dideler / toggle-youtube-comments

:cinema: :zipper_mouth_face: Chrome extension to hide or show YouTube comments
https://chrome.google.com/webstore/detail/toggle-youtube-comments/ampjnmipdgicjjidohpkidhghakoidfm
MIT License
14 stars 2 forks source link

Follow Chrome's security enhancement #42

Open 1natsu172 opened 6 years ago

1natsu172 commented 6 years ago

Chrome extension security enhancement was announced.

https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html

I think that it is probably okay with respect to permissions, external resources and JavaScript obfuscation. Just a 2-step verification may be troubling?

It may be necessary to wait for a second announce on the handling of 2-step verification of the group publisher account. We need to do when things need to happen.

dideler commented 6 years ago

Thanks for the report @1natsu172 🙇

I'm worried about

New code readability requirements Starting today, Chrome Web Store will no longer allow extensions with obfuscated code. This includes code within the extension package as well as any external code or resource fetched from the web. This policy applies immediately to all new extension submissions. Existing extensions with obfuscated code can continue to submit updates over the next 90 days, but will be removed from the Chrome Web Store in early January if not compliant.

Ordinary minification, on the other hand, typically speeds up code execution as it reduces code size, and is much more straightforward to review. Thus, minification will still be allowed, including the following techniques:

  • Removal of whitespace, newlines, code comments, and block delimiters
  • Shortening of variable and function names
  • Collapsing the number of JavaScript files

[https://developers.google.com/speed/docs/insights/MinifyResources]

Hopefully it's not an issue for us since our code is minified and not obfuscated.

I've posted a question about the 2FA on their forum: https://groups.google.com/a/chromium.org/forum/#!topic/chromium-extensions/wLQ3Wg1ir0E

1natsu172 commented 6 years ago

If you have an extension in the store with obfuscated code, please review our updated content policies as well as our recommended minification techniques for Google Developers, and submit a new compliant version before January 1st, 2019.

Use of uglify-js is recommended for linking "recommend minification techniques".

We are using uglify-es. This is the es2015 version of uglify-js. So I think that there is no problem. "uglify-" is a compression tool and not an obfuscation… 🤔

In case warnings are issued from the chrome web store, we probably can avoid disabling this mangle option.

https://github.com/dideler/toggle-youtube-comments/blob/b6245d4c20604736c3698c36f65667d01023f3fd/tasks/compress.js#L30


I've posted a question about the 2FA on their forum:

Thanks for the posted. đź‘Ť Let's wait for a good answer.