Let's guess what Google requires in 14 days or they kill our extension
Uh, yikes:<p>&gt; <i>As I looked at the permissions and what our extension actually needs to operate, I noticed a great opportunity to reduce our permissions requests. We do not need to request access to data on <a href="https:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*&#x2F;*</a> and <a href="http:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*&#x2F;*</a>. Instead, we can simply request data access for <a href="https:&#x2F;&#x2F;*.pushbullet.com&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*.pushbullet.com&#x2F;*</a>, <a href="http:&#x2F;&#x2F;*.pushbullet.com&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;*.pushbullet.com&#x2F;*</a>, and <a href="http:&#x2F;&#x2F;localhost&#x2F;*" rel="nofollow">http:&#x2F;&#x2F;localhost&#x2F;*</a>. This is a huge reduction in the private data our extension could theoretically access. A big win!</i><p>While I agree with the larger part about the lack of transparency of what they want you to fix, this is an amazingly huge oversight, and the fact that the extension review process got an established, popular extension to go &quot;Wait, we don&#x27;t actually need to request access to every website ever&quot; is a point <i>in favor</i> of the review process - and, unfortunately, a (weak) argument in favor of the review process taking the attitude that they get lots of crap and don&#x27;t have the time to explain to all the authors of crap what they&#x27;re doing wrong. How did the extension ever ask for this <i>in the first place</i>?<p>Also why do you need <a href="http:&#x2F;&#x2F;localhost&#x2F;" rel="nofollow">http:&#x2F;&#x2F;localhost&#x2F;</a>? Is the extension running a web server on localhost with native code? If so, can you use the specific mechanism&#x2F;permission for communicating with native code via a subprocess (because it turns out communicating with a web server on localhost is very hard to do securely)? If not, what&#x27;s it for?<p>I&#x27;m sympathetic to the broader argument here, but given the provided information, all of this is consistent with an extension that <i>should</i> be kicked off the app store within 14 days.<p>(Among other things, if you have an approved extension with <a href="https:&#x2F;&#x2F;*&#x2F;*" rel="nofollow">https:&#x2F;&#x2F;*&#x2F;*</a> permissions and active users, malware authors will offer to buy your extension for a very high price. So it&#x27;s definitely in the public interest to make sure there are as few of those as possible and that they&#x27;re only in the hands of people who have the ability to understand why the friendly person offering them way too much money for their extension isn&#x27;t just being nice.)