Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

151–160 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#151

Post by mikekchar »

Here's an opinion that is likely to be controversial: I like Gnome Shell for exactly the same reason. To be fair, it's something like 7 years since I used it, so maybe things have changed a lot. I ended up abandoning it because I don't like Gnome in general (I want something significantly more light weight). But I loved the idea that I could completely change the way my window manager worked by writing a surprisingly small amount of JS. Not only that, but it had (I hope still has) hooks into mutter, so you could do anything you want to the compositter as well. For example, one of the things I did was to have windows that zoomed the contents when I resized them rather than increasing the size of area in the window -- I did it because I have terrible vision and virtually every time I want a bigger window it's because I want it magnified.

I just noticed Xlambda which was featured very recently on HN: https://news.ycombinator.com/item?id=20316920 I wonder if there is compositor I could talk to as well... compton doesn't do the kinds of things I want to do...

Re: Browser extensions are underrated: the promise of hackable software

#152

Post by mycall »

zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

500ms to start but like flash, download site in 20s before anything but splash screen.

Re: Browser extensions are underrated: the promise of hackable software

#153

Post by ignoramous »

on_and_off wrote: post #132
ignoramous wrote: post #66

Extensions can be uninstalled, revoked, disabled at will. Can't really bend BigTech to do your biding, and that trumps whatever the security argument brings to the table, imo. Extensions should be done in a security friendly way [0], and not the other way around of making software secure by disabling all extensibility [1]. Take the example of the Android ecosystem: If plugins were allowed for apps, pretty sure there'…

> If plugins were allowed for apps, pretty sure there'd be a better story around privacy today . Honest question : Can you expand on how this would work please? If anything, extensions as in chrome extensions is something I try to avoid as much as possible : giving access to all of my data to a third party extension promising that is going to increase my privacy but that I need to trust 100% with a complete access is…

> Honest question : Can you expand on how this would work please?

Such a thing is already possible today. Some require root, some require breaking PlayStore's terms of use.

One such example is: XPrivacyLua [0] by the creator of NetGuard. It helps fake location data, hide contacts and calendar, fake device-id, IMEI, MAC addresses etc on a per-app basis.

Another example is how VPN in Android [1][2] is widely used to block trackers and ads.

A third example would be how the accessibility service APIs are (ab)used to temporary grant permissions to apps [3].

A fourth would be reversing engineering tools like Frida [4] that help with inspecting apps, and even change their behaviour.

A fifth is repackaging APKs with advertisement and tracking code removed, like with YouTube [5].

I am attempting to build an app with most of these features combined in to one, lets see how far I get. My aim is probably to build something as close as possible to uMatrix/uBlockOrigin but without requiring root.

---

[0] https://github.com/M66B/XPrivacyLua/blob/master/README.md

[1] https://github.com/M66B/NetGuard

[2] https://github.com/blokadaorg/blokada

[3] Sam Ruston's Bouncer app: https://samruston.co.uk/

[4] https://securitygrind.com/bypassing-android-ssl-pinning-with...

[5] https://youtubevanced.com/

Re: Browser extensions are underrated: the promise of hackable software

#154

Post by idoubtit »

hiccuphippo wrote: post #59
idoubtit wrote: post #4

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One tha…

I make extensive use of the Tampermonkey (for javascript) and stylus (for css) extensions. I probably don't have access to some of the browser's APIs but it is easier to create and edit scripts with them.

The irony is that I ported two of my old user scripts to web extensions. With old Opera, userJS was native, while TamperMonky is a (big) web extension. I had performance problems with TamperMonkey, so I rewrote my scripts to avoid this layer.

Pros of TamperMonkey/userJS:

- Allows live editing (with syntax highlighting) with immediate refresh, all in the browser. This is handy for minor changes on small files, but slow for big files.

- Direct access to some HTML5 APIs that are restricted in extensions. I don't recall if that was the case with TamperMonkey, but OperaJS allowed plain AJAX and WebStorage usage, just as if the file was included in the web page.

Cons:

- Slower than extensions.

- Less powerful (cannot add a button in a browser bar, etc)

- Painful as code grows. An extension allows simple splitting of code into several files. I found UserJS harder to maintain.

- Cannot load JS _and CSS_ like an extension does. Another extension like Stylus is needed.

Re: Browser extensions are underrated: the promise of hackable software

#155

Post by jackfraser »

lbatx wrote: post #146
crazygringo wrote: post #140

Earlier quoted context omitted.

+1000 Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an tag if the src isn't just a data URL or local extension resource. E.g. I want to be able to install an extension that…

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. This seems like a good idea until you realize that the behavior you might want to modify is coming from a different domain loaded by the page and you have no control over how they set that up.

So the app should ask for a permission to a reasonable set of domains, and when you're installing it, you should get a clearly laid out permissions / privacy risk management worksheet to look at and agree to.

Re: Browser extensions are underrated: the promise of hackable software

#156

Post by hota_mazi »

crazygringo wrote: post #140
zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

+1000 Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an tag if the src isn't just a data URL or local extension resource. E.g. I want to be able to install an extension that…

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.

They already can: extension authors can specify that their extension only operates on specific URL's.

The problem is that most extensions are designed to work on all web sites, so you have to choose between security and convenience.

Most users pick the latter and trust the former.

This model works pretty well overall since harmful extensions never take long before getting flagged by the community.

Re: Browser extensions are underrated: the promise of hackable software

#157

Post by stevefan1999 »

stevefan1999 wrote: post #149

I was involved into developing a simple app for WebExtension. Not gonna lie, the experience is awful, for example, no IPC support, being way too complicated in terms of API design and that really hateful manifest schema file which echoes the horror of Android API permission XML. I give up at some point, but I could provide the source code if I could get a chance to recover my files.

well no it indeed had IPC with WebWorkers, however it is also very difficult to work with: data sharing between scripts is a complete clusterfuck. I had found my code, it is written in Vue/Vuex and I will attempt to convert it to using nuxt and upload it github maybe.

Re: Browser extensions are underrated: the promise of hackable software

#158

Post by sma222k0n »

eitland wrote: post #11
Endy wrote: post #6

Browser extensions are being underrated deliberately by browser developers. Ever since we lost XUL Firefox, anyone who wants to really do anything worth doing around a web browser should have already switched to Pale Moon. Doubly so with Google's Manifest v3, which is going to kill selective content download management.

Even as much as I want my old Firefox extensions back I reaaly don't feel I can trust a small bunch of developers to keep something as complicated as the old Firefox patched in this day and age. Am I wrong?

I'm afraid you're

https://forum.palemoon.org/viewtopic.php?f=65&t=22399

https://forum.palemoon.org/viewtopic.php?t=22270&p=168663

Re: Browser extensions are underrated: the promise of hackable software

#159

Post by TuringTest »

hota_mazi wrote: post #156
crazygringo wrote: post #140

Earlier quoted context omitted.

+1000 Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an tag if the src isn't just a data URL or local extension resource. E.g. I want to be able to install an extension that…

> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. They already can: extension authors can specify that their extension only operates on specific URL's. The problem is that most extensions are designed to work on all web sites, so you have to choose between security and convenience. Most users pick the latter and trust the former. This model wor…

> This model works pretty well overall since harmful extensions never take long before getting flagged by the community.

No, this model works pretty well for stealthy extensions which take malicious actions without getting detected.

Re: Browser extensions are underrated: the promise of hackable software

#160

Post by Aardwolf »

mycall wrote: post #152
zmmmmm wrote: post #128

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions . I can't help but c…

500ms to start but like flash, download site in 20s before anything but splash screen.

To me back in those days:

Java applet loading felt like 30 seconds of staring at a gray reactangle while your entire browser ui locks up, sometimes ending in "applet uninited"

Flash game loading was just a few seconds of a black rectangle, browser ui did not lock up, then custom loader, and it usually worked.

Post reply on HN