301–310 of 320 posts
Earlier quoted context omitted.
I admit it is a bit combative, but his response took absolutely zero responsibility and expressed zero concern for what is in my mind a huge and inexcusable security oversight. Countering an acting apologist for a de facto monopolist corporation is also needed, or else we end up with complacency and rot.
Because there’s nothing to be concerned about. Author irresponsibly incited a bunch of FUD. End of story.
Earlier quoted context omitted.
> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. As the first in this chain of humans, I can tell you that (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold, (b) Chrome's extension model dramatically improved on…
> (a) we obviously considered this in the first version of extensions and did not allow permissions "below" the fold Irrelevant. > (b) Chrome's extension model dramatically improved on the previous state of the art which was Firefox's "every extension can do everything, extensions can't be uninstalled completely, and there's no review" Irrelevant. > (c) the install dialog is just one part in a bigger system which inc…
> Irrelevant
No, it is directly relevant. He is responding to someone who said that this problem with the permissions UI goes all the way back to the everyone who was involved from the very beginning.
He is one of those people who were involved at the beginning and is pointing out that they did not have that problem back then.
Earlier quoted context omitted.
> chrome extensions have horrible flaws and browsers are fundamentally broken > apple sucks and is the reason for all evil because scroll bars we dont have scroll bars on mobile as in days of yore. maybe browsers need to finish playing catchup to the threat and interaction models. having a vm on your machine with access to everything you do without sandbox is pretty bad
Hiding scrollbars has been obviously bad UX since day one and this has only become more obvious over time. It doesn't matter whether you're doing it in a web browser or not, whataboutism isn't an appropriate response
Earlier quoted context omitted.
This is a needlessly combative reply. Your interlocutor is not sitting at the interrogation table.
I admit it is a bit combative, but his response took absolutely zero responsibility and expressed zero concern for what is in my mind a huge and inexcusable security oversight. Countering an acting apologist for a de facto monopolist corporation is also needed, or else we end up with complacency and rot.
Even though he didn't take responsibility I walk away convinced that he's doing a good enough job.
Earlier quoted context omitted.
> nearly unbelievable I don't get why people say something like this, especially on HN where lots of people are SDE themselves. Every single feature is hand-crafted by a/some real person(s), and is usually only reviewed by a handful people. It only makes sense sometimes it has serious oversight.
It's true. However, the orgs in question have billions of money. They can afford more than a handful of people to address these things. Eight person startup? Sure. But not these folk who "only hire the best"
Earlier quoted context omitted.
I admit it is a bit combative, but his response took absolutely zero responsibility and expressed zero concern for what is in my mind a huge and inexcusable security oversight. Countering an acting apologist for a de facto monopolist corporation is also needed, or else we end up with complacency and rot.
Frankly your tone made yourself sound like an entitled armchair expert, whereas the paragraphs you have labeled as "irrelevant" sound extremely relevant. Why don't you use a few words to explain why you think that paragraph is irrelevant? Even though he didn't take responsibility I walk away convinced that he's doing a good enough job.
Well, the OP's tone was flippant, and I thought it was dismissive. Who cares how thankless the job is -- it is your job. Stop blaming it on the users for wanting things and fix the problem and stop making excuses and acting put out.
> whereas the paragraphs you have labeled as "irrelevant" sound extremely relevant. Why don't you use a few words to explain why you think that paragraph is irrelevant?
It is irrelevant because the issue exists now. Who cares what they accounted for 8 years ago, and who cares what their competitor does?
P1: My lock opens with any key. It should only open with my key.
P2: But the competitor's lock opens without a key!
P1: I don't care? Fix it.
> Even though he didn't take responsibility I walk away convinced that he's doing a good enough job.
You should raise your standards.
Earlier quoted context omitted.
Wouldn't it be cool if apple had some kind of menu called like "display settings" or something, and in that menu there was like a checkbox labeled "use invisible scrollbars", and when the checkbox was checked, scrollbars would be invisible, then when it was unchecked, and I know this'll sound crazy, the scollbars would be visible, and people could just make it look the way they like?
Exactly. So much is broken because of misunderstood UX design. Today I was again reminded that many years ago some UX designer thought it would be a great idea to remove back/forward buttons from the context menu in Firefox if I accidentally select some text on a page I visit. No one was asked and when someone filed a bug it was ignored because ux designers had already decided. Result: - a few times every month back/…
Earlier quoted context omitted.
Not with encrypted DNS (DoH and DoT).
Your router can proxy encrypted DNS (if you have some decent firmware) or you can set up your own DNS server. There are also things like nextdns.io which can do all the work that a pihole does but works outside your home network.
You can still block those by doing IP-level blocks for known ad domains, but that starts to become a problem if one of those domains are run from a shared cloud host (i.e. Cloudflare etc.) because you will also block legitimate domains.
Most in-app ads and tracking will still use HTTPS so if you use SNI sniffing + certificate validation (to prevent domain fronting) you can still do network level blocks, but that's quite resource intensive, especially at modern internet speeds.
Now try actually distributing it. My guess is this wouldn't even get close to getting through the review process for the Chrome Webstore. From our experience with Streak, this would def get picked up in review. Seeing other comments in the thread pointing to this article as a reason why MV3 is bad I think misses the point. Personally I think MV3 is a step in the right direction (even though it negatively affects us!)…
The real trick isn’t publishing a new app, it’s purchasing an existing app and pushing an update with malicious code. The latter review process is more lax
Now try actually distributing it. My guess is this wouldn't even get close to getting through the review process for the Chrome Webstore. From our experience with Streak, this would def get picked up in review. Seeing other comments in the thread pointing to this article as a reason why MV3 is bad I think misses the point. Personally I think MV3 is a step in the right direction (even though it negatively affects us!)…
Just buy an already published popular extension and submit an update