question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Adjust messaging (or remove) for side loading of extensions

See original GitHub issue

Test plan

  1. Open https://developer.chrome.com/extensions/samples in a new tab
  2. Download one of the sample extensions and unzip
  3. Visit chrome://extensions/
  4. Enable developer mode
  5. Click Load unpacked and then pick the folder where the extension was unzippped (step 2)
  6. Warning should not be shown (see picture below for example)
  7. Restart browser
  8. Warning should not be shown on startup (see picture below for example)

Description

We inherit the following UI from Chromium: 46507516-ba34d000-c7ed-11e8-94ee-754f0567e088

We should adjust the messaging for this since we sometimes recommend certain extensions be manually installed when the Chrome store doesn’t allow them.

Note that we don’t have our own store right now, so this isn’t about policy of what should or shouldn’t be allowed.

We definitely don’t need to keep showing it every time you launch the browser.

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Reactions:16
  • Comments:57 (14 by maintainers)

github_iconTop GitHub Comments

11reactions
Mr-Mondragoncommented, May 8, 2019

A suggestion from #1432 is to remove notification from dev channel but keep warning in release/beta.

To be honest, this is not a good idea. This more or less ‘forces’ people to use a dev version (or put up with the nagging popups forever). I am a normal user of Brave, and as such I should be using the official version. Besides the fact that I keep things up to date with package managers, and using dev channel would cause extra maintenance effort.

9reactions
Mr-Mondragoncommented, May 8, 2019

Let me please stress this again, as I think security is the most important concern of all this:

Keeping the same popup showing up every time makes security WORSE, not better!

I totally understand the reasons for this popup. Really. But I have a self made developer extension, and Brave warns me every single time. Despite the fact that I am with absolute 100% certainty NOT at any risk. Extremely annoying. After doing this a 100 times or so, clicking it away becomes something automatic, you do it unconsciously.

Can you please reconsider this feature, but with two critical changes:

  1. Only offer the option to not show the warning again for that specific version of that particular extension. Whenever a different extension is loaded, or if this one is changed (!) the warning should appear again.
  2. Maybe make the “do not warn me again about this specific version of this particular extension” feature optional. So by default it’s not there, but you can enable a setting to get it. To protect the user from doing this accidentally.

I think overall security would be served best by this approach. Better than how it’s done now, which introduces the risk that people develop the habit of clicking away the warning automatically. Very dangerous, this is not what we want if we have security in mind.

Thank you for your consideration.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Google to remove ability to sideload Chrome extensions
A better way to handle it would have been to have a switch and just not support users who have sideloaded extensions enabled,...
Read more >
Get extensions to customize Safari on iPhone - Apple Support
Manage your extensions ... on the left side of the search field, then tap Manage Extensions. Select or deselect each extension to turn...
Read more >
Set Chrome app and extension policies (Windows)
You can control whether an app or extension is blocked, allowed, or automatically installed on devices. This overrides the ExtensionInstallForcelist policy. In ...
Read more >
Chrome Extensions Message passing
How to pass messages between extensions and content scripts.
Read more >
Add, turn off, or remove extensions in Microsoft Edge
At the prompt showing permissions required by the extension, carefully review the permissions, and then select Add extension if you wish to proceed....
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found