I really like your article I agree with your point that extensions are tools for extend current software functionalities and see beyond the creators...
Currently Im working on a Gmail and Outlook extension for email called Mailverse that add superpowers to the current email clients.
Browser extensions are underrated: the promise of hackable software (2019)
231–240 of 320 posts
Re: Browser extensions are underrated: the promise of hackable software (2019)
#232Post author here! I wrote this post five years ago. Since then, my conviction in the value of customizable software has only grown, but I've also updated my thinking in a few ways: 1) AI AI is rapidly getting better at coding. Current AI is often bad at high-level architecture but is capable of making small local tweaks. Seems like a good fit for the kind of code you need to write a browser extension! I'm exploring t…
> Customizability is important enough that it may be worth prioritizing it over security in some cases.
100% this. It should at least be acknowledged that "security" often means less options for the user.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#233Earlier quoted context omitted.
I’d be really curious about in a system where browser extensions are limited to ~200 lines of code. No mechanism for distribution beyond typing text in. No concerns about permission. It would be interesting to see what people can do in an ecosystem where extensions can actually do anything but it is expected that people will actually read the code before running it.
My reaction would be simpler: Anything that's identified as risky? Show the user. Extension is making an HTTP request? Show the body in a toast. Extension is reading the keyboard? Same thing. Extension is looking at the page? Little icon in the corner showing the name of the extension and that it looked. Can't be turned off. So extensions can still do all that crazy stuff, but they're noisy about it.
If nothing else, basic logs of everything an extension does should be kept so that technically knowledgable users can take a look at the logs periodically (and maybe have them watched automatically by tools) to make sure everything checks out.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#234Earlier quoted context omitted.
iOS does offer options for "read selected photos" and "add-only photos". Contact list subset and pseudo-sensors (camera, microphone, accelerometer, barometer) are much needed. Preset location is also needed, but some apps enforce DRM or other policy by location. App-level network policy (whitelist, blacklist) is needed. For enterprise MDM, iOS allows per-app VPNs, which could enforce app-specific network filtering. W…
> iOS does offer options for "read selected photos" and "add-only photos". The annoying thing here is how apps insist on either requiring full album access so they can implement their own photo picker or don’t provide a button to re-trigger reselection of “selected photos”. I wish they’d just use the standard OS selector dialog and call it a day. I don’t care if the standard selector doesn’t meet some stupid product…
> don't provide a button to re-trigger reselection of "selected photos"
iOS Settings should have an app setting menu to "Edit Selected Photos".
Re: Browser extensions are underrated: the promise of hackable software (2019)
#235Earlier quoted context omitted.
Executing untrusted code would be a lot safer if browsers and mobile OSes would make it easy to provide fake resources to the app/extension. Yes, you may read my phone contents, and as far as you know, it's the contents, the whole contents and nothing but the contents - it just happens to be a folder to me. An empty folder. It's a new phone you see. Yes here's my contact list. Sorry it's mostly empty, there's just th…
I don’t think this is a bad idea per se (after all a fundamental principle of the open web is that the user should control the browser). However, although your suggestion is fun, it is mere civil disobedience for geeks. The million dollar question is: how do you deliver those capabilities (a) without having grandmas phone full of spyware and (b) without giving your favorite Silicon Valley thought leader a 40% cut and…
> The million dollar question is: how do you deliver those capabilities (a) without having grandmas phone full of spyware and (b) without giving your favorite Silicon Valley thought leader a 40% cut and total control of the ecosystem?
That seems orthogonal? Grandma's phone has the same spyware either way, but this makes it a toss up whether it can spy on anything real
Re: Browser extensions are underrated: the promise of hackable software (2019)
#236Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…
"I don't care to live in strategically lost situatios like this, so I think the conversation should be about Firefox extensions." Why would the conversation not be about editing the Firefox source code to add or remove "features" to meet one's personal needs. What is the point of "open source" if, to use the term from the submission title, the software is effectively un-"hackable". There is no small amount of "attack…
> Why would the conversation not be about editing the Firefox source code to add or remove "features" to meet one's personal needs.
Because extensions are way easier to write, less likely to break because they use mostly stable public interfaces, and don't require an amazingly long compile.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#237Scripting + Raycast / Alfred
Re: Browser extensions are underrated: the promise of hackable software (2019)
#238Post author here! I wrote this post five years ago. Since then, my conviction in the value of customizable software has only grown, but I've also updated my thinking in a few ways: 1) AI AI is rapidly getting better at coding. Current AI is often bad at high-level architecture but is capable of making small local tweaks. Seems like a good fit for the kind of code you need to write a browser extension! I'm exploring t…
Solution: move everything to client side.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#239Earlier quoted context omitted.
I'm so excited about the malleable software / local-first / local-AI crossover, I feel like we are at the dawn of a new era of software. If we play our cards right, we can bring back control of our data from the large corporations, have ownership, and more control of how we work. I'm particularly interested in how general purpose CRDT toolkits like Automerge and Yjs could become the backing filetype for local-first s…
taking back control from evil corporations is a funding/finance problem, not a technology problem. Everyone dreams of democratized ownership until they have to pay the huge developer salaries. and the go to market costs are even higher than that, all channels are saturated and you have to be louder than the noise.
It’s absolutely a technology problem. The hacker mentality is still the one who innovates and a single person is more than enough to make a significant contribution towards a very different future. That person is probably already working on it.
Re: Browser extensions are underrated: the promise of hackable software (2019)
#240Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…
>probably better to have that as a native browser feature /Agree. It is crazy that I have to trust some unknown coder with all my browser data just to enable vertical tabs in Firefox. Of course many of these extensions are open source and thus auditable. As I lack the skill to detect nefarious code, I am wondering if this might be a good use case for AI. Anyone have thoughts on building a good malware finding prompts…
This is a really great idea and use case. It also makes a ton of sense as a pilot use case for this type of open source project given extensions are smaller in scope.
I mean even having it document a best draft of what the extension code is doing would be awesome.
Unless it’s made into an extension and then you have a recursive hell.