[Answered] Why does v2.11 for Chrome require new permissions?

PawKanarek commented 2 months ago

Version 2.11 published on Google Chrome requires new permissions.

Read and change your browsing history on all your signed-in devices
Display notifications
Read and change your bookmarks
Read and modify data that you copy and paste
View and manage your tab groups

~This seems suspicious because the last version tagged on GitHub is 1.99.995: https://github.com/gdh1995/vimium-c/releases/tag/v1.99.995. It looks like someone hacked into the marketplace and uploaded malicious software.~

link to store: https://chromewebstore.google.com/detail/hfjbmagddngcpeloejdejnfgbamkjaeg

davidmickelsen commented 2 months ago

I share @PawKanarek's concerns. The permissions being requested seem excessive.

gradypark86 commented 2 months ago

The latest in release notes is v2.11.1, I think the author knows about this version.

https://github.com/gdh1995/vimium-c/blob/4d3e2d716cf49de717f68a6e756c7ae2fa1f7e39/RELEASE-NOTES.md?plain=1#L7-L14

gdh1995 commented 2 months ago

Hello all. Firstly, don't worry - this version 2.11 is indeed made by myself, gdh1995@qq.com .

This v2.xxx is "necessary" if Vimium C wants to keep accessible on Chrome Web Store, because Chrome 127+ will deprecate Manifest V2 (Vimium C v1.xxx uses it) and in months Google will remove Manifest V2 support from Chrome.

Those permissions are not a new thing. In fact, Vimium C v1.xxx also require most of them.

The only new things are:

tabGroups (to keep group relations during 'moveTab' and so on)
some inner permissions like 'offscreen' (to execute access to clipboard, detect system color theme (dark/light) and so on)

Others are necessary for most of frequent commands:

modify clipboard ('autoCopy' writes clipboard)
read clipboard (openCopiedUrlInNeeTab)
read history (Vomnibar searches in it)
modify history (if Shift+Delete on Vomnibar)
notification (version-upgraded msg only)
read bookmark (Vomnibar)
change bookmark (addBookmark uses it; no commands will delete any bookmark)

gdh1995 commented 2 months ago

As for the version number of 2.11, it's because:

Firefox doesn't support a prefix '0' or tail '0', like '2.0x'
2.2 "sometimes" looks like bigger than 2.12

so, a "easy-to-use-and-understand" version should begin from x.11

---Original--- From: @.> Date: Wed, Jul 17, 2024 04:00 AM To: @.>; Cc: @.***>; Subject: [gdh1995/vimium-c] Version 2.11 from Chrome Marketplace requires newpermissions (Issue #1169)

Version 2.11 published on Google Chrome requires new permissions. Read and change your browsing history on all your signed-in devices Display notifications Read and change your bookmarks Read and modify data that you copy and paste View and manage your tab groups
This seems suspicious because the last version tagged on GitHub is 1.99.995: https://github.com/gdh1995/vimium-c/releases/tag/v1.99.995. It looks like someone hacked into the marketplace and uploaded malicious software.

link to store: https://chromewebstore.google.com/detail/hfjbmagddngcpeloejdejnfgbamkjaeg

image.png (view on web)

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you are subscribed to this thread.Message ID: @.***>

theherk commented 2 months ago

Thank you for the clarification @gdh1995. I'm sure many will arrive here seeking the same information, since the extension is disabled until reenabling.

PawKanarek commented 2 months ago

Thank you for explanation, closing :)

davidmickelsen commented 2 months ago

Thank you for this explanation, gdh1995.

gdh1995 commented 2 months ago

Sorry but I want to keep this issue open, so there's a bigger chance for new users to notice it

riotrah commented 2 months ago

How about pinning this issue? Also, thanks for your response, appreciate it!

gdh1995 commented 2 months ago

there're at most 3 pinned issues allowed. I need some time to consider about which one to replace

---Original--- From: "Rayat @.> Date: Fri, Jul 19, 2024 13:21 PM To: @.>; Cc: "Dahan @.>;"State @.>; Subject: Re: [gdh1995/vimium-c] [Answered] Why does v2.11 from Chrome WebStore require new permissions? (Issue #1169)

How about pinning this issue? Also, thanks for your response, appreciate it!

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you modified the open/close state.Message ID: @.***>

gdh1995 / vimium-c

[Answered] Why does v2.11 for Chrome require new permissions? #1169