Anti-censorship Chrome extension removed for custom minification
Новости расширения · Issue #10 · anticensority/runet-censorship-bypass

          🔥 Расширение удалили за минификацию кода не по стандарту (ВОССТАНОВЛЕНО!)
Extension Was Deleted For Custom Minification Techniques (RESTORED!)
25.08.2019

RESTORED / ВОССТАНОВЛЕНО (25.08.2019)
Our extension was restored in the WebStore without any code modifications from our side!
Наше расширение восстановлено в WebStore без каких-либо модификаций кода с нашей стороны!
About Extension's Inner Workings
The extension downloads and applies external PAC-script compressed by custom minification from https://antizapret.prostovpn.org/proxy.pac. The worst thing PAC-script may do with your browser is to make it block or proxy URLs that you don't expect to be proxied (however extension's permission imply such behavior possible and not prohibited). It also may throw exceptions which may be handled by the extension. UPD: It also may leak data via DNS queries.
In English
From the letter below it's clear that Google doesn't like code obfuscation or concealing extension functionality.
The extension is open sourced and there are only two places that may be interpreted as obfuscation:

Webpack bundling (assembling one output js-file from many) for the popup window of the extension without any minification (sources).
Percent Hex-encoding of host names of our proxy servers to prevent simple copy-pasting of them for usage out of our solutions (sources).

I make a conclusion that our extension was removed because of custom minification techniques employed in an external PAC-script "Antizapret" (https://antizapret.prostovpn.org, https://antizapret.prostovpn.org/proxy.pac). As the author says:

It's optimized and minified as much as possible to comply with 1 MB file limit in Chrome and Windows WinInet API: https://bugs.chromium.org/p/chromium/issues/detail?id=678022.

IMPORTANT UPD: The PAC-script is compressed mainly to stay working for use cases that don't imply chromium extensions (non-chromium browsers, chromium with flag --proxy-pac-url, Windows system settings, etc.). In Chromium extensions there is a working workaround that we use.
One antivirus company already blocked this file in the past but then we had a chance to report a false-positive and explain how our techniques work.
We replied to Google, that our PAC-script can't work without custom minificaiton in many browsers and asked to reconsider their decision.
По-русски
Из письма ниже ясно, что Google не нравится обфускация (скрытие функциональности через усложнение/шифрование/сжатие кода).
Исходники расширения открыты и там есть только два намёка на обфускацию:

Сборка через webpack одного js-файла из нескольких без минификации для popup-меню расширения (исходники).
Процент Hex-кодирование доменных имён прокси-серверов, чтобы их просто не использовали вне наших решений через копивставку. Это кодирование тривиально, и это просто мелочь. Исходники.

Я делаю вывод, что расширение удалено из-за техник сжатия, применяемых в PAC-скрипте «Антизапрет» (https://antizapret.prostovpn.org, https://antizapret.prostovpn.org/proxy.pac). Как пишет сам автор:

Скрипт оптимизирован и минифицирован как только можно, чтобы не превысить лимит в 1 МБ для Chrome и Windows WinInet API: https://bugs.chromium.org/p/chromium/issues/detail?id=678022.

К этому файлу уже придирались антивирусы, но тогда нам дали возможность ответить и объяснить, что этот файл сжат, а не обфусцирован.
Мы указали Google, что PAC-скрипт не может работать без сжатия во многих браузерах и попросили пересмотреть своё решение.
Что делать?

Вы можете использовать другой способ установить себе решение «Антизапрет»: https://antizapret.prostovpn.org.
Наше расширение можно установить из zip-архива, который можно скачать здесь: https://github.com/anticensority/runet-censorship-bypass/releases (найдите последнюю версию, автоматическое обновление работать не будет). Или вот, mini-версию расширения пока не удалили.
Если вас это не устраивает, изучите список альтернативных решений (не ставьте fast proxy).
Ну, и просто боритесь с этой властью другими путями. Можно также записать любимые видео на флешку для бабушкиной ТВ-приставки и объяснить, что происходит.

Email From Google / Письмо от Google

Dear Developer,
We have reviewed your item, "Runet Censorship Bypass," with ID: npgcnondjocldhldegnakemclmfkngch and it does not comply with our program policies. Please review this section of our policy:
Developers must not obfuscate code or conceal functionality of their extension. This also applies to any external code or resource fetched by the extension package.
Your item was found to have one or more files that does not comply with this policy.
Please note that minification is allowed in the following forms:
Removal of whitespace, newlines, code comments, and block delimiters
Shortening of variable and function names
Collapsing the number of JavaScript files
For more information, please review these recommended minification techniques for Google Developers.
Once you have made the compliant changes you may submit and publish a new draft in the developer dashboard. Your draft will be reviewed for policy compliance, which typically takes a few business days. If the outcome of the review is successful, your store listing will remain published. If we find additional issues with your item, we will send you another email with details. If you have any questions about this email, please respond and the Chrome Web Store developer support team will follow up with you.
Thank you for your cooperation.
Google Chrome Web Store team

Reply From The Author of The Minified PAC-Script "Antizapret" / Ответ автора «Антизапрета»

Hello, I'm the administrator of AntiZapret anti-censorship service which this extension uses.
The PAC file which is loaded from the extension (https://antizapret.prostovpn.org/proxy.pac) is not encrypted or obfuscated. It's optimized and minified as much as possible to comply with 1 MB file limit in Chrome and Windows WinInet API: https://bugs.chromium.org/p/chromium/issues/detail?id=678022
The IP addresses contained in the file are compressed into base36, and domain name zones (.com, .net etc) are replaced with single digit equivalent.
Without this optimizations script exceeds 1 MB limit and refuses to work correctly in Chrome and Chromium-based browsers, also in Windows software which uses WinInet API.
The file contains only IP addresses and domain names blocked in Russia by Russian government. This list is official and I did not add any other domain names which are not blocked. You can get the list of blocked resources using one of the following links:
https://reestr.rublacklist.net/
https://antizapret.info/
https://github.com/zapret-info/z-i
The script itself is not obfuscated and/or encrypted, and it contains comments to understand what it does and how it works.

P.S. I didn't find comments in proxy.pac to understand how it works.
UPD: Found some comments in the end of the PAC-script.
Publications / Публикации

https://twitter.com/ilyaigpetrov/status/1165559175121911808 (en)
https://twitter.com/ilyaigpetrov/status/1165561175771373568 (ru)
https://news.ycombinator.com/item?id=20792195 (en)
https://www.reddit.com/r/javascript/comments/cv85kt/google_removes_anticensorship_chrome_extension/ (en)
https://groups.google.com/a/chromium.org/forum/#!topic/chromium-extensions/Ny2UR9bGO-0 (en)

      