Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

91–100 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#91

Post by bradknowles »

scarface74 wrote: post #76
chipperyman573 wrote: post #69

Earlier quoted context omitted.

The ad blocking changes also prevented blocking the request to the ad servers, which is what people were upset about (or at least, why I was upset). I don't remember seeing anyone be upset about anything related to browsing history.

No one was upset about a plug in not getting access to your browsing history. People were upset about the declarative ad blocking that took away some of the features that they ad blockers previously had and said Google was doing it to protect their business. I’m not going to defend Google’s overall business practices, but from what I understand, it’s the same type of architecture that Apple has had for four years and…

With respect, Google is not Apple, and Apple is not Google.

I think a lot of people would say that Google is a pretty evil company in many respects, whereas Apple isn't exactly 100% saintly, but at least their profit and business goals align more closely with what is generally considered to be good for customers.

Re: Browser extensions are underrated: the promise of hackable software

#92

Post by scarface74 »

gildas wrote: post #85
scarface74 wrote: post #76

Earlier quoted context omitted.

No one was upset about a plug in not getting access to your browsing history. People were upset about the declarative ad blocking that took away some of the features that they ad blockers previously had and said Google was doing it to protect their business. I’m not going to defend Google’s overall business practices, but from what I understand, it’s the same type of architecture that Apple has had for four years and…

Some also claim that Google kills innovation. Synchronous interception of requests allows developers to program sophisticated rules to fight malicious resources. In the future, they will only have a regular expressions list to block domains. It will be much easier for malicious actors to bypass this feature.

It also allows developers to intercept your entire browsing history. If you care about your privacy, why would you let a random third party intercept all of your browsing history?

Re: Browser extensions are underrated: the promise of hackable software

#93

Post by bradknowles »

gildas wrote: post #85
scarface74 wrote: post #76

Earlier quoted context omitted.

No one was upset about a plug in not getting access to your browsing history. People were upset about the declarative ad blocking that took away some of the features that they ad blockers previously had and said Google was doing it to protect their business. I’m not going to defend Google’s overall business practices, but from what I understand, it’s the same type of architecture that Apple has had for four years and…

Some also claim that Google kills innovation. Synchronous interception of requests allows developers to program sophisticated rules to fight malicious resources. In the future, they will only have a regular expressions list to block domains. It will be much easier for malicious actors to bypass this feature.

I want whitelist-only. No blacklists, unless that's something to be applied after the whitelisting step.

So, no -- Google's method is not sufficient.

Re: Browser extensions are underrated: the promise of hackable software

#94

Post by modzu »

filoleg wrote: post #67
modzu wrote: post #31

Earlier quoted context omitted.

at least in firefox, updates typically roll out immediately while any manual review happens asynchronously

While I disagree with the 1-week review times that google imposes, doesn't the firefox approach defeat the purpose of the review in the first place? While async review is better than no review, if someone pushed a malicious update and it got caught in the async review a few days later, the damage has already been done. Just a trade-off to think about.

its a tradeoff for sure; i tend to think the risk of unpatched software outweighs the risk of software hijacked from the author, so i prefer the moz model. iirc, there are automatic checks (ie permission changes, certain api calls, etc) which trigger a manual review before publishing. that said even the manual review is no guarantee malicious software doesnt get published (from my experience the reviewers are not always experts)

Re: Browser extensions are underrated: the promise of hackable software

#95

Post by scarface74 »

chipperyman573 wrote: post #89
scarface74 wrote: post #79

Earlier quoted context omitted.

That’s worked well for Safari for four years.

It's worked well on safari because most of its users are people who don't care about those limits. Traditionally safari has been a relatively closed ecosystem (I haven't used it in a long time but I remember an entire lack of support for extensions at one point), so the people who would care about these changes never used it to begin with. So now, when safari comes in with these changes that only add value compared t…

Safari had plugins from day one. As far as I know. Here is an early plug in from 2010 ( https://www.cultofmac.com/47232/macheist-tweaks-gruber-with-...)

But speaking of “closed”, where is the ad blocking extension for Chrome on Android and embedded web views?

Re: Browser extensions are underrated: the promise of hackable software

#96

Post by bradknowles »

dnate wrote: post #68
burtonator wrote: post #3

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome for example has a ton of limitations: https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E... If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates. You can't just push a…

That has been the reality for the Apple AppStore for many years. Seems to not have hurt them. And Chrome has a much larger market share (or browser share) than iOS has. As long as you have that, you can pretty much do whatever you like to the devs as long as you don't piss off the users

Oh? How many billions of users are on Chrome?

Re: Browser extensions are underrated: the promise of hackable software

#97

Post by mehrdadn »

zeta0134 wrote: post #70
idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

You can work around this by running Firefox Developer, which is able to disable Mozilla's signing requirements. That edition of the browser actually respects xpinstall.signatures.required, so just toggle that, zip your extension, rename to .xpi, and install. It'll warn you once, proceed, and persist through browser restarts just like any other extension. Obviously that's no help if you want to distribute the extensio…

I think unbranded builds work too. https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...

Re: Browser extensions are underrated: the promise of hackable software

#98

Post by ocdtrekkie »

On the contrary: Browser extensions are horribly overrated. They're a massive security problem (the number one place malware is found on a computer) often for the benefit of replacing the word "cloud" with "butt". They are rarely adequately audited or restricted and have far more access to private data than anyone generally realizes.

Re: Browser extensions are underrated: the promise of hackable software

#99

Post by chipperyman573 »

scarface74 wrote: post #95
chipperyman573 wrote: post #89

Earlier quoted context omitted.

It's worked well on safari because most of its users are people who don't care about those limits. Traditionally safari has been a relatively closed ecosystem (I haven't used it in a long time but I remember an entire lack of support for extensions at one point), so the people who would care about these changes never used it to begin with. So now, when safari comes in with these changes that only add value compared t…

Safari had plugins from day one. As far as I know. Here is an early plug in from 2010 ( https://www.cultofmac.com/47232/macheist-tweaks-gruber-with-... ) But speaking of “closed”, where is the ad blocking extension for Chrome on Android and embedded web views?

It's nowhere, which is the point. I bet if they were to add manifest V3 (the thing people are upset about) to chrome for Android, it would be received much more positively than this.

Re: Browser extensions are underrated: the promise of hackable software

#100

Post by scarface74 »

wutbrodo wrote: post #90
scarface74 wrote: post #15

Earlier quoted context omitted.

Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.

I feel like having a big scary warning would be sufficient instead of making it inconvenient. It's easy for a competent user to ignore a warning that they fully understand while it scares off those that are clueless.

People ignore warnings - they have since the dawn of personal computers. You remember Vista UAC?

Why optimize for the 1% instead of the 99%?

Post reply on HN