Why I disagree with the current policy

To start, let’s look at the pros:

• It removes the risk of malicious extensions being shared via the website.
  

That’s basically it. Now, let’s look at the cons:

• Extensions that are open source, ad-free, safe, have limited permissions and a privacy policy, and are owned by Scratchers you trust can’t be mentioned in the website, no matter how useful they are.
  
• Scratch users can’t share their creations in more advanced programming languages, except for websites, which can only do very limited things in terms of permissions.
  
• Extensions with no permissions can’t be shared, when they can’t do any harm.
  
• A useful comment like “I know you’re color-blind, so I suggest you use a program called f.lux, it lets you tweak colors and you’ll be able to code on Scratch easier” would be against the guidelines - how can you welcome all types of people into the website if you can’t share extensions or programs that make using Scratch more accessible?
  
• It’s a tremendous amount of time wasted for the moderators to remove links to open source, ad-free, safe extensions.
  
• It doesn’t let extension users communicate with extension creators inside the Scratch website without going to an external website, which is against the CGs.
  
• Not being able to share Scratcher-made extensions officially from the scratch website makes it harder to connect the Scratch user and the extension, making it easier for people with malicious intent to impersonate the creator and distribute a dangerous copy.
  

This Policy is Limiting Creativity

I’ll quote myself;

World_Languages wrote:

I personally feel that an extension like this is what the Scratch Team should be promoting. It's an excellent way of getting into programming in other languages, and it really perfectly captures what programming is all about: solving problems in automated and creative ways. Surely this is what Scratch is aimed to be, the first step of a staircase leading into programming. People are more likely to experiment with things close to them (like how many people are learning HTML/CSS through Inspect Element), and if Scratch actively promotes making extensions, more people are likely to learn languages such as JavaScript to be able to do cool things with the website outside the realm of Scratch.

Why I Believe the Current Policy Won’t Work

• It generates spam, anger and hate. This means more work for the scratch moderators.
  
• The line between talking about an extension, mentioning it, linking to it, or advertising it is unclear.
  
• Most people who know about the rule disagree with it. Who will report things that are against the policy?
  
• Streisand effect: It actually makes people talk more about extensions - when you block something entirely, people have to react, and they inadvertently advertise extensions even more.
  

This also makes me remember the FNAF ban, when some replicas of the game were banned - people who disagreed, would spam everywhere asking you to revert the rule, and not actually report FNAF replicas. However, in that situation, most people actually understood the situation and started reporting them.

Here, I’m seeing, from the people that stated their point of view in the forum topic, that most actually don’t like the rule, for whatever reason. And only extension users found the rule - with some exceptions. If the only people that know about the rule, like extensions and use them, I’m not sure who the ST expects to report mentions to extensions.

A proposition

• Nothing with autoupdate would be allowed, at least at first. Userscripts can easily be set to not autoupdate, and are much easier to moderate.
  
• Userscripts that are being advertised that collect information need to fill out a form that explains how it works and what information it collects, and send this to the ST. The creator of the userscript also must mandate that users read this before it collects any information (preferably in layman's terms), as well as sending this to the ST.
  
• Userscripts without a backend can be advertised freely, as long as they are open source, and the information above is sent to the ST in some way. If they are visibly malicious, Scratchers can report them, and all you need to do is alert them and ban said or extension in it’s noncompliant state. Scripts cannot be invisibly malicious because of the lack of outward requests.
  
• Userscripts with a backend or any requests to other sources require acceptance by the ST or an appointed trusted user in order to be advertised, and a reason must be stated in a form for each data point collected. Obviously, not following this can warrant whatever you want (although I don’t think having your head in the sand is punishable here).
  
• Userscripts can’t require permissions that they don’t use or aren’t actually necessary in the current release. This is so that the user also knows why they’re granting something when they do it.
  

That's it. What do you think?

    
if <(World_Languages) = [Awesome ]> then
    
go to [His profile v]
end
if <not <(World_Languages) = [Awesome]>> then
set [World_Languages v] to [Awesome ]

    
end


when I start as a clone
BE AWESOME

I have to admit that I actually agree on all of this. I do believe a change must be done.

I agree with all of this. A change should be made.

[I helped edit this]

Somebody should make a website that holds a list of all Scratch extensions.

Err, I think this would be solved a lot easier if a 13+ age restriction and privacy policies were put on extensions, Therefore prohibiting unknowledgable downloading…. +1 Regardless….

Support! Also, if the ST doesn't want to spend time moderating, there can just be a filter-bot!

AmazingMech2418 wrote:

there can just be a filter-bot

For what?

littlebene wrote:

AmazingMech2418 wrote:

there can just be a filter-bot

For what?

To filter out only bad extensions and userscripts.

AmazingMech2418 wrote:

To filter out only bad extensions and userscripts.

How would that work?

littlebene wrote:

AmazingMech2418 wrote:

To filter out only bad extensions and userscripts.

How would that work?

It wouldn't. Obfuscation is too simple.

-stache- wrote:

It wouldn't. Obfuscation is too simple.

Exactly….

AmazingMech2418 wrote:

var allowedExtensions = [];
function checkExt(name,codesite,downloadsite) {
var datavar;
$.get(codesite,function(data,status){datavar=data;});
// a code idea for code-based filters
if (datavar.search("a dangerous possible code goes here...")===-1) {
// other filters like this would go inside here and the following code would go inside all of them
var website;
$.get(downloadsite,function(data,status){website=data;});
if(website.search(codesite)!==-1) {
allowedExtensions.push(name);
}
}
}

This code should work but may not. If not, just a few changes would be needed. There could then be an auto-moderator that checks to see if the names or websites of the extensions appear and if they aren't in the allowedExtensions array, they will be replaced with the “**” that is used by manual extension moderators now.

This is from my idea for a filter-bot at https://scratch.mit.edu/discuss/topic/284440/.

I AGREEE M8

I completely agree.

I agree.

I don't think that the ST will repeal this, but I certainly am willing to help. I do not like this change at all.

#ExtensionsMatter

littlebene wrote:

Err, I think this would be solved a lot easier if a 13+ age restriction and privacy policies were put on extensions, Therefore prohibiting unknowledgable downloading…. +1 Regardless….

Lol that doesn't work.

pufflegamerz wrote:

Somebody should make a website that holds a list of all Scratch extensions.

I am currently making one, although I won't be able to mention it on Scratch so, it's pretty much useless.

bumpety bump

    
if <(World_Languages) = [Awesome ]> then
    
go to [His profile v]
end
if <not <(World_Languages) = [Awesome]>> then
set [World_Languages v] to [Awesome ]

    
end


when I start as a clone
BE AWESOME