Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

121–130 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#121

Post by moolcool »

foobiekr wrote: post #107
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Small price to pay for adblock

Re: Browser extensions are underrated: the promise of hackable software (2019)

#122

Post by Spivak »

syoc wrote: post #114
foobiekr wrote: post #107

Earlier quoted context omitted.

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Replace browser with operating system or computer and expand extensions to user installable programs and it mostly still rings true. I believe users should be empowered to modify their installed applications as they see fit.

It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people, desktop software is more difficult develop (for your average hacker wannabe), more difficult to get users to install, and has far less valuable data to go after.

I actually very much like Apple's approach to browser extensions forcing them to be truly installed software and in the purview of tools that protect the rest of the system.

The Chrome browser extension ecosystem is perfectly fine in theory but suffers from reinventing installed software without taking any of the lessons we've learned about OS software. Nice cautionary tale but the web is different.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#123

Post by gsuuon »

Hackbraten wrote: post #38
empiricus wrote: post #36

Is there a way to use browser extensions safely? Any extension that looks interesting needs access to everything I see on the screen (and even modify it), which to me seems a huge security risk. My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc. Do I understand correctly the situation?

You're free to use only extensions which are open source. So you can build them yourself, and also spot check changes in the code whenever there's a new upstream release.

That'd help, but a problem is they could still go closed-source and you wouldn't know - the store itself has no concept of open or closed source so it's not like you could check an "uninstall if it goes closed source" box. Maybe there's room for a browser extension that hosts other browser extensions but with a much better security model than what Google allows.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#124

Post by dev1ycan »

foobiekr wrote: post #107
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer. Well, maybe they didn't I hope they enjoy the eventual return of popups.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#125

Post by Spivak »

dev1ycan wrote: post #124
foobiekr wrote: post #107

Earlier quoted context omitted.

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer. Well, maybe they didn't I hope they enjoy the eventual return of popups.

They never left they're just called modals now.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#126

Post by sanitycheck »

remram wrote: post #102
Sophira wrote: post #53

> Today, it requires a big jump to go from using browser extensions to creating them: you need to learn a fair amount of web development to get started, and you can’t easily develop extensions in the browser itself. What if there were a quick way to get started developing and sharing extensions in the browser? You could imagine smoothly transitioning from editing a website in the developer tools to publishing a small…

Userscripts are underrated! I use them for all kinds of things, like fixing GitHub's useless landing page (taking me to my repositories instead), make the Mastodon "follow" button work (by hardcoding my instance's domain), block useless results from Google search results (stackshare and the like), redirect from the YouTube "short" view to the normal video video view, remove the stupid whitespace to the right of Gmail…

I've used Tampermonkey for a couple of moderately complex things and it does work well... I didn't come across a particularly nice way to use an external editor or integrate it with a normal dev workflow though, I wonder if anyone has tricks to share?

I'm fairly satisfied with editing in VS Code, using a tsconfig.json with strict mode and checkJs turned on, then using JSDoc for typing. The ugly bit is the manual copy-paste into the Tampermonkey code area each time.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#127

Post by mozball »

monkellipse wrote: post #23

I love the idea of browser extensions but they don’t appear to be worth the security/privacy risk for my use cases. I wonder how many others are like me and too paranoid to risk extensions at all?

Your paranoia is warranted. Like i replied in another thread up, there are a couple thing you can do. Use multiple browser/profiles. Keep a separate profile or two with no extensions for banking, shopping, email and other important stuff. You can be install a couple addons in your 'general browsing' profile. In general install only 'recommended' and security-reviewed addons with firefox.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#128

Post by fragmede »

mozball wrote: post #116
empiricus wrote: post #36

Is there a way to use browser extensions safely? Any extension that looks interesting needs access to everything I see on the screen (and even modify it), which to me seems a huge security risk. My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc. Do I understand correctly the situation?

>My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc. Depends on the permissions requested by the extension but often yes. The permission "Can read all data on any webpage" means exactly that. > Is there a way to use browser extensions safely? Yes. Depending on your paranoia /security standards. Here's what you can do ( ordered b…

Chrome has controls to not allow an extension free reign on all sites despite it asking for them. Allow only on specified sites. it's not a default for some reason, but if the extension doesn't have access then it can't do anything, bad or good.

Of course it doesn't help that it's a finance site that disables paste for which I need an extension to reenable, but at least I'm not letting the rest of my extensions get at my banking web session.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#129

Post by seagulls »

monkellipse wrote: post #23

I love the idea of browser extensions but they don’t appear to be worth the security/privacy risk for my use cases. I wonder how many others are like me and too paranoid to risk extensions at all?

There's a handful of trustworthy extensions like uBlock Origin, otherwise any with full DOM access are basically a browser rootkit.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#130

Post by seagulls »

monkellipse wrote: post #43
extesy wrote: post #35

Earlier quoted context omitted.

At all? Not even ublock origin? That would actually go against your stated goal of security/privacy.

Correct, none. I use Pihole for blocking. But the bigger point I think is that security conscious users are hesitant to employ extensions in general, even if some folks are ok with a couple select extensions they are still spooked by the general field.

DNS blocking has not been effective for probably close to a decade, with domain-fronting, L7 adware/spyware, fingerprinting and other trickery. Parent comment correctly characterized the lack of UBO as a net security/privacy loss.
Post reply on HN