Can't install external extension

[edwada]

Description

Google is now using Chrome Store censorship to stop extensions designed to facilitate exchange of information between users, one example of this is their removal of the Dissent extension by Gab, we need an easy way to install external extensions

Steps to Reproduce

1. Git clone https://github.com/gab-ai-inc/gab-dissenter-extension/
2. Turn developer mode on and load the unpacked extension from /build/chrome directory
3. Pack the extension to create the .crx file
4. Remove the dissenter extension and try to install it from the generated .crx file

Actual result:

When installing the packaged extension a message saying "This extension is not listed in the Brave Web Store and may have been added without your knowledge." appears and it's not possible to enable the extension

I didn't find any "Brave Web Store" so I'm assuming this message originally meant the Chrome Web Store but the "Chrome" was replaced by "Brave"

Expected result:

It should be possible to install the packaged extension without enabling developer mode and without it being listed on the Chrome web store, fail to do so makes Google's censorship of their Web Store effective on Brave as well

Reproduces how often:

Easily reproduced

Brave version (brave://version info)

Brave	1.33.106 Chromium: 96.0.4664.110 (Official Build) (64-bit)
Revision	d5ef0e8214bc14c9b5bbf69a1515e431394c62a6-refs/branch-heads/4664@{#1283}
OS	Windows 10 Version 20H2 (Build 19042.1415)
JavaScript	V8 9.6.180.21
User agent	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
Command Line	"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --disable-client-side-phishing-detection --disable-domain-reliability --enable-dom-distiller --no-pings --component-updater=url-source=https://go-updater.brave.com/extensions --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --sync-url=https://sync-v2.brave.com/v2 --lso-url=https://no-thanks.invalid --variations-server-url=https://variations.brave.com/seed --enable-features=WebUIDarkMode,PrefetchPrivacyChanges,PasswordImport,ReducedReferrerGranularity,LegacyTLSEnforced,AutoupgradeMixedContent,WinrtGeolocationImplementation,SafetyTip --disable-features=AppDiscoveryRemoteUrlSearch,Fledge,ReadLater,AutofillEnableAccountWalletStorage,IdleDetection,ComputePressure,AdInterestGroupAPI,CopyLinkToText,FirstPartySets,InterestCohortAPIOriginTrial,InterestCohortFeaturePolicy,ReportAllJavaScriptFrameworks,Prerender2,SpeculationRulesPrefetchProxy,ConversionMeasurement,InterestGroupStorage,TextFragmentAnchor,DirectSockets,TrustTokens,Parakeet,AutofillServerCommunication,TabGroupsFeedback,WebSQLInThirdPartyContextEnabled,NavigatorPluginsFixed,SignedExchangeSubresourcePrefetch,NotificationTriggers,WebOTP,LiveCaption,FederatedLearningOfCohorts,NetworkTimeServiceQuerying,SubresourceWebBundles,HandwritingRecognitionWebPlatformApiFinch,FlocIdComputedEventLogging --flag-switches-begin --flag-switches-end
Executable Path	C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
Profile Path	C:\Users\Eduar\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default
Variations	AdRewardsStudy:NextPaymentDayAdServingStudy:MaximumAdNotificationsPerDay=100/MaximumInlineContentAdsPerHour=8/MaximumInlineContentAdsPerDay=40BraveAds.FrequencyCappingStudy:ExcludeAdIfWithinTimeWindow=0hBraveAds.UserActivityStudy:Triggers=EMPTY/Threshold=0.0/IdleTimeThreshold=5ConversionsStudy:NewDefaultPatternDefault1pBlockingStudy:DisabledEphemeralStorageStudy:EnabledNativeCosmeticFilteringStudy:EnabledPartitionConnectionsByNetworkIsolationKeyStudy:EnabledPermissionLifetimeReleaseStudy:EnabledRequestAdsEnabledApiStudy:EnabledSpeedreaderReleaseStudy:Enabled

[crimsdings]

i was able to reproduce the same with another extensions https://github.com/puemos/hls-downloader/releases -

unable to enable - https://developer.chrome.com/docs/extensions/mv3/external_extensions/#registry is not a proper solution for this

[LanceTrahan]

unable to enable - https://developer.chrome.com/docs/extensions/mv3/external_extensions/ is not a proper solution for this

I was running into this as well on Mac. The listed workaround no longer works because Chrome is trying to force extensions to be hosted through them (which they can arbitrarily reject).

This message is now present in the prescribed link:

Brave really needs a solution for this as the field of "allowed" extensions continues to narrow daily. Honestly though, since Dissenter has all but been abandoned, having that functionality as a built-in feature in Brave would be really cool. Could be a way for the Brave community to interact with each other through shared commentary on sites that regularly keep their content from being commented on.

[edwada]

Dissenter has been abandoned but the fact remains it's still open source and the servers still work, there are still people who believe in the idea of dissenter so other than the extension censorship, nothing stops us from reviving dissenter or making our own Dissenter like extensions.

I don't believe this functionality should be part of Brave, it should be an extension so it can be added to any chrome-based browsers, in fact, ideally, all chrome based browsers should come from a censorship free fork of chrome.

[LanceTrahan]

I don't believe this functionality should be part of Brave, it should be an extension so it can be added to any chrome-based browsers, in fact, ideally, all chrome based browsers should come from a censorship free fork of chrome.

The comment was more of a passing thought. This isn't the place for feature requests. I think we agree though that currently users can't load external extensions using the currently described workarounds and should be resolved.

[J0s3f]

I have the same problem when installing https://gitlab.com/magnolia1234/bypass-paywalls-chrome-clean/ I installed Firefox as second browser and might just use it as main browser in the future. Sad, because I like brave, but limiting extensions to those google allows is nothing I can live with. And using two browsers in parallel like I did the last few days also isn't that comfortable.

[Renari]

Same issue here, recently one of the extensions I was using got removed from the webstore, the dev posted a zip which allowed me to pack a crx myself, but I cannot install it on Windows.

[kevineduardo]

Same issue here, it's a shame, but that will make me leave Brave for good.

[IzK666]

I wanted to use Brave, because I heard very good opinions, but the impossibility to install a custom crx file that is not from G store mades me discard Brave as a valid browser for me.

[lazymonkey2]

a CRX is just a ZIP file. Just extract the files and load them as an unpacked extension.

[crimsdings]

It should be possible to install the packaged extension without enabling developer mode and without it being listed on the Chrome web store, fail to do so makes Google's censorship of their Web Store effective on Brave as well

please read the ticket again

[xenstar]

Please allow to install custom CRX file. Updating manually extension is hard.

[macbugs]

• Background information -- excerpt from official Brave documentation:

  "Linux users can install an unsigned extension by simply enabling Developer mode on the Brave://extensions page, and dragging the .crx file onto the page directly."

-- I submit that the same functionality should be supported on Mac OS & Microsoft Windows (and this issue should be labeled accordingly for those platforms.)

• I recommend that the title of this issue be changed to "Support installation of [.crx] extension image by drag & drop", to increase the probability that others with the same issue will find this topic more easily in the course of a search, because this is how it is described in the official documentation.

• As mentioned in a previous post, an extension developer has provided an alternative installation method for Brave on other platforms (and the template can be modified for other extensions where the developer does not provide one), but I do not consider that method acceptable for the ordinary user because it is unnecessarily complex:

"In extension developer mode you can always install BPC by Load unpacked (latest master, but no automatic updates) or by crx-file (latest release & automatic updates, but possibly you have to add the extension to the allowlist)."

@J0s3f indicates that this did not work, but the [.crx] with allow-list install method works for me on Windows & Mac OS, so if it did not work before, you should try it again. (Technically speaking, you can install a [.crx] through drag & drop, but cannot enable it without creating the allow-list and restarting the browser... and that issue has already been fixed on Opera / Vivaldi / Yandex browsers.)

CRX-file: [add extension to allow list for Chrome, MS Edge or Brave]

---

• Rationale / Use cases

This is not merely a convenience for the developer (or a business which might have occasion to deploy custom extensions) — it is also necessary for the end user because the Chrome extension store prohibits some extensions purely for the sake of protecting Google’s advertising monopoly. For example, some video download extensions are prohibited because forcing the user to replay a video on YouTube results in more ad impressions — but this restriction is unfair to viewers on slow or metered connections with a data cap who might need to replay a long lecture multiple times in an academic setting. I realize that profit is ‘priority one’, and Google does not care about the challenges which the ordinary user must confront in rural areas (or countries with primitive infrastructure & draconian censorship policies.) But other companies do, and Brave should as well:

If Brave will not permit the user to add custom extension repositories through the browser GUI, then they need to support the Linux 'drag & drop' installation method on Windows & Mac OS too. I also think that Brave would benefit from deploying its own auxiliary extension store. If the store only hosted wrongfully-blacklisted extensions which dont qualify as malware, then it would not generate a lot of traffic and hosting would not be prohibitively expensive.

[macbugs]

@Renari wrote:

Same issue here, recently one of the extensions I was using got removed from the webstore, the dev posted a zip which allowed me to pack a crx myself, but I cannot install it on Windows.

I think the 👀 reaction you got from that post is begging the question of why it was removed from the Chrome store. I recall one case where a legitimate (and popular) extension was sold to another developer for a lot of money and the new developer added some spying code that leaked personal information, so the user of a banned or blacklisted extension is obligated to perform some research and determine the reason for its removal. But Google will not help you there because they do not want to disclose the reason for censoring extensions. If the same extension is still available in the official Firefox repository, and the link to the developer's site is the same, then the Firefox extension store might be a source of more information regarding the status & validity of the extension. However, what we really need is an extension firewall within the browser that would notify the user when extensions transmit information (instead of just modifying web page contents), so if that occurs when it is not expected, the user would be aware of it.

[Pointing8422]

+1 to this. In Linux it's fixed, but in Windows it doesn't. There are a lot of extensions not available in Chrome Web Store for the Manifest v3. My main is LibRedirect. Ublock Origin full version will not be available next year. If this continue, I will probably have to change to Firefox or Ungoogled Chromium permanently.

[bsclifton]

cc: @rebron for help prioritizing

[macbugs]

@Pointing8422

My main is LibRedirect.

Yes, this is another example of an extension which can bypass regional YouTube barriers, but Google does not allow it in the Chrome store because it also prevents tracking.

Ublock Origin full version will not be available next year.

What is the source of this information? (And what does Ublock accomplish which Brave Shields does not?)

I will probably have to change to Firefox

I do not consider Firefox a realistic option because it has become increasingly unstable, especially when private browsing mode is used to test various things with extensions disabled. The UI sometimes becomes partially-unresponsive, or behaves erratically, and it sometimes loses sessions… but Brave seems very stable.

[bayazidbh]

And what does Ublock accomplish which Brave Shields does not?

I haven't heard about the uBlock Origin full/separate version, other than general rumbling of what's happening around Manifest V3 and how AdGuard has a lot of limitations they need to work around to even have something functional for Manifest V3.

But I think a few important things that uBlock does that so far Brave Shields doesn't, right now, is sync-able settings & filters (I heard that's coming in next stable upgrade?), more granular blocking and allowing, and element zapper which is useful when something gets past the normal filters but you don't want to add it to filter list for whatever reason (for example, I often zap sticky headerbars).

I think Firefox's making some good strides as far as their PC browser goes, but it's mobile that's making me stay with Brave. Brave has the right mix of being powerful and easy to use as well as working right out of the box. Some people probably care less about their mobile browsers being the same as their PC browser than me, though.

[lazymonkey2]

And what does Ublock accomplish which Brave Shields does not?

brave shields doesn't support procedural filtering, so it blocks less ads than ublock origin.

[ghost]

I have the same problem when installing https://gitlab.com/magnolia1234/bypass-paywalls-chrome-clean/ I installed Firefox as second browser and might just use it as main browser in the future. Sad, because I like brave, but limiting extensions to those google allows is nothing I can live with. And using two browsers in parallel like I did the last few days also isn't that comfortable.

@J0s3f They have shown a method at https://gitlab.com/magnolia1234/bypass-paywalls-chrome-clean/-/tree/master/allowlist to add extension to allowlist in windows, mac, linux and I have tried that method works on my macOS. Haven't tried that on windows and linux. That is the only way i managed to use auto updating crx extension.

More References:

• https://github.com/younesaassila/ttv-lol-pro/issues/39

[AdnanHodzic]

I had this same problem kn MacOS with Bypass Paywall extension, and on Linux it would just get automatically removed after awhile. How I managed to get it installed on both Linux and MacOS:

1. Download source code as a ZIP file from GitHub releases.

2. Unzip the file and you should have a folder named bypass-paywalls-chrome-master-$version.

3. In Brave go to the extensions page (brave://extensions)

4. Enable Developer Mode toggle in the upper right.

5. Click LOAD UNPACKED upper left side.

6. Find bypass-paywalls-chrome-chrome-$version in the step 2 unzip destination folder (do not delete the folder afterwards).

[ghost]

any update on installing extension via CRX file?

[dsiminiuk]

And here is another scenario where users on Windows (and maybe other platforms) are hosed. I installed the latest version of a bookmark extension from the webstore and it had a bug. The previous version without the bug is no longer available on the Chrome Webstore and I can't load the crx file for the previous version into the Dev mode page.

Please fix this ASAP. I'm stuck until the extension developer fixes the bug and publishes the next version.

[kevineduardo]

I'm almost a year waiting. Nothing new here.

[dsiminiuk]

@kevineduardo It's almost like they want you to move to another browser.

[ghost]

yeah this is very painful. like enabling developer mode should auto approve extensions, assuming developer mode is for those who know what they are doing

[Fred-IV]

So still no solution? I understand google wanting to screw all users, and block everything that they don't control form their web store, but that's why we're using Brave!!! Enabling Dev Mode is enough to load the crx, but then there's no way to enable it. Brave needs to fix this. It literally goes against their purpose for existing. If not, then why are we not just using Chrome?

AntiCaptcha automatic captcha solver Off This extension is not listed in the Web Store and may have been added without your knowledge. Learn more Description This plugin allows you to automatically solve CAPTCHAs found on any webpage. Version 0.63 Size 1.2 MB ID lncaoejhfdpcafpkkcddpjnhnodcajfg

EDIT:

OK, found a solution. What I said above still goes. Why would Brave allow you to load a crx, then not be able to use it? I downloaded the zipped version, and at least that works. so, I guess crx files are unusable.

[ghost]

sadly installing extension via zip file is the only option at this moment, the reason we want CRX support is it enables auto updating extension, whereas in zip there won't be any auto updating.

A relatively new chromium based browser Arc Browser has no issue with installing crx extensions, It even allows creating custom extensions using a thing called boosts in browser itself which is very interesting and enables developers to experiment and make the web browsing experience more personalised.

Brave team should learn from them and enable developers while keeping all the security and privacy instead of limiting the way upstream chromium set it to be, especially when manifest v3 will be enforced people will be looking to move from google chrome and users will not like being limited by the browser on the extensions a user can install.

[ghost]

If I were the Brave team, I'd wait until Chrome starts enforcing MV3 and then announce Brave's own extension store a few days later to take advantage of the news cycle. At least I hope that's what they're doing!

[edwada]

The problem is though, Brave has betrayed its users by forcing them to dox themselves to collect their BATs, there's no coming back from this, Brave is no better than Chrome and cannot be trusted, I don't think they will ever fix this issue because it's not in their interest.

[ghost]

Did they advertise that you could remain anonymous to collect awards?

I've also read that private money transfers would be against the law for them.

I trust them plenty and every claim I've seen against Brave has been unfounded. In cases where a mistake was made, it was fixed and some people still act like they tried to con users. In this case, it's completely unfounded as far as I can see.

This is a very small team working with code that has 35 million lines, which dwarfs the size of the Linux kernel when you deduct all the driver code. I'm not saying I know what will happen in this particular case of extension sources. They may disallow certain things for security reasons just like they do with the File System API. In that case I wish they would have just enabled it for PWAs at least.

[arjpar]

Any update on this issue? Vivaldi allows users to install extensions (CRX) via drag & drop on the extension page.

[I-I-IT]

Not fixed. You can still sideload with a extension file, but no auto-updates. A possible solution is available, but it involves tinkering with your machine settings. https://gitlab.com/magnolia1234/bypass-paywalls-chrome-clean/-/blob/master/allowlist/README.md

[arjpar]

Not fixed. You can still sideload with a extension file, but no auto-updates. A possible solution is available, but it involves tinkering with your machine settings. https://gitlab.com/magnolia1234/bypass-paywalls-chrome-clean/-/blob/master/allowlist/README.md

Yup, I saw that already; activating a policy will make Chromium/Brave be considered managed and can disable some settings from being changed (IIRC the only one I remember is forcing https).

I think allowing people to sideload extensions from CRX would be great to differentiate it from most other Chromium browsers. Vivaldi allows you to sideload CRX extensions, Firefox also allows you to sideload XPI extensions -- both with autoupdate IIRC.

[Chiramisu]

If money is an issue, I'd even pay a small subscription to cover hosting costs for extensions from a dedicated Brave Webstore. To further save cost, you could limit it to extensions that have been censored by Google.

Sadly, Dissenter died several years ago with their last release in 2019, and the domain changing ownership some time between Sep 2 and Oct 11, 2023 (according to archive.org).