it looks like the comments are in plaintext. couldn't they be encrypted with the url?
Yes, they can be.
Show HN: A Firefox extension to leave comments on any URL
201–210 of 247 posts
Re: Show HN: A Firefox extension to leave comments on any URL
#202A bookmarklet would be better. It could achieve the same functionality without the security issues of an extension.
Isn't bookmarklet just a script that runs on the context of the current page when you click on that bookmark? If so, the script has all the access to your data. It can steal your auth cookie or some keys from the local storage and send them to some server.
Re: Show HN: A Firefox extension to leave comments on any URL
#203These were generally called metaweb tech when they were popular about 15-20 years ago. The problem was that everyone had to have a particular author's plugin to see the extra content. Some of them were better than others, allowing cross referencing, citation insertion, and a number of other sophisticated features. I don't know if they still are around. Sites like reddit and hn are really inverted versions of this con…
Is solving this "basic problem" ethical? The implied assumption here is that it's a "basic problem" that most sites do not have a readily-discoverable public commentary board. Sites such as Reddit, HN, and Facebook are popular , readily-discoverable public commentary boards about other sites. This much is true. However, it is incorrect to say that the absence of this is a "basic problem" as stated above. Given the pa…
The basic problem is that sites that do have a commentary board control the content; they delete what they don't like.
Re: Show HN: A Firefox extension to leave comments on any URL
#204And I'm sure this won't be used by bad actors at all...
and I'm sure the extension doesn't just send the URL of every page you visit somewhere... EDIT: Oh, it appears to be hashed... that's not as bad as I expected - but it's still extremely abusable. Nope... just nope - absolutely not without some sort of differential privacy or other concealment, thanks.
[deleted]
Re: Show HN: A Firefox extension to leave comments on any URL
#205Earlier quoted context omitted.
Is solving this "basic problem" ethical? The implied assumption here is that it's a "basic problem" that most sites do not have a readily-discoverable public commentary board. Sites such as Reddit, HN, and Facebook are popular , readily-discoverable public commentary boards about other sites. This much is true. However, it is incorrect to say that the absence of this is a "basic problem" as stated above. Given the pa…
No, I agree that this problem has to be solved before this idea can hope to get wide adoption. Mr A posts something really evil on Mr B's facebook page. What happens next? Mr B files a complaint to facebook. Since this is a legal matter, the complaint gets escalated to the top. FB realises that this is out of their control and proceeds with a complaint to FBI. Now what if the data server with that comment is hosted o…
> Right, the browsers will quickly ban this extension.
How is an open source browser going to ban an extension that throngs of people want?
Re: Show HN: A Firefox extension to leave comments on any URL
#206Earlier quoted context omitted.
>Allowing people to make as much noise as they can is almost as damaging to free speech as censorship. The thing is, to see that noise you would first have to be on the specific link, want to see comments on it, then go out of your way to install the addon if you haven't already. This is so much better for the people running the websites as they do not have to even acknowledge the comments' existence and are not obli…
I'd be more concerned about spam than speech I dislike. Is there any kind of rate-limiting to stop bad actors from making a million comments per second?
Not right now. But I'm hoping to come up with an equivalent of captcha that doesn't need 3rd parties. That way any comment will need a few seconds of the commenter's time (not CPU time).
Re: Show HN: A Firefox extension to leave comments on any URL
#207And I'm sure this won't be used by bad actors at all...
Comments under example.com already give a good idea what it will look like when everyone will start posting comments in public places.
Re: Show HN: A Firefox extension to leave comments on any URL
#208Earlier quoted context omitted.
The extension does two things: - It sends sha1 of the url to the data server to check the numebr of comments, but doesn't pull the comments. - It renders an to show the comments. Thus the extension has very little code and doesn't need much updates.
So answer is yes. The database does not sanitize user input and the extension just renders the tags as actual HTML. That doesn't seem super safe. I mean just check the example page from the github. It already has embedded Youtube videos and gifs.
Ah, right, I forgot to add basic html escaping!
Re: Show HN: A Firefox extension to leave comments on any URL
#209A bookmarklet would be better. It could achieve the same functionality without the security issues of an extension.
Isn't bookmarklet just a script that runs on the context of the current page when you click on that bookmark? If so, the script has all the access to your data. It can steal your auth cookie or some keys from the local storage and send them to some server.
A bookmarklet is only invoked when you click it. Not on every fricking website you visit.
And it would just have to be a single line that you can read so you can trust it. Something like:
javascript:location.href='https://discuss.com/'+location.href
To make it more convenient, the bookmarklet could also add the discussion to the current page via an iframe which also has no access to any outside data.
Re: Show HN: A Firefox extension to leave comments on any URL
#210Earlier quoted context omitted.
Isn't bookmarklet just a script that runs on the context of the current page when you click on that bookmark? If so, the script has all the access to your data. It can steal your auth cookie or some keys from the local storage and send them to some server.
A bookmarklet is only invoked when you click it. Not on every fricking website you visit. And it would just have to be a single line that you can read so you can trust it. Something like: javascript:location.href='https://discuss.com/'+location.href That would redirect you to discuss.com where you can discuss your current url without discuss.com having any access to your data. To make it more convenient, the bookmark…
But if you click on it, it will have access to all your data? There is no in between: either no access until you click or full access when you click.
This can be done already:
javascript:location.href='https://comntr.github.io/#'+location.href