Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A Firefox extension to add latency to distracting webpages

addons.mozilla.org

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Show HN: A Firefox extension to add latency to distracting webpages

#31

Post by saber1 »

iSoron wrote: post #14

Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…

This message is not accurate IMO.

Basically, if the addon wants to interact with any kind of urls, this message is unavoidable. Which means that even if the addon doesn't require to access any data of the websites, as long as it wants to be triggered for any websites, this message is not going to be avoidable.

https://extensionworkshop.com/documentation/develop/request-... has more information.

Re: Show HN: A Firefox extension to add latency to distracting webpages

#32

Post by LinuxBender »

Anon1096 wrote: post #19
iSoron wrote: post #14

Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…

You are incorrect. You can inspect extensions that you download to compare the source code to the github release, or even audit the specific source you have have downloaded. Please don't spread FUD.

Would it be feasible for browsers to have a console window that enumerates add-on's to display things like URL's contained in the code, what is stored in local storage, session storage, etc? Asking because this topic comes up a lot and might not if the browser had a way to show explicit detailed permissions and capabilities vs. high level abstract permissions. This would be for less than technical people that probably won't be viewing source code, but could click a shiny button in the add-on page and get some idea if the addon shows URL, http(s), number of times the addon has used GET or POST or other methods:

  URL: http://some.site.tld/    [ INSECURE GET:1 POST:2]
  URL: https://some.other.tld/  [ SECURE GET:3 POST:2 ]
Maybe in about:networking have a tab for logging / debugging all addons?

Re: Show HN: A Firefox extension to add latency to distracting webpages

#33

Post by ReverseCold »

snthd wrote: post #26
iSoron wrote: post #14

Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…

.xpis are just zip files. You can literally just save them from addons.mozilla.org and look inside - it's js so it's not compiled, and obfuscated code is against Mozilla policy. Automatic updates are optional too. Microsoft Application Inspector might be handy for some superficial profiling - https://github.com/microsoft/ApplicationInspector

> obfuscated code is against Mozilla policy

You can submit obfuscated code as long as you also upload non-obfuscated code to Mozilla. Not sure if that separate code upload is public or not...

Re: Show HN: A Firefox extension to add latency to distracting webpages

#34

Post by phantarch »

This and the post yesterday about adding latency to websites reaffirms an idea I've been thinking about lately - adding friction back into digital processes helps break some of the addictive power they have.

Imagine if you had to use a printer to print out your facebook feed when you wanted to see it. Then, in order to interact, you had to write on that paper the comments, likes, etc. that you wanted to transmit and scan it back into the system. That mode of interaction seems "primitive" compared to the way we use things on our phones, but I think carries with it a lot of nice advantages like introducing time buffers for your mind to catch up to your impulses.

Re: Show HN: A Firefox extension to add latency to distracting webpages

#35

Post by seanwilson »

amenod wrote: post #15
iSoron wrote: post #14

Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…

FTFY: To be clear, this is more a criticism of _every browser's_ security model,... I do agree with you though. What is surprising is that technically, this should be fairly easy to solve: - own the CI system (to make sure the sources match the built versions) - make sources (the ones that went into build) clearly visible - disable silent updates

The solution should surely involve more granular permissions?

I'm assuming this permission has no need to read the body of network responses, inject anything into the responses, read cookies etc.

However, it probably has no option than to request the "read and change all network data" permission because there is nothing weaker that will let it do what it needs to do.

Making sources available isn't a scalable option to help with this in my opinion. Who is going to be doing thorough security audits of every extension + every update?

Re: Show HN: A Firefox extension to add latency to distracting webpages

#36

Post by waterbadger »

waterbadger wrote: post #22

Something I started messing around with: add a global stylesheet with the rule body { filter: grayscale(100%); } (only gotcha is position: fixed; elements breaking in Firefox?) It feels a lot easier to focus on what I'm reading and to not be sucked in or distracted by websites. I bet psychologically color activates reward systems that may not be as healthy for digital content. I actually liked it so much that I used…

Hammerspoon shortcut to toggle grayscale & color (applescript not mine, borrowed from https://github.com/shavidzet/osa-grayscale)

  hs.hotkey.bind({"cmd", "ctrl", "alt"}, "c", function()
   hs.osascript.applescript([[
  tell application "System Preferences"
    reveal anchor "Seeing_Display" of pane id "com.apple.preference.universalaccess"
  end tell
  
  tell application "System Events" to tell process "System Preferences"
    repeat while not (exists of checkbox "Use grayscale" of group 1 of window "Accessibility")
      delay 0.1
    end repeat
    set theCheckbox to checkbox "Use grayscale" of group 1 of window "Accessibility"
    tell theCheckbox
      # If the checkbox is not checked, check it to turn grayscale on
      if not (its value as boolean) then
        set checked to true
        click theCheckbox
      else # else turn grayscale off
        set checked to false
        click theCheckbox
      end if
    end tell
  end tell
  tell application "System Preferences"
      quit
  end tell
   ]])
  end)

Re: Show HN: A Firefox extension to add latency to distracting webpages

#37

Post by chadlavi »

greenie_beans wrote: post #21
iSoron wrote: post #14

Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…

I used to have this exact same fear and never downloaded any extensions bc of that, until I started making browser extensions. Pretty much any useful extension needs the access that prompts that generic message about accessing all the data. Any extension that's listed on the web stores have to be reviewed for malicious code, and they must do what the listing say they do. So if your browser extension has your password…

There's a link to his github in the extension page. You can read his source code: https://github.com/OskarDamkjaer/FirefoxDelayWebpage

most of the relevant code is in https://github.com/OskarDamkjaer/FirefoxDelayWebpage/blob/ma...

Re: Show HN: A Firefox extension to add latency to distracting webpages

#38

Post by andai »

derefr wrote: post #29

See also: • Chrome's "throttling" feature: https://helpdeskgeek.com/networking/simulate-slow-internet-c... • Whole-computer "make my network stack worse" utilities: • • macOS's Network Link Conditioner: https://nshipster.com/network-link-conditioner/ • • clumsy (for Windows): http://jagt.github.io/clumsy/index.html • • dummynet (for Linux): http://info.iet.unipi.it/~luigi/dummynet/ • A naughty SOCKS5 proxy (multiplat…

Chrome's throttling is great, I didn't know about that. But it doesn't look like it persists (across tabs, or sessions)?

Re: Show HN: A Firefox extension to add latency to distracting webpages

#39

Post by Ottolay »

azhenley wrote: post #9

The relevant post from a day ago: I Add 3-25 Seconds of Latency to Every Site I Visit. https://news.ycombinator.com/item?id=22319383

I read that post and wished that there was a Firefox extension but could not find out. Glad someone made one.

Re: Show HN: A Firefox extension to add latency to distracting webpages

#40

Post by aswan »

iSoron wrote: post #14

Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…

> To be clear, this is more of a criticism to Mozilla Firefox's security model, not to this particular extension.

It's a fair comment, but this extension works by injecting javascript into every page the browser loads. If this capability were removed or even changed, it would break a ton of existing extensions (and compatibility with the many extensions written for Chrome).

Given the nature of javascript and the web, once you can run a bit of javascript on a page, you can do just about anything, so the phrasing "can access data" sounds scary but it is accurate. Of course, "can" doesn't mean "does", hence all the other commenters suggesting auditing the code.

Speaking of auditing extension code, I like https://addons.mozilla.org/en-US/firefox/addon/crxviewer/

Post reply on HN