Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software

geoffreylitt.com

Post reply on HN
Print view View original

111–120 of 189 posts

Re: Browser extensions are underrated: the promise of hackable software

#111

Post by scarface74 »

gildas wrote: post #105
scarface74 wrote: post #92

Earlier quoted context omitted.

It also allows developers to intercept your entire browsing history. If you care about your privacy, why would you let a random third party intercept all of your browsing history?

I consider everything to be a matter of risk in terms for example of privacy. By installing an extension like uBlock, I am indeed taking the risk you mentioned. However, I consider that the risk will be much higher when installing an extension that is based only on a list of regular expressions for the reason I mentioned. If uBlock did a bad thing, I'll know very quickly and all I'll have to do is install an alternat…

So how many consumers would know if uBlock did something bad? Should we optimize security for the minority or the majority?

Re: Browser extensions are underrated: the promise of hackable software

#112

Post by imiric »

dman wrote: post #86

I would really like a browser which attempted to be extensible the way emacs is. No modern browser appears committed to extensibility as a key feature / differentiator.

Surf[1] is very extensible if you know some C and shell. WebKit-based, for better or worse.

[1]: https://surf.suckless.org/

Re: Browser extensions are underrated: the promise of hackable software

#113

Post by scarface74 »

bradknowles wrote: post #93
gildas wrote: post #85

Earlier quoted context omitted.

Some also claim that Google kills innovation. Synchronous interception of requests allows developers to program sophisticated rules to fight malicious resources. In the future, they will only have a regular expressions list to block domains. It will be much easier for malicious actors to bypass this feature.

I want whitelist-only. No blacklists, unless that's something to be applied after the whitelisting step. So, no -- Google's method is not sufficient.

You really want an extension that limits your ability to access only a certain number of websites?

Re: Browser extensions are underrated: the promise of hackable software

#114

Post by scarface74 »

chipperyman573 wrote: post #99
scarface74 wrote: post #95

Earlier quoted context omitted.

Safari had plugins from day one. As far as I know. Here is an early plug in from 2010 ( https://www.cultofmac.com/47232/macheist-tweaks-gruber-with-... ) But speaking of “closed”, where is the ad blocking extension for Chrome on Android and embedded web views?

It's nowhere, which is the point. I bet if they were to add manifest V3 (the thing people are upset about) to chrome for Android, it would be received much more positively than this.

This is what I meant. The content blocking framework that works with both Safari on iOS and the newer web view has been around for four years.

Re: Browser extensions are underrated: the promise of hackable software

#115

Post by scarface74 »

cmroanirgo wrote: post #65
scarface74 wrote: post #15

Earlier quoted context omitted.

Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.

I've been on both sides of the fence in this one, and agree with both arguments. Perhaps FF could add (if it doesn't have it already) an about:config setting that allows reloads, perhaps from a specific folder(s).

It’s really not that hard to have a setting that allows an extension to run every time and hash the extension. If the hash changes, it’s disabled until you re-enable it.

Re: Browser extensions are underrated: the promise of hackable software

#116

Post by scarface74 »

bradknowles wrote: post #91
scarface74 wrote: post #76

Earlier quoted context omitted.

No one was upset about a plug in not getting access to your browsing history. People were upset about the declarative ad blocking that took away some of the features that they ad blockers previously had and said Google was doing it to protect their business. I’m not going to defend Google’s overall business practices, but from what I understand, it’s the same type of architecture that Apple has had for four years and…

With respect, Google is not Apple, and Apple is not Google. I think a lot of people would say that Google is a pretty evil company in many respects, whereas Apple isn't exactly 100% saintly, but at least their profit and business goals align more closely with what is generally considered to be good for customers.

I’m definitely an Apple customer - our cell phone plan has 6 devices and we have two AppleTVs. But playing devil’s advocate, Apple’s business model only allows a small percentage of upper income people globally to be able to afford their products. Android and Google have done a lot more to bring computing to the masses than Apple. The cheapest iPhone that you can buy is $475 over $200 more than the average selling price of an Android phone.

Re: Browser extensions are underrated: the promise of hackable software

#117

Post by gildas »

scarface74 wrote: post #111
gildas wrote: post #105

Earlier quoted context omitted.

I consider everything to be a matter of risk in terms for example of privacy. By installing an extension like uBlock, I am indeed taking the risk you mentioned. However, I consider that the risk will be much higher when installing an extension that is based only on a list of regular expressions for the reason I mentioned. If uBlock did a bad thing, I'll know very quickly and all I'll have to do is install an alternat…

So how many consumers would know if uBlock did something bad? Should we optimize security for the minority or the majority?

Google would remove uBlock from my PC before I even know it and I would notice it very quickly (unfortunately).

A personal computer has always been very complicated and using it has always been a risk in itself. I remember a time when a virus could damage the computer's hardware, and someone who knew how to program in BASIC (edit: or LOGO) was not considered as a "minority".

My point of view is that we need to make users aware of the risks and make them more responsible because things will not get any easier.

No need to optimize, I switched to Firefox, the browser for the minorities ;). I really liked Chrome though.

Re: Browser extensions are underrated: the promise of hackable software

#118

Post by hnaccy »

scarface74 wrote: post #111
gildas wrote: post #105

Earlier quoted context omitted.

I consider everything to be a matter of risk in terms for example of privacy. By installing an extension like uBlock, I am indeed taking the risk you mentioned. However, I consider that the risk will be much higher when installing an extension that is based only on a list of regular expressions for the reason I mentioned. If uBlock did a bad thing, I'll know very quickly and all I'll have to do is install an alternat…

So how many consumers would know if uBlock did something bad? Should we optimize security for the minority or the majority?

Why is better to fix adblocking capabilities at model that is borderline insufficient now let alone in 10 years.

There is arms race and you want adblockers (good guys) to give up any improvements in perpetuity, that is a recipe for losing.

Me installing uBlock for parents has improved their browser experience and security. I'd rather risk uBlock being compromised and having to phone them to uninstall it than have them being at the mercy of adtech, spyware, and scammers companies in 5 years.

Re: Browser extensions are underrated: the promise of hackable software

#119

Post by Causality1 »

jwatt wrote: post #52
Causality1 wrote: post #40

Earlier quoted context omitted.

Personally I just use two browsers. Chrome with no extensions for work and anything involving sensitive data such as logging into my google account, online banking, Amazon, eBay, etc. For everything else I use an old version of Firefox with proper XUL support so I can be comfortable and retain essential functionality during casual browsing.

Presumably you're using an outdated Firefox ESR version with known exploitable holes then? The oldest supported Firefox ESR (60.0) was the first ESR version to enable Quantum and drop support for old-style Mozilla Add-ons.

Yep, along with Ublock Origin and NoScript in whitelist mode with browser and extension updates disabled. Frankly it would be less hassle to have my identity stolen than operate all day every day without XUL extensions. Granted my attack surface and personal needs are far different from the average Joe and so my method isn't right for most people, but I've already saved so much time and effort that if starting tomorrow I had to spend the next month living off the cash in my wallet while sorting out a case of theft it would STILL have been worth it.

Hell I already saved a whole day of fuckery by being immune to Mozilla's "disable all extensions everywhere by having the certificates expertise of a four year old" screw-up.

Re: Browser extensions are underrated: the promise of hackable software

#120

Post by elliottcarlson »

octosphere wrote: post #71
ignoramous wrote: post #66

Extensions can be uninstalled, revoked, disabled at will. Can't really bend BigTech to do your biding, and that trumps whatever the security argument brings to the table, imo. Extensions should be done in a security friendly way [0], and not the other way around of making software secure by disabling all extensibility [1]. Take the example of the Android ecosystem: If plugins were allowed for apps, pretty sure there'…

Sometimes I like to inspect the code of existing addons to look for malicious code. My first sweep is regexing through the code for any URLs which means checking for (http?s://) and the next step is looking for any code that is deliberately obfuscated.

I built http://sublim.nl/crxviewer/ to do exactly that -- load in an extension and view the source, including doing a search through all files.
Post reply on HN