New Permissions Requested with v1.0.0

[kenyarmosh]

Thanks for this great extension. It should be a default approach by Trello.

It looks like the latest update is prompting new permission requests. Did the extension always require "Read your browsing history" as a permission? This doesn't seem necessary?

https://www.dropbox.com/s/5i7acieaxe9sgjd/Screenshot%202016-06-13%2022.54.33.png?dl=0

[Bastes]

Indeed, that permission is kind of a turn-off for me and I don't see what it's for.

[MikePulcini]

I would also like to know about this. I'm very hesitant to re-enable the extension.

[ashokfernandez]

Me too, doesn't seem necessary for what looks like a simple CSS injection

[jeffschuler]

Ditto.

[xandermathews]

fellow creeped-out user here. I read/tested the source and checked the google API docs.

TL;DR Permission is not needed and should be removed; API docs implied it was required but was poorly worded. The Chrome-specific code in github up through today (bc0d863637) is not using that permission. (I tested by cloning the code and mucking about.)

more detail For 1.0.0, author switched how the plugin targets trello URLs:

• old: manifest style. (all css was always injected on all trello URLs)
• new: background.js and options.js (because author also added ability to turn on/off certain parts of the plugin, the old paradigm is incompatible with that idea.)

API docs make it easy to assume that this new permission is required to read the new tab's URL, but my testing causes me to interpret the docs as: that perm is only required to mutate the relevant fields.

my testing shows plugin works just fine with Intelliot's pull request about removing the offending perm

[kenyarmosh]

This has been fixed in the latest update to only read data off of trello.com.

[xandermathews]

@ChuckJHardy, are you planning in pushing that update to github?

[ChuckJHardyGA]

@xandermathews Indeed, as soon as I have time. If you have anything to contribute code wise please do.

[xandermathews]

@ChuckJHardy if you've got a fix, and Intelliot's PR is a fix, there was never a reason for me to write code for this task.

(and I wouldn't spend code-time on my idea for fixing the unrelated issue 6 without a chat about it.)

[ChuckJHardyGA]

@xandermathews Thanks for your help :)

The two main issues reported where:

1. Permissions (Intelliot's PR is a fix)
2. Speed (moving from CSS inject to JS creates a lag)

I could merge Intelliot's fix without pushing to the Play Store and anyone who wants to use the Extension can manually load it.

[xandermathews]

there was a noticeable lag from that switch-over? Hmm, preserving speed and the new configurability is an interesting quandary.

But today's question is more specific: is there code uncommited, or is Kenyarmosh's comment a result of you doing only a rollback?

[ChuckJHardyGA]

@xandermathews Rollback