Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

191–200 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#191

Post by gleenn »

nottorp wrote: post #184
exe34 wrote: post #170

Earlier quoted context omitted.

Executing untrusted code would be a lot safer if browsers and mobile OSes would make it easy to provide fake resources to the app/extension. Yes, you may read my phone contents, and as far as you know, it's the contents, the whole contents and nothing but the contents - it just happens to be a folder to me. An empty folder. It's a new phone you see. Yes here's my contact list. Sorry it's mostly empty, there's just th…

There is already a permission system?

The issue the parent is trying to solve is you don't really have fine grained enough control, or apps nag you and won't load until you give them everything they want. My mom has a cheap camera security app that allows me to see the live streams from remote. Every single time I open the app it asks me again if I want to allow it access to my local network. The answer is a resounding "no". If I could just say "fake yes, here is my fake network", then I wouldn't be continually coerced into giving permissions to something I really don't want to share. I can think of many similar examples, another really common one is giving apps access to my contacts. Absolutely not, stop asking me, here is "Uncle Bob" with phone number 1-222-222-2222. Leave me alone

Re: Browser extensions are underrated: the promise of hackable software (2019)

#192

Post by account-5 »

olejorgenb wrote: post #82
account-5 wrote: post #6

I quite like bookmarklets, easy to write. Tried a userscript but couldn't get into it. Never tried an extension, wouldn't know where to start.

How do you "compile" the bookmarklets? I know of https://bookmarkl.ink/ but then we're back trusting some third-party service again. I get that it's not rocket science, but this is definitively a small hurdle to overcome.

I don't compile them. I just write the JavaScript and wrap it in an anonymous function then save the code as a bookmark.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#193

Post by dustingetz »

samwillis wrote: post #158
gklitt wrote: post #148

Post author here! I wrote this post five years ago. Since then, my conviction in the value of customizable software has only grown, but I've also updated my thinking in a few ways: 1) AI AI is rapidly getting better at coding. Current AI is often bad at high-level architecture but is capable of making small local tweaks. Seems like a good fit for the kind of code you need to write a browser extension! I'm exploring t…

I'm so excited about the malleable software / local-first / local-AI crossover, I feel like we are at the dawn of a new era of software. If we play our cards right, we can bring back control of our data from the large corporations, have ownership, and more control of how we work. I'm particularly interested in how general purpose CRDT toolkits like Automerge and Yjs could become the backing filetype for local-first s…

taking back control from evil corporations is a funding/finance problem, not a technology problem. Everyone dreams of democratized ownership until they have to pay the huge developer salaries. and the go to market costs are even higher than that, all channels are saturated and you have to be louder than the noise.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#194

Post by wiseowise »

dev1ycan wrote: post #124
foobiekr wrote: post #107

Earlier quoted context omitted.

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer. Well, maybe they didn't I hope they enjoy the eventual return of popups.

> Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer.

I wouldn’t be surprised if Gen Z didn’t live through it.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#195

Post by wiseowise »

CharlesW wrote: post #175
userbinator wrote: post #164

Earlier quoted context omitted.

"Those who give up freedom for security deserve neither."

The real quote is more nuanced: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety". It's a balance, obviously. I'm happy to have guardrails if they improve non-technical users' safety.

> I'm happy to have guardrails if they improve non-technical users' safety.

Not at the expense of expert freedom.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#196

Post by remram »

sanitycheck wrote: post #126
remram wrote: post #102

Earlier quoted context omitted.

Userscripts are underrated! I use them for all kinds of things, like fixing GitHub's useless landing page (taking me to my repositories instead), make the Mastodon "follow" button work (by hardcoding my instance's domain), block useless results from Google search results (stackshare and the like), redirect from the YouTube "short" view to the normal video video view, remove the stupid whitespace to the right of Gmail…

I've used Tampermonkey for a couple of moderately complex things and it does work well... I didn't come across a particularly nice way to use an external editor or integrate it with a normal dev workflow though, I wonder if anyone has tricks to share? I'm fairly satisfied with editing in VS Code, using a tsconfig.json with strict mode and checkJs turned on, then using JSDoc for typing. The ugly bit is the manual copy…

I tend to copy/paste into the console anyway during development, so having to copy/paste into Tampermonkey too doesn't slow me down too much. I suppose it would be nice to have a more integrated workflow though.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#197

Post by bee_rider »

Pxtl wrote: post #178
bee_rider wrote: post #173

Earlier quoted context omitted.

I’d be really curious about in a system where browser extensions are limited to ~200 lines of code. No mechanism for distribution beyond typing text in. No concerns about permission. It would be interesting to see what people can do in an ecosystem where extensions can actually do anything but it is expected that people will actually read the code before running it.

My reaction would be simpler: Anything that's identified as risky? Show the user. Extension is making an HTTP request? Show the body in a toast. Extension is reading the keyboard? Same thing. Extension is looking at the page? Little icon in the corner showing the name of the extension and that it looked. Can't be turned off. So extensions can still do all that crazy stuff, but they're noisy about it.

I don’t really see this as simpler:

1) “identified as risky” seems like it could hide some significant complexity (and room for error).

2) An extension might need to read from the keyboard. I don’t want to OK it every time. If I check once and then mark it as OK, I’d be worried that it could do something evil with that permission somehow, in a far-flung bit of the code.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#199

Post by cc101 »

It's possible that some here might confuse Web Extensions with Safari App Extensions. Safari App Extensions are not the same as Web Extensions. App extensions are written in native code (Objective C or Swift); they operate within Apple's sandbox; their data is saved within Apple's secure file system; and if they are sold via the Apple App Store, they are reviewed and approved by Apple. One never has absolute assurance that an app is proof against attack, but until I learn otherwise, I think Safari App Extensions are safe.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#200

Post by lmm »

PaulDavisThe1st wrote: post #12

> Browser extensions remind us what it’s like to have deep control over how we use our computers. Uh. Linux users would like a word here. But more generally, there's a significant component of this that seems isomorphous to the question I was trying to discuss in a post I wrote several years ago called "Is Open Source a diversion from what users really want?" There seems to be much more excitement about ways to "hack…

> Uh. Linux users would like a word here.

The shift of Linux to systemd was a very similar experience to the decline of browser extensions. Yes, you can change how your computer works. But unless you're willing to put a lot of effort into maintaining those changes, the APIs you use will be cut out from under you and it'll be harder and harder to make your computer do what you wanted rather than what someone else thought it should do.

Post reply on HN