Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

61–70 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#61

Post by PeterisP »

agumonkey wrote: post #43
ohazi wrote: post #27

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update…

What about a review service ? N peers => signed extension.

For any number of N, it's far easier to get N positive verifications by trusted peers for a crook (which can buy or fake them) than for a honest small developer.

Re: Browser extensions are underrated: the promise of hackable software

#62

Post by chipperyman573 »

scarface74 wrote: post #15
idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.

That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-us...

Re: Browser extensions are underrated: the promise of hackable software

#63

Post by scarface74 »

chipperyman573 wrote: post #62
scarface74 wrote: post #15

Earlier quoted context omitted.

Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.

That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-us...

I’m the last person who is going to defend the security architecture of browser plugins.

But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.

Re: Browser extensions are underrated: the promise of hackable software

#64

Post by Endy »

eitland wrote: post #11
Endy wrote: post #6

Browser extensions are being underrated deliberately by browser developers. Ever since we lost XUL Firefox, anyone who wants to really do anything worth doing around a web browser should have already switched to Pale Moon. Doubly so with Google's Manifest v3, which is going to kill selective content download management.

Even as much as I want my old Firefox extensions back I reaaly don't feel I can trust a small bunch of developers to keep something as complicated as the old Firefox patched in this day and age. Am I wrong?

As far as my user experience is concerned, yes, you're wrong, and that's okay - you're working from opinion & I'm speaking from personal experience only. I've had no security breaches of my PC since I switched to Pale Moon. I've also had an overall better experience than with any multi-process software of any kind. I understand your concern, but all I can say is, try it out. Keep it sandboxed (as you should with all port-accessing software tbh) if you don't trust it. If you have cause for a genuine security complaint, then say so. But please do recognize the target audience for PM before asking about introducing the latest tech widget or WebDRM.

Re: Browser extensions are underrated: the promise of hackable software

#65

Post by cmroanirgo »

scarface74 wrote: post #15
idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.

I've been on both sides of the fence in this one, and agree with both arguments. Perhaps FF could add (if it doesn't have it already) an about:config setting that allows reloads, perhaps from a specific folder(s).

Re: Browser extensions are underrated: the promise of hackable software

#66

Post by ignoramous »

Extensions can be uninstalled, revoked, disabled at will. Can't really bend BigTech to do your biding, and that trumps whatever the security argument brings to the table, imo. Extensions should be done in a security friendly way [0], and not the other way around of making software secure by disabling all extensibility [1].

Take the example of the Android ecosystem: If plugins were allowed for apps, pretty sure there'd be a better story around privacy today. An astonishing 40% of connections from an Oppo/Vivo or Xiaomi phones are to ad networks and trackers. And there's nothing you could do (without root) except to firewall it (apps have started working around pi-hole esque setups). XposedMod has brought plugin based development to Android [2], but it is niche and requires not just root, but replacing key framework components. Using it might still be worth it, though, given the relentlessness of OEMs and carriers.

And that's just sad.

[0] One way to tackle the problem of developers selling away rights to their extensions is to legally make it binding to publicly declare whenever ownership changes hands. Disable extensions across all installs, and let the users enable after the fact is made obvious to them.

[1] https://www.eff.org/deeplinks/2019/06/adversarial-interopera...

[2] https://www.xda-developers.com/best-xposed-modules/

Re: Browser extensions are underrated: the promise of hackable software

#67

Post by filoleg »

modzu wrote: post #31
burtonator wrote: post #3

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome for example has a ton of limitations: https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E... If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates. You can't just push a…

at least in firefox, updates typically roll out immediately while any manual review happens asynchronously

While I disagree with the 1-week review times that google imposes, doesn't the firefox approach defeat the purpose of the review in the first place?

While async review is better than no review, if someone pushed a malicious update and it got caught in the async review a few days later, the damage has already been done. Just a trade-off to think about.

Re: Browser extensions are underrated: the promise of hackable software

#68

Post by dnate »

burtonator wrote: post #3

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome for example has a ton of limitations: https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E... If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates. You can't just push a…

That has been the reality for the Apple AppStore for many years. Seems to not have hurt them. And Chrome has a much larger market share (or browser share) than iOS has.

As long as you have that, you can pretty much do whatever you like to the devs as long as you don't piss off the users

Re: Browser extensions are underrated: the promise of hackable software

#69

Post by chipperyman573 »

scarface74 wrote: post #63
chipperyman573 wrote: post #62

Earlier quoted context omitted.

That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-us...

I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.

The ad blocking changes also prevented blocking the request to the ad servers, which is what people were upset about (or at least, why I was upset). I don't remember seeing anyone be upset about anything related to browsing history.

Re: Browser extensions are underrated: the promise of hackable software

#70

Post by zeta0134 »

idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

You can work around this by running Firefox Developer, which is able to disable Mozilla's signing requirements. That edition of the browser actually respects xpinstall.signatures.required, so just toggle that, zip your extension, rename to .xpi, and install. It'll warn you once, proceed, and persist through browser restarts just like any other extension.

Obviously that's no help if you want to distribute the extension (we have to jump through hoops at our organization to push out a manifest) but for personal use I find it to be a good workaround.

Post reply on HN