Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

161–170 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#161

Post by sunshowers »

loktarogar wrote: post #147
sunshowers wrote: post #117

Earlier quoted context omitted.

Ultimately, as a society, we have to decide what is more important: the best of us or the worst of us.

Framing it like that makes it much more simplistic than reality. While there are some people you can clearly place into "best" or "worst", most people fit somewhere along a spectrum where their placement changes day to day. You ever had a bad day where you forgot to do something you would have done any other day? Do you want software that allows you to do anything on a good day but is potentially catastrophic on a ba…

That's fair, I was being more flippant than necessary. :)

Re: Browser extensions are underrated: the promise of hackable software (2019)

#162

Post by Hackbraten »

gsuuon wrote: post #123
Hackbraten wrote: post #38

Earlier quoted context omitted.

You're free to use only extensions which are open source. So you can build them yourself, and also spot check changes in the code whenever there's a new upstream release.

That'd help, but a problem is they could still go closed-source and you wouldn't know - the store itself has no concept of open or closed source so it's not like you could check an "uninstall if it goes closed source" box. Maybe there's room for a browser extension that hosts other browser extensions but with a much better security model than what Google allows.

You don’t have to use the store to install and update the extension. You monitor the upstream GitHub release feed, and build and install the extension yourself on every update.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#163

Post by FormulatedEdits »

swozey wrote: post #75
monkellipse wrote: post #23

I love the idea of browser extensions but they don’t appear to be worth the security/privacy risk for my use cases. I wonder how many others are like me and too paranoid to risk extensions at all?

I honestly can't imagine not using extensions. I'm 39 and have been on the web since Netscape etc in the early 90s and I honestly care more about the extensions than I do anything the browser actually does. Like, if there were no extensions I don't think I'd care at all if I used Firefox, Chrome, Opera, etc. But Chrome and Firefox have this massive, massive ecosystem of productitivy improving extensions. I'll give an…

Hello. I used to use Dark Reader but then some it changed hands and a very questionable update appeared and freaked many people out, so I uninstalled. IIRC the changes were removed, or the additional code was not correctly activated, maybe both. Anyway, you may wish to check the status of that particular extension. I use some flag in config now to do approximately the same thing, it’s not as effective, but it’s close.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#164

Post by userbinator »

sunshowers wrote: post #117
foobiekr wrote: post #107

Earlier quoted context omitted.

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Ultimately, as a society, we have to decide what is more important: the best of us or the worst of us.

"Those who give up freedom for security deserve neither."

Re: Browser extensions are underrated: the promise of hackable software (2019)

#165

Post by GeekyBear »

The web has become unusable without extensions like uBlock Origin, but extensions can contain malware.

I have moved over to only using extensions that have gone through Mozilla's manual code review necessary to become part of their "recommended extensions" program.

> Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts

https://support.mozilla.org/en-US/kb/recommended-extensions-...

Re: Browser extensions are underrated: the promise of hackable software (2019)

#166

Post by blibble »

Retr0id wrote: post #25
PaulDavisThe1st wrote: post #12

> Browser extensions remind us what it’s like to have deep control over how we use our computers. Uh. Linux users would like a word here. But more generally, there's a significant component of this that seems isomorphous to the question I was trying to discuss in a post I wrote several years ago called "Is Open Source a diversion from what users really want?" There seems to be much more excitement about ways to "hack…

> Uh. Linux users would like a word here. As a Linux user, I disagree. It's not quite the same. Yes, I could recompile my kernel if I wanted to. I can recompile most of userspace too. But it's a hassle, especially if you want to diverge from upstream, and maintain that divergence on a long-term basis. You can do some fun hacks with LD_PRELOAD et al, but it's nowhere near the degree of flexibility and ease of access o…

it's very easy with debian to maintain small patches on top of packages

and dpkg-buildpackage will do all the hard work for you

Re: Browser extensions are underrated: the promise of hackable software (2019)

#167

Post by wintermutestwin »

throwaway63467 wrote: post #24

Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…

>probably better to have that as a native browser feature

/Agree. It is crazy that I have to trust some unknown coder with all my browser data just to enable vertical tabs in Firefox.

Of course many of these extensions are open source and thus auditable. As I lack the skill to detect nefarious code, I am wondering if this might be a good use case for AI. Anyone have thoughts on building a good malware finding prompts?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#168

Post by quickthrower2 »

I love browser extensions both as a user and as a hacker.

The elephant in the room is browser extensions are not a web standard and Google or Firefox can make a breaking change to you at any time “for security”. Also Chrome can boot you out of the store or ask for 100 point ID check in the future.

Extensions are great but a web standard for them would be even better.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#170

Post by exe34 »

gklitt wrote: post #148

Post author here! I wrote this post five years ago. Since then, my conviction in the value of customizable software has only grown, but I've also updated my thinking in a few ways: 1) AI AI is rapidly getting better at coding. Current AI is often bad at high-level architecture but is capable of making small local tweaks. Seems like a good fit for the kind of code you need to write a browser extension! I'm exploring t…

Executing untrusted code would be a lot safer if browsers and mobile OSes would make it easy to provide fake resources to the app/extension.

Yes, you may read my phone contents, and as far as you know, it's the contents, the whole contents and nothing but the contents - it just happens to be a folder to me. An empty folder. It's a new phone you see.

Yes here's my contact list. Sorry it's mostly empty, there's just the costly premium number in there. I hope your mothership doesn't try to call it.

Yes, here's my microphone. Oh thank you, yes, I do a good impression of Rick Astley.

Pictures on my phone? Oh yes, right this way. It's all pictures of turnips. Do you like them?

Post reply on HN