Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

71–80 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#71

Post by octosphere »

ignoramous wrote: post #66

Extensions can be uninstalled, revoked, disabled at will. Can't really bend BigTech to do your biding, and that trumps whatever the security argument brings to the table, imo. Extensions should be done in a security friendly way [0], and not the other way around of making software secure by disabling all extensibility [1]. Take the example of the Android ecosystem: If plugins were allowed for apps, pretty sure there'…

Sometimes I like to inspect the code of existing addons to look for malicious code. My first sweep is regexing through the code for any URLs which means checking for (http?s://) and the next step is looking for any code that is deliberately obfuscated.

Re: Browser extensions are underrated: the promise of hackable software

#72

Post by fwip »

seanwilson wrote: post #54
dessant wrote: post #46

Earlier quoted context omitted.

Same, I get an offer every month or so for some of my extensions. One has quoted an offer of $0.25/user for the Firefox version of Search by Image in their introductory email. That kind of money would significantly improve my life, but it's all too obvious what they would do with my users. Most extension developers are not getting any significant income from their work, despite serving millions of users, and unless b…

> Most extension developers are not getting any significant income from their work, despite serving millions of users, and until browser vendors do not start to recognize the value of that labor and provide better tools for sponsoring developers, we will continue to be vulnerable to such offers. Any ideas what specifically could be done to help? You can integrate your own payment systems into extensions and there's s…

Google could pay developers for popular extensions.

The money doesn't have to come directly from the users.

Re: Browser extensions are underrated: the promise of hackable software

#73

Post by TeMPOraL »

scarface74 wrote: post #15
idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.

Adds friction. Ideally user-made extensions should be more trusted and easier to work with than Internet-sourced ones. I can understand that in practice, if user can make something, the user can also be convinced by an attacker to selfpwn through, but we ought to accept some level of that risk.

Re: Browser extensions are underrated: the promise of hackable software

#74

Post by paulryanrogers »

apsanz wrote: post #47
gnicholas wrote: post #21

Browser extensions are also really important for accessibility. People with many kinds of disabilities use extensions to make websites more readable, easier to navigate, or more accessible in other ways. Unfortunately, the big mobile browsers do not support extensions, which is a huge blow to accessibility. I think Firefox for Android is the only mainstream-ish browser that supports extensions. Apple prevents them fr…

Which specific extensions work well? My wife is visually impaired and she has tried a several extensions. All of them have cause more problems than they have solved. In addition, IE and firefox's attempts to change behavior when using windows high contrast mode also breaks many sites. Safari is the browser that works the most reliably.

"Dark Background and Light Text" for Firefox has worked for me. Some necessary background images are still invisible, though I chalk those up to bad implementions.

Re: Browser extensions are underrated: the promise of hackable software

#75

Post by TeMPOraL »

scarface74 wrote: post #63
chipperyman573 wrote: post #62

Earlier quoted context omitted.

That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-us...

I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.

Not sure if you're talking about the recent Chrome drama, but if so, "geeks were up in arms" because the new architecture essentially neutered ad blockers through the limits imposed on the block lists.

Re: Browser extensions are underrated: the promise of hackable software

#76

Post by scarface74 »

chipperyman573 wrote: post #69
scarface74 wrote: post #63

Earlier quoted context omitted.

I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.

The ad blocking changes also prevented blocking the request to the ad servers, which is what people were upset about (or at least, why I was upset). I don't remember seeing anyone be upset about anything related to browsing history.

No one was upset about a plug in not getting access to your browsing history. People were upset about the declarative ad blocking that took away some of the features that they ad blockers previously had and said Google was doing it to protect their business.

I’m not going to defend Google’s overall business practices, but from what I understand, it’s the same type of architecture that Apple has had for four years and no one said Apple’s intentions were nefarious.

Re: Browser extensions are underrated: the promise of hackable software

#77

Post by TeMPOraL »

hiccuphippo wrote: post #59
idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

I make extensive use of the Tampermonkey (for javascript) and stylus (for css) extensions. I probably don't have access to some of the browser's APIs but it is easier to create and edit scripts with them.

Seconded. Both of those plugins are excellent for end-user improvements, because they let you simply add code to be run on a given site or set of sites. No nonsense with packaging and building and programming environments; you can just write the code you need in the browser, as you need it.

Re: Browser extensions are underrated: the promise of hackable software

#78

Post by scarface74 »

TeMPOraL wrote: post #73
scarface74 wrote: post #15

Earlier quoted context omitted.

Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.

Adds friction. Ideally user-made extensions should be more trusted and easier to work with than Internet-sourced ones. I can understand that in practice, if user can make something, the user can also be convinced by an attacker to selfpwn through, but we ought to accept some level of that risk.

Why is adding friction for advanced cases a bad thing? How is the browser suppose to know whether the user wrote the extension or downloaded it from the internet?

We already see what happens when users download extensions and toolbars willy nilly.

Re: Browser extensions are underrated: the promise of hackable software

#79

Post by scarface74 »

TeMPOraL wrote: post #75
scarface74 wrote: post #63

Earlier quoted context omitted.

I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.

Not sure if you're talking about the recent Chrome drama, but if so, "geeks were up in arms" because the new architecture essentially neutered ad blockers through the limits imposed on the block lists.

That’s worked well for Safari for four years.
Post reply on HN