Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

21–30 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#21

Post by gnicholas »

Browser extensions are also really important for accessibility. People with many kinds of disabilities use extensions to make websites more readable, easier to navigate, or more accessible in other ways.

Unfortunately, the big mobile browsers do not support extensions, which is a huge blow to accessibility. I think Firefox for Android is the only mainstream-ish browser that supports extensions. Apple prevents them from doing the same on iOS because it would be considered "an app store within an app", which is forbidden.

The only thing Apple allows is action and share extensions, which have to be manually activated on every single page (2-3 taps to do so — which is super user-unfriendly, esp. for PWD). It's great that Apple does a lot for accessibility in general, but I really wish they would open things up a bit more so that users could customize the iOS experience to make it more accessible.

As a dev, I would be more than happy to have my code scrutinized even further in order to ensure that what we're doing doesn't create security, privacy, or performance issues. We'd just like to make our accessibility software as useful for folks on mobile as it is on desktop!

Re: Browser extensions are underrated: the promise of hackable software

#24

Post by ggurgone »

seanwilson wrote: post #20
ggurgone wrote: post #17

Earlier quoted context omitted.

ah sweet, so the extension is hosted on the Chrome Web Store but you manage payments and licenses with paddle?

That's right. This gives more flexibility like selling a license that works on Firefox + Chrome, and selling team based licenses. I wouldn't be surprised if Google killed Chrome store payments in the future as well - I pretty much never hear mentions or updates about it. I wouldn't want to lose all my subscribers if that happened.

Makes perfectly sense. Thank you for the tips!

Re: Browser extensions are underrated: the promise of hackable software

#25

Post by Wowfunhappy »

danShumway wrote: post #19
idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

I believe Firefox Dev edition allows you to disable the signing requirement[0]. I do wish the requirements around signing were less stringent, but I'm fine using Dev Edition as a daily driver for now. [0]: https://support.mozilla.org/en-US/kb/add-on-signing-in-firef...

But then you're using the beta channel instead of the stable channel. It's great that you're fine with that, but everyone shouldn't have to.

At the absolute least, Mozilla should make Unbranded auto-update.

Re: Browser extensions are underrated: the promise of hackable software

#26

Post by nodja »

idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

Aside of your cookie extension, the other 3 could probably have been done with userscripts. I often find a missing feature in a website that I add with userscripts. There's also user created userscripts for several websites, like a webcomic reader that preloads pages from several webcomic websites so you don't have to wait on the slow ones.

Re: Browser extensions are underrated: the promise of hackable software

#27

Post by ohazi »

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software.

The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update that quietly adds a backdoor.

There's at least some publicly documented evidence that Raymond Hill (uBlock Origin) isn't likely to cave to this sort of pressure, but do you really believe that none of the other authors of your fifteen favorite extensions would look the other way for $100k?

Keep in mind that these offers don't look like "Here's some money, please let us roll out an evil update to your extension." They look like "Our company has a product with a similar name. We love your extension and would like to offer to acquire it from you so that we can use the name. We'll even let you keep the rights to your software so that you can re-release it under a different name if you'd like!" They'll make it really easy for the developer to remain in denial about what they're actually facilitating.

Re: Browser extensions are underrated: the promise of hackable software

#28

Post by kevingadd »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

Worse still, the design of the most popular extension API is intrinsically poor at protecting users from malicious extension developers (or extension resale to malicious developers). Until Google and Mozilla fix the design people shouldn't be installing more than a handful of extensions, because they end up usually having complete access to all your data for convenience reasons.

Re: Browser extensions are underrated: the promise of hackable software

#29

Post by saurik »

I gave a highly related talk in 2010 called "Even Software Should Have Screws" at TEDxAmericanRiviera, based on my background working in the iOS jailbreaking community, where I maintained a software ecosystem similar to browser extensions, but for apps and system software.

https://youtu.be/ReKCp9K_Jqw

Re: Browser extensions are underrated: the promise of hackable software

#30

Post by seanwilson »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

> Keep in mind that it's not "Here's some money, please let us roll out an evil update to your extension," it's "Our company loves your extension and would like to acquire it."

I get messages like this every now and then for mobile apps and browser extensions I manage and they're painfully obvious to spot.

They're often from sketchy looking generic email addresses, have no information about the buying company, don't even attempt to demonstrate knowledge of the app, and most importantly mention nothing about how they plan to grow the app.

It's always just "would you like to sell?" and "how many users do you have?".

A recent one:

> From: *@gmail.com

> My name is John.

> I have noticed your google extension "https://checkbot.io/ Checkbot: SEO, Web Speed & Security Tester ", its looks interesting would you considering to sell it?

> Best regards

I've had more elaborate ones but they're always generic with no obvious business interest in the specific app they're asking to buy.

Post reply on HN