Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

221–230 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#221

Post by deepsun »

smudge-ai wrote: post #220

While I fully agree with the hacker ethos of this post, a major issue I have with extensions today is that they're hard to trust. Chrome updates them automatically in most cases, which means a malicious update can easily slip by undetected. There are hordes of data companies looking to buy popular extensions or pay their authors to sneak spyware or other trackers in. The risk surface is massive, which is sad because…

Same thing with NPM/PIP dependencies (they can launch arbitrary code and clean up after, unlike Java deps from maven that just copy immutable archives).

Re: Browser extensions are underrated: the promise of hackable software (2019)

#222

Post by transpute »

exe34 wrote: post #170
gklitt wrote: post #148

Post author here! I wrote this post five years ago. Since then, my conviction in the value of customizable software has only grown, but I've also updated my thinking in a few ways: 1) AI AI is rapidly getting better at coding. Current AI is often bad at high-level architecture but is capable of making small local tweaks. Seems like a good fit for the kind of code you need to write a browser extension! I'm exploring t…

Executing untrusted code would be a lot safer if browsers and mobile OSes would make it easy to provide fake resources to the app/extension. Yes, you may read my phone contents, and as far as you know, it's the contents, the whole contents and nothing but the contents - it just happens to be a folder to me. An empty folder. It's a new phone you see. Yes here's my contact list. Sorry it's mostly empty, there's just th…

iOS does offer options for "read selected photos" and "add-only photos".

Contact list subset and pseudo-sensors (camera, microphone, accelerometer, barometer) are much needed.

Preset location is also needed, but some apps enforce DRM or other policy by location.

App-level network policy (whitelist, blacklist) is needed. For enterprise MDM, iOS allows per-app VPNs, which could enforce app-specific network filtering. With Apple Configurator policy files, Safari can have on-demand VPNs for specific websites.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#223

Post by iansinnott »

smudge-ai wrote: post #220

While I fully agree with the hacker ethos of this post, a major issue I have with extensions today is that they're hard to trust. Chrome updates them automatically in most cases, which means a malicious update can easily slip by undetected. There are hordes of data companies looking to buy popular extensions or pay their authors to sneak spyware or other trackers in. The risk surface is massive, which is sad because…

Entirely agree, although as a developer the auto updating is definitely a feature. Since it lets you assume users are all on the same version.

It is definitely a risk for users though.

You can also "opt out" of automatic updates, but the process is a bit involved.

1. Locate the extension on disk

2. Copy it to some other location

3. Add it as a developer extension via the "Load unpacked" button in the extensions screen.

I would also advocate for extensions being open source, but of course most of them are not.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#224

Post by tbtech_vn »

1vuio0pswjnm7 wrote: post #174
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

"I don't care to live in strategically lost situatios like this, so I think the conversation should be about Firefox extensions." Why would the conversation not be about editing the Firefox source code to add or remove "features" to meet one's personal needs. What is the point of "open source" if, to use the term from the submission title, the software is effectively un-"hackable". There is no small amount of "attack…

I'd very much love to be able to clearly remove features I don't want and use, including a lot of the things about profiles, then use a tool to remove all unused codepaths to make a fast, usable and hopefully easier to understand product. But who has the time to dig into the behemoths of firefox and chrome today? It's just too much code to easily grasp.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#225

Post by Dwedit »

bee_rider wrote: post #173
Pxtl wrote: post #156

Earlier quoted context omitted.

Honestly as much as I love Firefox this is an underrated concern. Firefox allows their extensions to be far more powerful than Chrome's, but that power means they are also far more dangerous. If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever? Chrome, for all its faults, has ruined their extension framework at least in part…

I’d be really curious about in a system where browser extensions are limited to ~200 lines of code. No mechanism for distribution beyond typing text in. No concerns about permission. It would be interesting to see what people can do in an ecosystem where extensions can actually do anything but it is expected that people will actually read the code before running it.

Tampermonkey?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#226

Post by dugite-code »

mg wrote: post #69

I prefer bookmarklets because they - Are easy to edit - Are inactive until clicked - Work in all browsers - Work on mobile - Integrate nicely into the UI. I can move them around, put them into any bookmark folder, assign shortcuts. I wrote this bookmarlet editor which makes it easy to convert between clean code and a bookmarklet: https://www.gibney.org/bookmarklet_editor

Well that's a handy site you have there. Last time I fiddled with bookmarklets they didn't work on Firefox for Android, but now they do. This is going to be handy combining it with my Node-red instance.

Got any good bookmarklets you want to share?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#227

Post by Gigachad »

Rapzid wrote: post #93
swozey wrote: post #61

I program (not js/ts), use a massive number extensions and consider myself an absolute power user of them and refuse to ever use a browser WITHOUT the chrome/firefox extension ecosystem, I've written themes for Chrome and VScode, but I'm still here- (like pink/cyan? get on in! https://marketplace.visualstudio.com/items?itemName=mikejk8s... ). I have no idea via the Chrome prompts what extensions are able to do, read,…

I'm pretty sure it's as bad as it sounds haha. Like another user mentioned because of this I only trust a few key extensions(and like that user uBlock, Bitwarden, etc) with this sorta access. I'd be very wary of those scrapy screen/session recording startups if for no other reason than they could be particularly vulnerable to supply chain attacks.

Not only is it theoretically as bad as it sounds, its as bad as it sounds in reality as well. Most of the top extensions get sold to ad companies and silently start sucking up all of your browsing data to sell on. Some of them start injecting their own adverts and tracker scripts on to pages, some of them are outright stealing your credentials.

And you realistically have no way to sort the good from the bad. Especially when the good silently get sold to the bad and automatically updated.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#228

Post by jwells89 »

transpute wrote: post #222
exe34 wrote: post #170

Earlier quoted context omitted.

Executing untrusted code would be a lot safer if browsers and mobile OSes would make it easy to provide fake resources to the app/extension. Yes, you may read my phone contents, and as far as you know, it's the contents, the whole contents and nothing but the contents - it just happens to be a folder to me. An empty folder. It's a new phone you see. Yes here's my contact list. Sorry it's mostly empty, there's just th…

iOS does offer options for "read selected photos" and "add-only photos". Contact list subset and pseudo-sensors (camera, microphone, accelerometer, barometer) are much needed. Preset location is also needed, but some apps enforce DRM or other policy by location. App-level network policy (whitelist, blacklist) is needed. For enterprise MDM, iOS allows per-app VPNs, which could enforce app-specific network filtering. W…

> iOS does offer options for "read selected photos" and "add-only photos".

The annoying thing here is how apps insist on either requiring full album access so they can implement their own photo picker or don’t provide a button to re-trigger reselection of “selected photos”.

I wish they’d just use the standard OS selector dialog and call it a day. I don’t care if the standard selector doesn’t meet some stupid product requirement, it’s good enough.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#229

Post by mmis1000 »

weaksauce wrote: post #153
swozey wrote: post #61

I program (not js/ts), use a massive number extensions and consider myself an absolute power user of them and refuse to ever use a browser WITHOUT the chrome/firefox extension ecosystem, I've written themes for Chrome and VScode, but I'm still here- (like pink/cyan? get on in! https://marketplace.visualstudio.com/items?itemName=mikejk8s... ). I have no idea via the Chrome prompts what extensions are able to do, read,…

yes it’s that bad. i’ve written some webexts and if you ask for all data it really is all data... otherwise how would it work if you needed to change something on a page? i keep my list to my own bespoke one-off extensions or only the major big names or i audit the code manually.

Yep, I always think the 'all data' means there is no official api to do it, so I screw it and make my own from ground up.

Unfortunately browsers only make specific api for task that many people does. So there is always a portion of extensions need the 'all data' because there is no way otherwise.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#230

Post by jwells89 »

exe34 wrote: post #170
gklitt wrote: post #148

Post author here! I wrote this post five years ago. Since then, my conviction in the value of customizable software has only grown, but I've also updated my thinking in a few ways: 1) AI AI is rapidly getting better at coding. Current AI is often bad at high-level architecture but is capable of making small local tweaks. Seems like a good fit for the kind of code you need to write a browser extension! I'm exploring t…

Executing untrusted code would be a lot safer if browsers and mobile OSes would make it easy to provide fake resources to the app/extension. Yes, you may read my phone contents, and as far as you know, it's the contents, the whole contents and nothing but the contents - it just happens to be a folder to me. An empty folder. It's a new phone you see. Yes here's my contact list. Sorry it's mostly empty, there's just th…

Similarly every browser should have the capability to report to sites that the user has notifications enabled when they actually don’t to end those annoying in-site “pre-prompts” which bait you into saying no to the pre-prompts so they can try to ask you again later, rather than just deal with the fact that the user denied permission with the browser-level prompt and isn’t interested.
Post reply on HN