C# application

[Howard Ricketts]

Hi

I continue to struggle with porting a C# extension built for Internet Explorer to Chromium and I keep coming back to the same nagging thought. Why, if I am prepared to provide my C# source code for audit/scrutiny even deployment by the Chromium authorities, why am I being required to port a working C# extension to Javascript/CSS/HTML?'.  I can only assume that the Chromium consortium are all web developers and do not understand the benefits afforded by strongly typed object-oriented languages like C#.  Would Microsoft or any company with a sane IT Director ever consider porting a working C# program to Javascript/CSS/HTML where it could be stolen by anyone with half a brain? I am pretty sure the answer is a resounding 'no'.  I want to licence my product but how is that viable when anyone can simply copy my code and comment out the licencing hooks.  I am not even allowed to obfuscate my code.

I understand the motivation behind driving extension developers towards Javascript/CSS/HTML but surely there has to be some accommodation of code written in other languages that can provide far more sophisticated functionality to users.

[PhistucK]

First, there is nothing against C#, I believe. Plugins (not extensions), written using native code (maybe not C#, but you could have interfaced with it if you wanted, I guess) used to be supported and they were a can of worms, basically, filled with security issues.

Second, it is easier to support a language that is already supported and is interoperable between the platforms.

Third, there are Blazor and maybe Emscripten and maybe other solutions that can transform your C# into either WebAssembly or JavaScript, both of which are legal to publish in extensions, so maybe look at those solutions. It will not be a trivial port anyway (thank ActiveX for that ;)), but it will make it easier as you might be able to use most of your C# code.

☆PhistucK

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/79998f7b-bf6c-49dc-aa99-1702341bc384n%40chromium.org.

[PhistucK]

And regarding C#, unless you took steps against that, decompiling that would have been very easy anyway, so it is not so different from JavaScript code (not only that, I think decompiled C# is easier to read than minified JavaScript).

☆PhistucK

[Howard Ricketts]

Thanks for responding – however I think you are slightly misinformed.  Firstly, using web-assemblies is outlawed in the V3 Manifesto so no joy there (rules out Blazor and Mono and …) I think I read somewhere that minification was also not be allowed in extensions under V3 Manifesto (happy to be corrected). While C# can be decompiled, it most certainly isn’t as easy as clicking on ‘View Source’ and following a few references.  I can see no way of protecting your IPR with code written in Javascript.  Finally, as someone who has been in the IT industry for over 40 years and programmed using virtually every paradigm and language, I can assure you that Javascript, while being very useful for web design, is not as powerful as C# nor any other object oriented programming language - it simply doesn't scale to large or difficult problems involving complex logic and data structures.  Yes you can do it but then I suppose one can empty one's bath with a teaspoon but would you really want to do that?

[hrg...@gmail.com]

Assuming that what you would like to do is to compile your C# program to a native executable, then, yes, it's perfectly possible to have an extension that runs such a native executable. This has always been possible.

In the past this was possible thru the NPAPI and nowadays it's possible thru the Native Messaging API.

There are many extensions in the Web Store that do this. You can write your program in C#, C++, Java or anything you want.

On the other hand, if you want that your C# program, compiled to CIL, runs in the browser somehow... this of course not possible. But given the decades of experience you have, you surely know this already.

[Darbid Darbid]

I hear your pain and frustration. I am a long time, inexperienced, hobby .NET coder that has spent years trying to best automate web browsers. I started with a MSAccess form with the webbrowser object in that form and used VBA and the HTMLDocument to automate a website. I then moved to using .NET and IE11 because microsoft still allowed us to control IE11. All my code was in a .NET executable so it was hidden somewhat from people.  I have decompiled C# and VB.NET and you get pretty nice code, very readable. 

 But even I can agree that what I was doing was not great from a security perspective. All I needed to do was get an .exe file to start up on a persons PC and I could without any permission hook into IE11 and the HTMLDocument.  It was great :-) my colleagues did not have to do anything IT JUST WORKED.  Unfortunately it seems the direction in which all webbrowser owners are going is to hinder people like me as much as possible. The target website has not changed, the tasks my users need to do has not changed but I spend most of my hobby time finding work arounds to problems put in front of me by companies than on actually coming up with and creating new cool features.  I also now spend a lot of time explaining to my colleagues/users all the steps and permission they need to do just to get it working. Most blame me for all the steps they now need to do and say why can't I just install this and use it. IT JUST WORKS is for the likes of Apple and Google, for us developers that use their API's we have a different and much higher standard of hoops to jump through.  Imagine if a permission dialog popped up for each and every time Google did something with respect to a users privacy :-). Of course they cover themselves by having the licensing agreement and privacy policy which no user reads and spends most of their time looking for the OK button.  

Right now I am looking at almost a 100% re-write of my extension so that it meets Google Chromes new policies even though my extension is and will never be publicly available.  For obvious subjective reasons I have started other conversations here suggesting change. I have to accept that if I want to piggy back Google Chromes hard work I need to follow their rules.

So I sympathise with you and know almost exactly what you are going through. If you want a C# plug-in to a publicly available web browser then I think you need to work through the fact that your plug-in is dead. I had to do the same. Once you have worked through this you need to decide if it is worth your time now to rewrite your code somewhere else and assess the risks associated with for example theft of your code in the form of a Chrome extension. 

What does your C# plug-in do? You do not need to expose a technical response, you could simply "sell" it to me/us.

A Chrome extension can have, as someone else has already pointed out a Native Host. Right now for the new manifest Version 3 (V3) that Google has forced through (sorry I mean released after exhaustive testing and developer feedback   :-) sorry I just cannot help myself) it does not work but it hopefully will.  The native host creates a pretty nice IPC to the web browser.  It was in manifest Version 2 (V2) very fast and reliable. Depending on what you are doing it could have a lot of your C# business logic as Google does not get to see or approve the native host.

One benefit of a chrome extension is that Microsoft has finally accepted that IE is dead and now simply re-windows Chrome as their own. So your extension works in Edge Chromium in fact I think you can even download an extension in the Chrome web-store directly in Edge. Firefox is a little more complicated and I have not got my extension working on Firefox, however, this is more because my colleagues do not really use it.

For me I also have an alternative. I only target 1 website so I could create an "app". This seems to be a trend at the moment. For example MSTeams desktop version is simple Chromium web browser wrapped in a Microsoft window.  You would then control 100% the web browser and can do whatever you like.  The Chromium side of this is called CEF and http://cefsharp.github.io/ Cefsharp is your best .NET wrapper which is pretty nice.  Problem is that you then need users to install it and if your plug in is something generally used on the internet it is probably not going gain acceptance.

Hope this helps you to see what direction you would like to go with your ideas and plug-in for the future.

[PhistucK]

> Firstly, using web-assemblies is outlawed in the V3 Manifesto

References?

I know remotely hosted JavaScript, CSS and WebAssembly code is disallowed, but I remember that Simeon called out that (local) WebAssembly code is allowed.

While I would hate to be corrected (but only because it means the platform is too restrictive, not because I want to be right ;)), I would love to see references that allude to that.

> I think I read somewhere that minification was also not be allowed in extensions under V3 Manifesto

That is surely not correct (fortunately!). Minified code is allowed (smaller and with unreadable variable/function names, like Uglify or Closure Compiler do). Obfuscated or encrypted code is definitely not allowed.

And I never tried to argue that JavaScript is better/more powerful than C#/any other language. :)

☆PhistucK

[Howard Ricketts]

Hi PhistucK

Thank you for replying and for pointing out Simeon calling out in an earlier conversation that '(local) WebAssembly' code is allowed - I am new to the forum, is Simeon of the standards committee?  Can I get formal confirmation that this is the case in Manifesto V3.  If it is that will most definitely be my direction of travel.  

In the Overview it states 'A key security improvement in MV3 is that extensions can't load remote code like JavaScript or Wasm files' and also 'Remotely hosted code is no longer allowed; an extension can only execute JavaScript that is included within its package.'   I didn't consider Manifesto V3 might make an exception of WebAssembly code that is provided as part of the extension package i.e. local.

I can confirm that minified code is allowed under V3 - my mistake - and that obfuscated/encrypted code is not allowed.

Thanks, Howard

[PhistucK]

Simeon is part of the Chrome extensions team. I believe he is the developer relations engineer/person. 

☆PhistucK

[Howard Ricketts]

Hi Darbid

I had come to terms with rewriting my extension in Javascript having thought that Web Assemblies would not be allowed going forward (tbc).  As you say 'we are brothers in pain'.

My extension provides a kind of Thesaurus that runs across all web pages (irrespective of source) - you can click on a word and it will give you alternative words/phrases.  And if it doesn't know the word you can add your own entries.   My extension needs a permanent editable file that can be consulted. It provides a pop up so that users can enter new words/terms and it also accepts entries via the Clipboard.  Hardly rocket science but way outside of the mindset that produced Manifesto V3.  I am confident my requirements can be met in Javascript if I dig around enough to find suitable APIs but it isn't straight-forward.  For my IE C# extension I developed 8 classes and referenced 20 DLLs, 3 of which supported licencing - hardly child's play and not well matched by the current list of available extension APIs .

[Darbid Darbid]

Sounds perfect for an extension with native host. Your extension handles the clicking of a word, sends the word back to your native code to do all the work and database lookups and then get your native code to send back the suggestions and have the extension display it. 

I would guess you could keep a lot of your existing code and pretty much all of your business logic and Word databases would remain in compiled code.

[Simeon Vincent]

Why, if I am prepared to provide my C# source code for audit/scrutiny even deployment by the Chromium authorities, why am I being required to port a working C# extension to Javascript/CSS/HTML?

Because IE's Add Ons and Chrome's extensions are completely different platforms. That's similar to saing, "I have a Swift app for iOS that I want to run on Android, why do I have to port it to Kotlin?" Yes, both run on mobile devices / extend web browsers, but they're different systems designed with different constraints, technologies, paradigms, etc.

Chrome's extension platform was a fundamental departure from previous browser extensions/addons in no small part because the Chrome team saw that there were consistently major security issues caused by running machine code in the browser. Rather than build on platform specific models like Internet Explorer's Browser Helper Objects did with COM or trying to adapt such a model like Firefox Addons did XPCOM with models like, Chrome's platform is built on top of web technologies and chose to surface a subset of browser functionality rather than provide deep hooks into the browser.

I am a long time, inexperienced, hobby .NET coder that has spent years trying to best automate web browsers. I started with a MSAccess form with the webbrowser object in that form and used VBA and the HTMLDocument to automate a website

If you haven't yet, you may want to look into ChromeDriver & Selenium WebDriver. Selenium provides a .Net API that you can use to drive Chrome & other web browsers.

Right now I am looking at almost a 100% re-write of my extension so that it meets Google Chromes new policies even though my extension is [not] and will never be publicly available.

 

To be clear, if you are not publishing the extension to the Chrome Web Store you do not need to comply with CWS policies. Depending on the usage scenarios you want to support, loading an unpacked extension or using enterprise policies to force install an extension may be a better route for you.

I know remotely hosted JavaScript, CSS and WebAssembly code is disallowed, but I remember that Simeon called out that (local) WebAssembly code is allowed.

They may be referring to the fact that MV3 extensions cannot currently run Wasm because MV3 does not allow the use of the unsafe-eval or unsafe-wasm-eval CSP directives (crbug.com/1173354). To the best of my knowledge this is a bug, not an intentional limitation of the MV3 platform.

General note on the use of "V3 Manifesto" and  "Manifesto V3"

For clarity, "MV3" or "Manifest V3" refers to the "manifest_version" field in manifest.json, not a manifesto – "a public declaration of policy and aims, especially one issued before an election by a political party or candidate" (Merriam-Webster).

Simeon is part of the Chrome extensions team. I believe he is the developer relations engineer/person. 

Hi! Yep, I'm currently the only Developer Advocate at Google focused on extensions. Actually my title officially changed to "Developer Relations Engineer" but AFAIK that title isn't used elsewhere so I tend to fall back to the thing more people are familiar with. The core extensions DevRel team is me and a tech writer named Andy. Other folks are involved in our work like the extensions PMs & tech leads, but Andy and I are the folks focusing full-time on sharing information with the extension development community.

is Simeon of the standards committee

There is no standards committee for browser extensions. Chrome's extension platform is Chrome feature. Other browsers have adopted Chrome's model and target compatibility with Chrome's platform, but each platform is independent (albeit symbiotic). 

Cheers,

Simeon - @dotproto

Chrome Extensions DevRel

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/1a5cf330-8192-4227-81c8-c3ac15a5a22dn%40chromium.org.

[Darbid Darbid]

 

                    If you haven't yet, you may want to look into ChromeDriver & Selenium WebDriver. Selenium provides a .Net API that you can use to drive Chrome & other web browsers.

Their use case is for testing primarily and not really for normal user automation. Further they are not really set up for finding existing sessions which makes sense as they are primarily for testing.

                  To be clear, if you are not publishing the extension to the Chrome Web Store you do not need to comply with CWS policies. Depending on the usage scenarios you want to support, loading an unpacked extension or using enterprise policies to force install an extension may be a better route for you.

I am open to all the publishing options, but I am not an enterprise nor could I been one.  It is not a private app and otherwise Google has made developer unpacked extension ugly enough and "un user" friendly enough to warn users that it is not a solution to someone using my extension each day.

[Howard Ricketts]

Thank you for all of your responses and suggestions.  I will follow them all up.  I do hope to publish to the Chrome store so will be revisiting Mono with the aim of converting my extension to a Web Assembly but will most likely to convert to Javascript if that proves futile.