Browser extensions are bad.
Don't create them.
Don't use them.
Use Tampermonkey/userscript instead.
Browser extensions are underrated: the promise of hackable software (2019)
151–160 of 320 posts
Re: Browser extensions are underrated: the promise of hackable software (2019)
#152What has always blown my mind is the lack of documentation/open source projects. With such powerful data we come across while browsing the web, it would only make sense to me there would be more tools to use an extend in this space. Browsing history is especially under valued. Even though the data technically exists, it is quite difficult to retrieve pages that have been visited, imo because of poor UX. Most people keep every Internet journey opened in hopes they will remember to return to it. I have been taking a stab at improving the UX with a history browser extension [1] which I have found myself legitimately finding value in using (a first for my personal projects lol).
[1] https://github.com/lunabrain-ai/lunabrain/tree/main/js/exten...
Re: Browser extensions are underrated: the promise of hackable software (2019)
#153I program (not js/ts), use a massive number extensions and consider myself an absolute power user of them and refuse to ever use a browser WITHOUT the chrome/firefox extension ecosystem, I've written themes for Chrome and VScode, but I'm still here- (like pink/cyan? get on in! https://marketplace.visualstudio.com/items?itemName=mikejk8s... ). I have no idea via the Chrome prompts what extensions are able to do, read,…
yes it’s that bad. i’ve written some webexts and if you ask for all data it really is all data... otherwise how would it work if you needed to change something on a page? i keep my list to my own bespoke one-off extensions or only the major big names or i audit the code manually.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#154Earlier quoted context omitted.
Yes. Because of this and the lack of fine-grained permissions mentioned by a sibling comment, I tend to use desktop apps where I can instead of extensions, keeping my extensions list quite slim — basically all I install are FOSS extensions by “big” known-good authors (e.g. Raymond Hill) or projects that aren’t going to sell out. Of course risks exist with desktop apps too, but historically this kind of buy-and-exfilt…
The bar to write secure desktop software is significantly higher than for browser extensions. Especially with all the Electron crap these days, you're one XSS away from full-blown RCE.
Absolutely, but the short and long terms risk posed to most by installing random browser extensions willy-nilly is still almost certainly higher than that of instead opting for vetted desktop apps, especially if using PWAs in place of Electron apps where possible (which I do).
Re: Browser extensions are underrated: the promise of hackable software (2019)
#155I think that metamask is an example of a great add on that proves how great browser extensions are. Also, I think that the most popular browser extensions like metamask will eventually become built into every browser
MM terrifies me as an extension. I run it in its own separate browser profile with no other extensions installed. My fear is actually that another extension can hijack MM.
Yeah, I have wondered about that. Can browser extensions read or hijack data from other extensions? or are browser extensions sandboxed?
Re: Browser extensions are underrated: the promise of hackable software (2019)
#156Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…
Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.
Honestly as much as I love Firefox this is an underrated concern.
Firefox allows their extensions to be far more powerful than Chrome's, but that power means they are also far more dangerous.
If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever?
Chrome, for all its faults, has ruined their extension framework at least in part because they were trying to prevent this threat.
How do we make this work? Endless notification spam from the plug-ins? Expensive certifications for each plug-in release?
Re: Browser extensions are underrated: the promise of hackable software (2019)
#157Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…
> Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second thought. How unlike developing for literally any other environment.
Quite right. Google and other commercial platforms may cut features or make breaking changes out of greed, while open source projects do it because they chase shiny things and can't be arsed to do legacy support. The end result is the same.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#158Post author here! I wrote this post five years ago. Since then, my conviction in the value of customizable software has only grown, but I've also updated my thinking in a few ways: 1) AI AI is rapidly getting better at coding. Current AI is often bad at high-level architecture but is capable of making small local tweaks. Seems like a good fit for the kind of code you need to write a browser extension! I'm exploring t…
I'm so excited about the malleable software / local-first / local-AI crossover, I feel like we are at the dawn of a new era of software. If we play our cards right, we can bring back control of our data from the large corporations, have ownership, and more control of how we work.
I'm particularly interested in how general purpose CRDT toolkits like Automerge and Yjs could become the backing filetype for local-first software with interoperable sync/collaboration backends. The user can then have direct access to the underlaying data via standard tooling. Files can be linked, embedded within each other, forked and merged.
We could have a new hypermedia platform built on this, where all documents are possible to be shared, forked, edited in realtime...
Basically, love what you are all doing at Ink and Switch, excited to see what you publish next.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#159Earlier quoted context omitted.
MM terrifies me as an extension. I run it in its own separate browser profile with no other extensions installed. My fear is actually that another extension can hijack MM.
Yeah, I have wondered about that. Can browser extensions read or hijack data from other extensions? or are browser extensions sandboxed?
It doesn't matter. Everything has security holes.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#160More like overrated. An extension can't be better, can't offer more than what the host application allows. All these developers hang on by a thread. Compared to OS APIs, in-app APIs are more unstable. Goals, profit incentives affect a single application much harsher than how a wider ecosystem would react. It's good that they exist, but at most they are viewed as a necessary annoyance by their hosts. Chrome I won't even need to mention, but winds could turn anytime on something like VSCode as well.
Sure, Webkit and VSCode are both open source and forkable along with their extension support, but any later development would rot compatibility until, and if, a popular fork emerges.