Google to reject Chrome extensions outside of Chrome Web Store

Knowing that option exists and persisting with their store-only approach means they must have an ulterior motive of some sort, most likely control and money. Ad blockers that target Google Ads will be no more, as well as anything else that the user might want to use to subvert or circumvent. Extensions will also have to adhere to Google's moral code, and developers will once again be beholden to a greater authority in order to operate their business.

Just like with Facebook and the Apple app store, if you build a business on Google Chrome Extensions you now face having the plug pulled at any time for any reason, with absolutely no recourse.

[1] http://blog.chromium.org/2013/11/protecting-windows-users-fr...

[2] https://news.ycombinator.com/user?id=magicalist

I currently have a product that uses a Chrome extension to work. I am privately beta'ing it out by hosting it on my own website.

Because I don't want to be killed with negative reviews of my unpolished first version in the Chrome store.

Now I am forced to show my work and suffer brickbats in public even before I finish it. WTF.

Second =======

And post-Snowden, the Chrome web store publication process is LESS secure for my users than me hosting the app myself. In the Chrome store, you send Google your raw source (possibly minimized) files. They will sign it and push a blob to the end user. https://developers.google.com/chrome/web-store/docs/publish

AFAIK, there is no way for the end user to have any assurance that the file being pushed by Google was the file that the developer intended to push.

With a privately-served version, the equivalent of a secret key created by the developer needs to be compromised to push updates.

Please correct me if I'm mistaken about this.

And even if it does affect a ton of users, I'm sure there are other ways for Google to fix this, even if not completely. But assuming for a moment this wasn't a malicious move from Google's part, I'm still angry with the lazy decision to "just close off non-store extensions" to fix the problem.

Should I expect side-loading to be gone from Android soon, too, Google? Don't you dare!

The way Android handles this issue is the best possible compromise (there will always be a compromise between security and freedom - and that's a great thing). In Android sideloading is disabled by default, and if a user knows what he's doing, he'll enable it and do whatever he wants.

So why can't Google do the same with Chrome?! Disable sideloading by default, but still keep the option in settings somewhere. What's the big deal? Unless they have a completely different agenda behind this...

Also, I'm not sure, but do Chrome extensions work in Opera or Safari? I think it's about time we call Google on this and ask them to open up the format, so other browsers can use the same extensions. The browser shouldn't be another vector for "lock-in".

Wasn't this already largely the case? You have to manually download extensions and then drag them into the extensions manager to install them outside the store right now, don't you?

The only change here seems to be that now you need a checked "Developer mode" box in order for that to work. I guess that discourages randomly checking the box, but if they had just labelled it "Allow third party extensions" it would make the change seem less overbearing.

Question: what is the situation with ChromeOS? If this applies to ChromeOS then it is essentially in the same locked down, anti-competitive state that the Apple app store is in. It is the main reason I avoid Apple devices and would pretty much put ChromeOS devices on the same blacklist as well for me.

However, to fully remove the ability to install third party extensions is just ludicrous.

I develop a small Chrome application for internal use at my workplace. The staff love it, it helps them do their jobs a lot quicker. I don't see any easy way other than (as mentioned), building Chromium to remove this limit, as has been done before with crx files.

Might just move to Firefox and take my workforce following with me!

I don't think anyone would have a problem if this was a simple opt-in system like downloading unofficial apk's on android. Only a select few would be opting in, and those are not the core audience that Google is pretending to be security conscious about.

Giving no ability to switch on this ability for a normal user makes Google lose face with the general tech community. I don't understand the reasons behind this.

The developer option will still work: replace the crx extension with zip, extract the files to a new folder, go to the Chrome extensions page, enable developer mode, load unpacked extension and select the folder you've created.

Sounds like a huge pain in the ass but at least people doing this are less likely to be in the same group of people that are complaining about malware.

[1] http://blog.chromium.org/2013/11/protecting-windows-users-fr...

I imagine most of these complaints come from people who pick up the extensions via bundling (not opting out of something when installing software). As those bundles run off of executables with admin privileges in Windows, the last change was circumvented simply by altering some files in the user's chrome directory and the registry. I imagine a similar tactic will defeat this measure. At least before the removal of the third party installation route, Chrome was able to control the messaging and generate warnings. These changes are simply pushing the malevolent even further underground.

Or maybe I'm just overreacting.

I don't know how these people get all these malwares, but is a fact that they get them installed. And if you don't have a better solution, Google at least has a temporary potentially good one.