6 ms·

I was optimistically hoping some of the MV3 changes would result in Chrome webstore policy enforcement being standardized, but that hasn't happened. Sensor Tow

I was optimistically hoping some of the MV3 changes would result in Chrome webstore policy enforcement being standardized, but that hasn't happened. Sensor Tower (https://sensortower.com/ https://sensortower.com/) makes a lot of popular extensions, like StayFocusd https://www.stayfocusd.com/ https://www.stayfocusd.com/. They seem to resell ad data (in violation of [1]?) and ship likely obfuscated code [2] (in violation of [3]?), but there's no enforcement or even clear reporting mechanism. [1] https://developer.chrome.com/docs/webstore/program-policies/limited-use/ https://developer.chrome.com/docs/webstore/program-policies/... [2] https://robwu.nl/crxviewer/?crx=https%3A%2F%2Fclients2.google.com%2Fservice%2Fupdate2%2Fcrx%3Fresponse%3Dredirect%26os%3Dmac%26arch%3Dx86-32%26os_arch%3Dx86-32%26nacl_arch%3Dx86-32%26prod%3Dchromecrx%26prodchannel%3Dunknown%26prodversion%3D9999.0.9999.0%26acceptformat%3Dcrx2%2Ccrx3%26x%3Did%253Dlaankejkbhbdhmipfmgcngdelahlfoji%2526uc&qf=content-scripts%2Fad-finder.js&qb=1 https://robwu.nl/crxviewer/?crx=https%3A%2F%2Fclients2.googl... [3] https://developer.chrome.com/docs/webstore/program-policies/code-readability https://developer.chrome.com/docs/webstore/program-policies/...

Raed667 2y ago
Event with MV3 you still have access to `chrome.webRequest.onBeforeRequest` and content scripts, so this particular issue won't be 100% solved. I don't think the solution is technical. The solution would be a strict policy, and nuke every extension and publisher from the store who even hints at doing this kind of BS.
palant 2y ago
Note: I am the author of this article. MV3 makes it considerably harder to introduce a security vulnerability, but it doesn’t really help with outright malicious extensions. In the end this isn’t an issue which can be solved by technical means. It’s a moderation issue, and Google currently seems to be scaling back moderation despite not being great at it to start with.

Raed667 2y ago

Event with MV3 you still have access to `chrome.webRequest.onBeforeRequest` and content scripts, so this particular issue won't be 100% solved. I don't think the solution is technical. The solution would be a strict policy, and nuke every extension and publisher from the store who even hints at doing this kind of BS.

palant 2y ago

Note: I am the author of this article. MV3 makes it considerably harder to introduce a security vulnerability, but it doesn’t really help with outright malicious extensions. In the end this isn’t an issue which can be solved by technical means. It’s a moderation issue, and Google currently seems to be scaling back moderation despite not being great at it to start with.