Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

261–270 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#261

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #174
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

"I don't care to live in strategically lost situatios like this, so I think the conversation should be about Firefox extensions." Why would the conversation not be about editing the Firefox source code to add or remove "features" to meet one's personal needs. What is the point of "open source" if, to use the term from the submission title, the software is effectively un-"hackable". There is no small amount of "attack…

The impedence to compiling IMHO defeats the point of open source. I use a text-only browser I can compile in less than a minute. I use an HTTP generator that compiles in two seconds. The so-called "modern" browser is a PITA. A nuisance. An unfortunate necessity for accomplishing certain tasks, e.g., commercial transactions such as banking or shopping. But most of the time I am using the web I am not doing those tasks.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#262

Post by loceng »

pyinstallwoes wrote: post #239
dustingetz wrote: post #193

Earlier quoted context omitted.

taking back control from evil corporations is a funding/finance problem, not a technology problem. Everyone dreams of democratized ownership until they have to pay the huge developer salaries. and the go to market costs are even higher than that, all channels are saturated and you have to be louder than the noise.

It’s absolutely a technology problem. The hacker mentality is still the one who innovates and a single person is more than enough to make a significant contribution towards a very different future. That person is probably already working on it.

And here I will interject and argue a third point that it's primarily an organizational problem, and I am already working on it.

Not ready to spill the beans yet though on my projects, first have low back surgery tomorrow to get an artificial disc put in between L5-S1 - and will see how much my overall pain goes down, and how much my productivity can go up - before knowing when I can make any public announcements.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#263

Post by PurpleRamen »

Pxtl wrote: post #156
foobiekr wrote: post #107

Earlier quoted context omitted.

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Honestly as much as I love Firefox this is an underrated concern. Firefox allows their extensions to be far more powerful than Chrome's, but that power means they are also far more dangerous. If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever? Chrome, for all its faults, has ruined their extension framework at least in part…

> If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever?

We've been there, nobody died. 15+ Years ago, Firefox was significant more powerful, while also having a significant higher marketshare.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#264

Post by PurpleRamen »

Animats wrote: post #103
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Most browser extensions seem to be used on Firefox, because Google is so hostile to ones on Chrome. With the decline of Firefox, the extension world has shrunk. I had something called "Ad Limiter" on both Firefox and Chrome for a decade. Identical code, even. Google sent me threatening messages last year, as they tightened the screws on ad blockers, and I dropped it for Chrome.

Firefox is not really less hostile now. You can't even install and maintain local add-ons anymore. You can either install them temporary, and they are removed when the app closes. Or you must upload and sign them to their store.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#265

Post by Malcolmlisk »

LoganDark wrote: post #256
rrr_oh_man wrote: post #253

Earlier quoted context omitted.

> I'm biased because I'm neurodivergent, which means I don't have as much experience with neurotypical thought processes. > I'm so confused, heh I’m biased right now because you assume stuff about me that you maybe shouldn’t. Everyone’s experiences and thought processes might be starkly different from each other. (No matter which observational group you put people into.)

> I’m biased right now because you assume stuff about me that you maybe shouldn’t. I only talked about "typical thought processes" because you said "we all" which I assume meant the general population. Didn't assume anything about you. Even though the base problem was given to me by another, everything I wrote about "what makes a resourceful idiot / how they are a problem" is based on my personal perception of the on…

At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical.

The mind process you have described is pretty standard, even using some different things to recover information instead of saving it. There is no neurodivergent path of extracting information and there is no neurodivergent understanding of reality or neurodivergent thought process.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#266

Post by asjir »

dvdkon wrote: post #140
Spivak wrote: post #122

Earlier quoted context omitted.

It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people, desktop software is more difficult develop (for your average hacker wannabe), more difficult to get users to install, and has far less valuable data to go after. I actually very much like Apple's approach to browser extensions forcing them to be truly installed software and in the purv…

On a typical PC, installed software has even more permissions than a browser extension, and all any malware author has to do is write their own keylogger or upload the browser cookie database. Sure, it's a little more effort, but I think the only real advantage that malicious browser extensions have over native programs is the discoverability and auto-update Google and Mozilla give them "for free".

Wouldn't AV pick up uploading browser cookies?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#267

Post by asjir »

mardifoufs wrote: post #204
a13o wrote: post #50

Earlier quoted context omitted.

In chrome go to chrome://extensions, enable developer mode, and now you can view source for any extension in devtools. The content scripts are already available in the regular web page's devtools without enabling developer mode. The total list of websites is available in the installation popup for the extension. The chrome web store already bans code obfuscation. minification is allowed as there's no meaningful way t…

Is there any legitimate reason to minify code for extensions? The size gains are minimal since it's a one time thing. But I agree that it would be hard to enforce, though google "manages" to enforce even more ambiguous requirements on their play store haha. I guess they could make it a guideline or a requirement, and "good faith" devs would comply even if it would be hard to enforce.

It would be waay easier than e.g. deciding if a YT video is for kids. You can immediately generate all the data by taking all unminified chrome extensions and minifying them, so you can validate your detection accuracy, then flag those that are minified on the store page, and provide some appeal option for devs just in case.

Come to think of it, it could be a chrome extension...

Re: Browser extensions are underrated: the promise of hackable software (2019)

#268

Post by paulryanrogers »

CharlesW wrote: post #211
wiseowise wrote: post #195

Earlier quoted context omitted.

> I'm happy to have guardrails if they improve non-technical users' safety. Not at the expense of expert freedom.

Safety is paramount for experts. Those who disregard the importance of safety are likely not experts in their field. If the "console" analogy doesn't resonate, think of Apple as NASCAR. NASCAR has created a private ecosystem. Participating in NASCAR as a team or a driver is a choice, contingent upon meeting their requirements and paying entry fees. NASCAR implements numerous safety measures — SAFER barriers, catch fe…

Most users have no idea the tradeoffs between the two. Or the dominance both have in their respective realms. Or the possibilities of having more viable platform choices.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#269

Post by Pxtl »

bee_rider wrote: post #197
Pxtl wrote: post #178

Earlier quoted context omitted.

My reaction would be simpler: Anything that's identified as risky? Show the user. Extension is making an HTTP request? Show the body in a toast. Extension is reading the keyboard? Same thing. Extension is looking at the page? Little icon in the corner showing the name of the extension and that it looked. Can't be turned off. So extensions can still do all that crazy stuff, but they're noisy about it.

I don’t really see this as simpler: 1) “identified as risky” seems like it could hide some significant complexity (and room for error). 2) An extension might need to read from the keyboard. I don’t want to OK it every time. If I check once and then mark it as OK, I’d be worried that it could do something evil with that permission somehow, in a far-flung bit of the code.

I'm not saying a popover modal, I'm saying a toast notification or a status-bar icon. Non-blocking.

Like, when you're typing and it's being monitored: in the corner of the window it says"Extension TweetSyndicator is reading your keyboard. Click here to manage extension."

Re: Browser extensions are underrated: the promise of hackable software (2019)

#270

Post by Pxtl »

PurpleRamen wrote: post #263
Pxtl wrote: post #156

Earlier quoted context omitted.

Honestly as much as I love Firefox this is an underrated concern. Firefox allows their extensions to be far more powerful than Chrome's, but that power means they are also far more dangerous. If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever? Chrome, for all its faults, has ruined their extension framework at least in part…

> If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever? We've been there, nobody died. 15+ Years ago, Firefox was significant more powerful, while also having a significant higher marketshare.

Yes but that was before cryptocurrency created a new era of crime monetization.
Post reply on HN