Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn checks for 2953 browser extensions

github.com

Post reply on HN
Print view View original

221–230 of 263 posts

Re: LinkedIn checks for 2953 browser extensions

#221

Post by mrweasel »

awesome_dude wrote: post #70
cbsks wrote: post #44

Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif... On Firefox, web accessible resources are available at "moz-extension:// /myfile.png" is not your extension's ID. This ID is randomly gener…

This is probably a naive question, but... Doesn't the idea of swapping extension specific IDs to your browser specific extension IDs mean that instead of your browser being identifiable, you become identifiable? I mean, it goes from "Oh they have X, Y , and Z installed" to "Oh, it's jim bob, only he has that unique set of IDs for extensions"

Why does the browser even allow a website to query for installed extensions? I really don't see what the point of that would be.

The website should never be able to tell what's running in my browser, or on my computer in general. The browser renders the page, maybe runs a little Javascript, but there's no reason why it should be able to query anything about my environment.

I wonder how much stuff would break if the Chrome sandboxing was extended to preventing access to chrome-extension:// from Javascript loaded of random websites.

Re: LinkedIn checks for 2953 browser extensions

#222

Post by cranberryturkey »

rchaud wrote: post #71
cbsks wrote: post #44

Looks like Firefox is immune. This works by looking for web accessible resources that are provided by the extensions. For Chrome, these are are available in a webpage via the URL chrome-extension://[PACKAGE ID]/[PATH] https://developer.chrome.com/docs/extensions/reference/manif... On Firefox, web accessible resources are available at "moz-extension:// /myfile.png" is not your extension's ID. This ID is randomly gener…

And they said that using a browser with sub-5% market share would cause us to miss out on the latest and greatest in web technology!

The real friction in browser hopping isn't features — it's keeping your workflow portable. Bookmarks especially. Each browser has its own sync silo (Chrome → Google, Firefox → Mozilla, Safari → iCloud).

For multi-browser setups (Firefox for fingerprint resistance, Chrome for the sites that only work there), cross-browser bookmark sync is weirdly undersolved. Xbrowsersync, marksyncr, and a few others exist but most people don't know about them.

Re: LinkedIn checks for 2953 browser extensions

#223

Post by lapcat »

cxr wrote: post #107
lapcat wrote: post #100

Earlier quoted context omitted.

> The fact that you have now replied—which automatically disables comment deletion—is the only thing that prevented my removing it just now. So great job. How was I supposed to know that you intended to delete it? In any case, you may still have time to edit your comment, as I did with my erroneous root-level comment, since I can't delete that either, for the same reason.

Not interested. You also shouldn't have done that. You broke the thread—exactly what HN's no-deleting-comments-that-have-replies check was created to prevent. Consider this: just stop being reckless.

I wrote an erroneous comment in haste, which I regret. However, this kind of thing happens countless times every day on HN. It's not unusual. Except perhaps the regret part: unlike me, many of those other commenters admit no error and express no regret.

If you truly cared about HN etiquette as much as you claim, you wouldn't post haughty hyperbole such as "Consider this: just stop being reckless" and "The person you're responding to has a habit of posting implausible-but-plausibly-plausible nonsense," which go against the HN guidelines, as you may already know. Be honest: do you actually care about the thread? Why would you care, when you ridiculed my top-level comment? Who are you trying to save the thread for, posterity? Nobody cares. The thread had already been downvoted to the bottom of the submission, and the top-level comment was misinformation, so I removed it, because no more people needed to read the misinformation or respond to it. Nothing of value was lost, and I thought my action was prudent, but in any case, the term "reckless" makes a mountain out of a molehill.

My impression is that you made a bigger deal out of this than is warranted because you appear to have some kind of strange, unexplained, preexisting grudge against me and take any minor fault as an excuse to bash me personally. I have no objection to correcting a falsehood, but please keep your personal feelings to yourself and the personal attacks out of the comments.

Re: LinkedIn checks for 2953 browser extensions

#224

Post by bluebxrry »

shj2105 wrote: post #67
DrStartup wrote: post #61

Setup a quick CDP connection. Have Claude Code attach and inject JS into Page.addScriptToEvaluateOnNewDocument. Loads before the page. Typical early hooks: • fetch wrapper • XMLHttpRequest.prototype.open/send wrapper • WebSocket constructor wrapper • history.pushState/replaceState wrapper • EventTarget.addEventListener wrapper (optional, heavy) • MutationObserver for DOM diffs • Error + unhandledrejection capture

what would this do?

It increases the number of jobs at the job factory. You write it into a Chrome extension and name it 2954.

Re: LinkedIn checks for 2953 browser extensions

#225

Post by Ghoelian »

awesome_dude wrote: post #79
triceratops wrote: post #76

Earlier quoted context omitted.

It's not a naive question. This comment says it's not possible to do that: https://news.ycombinator.com/item?id=46905213

Oh, it's (re)randomised upon each restart, whew, thanks for the heads up edit: er, I think that that also suggests that I need to restart firefox more often...

I don't think that's the case. I have the Earth View extension installed which shows a random google earth image.

I have this set as my homepage in Firefox as moz-extension:///index.html, and this has not changed since installing the extension. The page still works.

Re: LinkedIn checks for 2953 browser extensions

#226

Post by Velocifyer »

stirfish wrote: post #115
throwaway808081 wrote: post #110

Earlier quoted context omitted.

Just have a database of UUIDs. Seems pretty trivial to generate and sort as it's only 16 bytes each.

lol Let's go a step further and just iterate through them on the client. I plan on having this phone well past the heat death of the universe, so this is guaranteed to finish on my hardware. function* uuidIterator() { const bytes = new Uint8Array(16); while (true) { yield formatUUID(bytes); let carry = 1; for (let i = 15; i >= 0 && carry; i--) { const sum = bytes[i] + carry; bytes[i] = sum & 0xff; carry = sum > 0xff…

What license is this? Company policy says we can't use Apache licensed stuff.

Re: LinkedIn checks for 2953 browser extensions

#227

Post by esprehn »

Reading the fingerprint.js is interesting, it's not just the thousands of extensions. It looks like it's also probing for a long list of webgl extensions, fonts, and other capabilities. There's recaptcha v3 references in there too.

Perhaps an overly aggressive attempt to block bots.

Re: LinkedIn checks for 2953 browser extensions

#228

Post by timnetworks »

cranberryturkey wrote: post #222
rchaud wrote: post #71

Earlier quoted context omitted.

And they said that using a browser with sub-5% market share would cause us to miss out on the latest and greatest in web technology!

The real friction in browser hopping isn't features — it's keeping your workflow portable. Bookmarks especially. Each browser has its own sync silo (Chrome → Google, Firefox → Mozilla, Safari → iCloud). For multi-browser setups (Firefox for fingerprint resistance, Chrome for the sites that only work there), cross-browser bookmark sync is weirdly undersolved. Xbrowsersync, marksyncr, and a few others exist but most pe…

Anecdote: yesterday i exported my bookmarks into an html file and then asked for a script that will make a webpage out of them. with a search. and favicon download from domain. better than any bookmark bar imho.

Re: LinkedIn checks for 2953 browser extensions

#229

Post by [deleted] »

Ghoelian wrote: post #225
awesome_dude wrote: post #79

Earlier quoted context omitted.

Oh, it's (re)randomised upon each restart, whew, thanks for the heads up edit: er, I think that that also suggests that I need to restart firefox more often...

I don't think that's the case. I have the Earth View extension installed which shows a random google earth image. I have this set as my homepage in Firefox as moz-extension:// /index.html, and this has not changed since installing the extension. The page still works.

[deleted]

Re: LinkedIn checks for 2953 browser extensions

#230

Post by rpigab »

Banditoz wrote: post #156

LinkedIn has been employing a lot of strange dark patterns recently: * Overriding scroll speed on Firefox Web. Not sure why. * Opening a profile on mobile web, then pressing back to go to last page, takes me to the LinkedIn homepage everytime. * One of their analytic URLs is a randomly generated path on www.linkedin.com, supposedly to make it harder to block. Regex rules on ublock origin sufficiently stop this. Anyon…

I've been wondering why my scroll speed was off in LinkedIn, inspecting scroll-related css without finding an answer, I thought this was a bug. Anyone know what property does this? I might try to fix it with uBO scripts.

I think they want you to feel disoriented.

Why do they do all this bs and not fix the bug that happens when you insert Unicode U+202E in your name?

I've been having loads of fun with that but it's never been fixed. Anyone tagging me in a comment makes their input right-to-left unless they backspace the tag or insert newline. It also jumbles notification text because your name is concatenated to the notification static text.

You can also create an inverted link but it isn't clickable, just like other unicode links which aren't punycode-encoded on LinkedIn but aren't clickable (on the clients I've tried).

Post reply on HN