Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Removed ClearURLs Extension from Chrome Web Store

github.com

Post reply on HN
Print view View original

361–369 of 369 posts

Re: Google Removed ClearURLs Extension from Chrome Web Store

#361

Post by bsdubernerd »

kuschku wrote: post #334
lordofgibbons wrote: post #282

Earlier quoted context omitted.

Can you please link to instructions on how to do this?

1. Create a collection of addons you'd like to use on AMO (e.g. via desktop mode) 2. Use Firefox Nightly 3. Click several times on the firefox icon in settings > about until developer mode is enabled 4. Click "change addon collection" and enter your AMO userid as well as the name of the collection you created in step 1 5. Firefox is restarted, and you can install all addons from your collection (if this doesn't work,…

I hope you see why I still don't consider Mozilla behavior acceptable here.

Many addons work already, but they're locked behind mozilla's vetting. Not only you need to jump through additional hoops, but you actually require an account on Mozilla's website as well.

This is like saying that Chrome is fine too, just use Chromium, get the addon from a github release and there you go!

Re: Google Removed ClearURLs Extension from Chrome Web Store

#362

Post by kuschku »

bsdubernerd wrote: post #361
kuschku wrote: post #334

Earlier quoted context omitted.

1. Create a collection of addons you'd like to use on AMO (e.g. via desktop mode) 2. Use Firefox Nightly 3. Click several times on the firefox icon in settings > about until developer mode is enabled 4. Click "change addon collection" and enter your AMO userid as well as the name of the collection you created in step 1 5. Firefox is restarted, and you can install all addons from your collection (if this doesn't work,…

I hope you see why I still don't consider Mozilla behavior acceptable here. Many addons work already, but they're locked behind mozilla's vetting. Not only you need to jump through additional hoops, but you actually require an account on Mozilla's website as well. This is like saying that Chrome is fine too, just use Chromium, get the addon from a github release and there you go!

Definitely. But I can understand why not everything is added yet: Addon configuration pages are mostly broken, downloads are broken, and some other APIs.

Once those are implemented, which is expected soon (only in october did they implement the majority of the APIs so far) all addons should work, and it'll be open again.

The big issue with just opening it now is that it'd lead to dozens of complaints due to broken addons, so I can easily understand limiting it to people with enough understanding to go through these steps.

Besides, the chromium workaround used to be the official installation instructions for AdNauseam for Chrome, until Google markef it as malware. And Chromium doesn't even support addons at all on mobile devices

Re: Google Removed ClearURLs Extension from Chrome Web Store

#363

Post by nottorp »

JamesAdir wrote: post #360
nottorp wrote: post #196

Earlier quoted context omitted.

That train has unfortunately left the station long ago. I'd like to see more small sites have a donation (not subscription, unless a decent micropayment solution shows up and they give up on the "it's just the price of a Starbucks coffee" crap) instead.

I'm don't have the number but unless there is a specific cause I think that content sites are not seeing donations as a good revenue stream. Maybe Substack and such tools will be able to be a more sustainable solution.

Donations as a revenue stream is unpredictable, and they're right to not like it.

But from the reader side, how many subscriptions can you have? It may feel good now because there are only a few options and any one person only likes a small percentage of those few options enough to give them money. But what happens when every site you click on on HN asks for a subscription? Will you pay for all of them?

Re: Google Removed ClearURLs Extension from Chrome Web Store

#364

Post by mcovey »

dessant wrote: post #37

I'd love to use ClearURLs, though last I checked it had a major flaw: it allows arbitrary code execution by the provider of the filter list. Among other things, it can redirect script URLs to arbitrary sources, and the filter list is periodically updated from a GitLab page, which enables the filter list provider to perform a targeted attack by serving a malicious filter list to a specific device. The only filter list…

Check out Neat URL - it's more basic, uses a comma-separated list of rules, and comes with some hard-coded presets you can override. I maintain my list in a text file and just update that and copy/paste in when I want to create one.

Of the defaults, I only override "cid, mbid" as blocking those on every site has ended up breaking some.

https://github.com/Smile4ever/Neat-URL

Re: Google Removed ClearURLs Extension from Chrome Web Store

#365

Post by emayljames »

int_19h wrote: post #260
emayljames wrote: post #119

Earlier quoted context omitted.

I'd respectfully disagree, Netscape (Gecko) had better, more up to date standards. The issue was always folks not testing on other than Internet Exploder.

It didn't when Netscape 4 (which was pre-Gecko) was a thing. The IE vs NN browser war saw both adopting various incompatible non-standard features - e.g. layers in NN, innerHTML in IE - but the set that IE ended up with was closer to what was eventually standardized as HTML5/CSS/DOM.

That sounds like a ruff time for devs.

Re: Google Removed ClearURLs Extension from Chrome Web Store

#367

Post by wepple »

Const-me wrote: post #222
wepple wrote: post #209

Earlier quoted context omitted.

At Starbucks I can inject arbitrary content into the browser of anyone who visits your site over HTTP and take control of their browser. Furthermore, congrats on your site but you’re 0.01% of sites like that. Should we keep an insecure web because your hosting provider is ripping you off? TLS is easy and free in 2021.

I don't like when Google, or anyone at all really, tries to globally police the internets. It's up to web site owners to decide whether to implement encryption, and up to users to decide whether to use these web sites or not.

Website owners can decide: don’t use a cert.

Users can decide: find a browser which doesn’t put importance on cert usage. You’ll find this hard to find because every browser manufacturer realizes that 99.9% of users cannot make sound security decisions, so they shouldn’t have to. Things should default to secure.

There’s a trade off between protecting users and having a 100% free and open internet. An insecure internet is untrustworthy and therefore not useful, IMO.

Re: Google Removed ClearURLs Extension from Chrome Web Store

#368

Post by wepple »

prepend wrote: post #221
wepple wrote: post #209

Earlier quoted context omitted.

At Starbucks I can inject arbitrary content into the browser of anyone who visits your site over HTTP and take control of their browser. Furthermore, congrats on your site but you’re 0.01% of sites like that. Should we keep an insecure web because your hosting provider is ripping you off? TLS is easy and free in 2021.

So what. We’ve all done this stuff and it’s fun for like 5 minutes. It’s been possible for decades and doesn’t end up being a common problem. And even if it was the risk is just crap injected into someone’s blog.

> It’s been possible for decades and doesn’t end up being a common problem.

https://news.ycombinator.com/item?id=3804608

This is far more common than you think. ISPs, hotels, cafes, mobile providers do this en masse far more than you think. Have you forgotten the NSA “SSL added and removed here”? That was a highly targeted attack against infrastructure. What we’re discussing here is 10x easier to achieve.

> And even if it was the risk is just crap injected into someone’s blog.

That “crap injected” has full control over the DOM, any authentication, and everything displayed. How many of your users would happily put their creds into a fake login modal that popped up claiming to be SSO for a popular identity provider?

Re: Google Removed ClearURLs Extension from Chrome Web Store

#369

Post by jeltz »

rjmunro wrote: post #194
jeltz wrote: post #172

Earlier quoted context omitted.

The certbot client is pretty awful (it does not cooperate well with automization) but otherwise I agree 100%. HTTPS everywhere and Letsencrypt have been huge boons to security.

Can you expand "it does not cooperate well with automization", because that's not something I've ever heard before.

Some of its commands modify the config files so if you ever need to fix something manually you can very easily end up changing the config and breaking something.

I use dehydrated instead.

Post reply on HN