Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

271–280 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#271

Post by jameshart »

LoganDark wrote: post #245
rrr_oh_man wrote: post #243

Earlier quoted context omitted.

I think you underestimate how much we all are these resourceful idiots under the right circumstances.

I'm biased because I'm neurodivergent, which means I don't have as much experience with neurotypical thought processes. While I do use search engines and the resultant resources all the time, I don't follow steps completely cluelessly/mindlessly and later forget that I did it. I don't know what the equivalent would be for non-tech - I at least try to understand what a guide is doing so I can reproduce it independentl…

It’s not necessarily that you will forget that you changed a setting.

What’s more likely is that if you change a setting with an incomplete mental model of what that setting affects, you might later discover that it opened you up to some risk that you did not appreciate when you made the change.

This affects technical users just as much as nontechnical users, it just kicks in at a different level.

A user who clicks the ‘install anyway’ button on an OS warning dialog telling them they are about to run untrusted software might be doing so without an appreciation of quite how many safety features they just disabled, so when asked later on ‘when did you turn off your firewall?’ they honestly don’t know that was something they ever did.

But likewise, a developer who enables a setting to solve problem A, without realizing that that setting will also screw them when they run into problem B, is… basically the cause of 99% of debugging.

‘It can’t be DNS because that would always be cached, unless there’s some setting that… son of a bitch, who knew that when you enable debug logging it disables DNS caching?’ - some developer somewhere at least once a day

Re: Browser extensions are underrated: the promise of hackable software (2019)

#272

Post by dolmen »

sidwyn wrote: post #72
seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

The "read and change all your data" permission is a huge hurdle for our shopping extension, especially since we only need to identify shopping pages. What I've tried to build trust is to open source our tracking analytics (e.g. https://github.com/Score-Extension/score-extension-analytics... ). Hopefully transparency is one way to overcome this trust barrier.

We have the same issue. We have a browser extension that wants to extract data from given web pages (retailers, like yours), but there is no API to declare "I want to look at the content of this page only if the URL matches this pattern" or "Let me have a look at the URL and I will tell you if I want to look at the page content". It's unfortunately "all the web" or nothing.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#273

Post by dolmen »

Fogest wrote: post #135
redder23 wrote: post #81

Earlier quoted context omitted.

There is a button to format the code for minified files.

Formatting isn't the issue. Just more time consuming to try and read the code when it's all got garbage variable and function names. Not that you can't do it, just slightly more effort. Also the bigger issue I mentioned in my comment relates to the problem of extensions updating without any notice.

I expect that LLMs will help to make a breakthrough in reverse engineering by helping giving meaningful names to variables/functions.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#274

Post by olejorgenb »

account-5 wrote: post #192
olejorgenb wrote: post #82

Earlier quoted context omitted.

How do you "compile" the bookmarklets? I know of https://bookmarkl.ink/ but then we're back trusting some third-party service again. I get that it's not rocket science, but this is definitively a small hurdle to overcome.

I don't compile them. I just write the JavaScript and wrap it in an anonymous function then save the code as a bookmark.

Ah, I thought it didn't work to simply paste the javascript directly into the bookmark. Don't you have to minimally URI encode it? `javascript:URI_ENCODED_CODE`

Re: Browser extensions are underrated: the promise of hackable software (2019)

#275

Post by smudge-ai »

iansinnott wrote: post #223
smudge-ai wrote: post #220

While I fully agree with the hacker ethos of this post, a major issue I have with extensions today is that they're hard to trust. Chrome updates them automatically in most cases, which means a malicious update can easily slip by undetected. There are hordes of data companies looking to buy popular extensions or pay their authors to sneak spyware or other trackers in. The risk surface is massive, which is sad because…

Entirely agree, although as a developer the auto updating is definitely a feature. Since it lets you assume users are all on the same version. It is definitely a risk for users though. You can also "opt out" of automatic updates, but the process is a bit involved. 1. Locate the extension on disk 2. Copy it to some other location 3. Add it as a developer extension via the "Load unpacked" button in the extensions scree…

Great points. I'm the author of a few extensions and I do agree that it's nice to see the vast majority of users end up on the same version within a day. I think a reasonable middle-ground would be for Chrome to confirm that you want to perform the update if a privacy-sensitive change is made. For example: "This extension would now also like access to X/Y/Z. Confirm update?".

Even that would only be a small step in the right direction, though, since plenty of apps already have broad enough privacy settings to inject scripts on any page with no change needed to the app manifest's permissions.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#276

Post by snuxoll »

gleenn wrote: post #191
nottorp wrote: post #184

Earlier quoted context omitted.

There is already a permission system?

The issue the parent is trying to solve is you don't really have fine grained enough control, or apps nag you and won't load until you give them everything they want. My mom has a cheap camera security app that allows me to see the live streams from remote. Every single time I open the app it asks me again if I want to allow it access to my local network. The answer is a resounding "no". If I could just say "fake yes…

Denying "local network" permissions is hilariously worthless. On both Android and iOS all it does is prevent software from sending out multicast packets (for things like device discovery, Chromecast, etc. that don't use DNS-SD), it can still go ahead and just start trying to iterate through the entire RFC 1918 address space and try to connect to everything on your network.

I spent a bunch of time trying to figure out how I would implement such a feature on a standard Linux system to sandbox apps on my PinePhone, but there's no sane way you can implement a standard "you can have internet access but not touch my local network" policy.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#277

Post by dolmen »

swozey wrote: post #75
monkellipse wrote: post #23

I love the idea of browser extensions but they don’t appear to be worth the security/privacy risk for my use cases. I wonder how many others are like me and too paranoid to risk extensions at all?

I honestly can't imagine not using extensions. I'm 39 and have been on the web since Netscape etc in the early 90s and I honestly care more about the extensions than I do anything the browser actually does. Like, if there were no extensions I don't think I'd care at all if I used Firefox, Chrome, Opera, etc. But Chrome and Firefox have this massive, massive ecosystem of productitivy improving extensions. I'll give an…

So this is another social network, on top of the web. Another walled garden.

From the terms of service: > Our services evolve constantly. As such, the services may change from time to time, at our discretion. We may stop (permanently or temporarily) providing the services or any features within the services to you or to users generally. We also retain the right to create limits on use and storage at our sole discretion at any time. We may also remove or refuse to distribute any content on the services, suspend or terminate users, and reclaim usernames without liability to you.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#278

Post by [deleted] »

Malcolmlisk wrote: post #265
LoganDark wrote: post #256

Earlier quoted context omitted.

> I’m biased right now because you assume stuff about me that you maybe shouldn’t. I only talked about "typical thought processes" because you said "we all" which I assume meant the general population. Didn't assume anything about you. Even though the base problem was given to me by another, everything I wrote about "what makes a resourceful idiot / how they are a problem" is based on my personal perception of the on…

At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical. The mind process you have described is pretty standard, even using some different things to recover information instead of saving it. There is no ne…

[deleted]

Re: Browser extensions are underrated: the promise of hackable software (2019)

#279

Post by bobajeff »

1vuio0pswjnm7 wrote: post #174
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

"I don't care to live in strategically lost situatios like this, so I think the conversation should be about Firefox extensions." Why would the conversation not be about editing the Firefox source code to add or remove "features" to meet one's personal needs. What is the point of "open source" if, to use the term from the submission title, the software is effectively un-"hackable". There is no small amount of "attack…

Unlike you I don't have a dislike of graphics. I do however see value in small simple software. The Web is a runtime so very complex that it takes huge organizations to create.

Theoretically, you could sacrifice full compatibility by implementing only the APIs used for Google, Facebook, YouTube, Reddit, Amazon etc. and have something much simpler. But that would still be a hard task because you are making a big compatibility hack for certain websites. Like the wine compatibility layer only for websites. Except that the websites could stop working at anytime and then you'll have to pile on more interfaces to keep up with them.

When evaluating software utility we often times forget that websites are software and don't attempt cost them in. Using them is a recurring cost in terms of complexity. They are definitely not free or even low cost.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#280

Post by medstrom »

Malcolmlisk wrote: post #265
LoganDark wrote: post #256

Earlier quoted context omitted.

> I’m biased right now because you assume stuff about me that you maybe shouldn’t. I only talked about "typical thought processes" because you said "we all" which I assume meant the general population. Didn't assume anything about you. Even though the base problem was given to me by another, everything I wrote about "what makes a resourceful idiot / how they are a problem" is based on my personal perception of the on…

At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical. The mind process you have described is pretty standard, even using some different things to recover information instead of saving it. There is no ne…

This comment is puzzling to me on several levels, but I'll just go to the centre of the topic. Do you feel that something needs to be addressed about the way LoganDark disclaimed that they were biased on account of their neurodivergency?
Post reply on HN