to do my work.If you can use the Apple stack this functionality has been built in for years and is pretty robust.Just FYI as you say the functionality is needed — I know this won’t help if you can’t switch to Apple

They blocked ublock origin?! Really?! What was their stated rationale (I assume they didn’t admit it is because they want people not to block ads)? Might I suggest using Firefox? I use it and don’t have any trouble with it.

It would be interesting to hear Google&#x27;s actual reasoning but I don&#x27;t expect that we will. I will speculate that it is exactly the clipboard permissions as there have been apocryphal reports of Android apps and web extensions that use this to steal passwords that password managers put there for users to &quot;paste&quot; into their pages.If that is the case, then a much better solution would be for Chrome to implement a secure channel for password managers to use for just that purpose and make access really really explicit. But again, without them saying anything we won&#x27;t know.My advice is to watch for a CVE regarding sniffing sensitive data off the clipboard to surface in the next 30 - 90 days.

&gt; this kind of behavior kills my desire to continue using your products deadHaving already moved to firefox for over a year since quantum came out, what are you waiting for?

If you haven&#x27;t switched to Firefox, you should! There were a few things I didn&#x27;t like at first, but after searching StackOverflow and blog posts for how to change the settings, I am now fairly happy!

(old dude here) I knew this attitude was coming when i saw the billboards recruiting PhD&#x27;s back in 2008 (or so). I figured they&#x27;d be completely infected by arrogant (but clever) twats around 2015. i believe my guess proved to be true and it&#x27;s been getting worse ever since. also, the fact that their (organic) search is so awesome also-also that they were allowed to buy Waze, ffs, get out of my life!.

Can you elaborate on the ublock origin nerf?

I&#x27;ve been using PushBullet for years. Great product! It&#x27;s not fair what big companies are doing to what it seems to be, prioritizing their own features over third party well-built products. It&#x27;s abusive.

Another long-term PushBullet customer here.Anyone at Google who is listening- this kind of behavior kills my desire to continue using your products dead. I need functionality, of the type PushBullet has provided for years, to do my work. The recent nerfing of ublock origin has already had me feeling iffy on things. Behavior like this is simply unacceptable. If you want people to use your services, you need to have some way to communicate. Period. &quot;If you use our tools, we can kill your livelihood at any time for any reason and tough shit if you want a why&quot; doesn&#x27;t exactly inspire, you know?

The SMS access process never worked after it was introduced in a similar way several years ago now. Google even put some minority groups in significant danger to their safety as a result.Nobody at Google gave a shit and it was never fixed.

Slightly related, Google is also tightening up Android 11 location permissions (with good reason). In this blog post[0] they outline a process for getting approval that was supposed to be underway by the start of May.So far I have not been able to locate this form nor have I been able to find any Android developers who have.If anyone here knows where it is or what the deal is, please let me know.[0] <a href="https:&#x2F;&#x2F;android-developers.googleblog.com&#x2F;2020&#x2F;02&#x2F;safer-location-access.html" rel="nofollow">https:&#x2F;&#x2F;android-developers.googleblog.com&#x2F;2020&#x2F;02&#x2F;safer-loca...</a>

When I read something like this I have to assume Google is just trying to kill off extensions, it&#x27;s such a glaringly obvious problem there&#x27;s no way any human has seen and okay&#x27;d it with good intentions.

This one looks particularly relevant: <a href="https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!topic&#x2F;chromium-extensions&#x2F;uo1HZWfHiFU" rel="nofollow">https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!topic&#x2F;chrom...</a>It seems like all extension developers play the same game of guess-and-check to find out which permissions they should remove, and the unlucky ones get banned for trying too often.

Have been through a similar experience.Developing extensions for Google Chrome is a particular form of masochism. They really don&#x27;t seem to care. And things took a turn for the worst last December when the approval process went from hours to weeks.Check out the Chrome Google group for a sample of the lost souls who hitched their wagon to the Chrome platform and now cry futilely into the abyss for support: <a href="https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!forum&#x2F;chromium-extensions" rel="nofollow">https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!forum&#x2F;chrom...</a>

The general idea of &quot;please limit the permissions you request&quot;, maybe. The secrecy about what they don&#x27;t like isn&#x27;t part of that, that&#x27;s just Google&#x27;s preference for keeping things vague.

&gt; but they&#x27;re just responding to market hysteria on permissions.And responding poorly.What the market wants is for companies to lay out understandable policies that protect their privacy. People I know want more clarity about what&#x27;s happening in the extension store and on their devices, not less.As a consumer, it doesn&#x27;t make me feel any better for Google to say in vague terms, &quot;we booted off an app that doesn&#x27;t respect your privacy.&quot; Okay, what was it doing? Are there other apps I should be concerned about? How bad did the app need to get before you booted it off? Are there exceptions to these standards? Are they being applied to internal apps as well?My feeling is that Google&#x27;s inability to communicate with developers and users is its own problem; it&#x27;s not the market&#x27;s fault. Tech companies in general have had difficulty with customer support for a while, even before the media started picking up on privacy issues. Nothing has really changed, Google just happens to be notably bad at this.

I&#x27;m not mad about them increasing scrutiny on permissions, that seems fine. What sucks is Google giving a short deadline, no details, and zero response to the developer&#x27;s repeated communication attempts; all with the threat of Google nuking every single Google resource tied to the developer if they step over some invisible line.

This is sad but they&#x27;re just responding to market hysteria on permissions.

Under the Clayton Act, the Sherman Act, or both? Is this a legal realism commentary on the comparative cost-benefit of civil antitrust litigation in modern America?Or are you just pretending you know things to feel good on the internet.

Zero chance this will happen without a much bigger party involved

yes they offer <a href="https:&#x2F;&#x2F;messages.google.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;messages.google.com&#x2F;</a>

Does chrome already offer features like PushBullet? Firefox somewhat does with Pocket, so I assume chrome has something similar.If they do offer something of the sort, or start to shortly, this seems like a perfect antitrust case.

I assume GP is trying not to help those the automated system intends to catch

&gt; Email me pat [at] trypigeon [dot] co and I can send you some of the things I did that maybe have helped.Please post here so everyone else can learn too.

&gt; trypigeon [dot] coUnrelated, but you got multiple ids with value &#x27;feature-1&#x27; on your landing page.

I had a similar experience but it wasn&#x27;t important to me and I let it go despite being a growing extension with 10s of thousands of users and lots of good reviews.

I tried to follow you link but just get prompted to make a medium account.

Google has effectively created a private monopoly on any Android applications related to Covid-19. And the last time this sort of information was posted to HN the comments section was a race to see who could do the best apology for Google.This policy by Google is hurting people and businesses.Meanwhile, Apple has a similar policy but all they do is just take extra care when reviewing your app. I suggest you port your app to iOS and submit it to the App Store. Apple will accept it and approve it.

&quot;Sign in to view this draft&quot; :&#x2F;Seems like you hit the wrong button or something, when trying to publish it.

I have written about this recently on the Android side.<a href="https:&#x2F;&#x2F;medium.com&#x2F;@lazherrera&#x2F;that-one-time-google-made-it-more-difficult-to-communicate-about-covid-19-cf29c3751c69" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;@lazherrera&#x2F;that-one-time-google-made-it-...</a>If you use any of the words related to the COVID-19 pandemic, they will pull your app, suspend you and ding your account.

Chrome extension developer here.Google ripped my Chrome extension off the app store about a month ago.I got a similar cryptic message, and then I scrambled to fix it, like you&#x27;re doing now. Somehow my extension reappeared the next day.Email me pat [at] trypigeon [dot] co and I can send you some of the things I did that maybe have helped.Tweeting my support as well: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;thepatwalls&#x2F;status&#x2F;1260638967793242113" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;thepatwalls&#x2F;status&#x2F;1260638967793242113</a>

It&#x27;s very automated, especially during the pandemic when many of the content moderators can&#x27;t go to work.

What kind of people make these decision at Google? Engineers? Or did they automate everything with &quot;machine learning&quot;?

Outright admitting this may cause issues with antitrust laws.

You know, at the very least it would be nice to get something a bit more direct, like, &quot;We are no longer permitting extensions that do X on our marketplace&quot;, or heck, even just a &quot;We&#x27;re permanently rejecting this for unspecified reasons.&quot;But if that&#x27;s what you&#x27;re doing, don&#x27;t claim that the extension is being rejected for &quot;overbroad permissions&quot;. I understand that Google may not literally come out and say &quot;We&#x27;ve decided to eat your extension&#x27;s functionality and you can just burn.&quot; But don&#x27;t lie about why it&#x27;s being rejected... however much you may wrap the result up in marketingspeak, don&#x27;t actively lie about the reason for rejection, so that someone can burn the candle at both end for two weeks futilely trying to appease the lying error message.As for the fact it may not look that great no matter how much marketing-speak it gets wrapped up in for Google to just eat some functionality and kill all competition... yeah, well, suck it up Google. Don&#x27;t lie about it. I mean, you can always spin it as security security blah blah security if nothing else, which ought to be enough of a fig leaf.

Neither here nor there but it was &quot;Don&#x27;t be evil&quot;, never &quot;Do no evil&quot;. The latter evokes the Hippocratic Oath and sounds virtuous, but the former is a somewhat tongue-in-cheek reference to the (at the time) megacorps they wanted Google to not be like.(Mind, they&#x27;re arguably not complying with the &quot;Don&#x27;t be evil&quot; version either, especially lately.)

Yikes! I&#x27;ve used PushBullet for since several years and I can&#x27;t imagine not using it.I can understand why Google is doing this though. They have a &quot;Send to device&quot; feature in Chrome. Killing the top 3rd party app is the perfect way to grow adoption of their new &amp; in-built feature.&quot;Do no evil&quot;

Huh? They turned off reviews because a worldwide pandemic eliminated their ability to maintain staff to moderate reviews. That&#x27;s the opposite of &quot;automating it&quot;.

Because they are attempting to automate all of it. This message is generic and based on some analysis of the &quot;manifest.json&quot;.They have also turned off all reviews in the Chrome Web Store: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22935092" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22935092</a>

Famously might be too broad and a bias from my own experience. I went to school in Ontario and knew a bunch of Blackberry interns and employees and people generally know a lot of absurd stories about RIM.An intern who I went to school with told me about how legal once chose the colors for a dashboard he worked on as they did not want to seem to be copying some other company.A co-op complained about them being in every meeting and constantly shooting stuff down.The one written reference to it I know about was in a 2011 open letter.<a href="https:&#x2F;&#x2F;bgr.com&#x2F;2011&#x2F;06&#x2F;30&#x2F;open-letter-to-blackberry-bosses-senior-rim-exec-tells-all-as-company-crumbles-around-him&#x2F;" rel="nofollow">https:&#x2F;&#x2F;bgr.com&#x2F;2011&#x2F;06&#x2F;30&#x2F;open-letter-to-blackberry-bosses-...</a>

&gt; Blackberry famously let legal influence design,Do you have a source or link for this at all for further reading? A quick search doesn&#x27;t turn up anything, but it sounds like a great read

Most likely an automated system to prevent abuse. For a company that takes pride in their machine learning they sure do have a lot of false positives.

Any reason that Google doesn&#x27;t give reasons and ways to comply?I haven&#x27;t ever had to deal with a Google person regarding Android development, but when I built stuff for Blackberry (miss that company), they always provided nice and detailed feedback. Blackberry famously let legal influence design, so I would be surprised if it was a cover your ass thing.

I use<pre><code> wl-paste | qrencode -s 20 -o - | display -
</code></pre>
for this purpose. Shows the contents of the current Wayland clipboard as a QR code. For X11, replace `wl-paste` with `xsel -b`.

For the more limited use case of “get a link from a desktop to my phone right now” I have really enjoyed using an extension on the desktop browser that pops up a QR code linking to the current tab. Then I just point my phone camera at the QR code on the monitor to open the link on my phone. I like this setup because it doesn’t require any pre-configuration to link the desktop and the phone. Your friend sitting next to you can scan the QR code too.I’m not linking to any specific QR code extension because I haven’t audited them for privacy but it’s easy to find one that claims to generate the QR code locally.

I use Slack for this, using a chat window with myself.

My issue is that whatsapp really compress the photos. But decent workaround.

I&#x27;ve replaced Pushbullet with Telegram as I already use it for daily communication.Telegram&#x27;s built-in &quot;Saved Messages&quot; is where I share links, files, text snippets, photos, etc. for follow up and archiving; seamlessly between my devices and the Telegram desktop app.Telegram also has an export feature, so I can backup all (thousands) of saved URLs, messages, media files, and so on for offline safe keeping; both in human and machine-readable formats.

This is a good extension but here is a cool hack I&#x27;ve discovered that let&#x27;s you do this anywhere without any chrome extensions:- Create a new whatsgroupp called &#x27;ping self&#x27; and add your friend to it.- Then kick your friend out from this group- Open web.whatsapp.com and now you can access your messages, files, photos across any device anywhere, anytime! (telegram also does this and allows file up to 1gb)

Chrome extension developers should start hosting them on Github.I use a flavor of Chrome called Ungoogled Chrome (<a href="https:&#x2F;&#x2F;ungoogled-software.github.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ungoogled-software.github.io&#x2F;</a>) and the only way to install plugins is to manually install the CRX file.

It&#x27;s that last one. Chrome Extensions, as a whole, are a value-add to Chrome. Individual Chrome extensions have negligible added value.As long as Chrome isn&#x27;t killing extensions &quot;everyone cares about,&quot; their system can bias pretty far towards making it had to get an extension accepted and maintained in the store without killing the whole ecosystem.

&gt; It is a common theme with Google, what they do makes sense, but communication is impossible.You could say the same about some machine learning algorithms.

It is a common theme with Google, what they do makes sense, but communication is impossible.I don&#x27;t know if it is an artifact of overusing machine learning &quot;our neural network trained on a variety of malware gives your app a score of 4.3, you have 15 days to get it down to 4.0&quot;. How is that calculated? No one knows, maybe you shouldn&#x27;t use the location permission if your icon is red and your domain is not in .org, or something like that.Or maybe it is a form of security by obscurity. Or maybe they just don&#x27;t want to pay for people to support you. Who knows?

Yeah, it&#x27;s crap that they didn&#x27;t give you guidance, although it seems like you managed to find plenty of issues quickly so perhaps the guidance is less necessary than it might seem.Ultimately you know your extension, codebase, and use-case, far better than Google does, so it may not really be possible for them to give you the detail that you&#x27;re looking for – you may be the only person who can do that.I hope that they provide the support you need in understanding the problem to the point where the extension can continue to live on the Chrome store.

I really did try to call out the benefits that happened when I was told to &quot;give permissions another look&quot;. Like all software, needs change and I was able to make a great improvement.The issue I have is that it&#x27;s not clear if I&#x27;m even addressing the correct issue(s). If I don&#x27;t make the Correct change, all other changes are irrelevant since they&#x27;ll never get published.

Permissions seem to be a pretty empty metric if you don&#x27;t&#x27; know what the result is...What was the impact of fewer permissions?Let&#x27;s assume PushBullet was doing something bad with some of those permissions and gathering data? Do they no longer have access to that data? I&#x27;m not sure that&#x27;s the case, permissions alone don&#x27;t determine that.If PushBullet wasn&#x27;t doing anything bad, did anything change?Is it a positive thing for users when the extension disappears in a few days?

Usual answer is that this would make it easier for malicious actors to bypass the limitations.Likely there is some automated system running these checks.

Why can&#x27;t Google provide support instead of vague threats?
Provide a permissions audit tool, recommend ways to reduce permissions, provide a dev tool to automatically report on permissions that haven&#x27;t been used while running an extension.Is banning someone&#x27;s entire Google account across all services a proportionate response to a developmer having trouble with Google&#x27;s confusing permissions API?

&gt;&gt; As much as we can criticise Google&#x27;s handling of this situation, the fact that the developer was able to reduce permissions from accessing data on _all websites_ down to _their website_, as well as tighten up a few other permissions, shows that Google is correct that the extension is asking for more than it needs.OK fair enough, but why aren&#x27;t the big violators held to this? (I realize this example isn&#x27;t Chrome, but it is Google Calendar -- ever try to add a Zoom meeting invitation to your Google calendar? Zoom wants access to read and write all events ever on your entire calendar!

They aren&#x27;t solving this problem, they&#x27;re killing off extensions.  And I say this having received many unsolicited attempts to &quot;purchase&quot; Chrome extensions.

&gt; I love that Google is starting to solve this problemThey aren&#x27;t solving the problem. They are making sure only they can get all the user information.I would rather give all my information to everyone rather than giving all my information to google.

&quot;Solve the problem&quot; ok, so you&#x27;re starting that this selling only happens when a third party dev does it?Do You have an android phone? Do You use google for anything? Gmail? Google docs&#x2F;drive? Youtube? Chrome? ChromeOS? Anything google owns? Then they&#x27;re selling your data.Try reading all those fun TOS agreements that come with using any of the aformentioned products, or heck, visiting sites that use google analytics.that won&#x27;t tell you how much or what data google gets from you, but it&#x27;ll tell you that you agreed to it.

Extension developers monetizing their extensions by selling the data that they get from users is a big problem. It&#x27;s the reason that I don&#x27;t freely install useful extensions that I find today. I have no way to distinguish those who sell my data from those who dont.I love that Google is starting to solve this problem, and from my perspective an extension that is sending and receiving SMS messages should not be requesting the ability to read and change all data on all websites that I access.

yeah, it would make way more sense to codify the policy and just tell devs that they are using banned functionality or something.

This exemplifies Google&#x27;s reputation well.

The big crime isn&#x27;t the request to reduce permissions. The big crime is the lack of details and lack of communication. It&#x27;s having to drop everything and work in a panic trying to guess how to please the faceless mysterious robot.

I strongly disagree. If they were actually interested in this, they could simply tell the developers what to fix. This is beyond arrogant and counterproductive.

&gt; These rules impact this developer&#x27;s livelihood.Let this be the millionth lesson of &quot;the perils of building on a platform instead of on a protocol&quot;.

Well they did give details on what needs tightening, it&#x27;s just that those details are in the form of policy points not being hit.What do you think they should be providing? Honest question, I have some ideas but they all feel very tricky&#x2F;error prone to implement.

&gt; I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved.You&#x27;re missing the point here. The developer isn&#x27;t given any guidance on what needs tightening. This shouldn&#x27;t be guess and check. These rules impact this developer&#x27;s livelihood. They should be well defined, documented, and communicated.

Also, Google could just block the permission and let the extension developers deal. Even that would be less hostile because at least the developers would know what to fix.

&gt; - if G has the ability to automatically audit necessary permissions, they&#x27;d do it when you upload to the plugin storeIf they added it more recently then they are just back-applying it to an already existing extension.Alternatively, you can report plugins as requesting incorrect permissions – I&#x27;ve done this. Perhaps that&#x27;s what&#x27;s happened here, lots of reports triggering an investigation.

Disagree that G&#x27;s motivation here is to reduce permission footprint, because:- if G has the ability to automatically audit necessary permissions, they&#x27;d do it when you upload to the plugin store- if they&#x27;re doing this manually for popular plugins, then (1) they&#x27;d publicly certify safe plugins and (2) the interaction would be way more high touchPlugins are inherently unsafe + require trusting the developer.Could be malicious, or G may not even have a reason for this (it may be some forgotten dinosaur instinct to knock over other people&#x27;s stuff when it gets too big).

Exactly. Not once in their diatribe did they provide a reason that they need those permissions. The fact that noone there knew why they were asking for those permissions in the first place is a huge red flag for me.Why are they asking for <a href="https:&#x2F;&#x2F;*.pushbullet.com&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*.pushbullet.com&#x2F;*</a>, <a href="http:&#x2F;&#x2F;*.pushbullet.com&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*.pushbullet.com&#x2F;*</a>, and <a href="http:&#x2F;&#x2F;localhost&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;localhost&#x2F;*</a> read permissions? I suspect it&#x27;s the localhost permission request that is currently blocking them.And why in the world are they asking for the cookies permission? That&#x27;s a big, fat nope for me. It&#x27;s as if they don&#x27;t understand what they are asking for and the potential implications of passing that data around so haphazardly.These folks need to take another hard look in the mirror before they point the finger, because their own house is way out of order.

I&#x27;m trying to figure out why that was their setting to begin with.&gt; We do not need to request access to data on <a href="https:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*&#x2F;*</a> and <a href="http:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*&#x2F;*</a>.Was this not determined before, or they changed their minds now that Google is threatening to pull their product? Either they thought that was appropriate before, or they didn&#x27;t think about it at all. Inexcusable either way.

Yes, it seems pretty bad that by default they were accessing user data everywhere. Gross.

This is an unsafe extension that had access to every website but did not need it. Yes, that is what I got too.

As mentioned, I think Google have handled it poorly, but their fundamental position – that this extension is incorrectly using permissions – was significantly correct and may prove to be fully correct.Google deserve criticism for the lack of clarity in the communication, they deserve criticism for the lack of human touch, customer support and many other aspects.They do not deserve criticism for calling out incorrect permissions usage and forcing developers to do better.

&gt; They sent an email with no guidance whatsoever.Did they, though? The email seemed pretty clear that the problem was requesting more permissions than necessary.I&#x27;m no Google fan, by any means, but if it&#x27;s that hard for the developer to check which permissions their own app is requesting, I don&#x27;t know if it&#x27;s Google&#x27;s fault.

Google sent an email saying they were asking for too many permissions. Pushbullet was asking to observe all website traffic. Google&#x27;s email was objectively correct. I agree that the second rejection is more surprising, but yes, the first email seems like a case of Google doing a good job. I have very little sympathy for apps that ask for too many permissions.

14 days is an absolutely egregious duration to get a response for a software change. A developer could be out on  vacation for that long. Encouraging  fast fixes is also irresponsible from a security perspective, which is what they are trying to fix to begin with.

That&#x27;s what you got out of it? Google doing a good job? They sent an email with no guidance whatsoever.These guys went above and beyond what most developers would&#x27;ve done, which would have been to contact support until they get a clear answer.This only alienates the extension ecosystem. And this was the primary reason I switched to Firefox. Google is the new Microsoft. If I remember correctly, they started Chrome exactly so this very thing wouldn&#x27;t happen.

&gt; As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on <a href="https:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*&#x2F;*</a> and <a href="http:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*&#x2F;*</a>. Instead, we can simply request data access for <a href="https:&#x2F;&#x2F;*.pushbullet.com&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*.pushbullet.com&#x2F;*</a>, <a href="http:&#x2F;&#x2F;*.pushbullet.com&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*.pushbullet.com&#x2F;*</a>, and <a href="http:&#x2F;&#x2F;localhost&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;localhost&#x2F;*</a>. This is a huge reduction in the private data our extension could theoretically access. A big win!They were completely in the wrong there, and posing a huge security risk to all of their users.

I think you&#x27;re the one misreading. From the article: &quot;We do not need to request access to data on <a href="https:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*&#x2F;*</a> and <a href="http:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*&#x2F;*</a>. Instead, we can simply request data access for <a href="https:&#x2F;&#x2F;*.pushbullet.com&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*.pushbullet.com&#x2F;*</a>, <a href="http:&#x2F;&#x2F;*.pushbullet.com&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*.pushbullet.com&#x2F;*</a>, and <a href="http:&#x2F;&#x2F;localhost&#x2F;*.&quot;" rel="nofollow">http:&#x2F;&#x2F;localhost&#x2F;*.&quot;</a>

Edit: I was the one who misread it. My mistake

Please don&#x27;t use that quoting style for non-code.

I disagree with you here because:<pre><code> 1. The article contains more relevant information that you did not show in your point.

 2. Those relevant information made your point void

 3. I think your point make no sense on the relevant information.
</code></pre>
There, I refuted your claim, you have 14 days to change it and show what you learned.

As much as we can criticise Google&#x27;s handling of this situation, the fact that the developer was able to reduce permissions from accessing data on _all websites_ down to _their website_, as well as tighten up a few other permissions, shows that Google is correct that the extension is asking for more than it needs.I hope the developer finds another load of permissions they can tighten up, resubmits, and is approved. As long as it results in permissions being more correct this is a very positive thing for users because for every PushBullet there&#x27;s hundreds of attempts at malicious Chrome extensions that are abusing permissions.

Good news! They won&#x27;t. They&#x27;re only providing an API to give everyone who needs to run contact tracing access to the Bluetooth Beacon system.EDIT: &#x2F;me wonders what &quot;contract tracing&quot; is going to be

I can&#x27;t wait till Google starts running contract tracing.

Out of curiosity, where those big name apps, or small ones? I assume that level of service is reserved or more important apps?

I&#x27;ve seen cases where Apple will actually decompile&#x2F;debug your app and point you the exact feature &#x2F; method &#x2F; line that they find unacceptable. Despite all of my other complaints about iOS ecosystem, they _do_ keep their App Store walled garden fairly well tended.

I consider it a &quot;token&quot; amount, calculated to be just enough to keep people that aren&#x27;t actually serious about releasing apps out.They sure aren&#x27;t looking at developer account fees to hold their bottom line up.It&#x27;s low enough that I can easily keep two organizational accounts going.

As someone who gripes about it: I think $99&#x2F;year is a perfectly reasonable fee in order to submit to the App Store. I just don&#x27;t think it should be the only way to run my own code on my own phone (without jumping through the rediculous hoop of reinstalling an app every single week).

Xcode is free, Interface Builder is free, all the documentation for everything is free. I&#x27;m trying to get into Windows development and don&#x27;t use Apple devices, but I agree $99 a year for everything Apple gives developers is not expensive considering the value and the cost of these tools on similar platforms.

This is why I&#x27;m often amused when people gripe about the $99&#x2F;year membership fee for the Apple Developer Program.

I was able to get a couple of apps approved, but I have perfected my forelock-pulling and wheedling skills. I always deal with them very respectfully and deferentially.Basically, I support Apple’s “walled garden.” It’s a pain to deal with, but it makes their App Store a lot more valuable.There is a lot of loud, vocal, opposition to it, but the vast majority of regular (as in non-geek) people like it just fine.

Someone from Apple got on the phone with me to explain a rejection. I was disappointed with the outcome but very surprised at how they were willing to talk about it and explain why.

Which pretty much blows up the idea that Google&#x27;s vagueness is about security.

I am the proud recipient of many Apple rejection notices from the App Store (I have been releasing iOS apps since 2012). I have not had an app pulled, but I have had many rejections to submitted apps (the latest were received yesterday).In all of the notices, Apple is usually quite explicit in what the problem is, including attaching screengrabs, and they will respond, if I ask them for further clarification.

The fact that this team realized so simply that they shouldn&#x27;t be reading data on every site the user visits while the extension is installed is deserving of a vague response from google. Sad really.

Does Google send this message to random developers ([1]) and then look at the changes that developers make to get a list of things that developers apparently think are not so good?[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Thirty-Six_Stratagems#Stomp_the_grass_to_scare_the_snake" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Thirty-Six_Stratagems#Stomp_th...</a>

Why doesn&#x27;t Google notify all extension devs about these issues, to get it fixed, instead of sending vague threats?

&gt; I don&#x27;t know why you can always count on someone to defend a multi-billion corporation against small companies, is there no empathy left?I don&#x27;t have empathy for companies, I (try to) have empathy for people. Small companies are made up of people. Large companies are made up of people. I try (and often fail, alas) to have empathy for the people in both cases.

Nobody is against enforcing better behaviors from developers, the issue is that they are not telling anyone what those issues are. I don&#x27;t know why you can always count on someone to defend a multi-billion corporation against small companies, is there no empathy left?

The fact that they were requesting <a href="https:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*&#x2F;*</a> and <a href="http:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*&#x2F;*</a> (i.e. full control over all your accounts) without it being absolutely necessary reflects terribly on them.Still not clear why localhost (which can mean root access to the local machine since it may have localhost-only services that enable that) and cookies access is needed, also <a href="http:&#x2F;&#x2F;*.pushbullet.com" rel="nofollow">http:&#x2F;&#x2F;*.pushbullet.com</a> is unnecessary since they should always use HTTPS.If they had properly implemented the extension they may not have this problem now.

We had a similar interaction with the Chrome Web Store out of the blue. After a few maddening rounds of requests for clarification and nonsensical canned responses, I finally just gave up and accused them of gaslighting me. Our extension was restored the next day, of course with no explanation for the ordeal.

Chrome on Android already doesn&#x27;t have extensions. That made me switch to Firefox on Android and within a week my laptop was also on Firefox because it&#x27;s nice to have tab syncing etc between devices.If enough users do this I think Google will review their policy on extensions and specifically adblockers. Can&#x27;t browse without one anymore after having used it for a while.

&gt; Chrome is exploring hiding extensions by default so they no longer will show up automatically by the omnibar when you install them (say hello to a huge amount of confused users who don&#x27;t know where your extension went)Haven&#x27;t heard about this change (more info at [1] for anyone interested) - wow! I really wonder if those are the first steps of the roadmap to get rid of extensions altogether.[1] <a href="https:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2020&#x2F;04&#x2F;07&#x2F;chrome_hiding_extensions&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2020&#x2F;04&#x2F;07&#x2F;chrome_hiding_exten...</a>

The screenshot thing sounds downright Kafkaesque.  Infuriating!

Fellow extension developer here as well. I&#x27;ve been trying to get an update approved since February or March.Submitted an update in late February and decided to update my screnshots. Remove the screenshots and add new ones only for Google to tell me &quot;you can&#x27;t add screenshots while you app is in review&quot;, fine, add them later after the review.3-4 weeks go by and I check the approval status. Status has been rejected because....no screenshots provided. I&#x27;ve since updated the screenshots and resubmitted for review. Currently still waiting on approval.I&#x27;ve been planning on doing a Product Hunt Launch but that&#x27;s been put on hold until I can get an updated version in the chrome web store (the current version is very old and buggy). I&#x27;ve even looked into distribution outside the store but turns out chrome will no longer let you do that.

They have some automated review mechanisms to try and stop you from downloading and running arbitrary code, but it&#x27;s definitely possible to do it.In my case I settled for having a remote configuration file that I could use to disable features in an emergency (and had to use it a couple times), as a compromise since I didn&#x27;t want to pull down arbitrary code but was tired of getting burned by it taking a week to push a bug fix.

&gt; Extension review times have gone from 1 hour to a variable amount of time ranging from 1 minute to 3 weeks or longer (try to plan a release or spot fix an issue when you have no idea how long it will take for a deploy to reach users)This is potentially a huge security issue, because the natural way to &quot;fix&quot; the problem is to download and run arbitrary code as an end-run around the review process.

I removed my Chrome Extension from the store in February. It was averaging about £30 per a month in sales and the cost of keeping up-to-date with the changes in Chrome&#x2F;the extension store seemed hardly worth it.The thing which really pushed me over the edge was their new developer dashboard, it was a step in the right direction but what missing some key features which were present in the old dashboard. Googles solution? Make us use both dashboards for almost a year.

Different extension developer here. The Chrome Extension store ecosystem has become a nightmare for developers over the past year. Some items:- Extension review times have gone from 1 hour to a variable amount of time ranging from 1 minute to 3 weeks or longer (try to plan a release or spot fix an issue when you have no idea how long it will take for a deploy to reach users)- User reviews of extensions have been disabled (how are you supposed to build an audience or build up trust without reviews?)- Manifest v3 was announced (this was actually longer than a year ago) which will completely break many types of extensions. Over a year later, it is still on the horizon but the beta releases of it are buggy so it is hard to even try to adapt to it at this point.- Persistent extension related bugs in Chrome are not being fixed and new regressions are being introduced breaking previously working extensions (which you then need to rush out a fix for but good luck with that when the reviewers may take weeks to approve the update)- Chrome is exploring hiding extensions by default so they no longer will show up automatically by the omnibar when you install them (say hello to a huge amount of confused users who don&#x27;t know where your extension went)I understand the Chrome team is trying to address a user trust and fraud issue with extensions and we are grateful for that. However, the Google extension team appears to be massively understaffed and are having huge issues managing and evolving the ecosystem.

&gt; Stop using their browser, stop using their search.The more people that do this in general, the better. We&#x27;ve given Google entirely too much power to control what people see and read (and it follows, control over what they say and think).They don&#x27;t have our best interests at heart, they have financial interests at heart, and everything else flows from there. I&#x27;m not saying this is evil, but it&#x27;s certainly not _good_.

&gt; &quot;no support and no service&quot; model?this is one of the reasons why Google cloud will lose to AWS in the long run.AWS is customer obsessed, Google is not.

&gt;We hear you and are eagerly looking to improve things.Joking aside, isn&#x27;t this just what people should come to expect from the company that has always tried to normalize the &quot;no support and no service&quot; model?If these antics start causing GOOG to lose share in the browser market then they may review these policies, but I highly doubt it. At the end of the day GOOG is an ad company and publicly-traded at that. They have a bottom-line and a lot of shareholders watching it.Support channels&#x2F;forums are probably not the way to go, in other words. Stop using their browser, stop using their search. That&#x27;s probably the only way they will be incentivized to change.

How can you realistically avoid this for certain products though? For mobile for example, you&#x27;ve got the iOS and Android store policies to go through, the iOS and Android SDKs, and whatever restrictions Safari (e.g. no proper PWAs) and Chrome have.Not everything can be a website that just needs basic browser capabilities.

This isn&#x27;t very actionable advice, though, since there is basically no such thing as a software product that isn&#x27;t built on somebody else&#x27;s property.You might think, &quot;Ah-ha, web apps!&quot; But no, Google can still casually destroy you there. Or you might think, &quot;Ah-ha, desktop apps!&quot; But the OS vendor can casually destroy you there.

What business short of The Principality of Sealand&#x27;s data warehousing is not &quot;built on someone else&#x27;s property&quot;? Even a brick-and-mortar business needs to appease the taxman.

I’m torn here.1. I agree as to the need to get off the Google lands.2. Being able to create business relationships to build on other people’s property and work without fear of their yanking the rug out is an incredibly important part of a working society.

Their business isn’t solely built on google. Part of it relies on browsers and google have a dominant position in browsers. Should no one build a business related to browsers until google is toppled? I wouldn’t follow your “rule”, as most successful businesses started out by violating that rule.

Except chrome isn&#x27;t really a &quot;property app&quot; so much as a &quot;proprietary OS&quot;; it&#x27;s the platform in which ~70% of desktop users spend &gt;10 hours a day. This is different from eg Facebook, in that FB&#x27;s valueprop is being &quot;full stack&quot; (content + controls + ads); while Chrome&#x27;s design is open-ended -running other people&#x27;s websites, with other people&#x27;s extensions.The other side of the issue is tough, though: Chrome extensions are regularly purchased &amp; have ads embedded into them ( <a href="https:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;1551266&#x2F;how-to-track-down-which-chrome-extension-is-generating-popunders" rel="nofollow">https:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;1551266&#x2F;how-to-track-down-wh...</a> ), so Google&#x27;s chrome extension team (couple of ~hundred person?) is essentially held accountable by ~1 billion users to the behavior of ~10s of thousands of extensions.

This is not a useful comment. You are suggesting a world where no platform is extensible, which isn&#x27;t realistic nor desirable.When you are building for an extensible platform it&#x27;s entirely reasonable to be surprised when the vendor sabotages you. Platforms like this are good because they help both parties, so there is an expectation that one side won&#x27;t sabotage the other in general. When it happens it&#x27;s surprising, and usually not a great outcome for the platform provider.

The rule still applies: if you build your business on someone else&#x27;s property, don&#x27;t act surprised when they they casually destroy you.It has happened again and again and again. Building for FB or Google is you making yourself their serf, and you will be allowed to exist at their whim.

I blamed the Chrome Web Store team at first but I can understand why they&#x27;re anxious about allowing extensions onto the store which basically access everything on your browser.The issue is the outdated permission spec for browser extensions (I&#x27;ve gone into more detail on another comment on this thread)

I guess the solution is to stop using Chrome.

I want to share my opinion on this as it&#x27;s something that I&#x27;ve spent a lot of time thinking and talking to the Chrome Web Store team about.The very core of the issue here is less about the manual review process (although that sucks) and more about how the review process is necessary due to how extension permissions work in browsers to-date. The current process works similar to how Android and IOS permissions worked back in the day by requiring the user to grant all permissions up front (equivalent to giving an extension sudo permission to your browser).The feedback you&#x27;ll most likely get from Google on this isue is that the solution to this is to narrow down what URLs your extension works on... but that comes with a pretty big assumption that an extension can declare that information up front. Many extensions (including developer tooling) don&#x27;t need to run on EVERY page - they need to run on specific pages where some extension-specific code is running (this is the case with Urql, Preact, React, Rexux devtools). Narrowing down by URL just isn&#x27;t possible and an ad-hoc solution where extension-specific code on the webpage can trigger permission requests (similar to how a website requests access to your camera) is needed.I&#x27;ve written up a proposal for this case which I think addresses 90% of use cases where &quot;sudo permissions&quot; are being requested up front and in reality, could be requested on an ad-hoc basis. Whether it&#x27;s an agreement or some criticism, anyone who is able to get involved in this discussion - please do! Every other platform is using ad-hoc permissions and we need to push for the same with browser extensions.Here&#x27;s the proposal: <a href="https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!topic&#x2F;chromium-extensions&#x2F;YyVw0OEkUXA" rel="nofollow">https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!topic&#x2F;chrom...</a>Here&#x27;s my rant on Twitter about this problem (see retweeted comment): <a href="https:&#x2F;&#x2F;twitter.com&#x2F;andyrichardsonn&#x2F;status&#x2F;1252920565696004096" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;andyrichardsonn&#x2F;status&#x2F;12529205656960040...</a>

For people focusing their comments on this particular extension + the permissions it asks for, please take a quick look at the numerous recent posts in the official forum for Chrome extension developers to see it&#x27;s not an isolated issue:<a href="https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!forum&#x2F;chromium-extensions" rel="nofollow">https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!forum&#x2F;chrom...</a>It&#x27;s a systematic issue that isn&#x27;t specific to anything Pushbullet is doing and it&#x27;s been like this before the pandemic:- Reviews can take up to 3 weeks. This in alone would be crazy enough if you have an urgent bug to fix.- Rejection emails are vague and don&#x27;t tell you what to fix.- After you guess at what to fix, you&#x27;ve then got to join the up to 3 weeks review queue again.- If you try too many times, your extension gets pulled.- On top of this, they&#x27;ve recently disabled new Chrome Web Store paid items, and user reviews.Can anyone from Google escalate this and help extension developers? I can&#x27;t speak for everyone but there&#x27;s lots of complaints in the forum and little action beyond &quot;we hear you and are looking to improve things&quot;.

&gt; clipboardReadI bet that this is it. Clipboard data is extremely sensitive, as it can often contain passwords.

Redirects shouldn&#x27;t compromise the CORS &#x2F; XSRF security model, which is the key item of concern from a Chrome Extension standpoint. Like if pushbullet.com redirects to foo.com, the crex is now looking at the foo.com page and its permissions will apply accordingly.

Right, this suggests the app either (1) runs a web server on the client device, or (2) wants to access a third party webserver on the client device. I don&#x27;t know if this is common. Or maybe I don&#x27;t know&#x2F;understand why this is needed.Also, isn&#x27;t allowing access to the app&#x27;s website the same as allowing access to any website? Can&#x27;t you just redirect?

This is a very good suggestion, and could very well be the root cause of these rejections. It’s a potential security vulnerability that is triggering the violation.I hope the author sees thorum’s comment!

I believe you&#x27;re supposed to use Native Messaging for that: <a href="https:&#x2F;&#x2F;developer.chrome.com&#x2F;extensions&#x2F;nativeMessaging" rel="nofollow">https:&#x2F;&#x2F;developer.chrome.com&#x2F;extensions&#x2F;nativeMessaging</a>

You can probably get around this by setting up some DNS like localhost.pushbullet.com -&gt; 127.0.0.1.  It&#x27;s probably not in the spirit of what they&#x27;re asking for though, if it is indeed the problem.

It might be a bit trickier, because if you hardcode the port in the manifest, the user wouldn&#x27;t be able to change it?Might be better than nothing I guess, but on the long term you&#x27;d need to add the port in settings and request the permission for localhost+port dynamically? But that&#x27;s got another issue, e.g. last time I tried it [0] for my extension, Firefox didn&#x27;t support dynamic URL permissions for URLs with ports.[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;karlicoss&#x2F;grasp&#x2F;blob&#x2F;f24378ebae68c22bea03e72fa8cfc6da777adcb0&#x2F;src&#x2F;js&#x2F;permissions.js#L15-L24" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;karlicoss&#x2F;grasp&#x2F;blob&#x2F;f24378ebae68c22bea03...</a>

Can’t you setup a DNS entry on your domain that resolves to 127.0.0.1 that you reference instead of localhost?

We use localhost to communicate with our desktop application which is commonly installed alongside our extension by users.An example of how we use this communication channel is preventing both our extension and desktop apps from showing notifications on the same computer. Our apps are all about notifications so this would get unacceptable very fast. We ping our local desktop app via localhost to see if it can manage the notification, and show it with our extension if it isn&#x27;t running.Maybe if we limit it to just the local port we use? Seems like it can&#x27;t hurt to try that too.

I have a desktop application that communicates on localhost. I recently read that it’s advisable for the server to bind port 0 and then a free port will be chosen to avoid conflicts. I guess the port could be a configurable option. Although for my users it would just add confusion.
I can see why the security conscious would not like a dynamic port though.

Does your browser extension really need to access localhost&#x2F;* - as in, port 80 on my local machine? That would make me very uncomfortable about installing the extension.Would it be possible to restrict the extension to accessing a specific port or endpoint that is used by PushBullet?

Damn that sounds like crazymaking :(Dunno why they can&#x27;t be more explicit which part of the code is the issue

We went through the same problem at Superhuman (and as I write our latest extension update has been pending review for 2 weeks, so maybe we&#x27;re about to hit it again).Simeon on the mailing list was quite re-assuring, and I would recommend reaching out to him, though there are limits to what he can help with.That said we found that the review process is quite arbitrary, resubmitting may work simply because you get a different reviewer. (We&#x27;ve seen identical copies of the extension with different version numbers where one was approved and one rejected).We&#x27;ve also observed that they use some kind of automated code-analysis to tell whether or not you&#x27;re making use of the permission; so you may want to check that it&#x27;s obvious from the code included in the extension bundle that you need the permissions you&#x27;re asking for.We&#x27;ve also hypothesized that they apply different standards to extensions depending on the number of users – our staging extension (~50 users) usually gets approved quickly, but our production extension usually takes a while and is less likely to be approved. (This may just be luck of the draw coupled with arbitrariness though)

It says, in the email provided, exactly what must be done: Change the required permissions - your scope is too broad.

You could try that. Long term, it should also be possible to route this communication through the internet, or use the Chrome&#x2F;Firefox&#x2F;WebExtension NativeMessaging API [0][1].0. <a href="https:&#x2F;&#x2F;developer.chrome.com&#x2F;apps&#x2F;nativeMessaging" rel="nofollow">https:&#x2F;&#x2F;developer.chrome.com&#x2F;apps&#x2F;nativeMessaging</a>.1. <a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Mozilla&#x2F;Add-ons&#x2F;WebExtensions&#x2F;Native_messaging" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Mozilla&#x2F;Add-ons&#x2F;Web...</a>

We never use plaintext http so that is a reasonable thing to remove for our first-part domain (pushbullet.com).We use localhost to communicate with our desktop application. An example is preventing both our extension and desktop apps from showing notifications on the same computer (our apps are all about notifications so this would get unacceptable very fast). Maybe if we limit it to just the local port we use? Seems like it can&#x27;t hurt to try that too.

i guess removing plaintext http and localhost should fix this.

I stopped using pushbullet because I realised its access made me a bit uncomfortable, but had I had the &#x27;So, can we cut any of these permissions?&#x27; paragraph to read at the time, that may have reassured me. Nice to see it not only being investigated (even if it took Google&#x27;s vague threat to spur it on) but positively so; seen as &#x27;A big win!&#x27;.

&gt; This may also result in the suspension of related Google services 
associated with your Google account.Get all your emails off gmail ASAP, pushbullet developers. It may be more than your extension that gets nuked.

No Chrome, no Google search and no Gmail as default email here.Hopefully, many others will follow.

I was using Google Ads for a pet project of mine.  I lost the password to one account, and then decided to set up another. Using the same CC (which is also my personal CC) on both accounts triggered something and they killed my account.  I explained what happened, and told them to check the first account access patterns as they had abruptly stopped due to the loss of the password. They didn&#x27;t care in the least.

Yes I in fact did. One of the only reasons I took the call. He said he would check internally. Nothing came of that. Technically they weren&#x27;t sales but were doing a free account review (but purely focused on how to increase my spend).

We spend a quite a bit on Google Ads yet they seem to refuse devoting even a few minutes of a knowledgable support staff’s time to our account—even when we’re trying to figure out how to give them more money. For 1-2 years our product shopping ads never displayed and we couldn’t get anyone to tell us why. One day, it just started working by itself (perhaps some engineer pushed a fix).Contrast this with their sales strategy of aggressively making a human call me every quarter to try to up my budgets. I’m not sure why they are so against helping people succeed with their products...It’s like they are allergic to manual human processes (unless it’s sales).

Let's guess what Google requires in 14 days or they kill our extension