Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

51–60 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#51

Post by zzzcpan »

holmberd wrote: post #37
ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

This is not limited to Chrome extensions. If you build and publish any kind of software, there is a high chance that someone shady will come along and offer you money for it, or to become an "affiliate" partner.

Right. Extensions are just software and no need to pretend they have it worse than apps in app stores.

Re: Browser extensions are underrated: the promise of hackable software

#52

Post by jwatt »

Causality1 wrote: post #40
ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

Personally I just use two browsers. Chrome with no extensions for work and anything involving sensitive data such as logging into my google account, online banking, Amazon, eBay, etc. For everything else I use an old version of Firefox with proper XUL support so I can be comfortable and retain essential functionality during casual browsing.

Presumably you're using an outdated Firefox ESR version with known exploitable holes then? The oldest supported Firefox ESR (60.0) was the first ESR version to enable Quantum and drop support for old-style Mozilla Add-ons.

Re: Browser extensions are underrated: the promise of hackable software

#54

Post by seanwilson »

dessant wrote: post #46
seanwilson wrote: post #30

Earlier quoted context omitted.

> Keep in mind that it's not "Here's some money, please let us roll out an evil update to your extension," it's "Our company loves your extension and would like to acquire it." I get messages like this every now and then for mobile apps and browser extensions I manage and they're painfully obvious to spot. They're often from sketchy looking generic email addresses, have no information about the buying company, don't…

Same, I get an offer every month or so for some of my extensions. One has quoted an offer of $0.25/user for the Firefox version of Search by Image in their introductory email. That kind of money would significantly improve my life, but it's all too obvious what they would do with my users. Most extension developers are not getting any significant income from their work, despite serving millions of users, and unless b…

> Most extension developers are not getting any significant income from their work, despite serving millions of users, and until browser vendors do not start to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers.

Any ideas what specifically could be done to help? You can integrate your own payment systems into extensions and there's some ad vendors that support browser extensions.

Re: Browser extensions are underrated: the promise of hackable software

#55

Post by sp332 »

ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

roll out an update that quietly adds a backdoor.

You can turn off automatic updates on an extension-by-extension basis.

Re: Browser extensions are underrated: the promise of hackable software

#56

Post by luckylion »

seanwilson wrote: post #54
dessant wrote: post #46

Earlier quoted context omitted.

Same, I get an offer every month or so for some of my extensions. One has quoted an offer of $0.25/user for the Firefox version of Search by Image in their introductory email. That kind of money would significantly improve my life, but it's all too obvious what they would do with my users. Most extension developers are not getting any significant income from their work, despite serving millions of users, and unless b…

> Most extension developers are not getting any significant income from their work, despite serving millions of users, and until browser vendors do not start to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers. Any ideas what specifically could be done to help? You can integrate your own payment systems into extensions and there's s…

Make paying for them simple and easy. The app store concept works very well for a reason, a billion individual one-software web stores don't.

Re: Browser extensions are underrated: the promise of hackable software

#57

Post by burtonator »

dessant wrote: post #5
burtonator wrote: post #3

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome for example has a ton of limitations: https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E... If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates. You can't just push a…

I experience the same one week delay with an extension. The publishing delay is always about a week, and that is highly unusual. They state that the extension update is under compliance review, which may take several business days, though the similar approval times indicate that this is actually an arbitrary publishing delay, and that no human review takes place in all cases, otherwise there would be more variation b…

It's always a week AND it's also applied at a week even if you change an image. They don't need to audit an image.

I'm suspicious that they might be doing this for other reasons more likely to punish people for more aggressive permissions.

Re: Browser extensions are underrated: the promise of hackable software

#58

Post by dbandstra »

idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

I think this is a great idea. I maintain a personal extension as well. I've experimented with a few ideas for augmenting browser experience, but so far I'm mostly just hiding obtrusive elements on various websites (mostly by CSS, with some JS where sites obfuscate class names).

Even that would have taken multiple thirdparty extensions to accomplish - and probably would have required giving very broad permissions to them. Worth noting that Stylish, one of the extensions I might have used, was compromised with spyware a few years ago.

As for publishing, I don't publish mine because it forms a kind of personal fingerprint. The more I add to it the more personal it gets. I rather support the idea of everyone having their own custom extension. You can really improve your online quality of life and with the WebExtension API it's pretty painless.

Re: Browser extensions are underrated: the promise of hackable software

#59

Post by hiccuphippo »

idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

I make extensive use of the Tampermonkey (for javascript) and stylus (for css) extensions. I probably don't have access to some of the browser's APIs but it is easier to create and edit scripts with them.

Re: Browser extensions are underrated: the promise of hackable software

#60

Post by dessant »

seanwilson wrote: post #54
dessant wrote: post #46

Earlier quoted context omitted.

Same, I get an offer every month or so for some of my extensions. One has quoted an offer of $0.25/user for the Firefox version of Search by Image in their introductory email. That kind of money would significantly improve my life, but it's all too obvious what they would do with my users. Most extension developers are not getting any significant income from their work, despite serving millions of users, and unless b…

> Most extension developers are not getting any significant income from their work, despite serving millions of users, and until browser vendors do not start to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers. Any ideas what specifically could be done to help? You can integrate your own payment systems into extensions and there's s…

I'm specifically talking about extensions that strive to be free and accessible for everyone.

A great example for how Mozilla is deprioritizing contributions for extension developers is the new design of Firefox Add-ons. The contribution button was pushed down below the fold. Previously it was at a very prominent place next to the install button, and several modes for requesting contributions before or after installation have been deprecated.

Yes, adding a donation button to your extension is a possibility, but it would send a whole different signal if Mozilla would encourage users to support developers, from a unified and trusted user interface, and experiment with better ways to ensure that users are aware of support options for their favourite extensions.

Mozilla directly supporting extensions which they consider to be of great value could also be explored.

Post reply on HN