Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

31–40 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#31

Post by modzu »

burtonator wrote: post #3

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome for example has a ton of limitations: https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E... If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates. You can't just push a…

at least in firefox, updates typically roll out immediately while any manual review happens asynchronously

Re: Browser extensions are underrated: the promise of hackable software

#33

Post by pvg »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

Raymond Hill (uBlock Origin)

It's uBlock Origin because the uBlock name itself got taken over by swindlers. So even well-intentioned actors aren't immune to this kind of abuse.

Re: Browser extensions are underrated: the promise of hackable software

#34

Post by modzu »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

these same risks exist with any app. totally agree its a valid concern and deserves more than a footnote, but i don't think that counters anything that the author is praising about extensions specifically.

at least extensions exist within an ecosystem where they are subject to manual review and approval / removal. and in terms of updates, any changes to the permissions show a prompt to the user as though they were newly installed

Re: Browser extensions are underrated: the promise of hackable software

#35

Post by weaksauce »

eitland wrote: post #11
Endy wrote: post #6

Browser extensions are being underrated deliberately by browser developers. Ever since we lost XUL Firefox, anyone who wants to really do anything worth doing around a web browser should have already switched to Pale Moon. Doubly so with Google's Manifest v3, which is going to kill selective content download management.

Even as much as I want my old Firefox extensions back I reaaly don't feel I can trust a small bunch of developers to keep something as complicated as the old Firefox patched in this day and age. Am I wrong?

not even a little bit. the advances that were made in multi-process firefox and reducing memory usage and speeding up firefox are all on the backs of webextensions existing. it freed up the developers from having to worry that some internal api getting changed will break the extensions. it simply had to go.

Re: Browser extensions are underrated: the promise of hackable software

#37

Post by holmberd »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

This is not limited to Chrome extensions. If you build and publish any kind of software, there is a high chance that someone shady will come along and offer you money for it, or to become an "affiliate" partner.

Re: Browser extensions are underrated: the promise of hackable software

#39

Post by ohazi »

modzu wrote: post #34
ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

these same risks exist with any app. totally agree its a valid concern and deserves more than a footnote, but i don't think that counters anything that the author is praising about extensions specifically. at least extensions exist within an ecosystem where they are subject to manual review and approval / removal. and in terms of updates, any changes to the permissions show a prompt to the user as though they were ne…

Manual review doesn't work. The volume is too high, and subtle trickery is too easy.

To first order, there is no permissions model for browser extensions. You should assume that an extension can see and do everything that your browser can see and do.

This is also a huge problem with mobile apps, but the problem is at least acknowledged, and there's some degree of permissions and sandboxing, even though it's not completely effective, and even though most apps ask for every single permission anyway. But in general, yes, you should take a similar approach to mobile apps, and only use the minimal set that you absolutely can't live without. Don't install games or stupid shit. We already know that basically every weather app on Android contains malware.

This is also a problem in free-for-all developer library ecosystems like npm, as we keep seeing. Popular dependencies get taken over or sold and then all of a sudden lots of servers are running malware.

Software may be eating the world, but it's really important to know what software you're actually running. You can't just build a house of cards and hope for the best.

Re: Browser extensions are underrated: the promise of hackable software

#40

Post by Causality1 »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

Personally I just use two browsers. Chrome with no extensions for work and anything involving sensitive data such as logging into my google account, online banking, Amazon, eBay, etc. For everything else I use an old version of Firefox with proper XUL support so I can be comfortable and retain essential functionality during casual browsing.
Post reply on HN