Why does this require access to all my tabs?

[dmnd]

Recently this extension was updated to require more permissions than I think is necessary. Accessing all tabs sounds much scarier than accessing just amazon.com. This has prevented me from upgrading until I looked at the source. It also makes it much harder to recommend the extension.

[dmnd]

It looks like it was added in 29ae3eeecd2d95a1f019eed3fc2685adcc413e9f. What's the purpose of that change? Is it really worth the additional permissions that are required?

[jchubber]

@dmnd I believe there is no choice, but if you can find a way to make it work without that permission, I'm sure @Jdhaimson would welcome a pull request. The "tab" permission is the one which creates that sentence "Access your tabs and browsing activity". My guess is that the reason they're asking for the "tab" permission is in order to access the URL for the tab. If the extension cannot access the URL for the tab then it cannot identify when the url is www.amazon.com and change it to smile.amazon.com, which is the whole point of this extension (of course). Here's the write-up on the "tabs" permission: https://developer.chrome.com/extensions/tabs

Again, if you think you can get it to work without that extension, I'd love to see the solution. If that isn't possible, then I'd suggest @Jdhaimson close this issue.

[jchubber]

Actually after reading 29ae3ee I'm realizing I may have been a bit hasty in my reply... @Jdhaimson Maybe you can clarify what's going on in that commit?

[dmnd]

@jchubber I think you noticed this, but just to confirm, the extension was working fine for months previous to this changeset. Unless I didn't notice it break. That screenshot I showed only popped up when it tried to update itself.

[jchubber]

Yup. I didn't realize you were pointing to a recent commit.

On Tue, Jul 8, 2014 at 4:03 PM, Desmond Brand notifications@github.com wrote:

@jchubber https://github.com/jchubber I think you noticed this, but just to confirm, the extension was working fine for months previous to this changeset. Unless I didn't notice it break. That screenshot I showed only popped up when it tried to update itself.

— Reply to this email directly or view it on GitHub https://github.com/Jdhaimson/smilealways/issues/10#issuecomment-48392783 .

[Jdhaimson]

@jchubber is spot on. I needed those permissions to be able to update the toggle switch in the page action on the correct tab.

I just removed those permissions and the toggle switch due to the overwhelming backlash I got from asking for those permissions. Fixing the small amount of cases where it was useful is not worth ignoring legitimate privacy concerns.

That being said, if anyone knows of a way of implementing a toggle switch that doesn't require those permissions, please let me know! I also welcome any pull requests for ways to improve the extension.

[dmnd]

Are you sure you even needed that permission? The docs say:

The majority of the chrome.tabs API can be used without declaring any permission. However, the "tabs" permission is required in order to populate the url, title, and favIconUrl properties of Tab.

It seems to me you wanted to use those functions on the pageAction and not necessarily on the Tab. I think you wanted to change the icon of the pageAction and not the icon of the Tab?

I haven't actually tried this though and am probably misinterpreting the docs.

Either way, thanks for your work on this @Jdhaimson! A lot of us at Khan Academy recommend it to people because it's a great way to (reliably) get ongoing donations :moneybag: