221–230 of 286 posts
https://datum.alwaysdata.net/static/extension/index.html
It crowdsources tags for hacker news threads. And it also adds contextual and relevant real world data while you browse a HN thread.
It's a companion extension for the website https://datum.alwaysdata.net . I want to grow my tester community.. don't be shy !
You can access the code !
A lot of the most useful software I've made for myself has been browser extensions. Spend too much time on Hacker News? I made an extension to freeze the front page so it updates once every 6 hours. Spend too much time on Reddit? I made an extension requiring a password to be input for every page I visit. Want to extensively filter LinkedIn jobs, and track which jobs you've applied to? I made an extension to apply ve…
I’d love to see how these things are architected. Do you have them on GitHub? Are there any boilerplates or anything you recommend to get started?
I try to stay away from browser extensions as much as I can, it will only bloat my browser even further. Firefox + Tampermonkey should be enough in my case. Is there anything a browser extension can do that Tampermonkey cannot?
Why don't you consider tampermonkey scripts to be bloat?
Not sure if things have changed lately but as a user, I try to avoid browser extensions because they seem to be very insecure.
Earlier quoted context omitted.
I know this hurts as a developer, but using this language is just a way of being sincere to the user.
As a user it's not that helpful when extensions which inject stuff into the page (lots of them) all say they can access your history and browsing data. Even though it's actually true, it feels like a gap in the permissions model.
Try analyze these things while wearing a tinfoil hat. Google wants to gimp extensions so that we're one-step further away from tampering with the precious data pipe that Google wants from their servers to the user's monitor/eyeballs. If it gets in the way of that, they will neglect it (whether purposefully or conveniently unintentionally like these seemingly benign wording).
Earlier quoted context omitted.
They're describing the worst-case thing someone could do with the privilege being granted, because they have no way of saying what the developer will do with the privilege. The way to make the prompt sound less scary, is to use finer-grained permissions where the worst-case thing someone could do is less scary. (Or, if there aren't any fine-grained permissions suited to doing your task — then propose some! The browse…
> They're describing the worst-case thing someone could do with the privilege I understand that - I wrote just that in my comment above. But it's a lot scarier to see a pop-up saying "This extension in the worst case does this", versus the worst-case scenario and a longer explanation. I see from your profile that you're at a web3 analytics company. I'll just say that I think metamask would be a lot less popular if at…
People rightfully point out that if you have access to current URL, you technically have access to browsing history. The right approach is to assume you will use it, hence the warning. Unfortunately, the only way to prevent this is to ensure the extension never, ever gets to make a networking request on its own, or populates any field that could become part of a network request triggered made by the site, or another extension.
It's a trust issue. It's not just fear that you might theoretically sell your extension to some unscrupulous third party. I don't know you personally. I have no reason to assume you are not an unscrupulous party. At this point there is, like, four or five extensions I trust enough to use, and it's mostly because they're OSS and it would be frontpage news on HN if any of them deviated from the expected functionality even slightly.
Having much finer-grained permission system would help a little, at the cost of making it incomprehensible to most users; there's a limit past which it's too complicated to be useful. We need actual innovation in the trust space - by which I don't mean crypto zero-trust shenanigans, but rather a system in which I can trust that, should the browser extension or phone app turn malicious, the vendor will be legally liable, and that it's actually enforced - thus disincentivizing malicious apps/extensions.
I was enthusiastic enough about extensions that I decided to publish a book about building them: https://www.buildingbrowserextensions.com/ Browser extensions are severely underrated as a platform because they aren't sexy. For all that mobile devices have given us, so much of our work continues to be done using a desktop browser. Enhancements such as augmenting websites with widgets, supplying contextual information,…
> Browser extensions are severely underrated as a platform because they aren't sexy. Nah, it's because it's a niche, fragmented platform on which it's very hard to make real money. It's also a very fragile platform that makes very clear you're a sharecropper who can be evicted on a whim by any browser vendor. I like extensions, I've built several for personal and public use, but I wouldn't invest a penny on them.
I have built a couple of extensions. It's not fun.
The review process, both on Chrome and on Firefox, is long and incredibly annoying. (For example, including minified versions of popular libraries like Lodash gets you stern warnings... Why can't the review process check automatically, and once and for all, that the library is safe and that the version included in an extension is correct?)
The promise of "build once, run everywhere" runs aground very fast because of slight differences between browsers, and because some bugs on Firefox stay unfixed for years.
Sideloading has been made difficult to the point of impossibility.
And now Manifest V3 sucked all the remaining fun out of it.
It's very clear you're building something on someone else's property; they don't like it, they don't like you, and they'll try to fire you at the flimsiest occasion.
Earlier quoted context omitted.
I know this hurts as a developer, but using this language is just a way of being sincere to the user.
As a user it's not that helpful when extensions which inject stuff into the page (lots of them) all say they can access your history and browsing data. Even though it's actually true, it feels like a gap in the permissions model.
> it feels like a gap in the permissions model.
Earlier quoted context omitted.
Maybe I'm underestimating the difficulty of this, but would it not make more sense for platforms to just give the user a complete listing of all the unique API function/method calls used by the app/extension with user-friendly descriptions of each? The APIs would still be grouped by permission, but the user would be able to expand into a list of checkmarks showing to what extent those permissions are used. As well, a…
Several problems. 1) Bypassing any sort of static analysis of your extension requires, at worst, crafting an arbitrary code execution attack against yourself. This is not particuarly difficult. 2) Often times, the specific method you want to use is more powerful than what you need to do, so even if you were restricted to those specific methods, you still have more power than you actually use. 3) Supposing you want to…
The example raised elsewhere in the thread is good: in a browser, if you have access to the current URL of any tab in context of which you run, you can start building browsing history. Whatever mitigations one could think of get defeated if the extension is allowed to make network requests, or modify content of web pages. Once an extension can communicate with outside world, it can exfil the data, even if piece by piece - and it can also keep its state outside of the browser.
Same applies to mobile apps.
I was enthusiastic enough about extensions that I decided to publish a book about building them: https://www.buildingbrowserextensions.com/ Browser extensions are severely underrated as a platform because they aren't sexy. For all that mobile devices have given us, so much of our work continues to be done using a desktop browser. Enhancements such as augmenting websites with widgets, supplying contextual information,…
Fx on Android allow add-ons. I've used them for years.