41–50 of 52 posts
I use the poorly named extension Monastery for the delay timer.
https://addons.mozilla.org/en-US/firefox/addon/monastery/?sr...
Earlier quoted context omitted.
.xpis are just zip files. You can literally just save them from addons.mozilla.org and look inside - it's js so it's not compiled, and obfuscated code is against Mozilla policy. Automatic updates are optional too. Microsoft Application Inspector might be handy for some superficial profiling - https://github.com/microsoft/ApplicationInspector
> obfuscated code is against Mozilla policy You can submit obfuscated code as long as you also upload non-obfuscated code to Mozilla. Not sure if that separate code upload is public or not...
Only reviewers have access to the source code, unless you configure the listing to make the code public.
Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…
> Even if the extension's source code is available on GitHub, there is no guarantee that the code hosted at addons.mozilla.org corresponds to the same one found on GitHub; and even if I (or someone else) could verify that the code is indeed the same, and that there is nothing malicious in it right now, there is no guarantee this will still be the case in future (silent) updates.
> To be clear, this is more of a criticism to Mozilla Firefox's security model, not to this particular extension.
Uhhh... yeah
Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…
To make any headway on this, you would need to start considering how to prohibit JavaScript from transmitting page content to remote servers if it's been modified by an addon, but that would then break all JavaScript modified by adblockers, and so there's not any easy solution there either.
If you can think of a valid security model here that isn't vulnerable to today's arbitrary JavaScript execution issues, I think you'd find a willing audience. Chrome tried to solve this by nailing down what extensions can do, and the adblockers all flipped out because they won't be able to run arbitrary JavaScript in-page anymore. It remains unclear how this can ever be solved.
Easily disabled if you find it annoying. And if you're self disciplined enough to not turn it off, surely you're self disciplined enough to curb your browsing habits?
In my /etc/hosts file, I redirect distracting websites to 0.0.0.0 to block them. There's nothing stopping me from enabling a website beyond the effort to type in sudo vim /etc/hosts, but yet I now spend a lot less time on those websites. Human psychology is funny that way.
I've found greater success in just observing my impulses. While I'm working, I might get a desire to type the "hn" keyword into my URL bar (guess where it goes). But because I've noticed this before it happened, I can choose to not do it. If I find myself "idling" on such distractions without realizing, then that means it's time to do something else. Get back to work. Take a break and relax. Get off the screen entirely. Anything else, just don't idle. This seems to get easier with practice.
Looks like an interesting extension, but unfortunately I would never install it given that "this add-on can access data for all your websites". As far as I am aware, this means it can read and record all data in all websites I visit (including emails, banks, etc) and record everything I type anywhere (including usernames and passwords). Even if the extension's source code is available on GitHub, there is no guarantee…
I used to have this exact same fear and never downloaded any extensions bc of that, until I started making browser extensions. Pretty much any useful extension needs the access that prompts that generic message about accessing all the data. Any extension that's listed on the web stores have to be reviewed for malicious code, and they must do what the listing say they do. So if your browser extension has your password…