Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

281–290 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#281
post #156

Earlier quoted context omitted.

Honestly as much as I love Firefox this is an underrated concern. Firefox allows their extensions to be far more powerful than Chrome's, but that power means they are also far more dangerous. If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever? Chrome, for all its faults, has ruined their extension framework at least in part…

> If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever? We've been there, nobody died. 15+ Years ago, Firefox was significant more powerful, while also having a significant higher marketshare.

> We've been there, nobody died.

[Citation needed]

Re: Browser extensions are underrated: the promise of hackable software (2019)

#282
post #225

Earlier quoted context omitted.

I’d be really curious about in a system where browser extensions are limited to ~200 lines of code. No mechanism for distribution beyond typing text in. No concerns about permission. It would be interesting to see what people can do in an ecosystem where extensions can actually do anything but it is expected that people will actually read the code before running it.

Tampermonkey?

And bookmarklets. These are leftover artifacts of the time when computers worked for us.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#283

Earlier quoted context omitted.

Bear in mind that on iOS, you can't just prompt for permission; those "regular users" need to be able to navigate to the settings app, find the relevant (deeply nested) section, and enable it there. That narrows the gap significantly - to users who can't understand the issues, but can (even with the app providing an explanation) find reasonably well-hidden settings.

I've heard from a couple developers over the years that it's entirely impossible to implement a setting that will not be changed by people who don't know what it does. It doesn't matter if it's behind a footnote, an easter egg, a password input, a magic email code, a call with the main project developer, all of the above, etc. No matter how many steps you try to add, there are still an incredible number of idiots who…

I bookmarked this post, thanks! Really interesting.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#284
post #266
post #140

Earlier quoted context omitted.

On a typical PC, installed software has even more permissions than a browser extension, and all any malware author has to do is write their own keylogger or upload the browser cookie database. Sure, it's a little more effort, but I think the only real advantage that malicious browser extensions have over native programs is the discoverability and auto-update Google and Mozilla give them "for free".

Wouldn't AV pick up uploading browser cookies?

I don't know, it would simple enough to catch, but would also flag access by file managers. Probably the only way is to test. Generally I've found writing malware from scratch is enough to get it through AV, but I only tested on what I had installed.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#285
post #148

Post author here! I wrote this post five years ago. Since then, my conviction in the value of customizable software has only grown, but I've also updated my thinking in a few ways: 1) AI AI is rapidly getting better at coding. Current AI is often bad at high-level architecture but is capable of making small local tweaks. Seems like a good fit for the kind of code you need to write a browser extension! I'm exploring t…

Major limitation of browser extensions is that if you want to just write them for yourself, there's no user friendly, scalable way to install them. There's no way to tell the browser that you trust all extensions in some directory to be loaded automatically and be used without signing and without maybe even having to be packed into XPI file. There's no "put a bunch of code+manifest into a directory and have browser use that" feature. This kind of simple deployment drove me to write a ton of userscripts when greasemonky just loaded plain files from gm_scripts/ subdir of browser profile directory. It was fun and easy to extend websites back then. Mozilla killed all that.

Deployment is just terrible. There's no way I'm sending my extensions somewhere over the internet to get signed after every change so I can use code I wrote on my own computer. WTF distopia is that? Nevermind the last time I checked the tooling for signing is some stupid ass 100MiB+ NPM/node app I have to now trust too. It's bigger than a freaking Linux kernel build itself.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#286

Earlier quoted context omitted.

Custom keyboards are a great example of an app that - by default - shouldn't have write access to shared resources (that is, no network access, no writing to files which other apps can read). Adding either of those entitlements to a keyboard app should require extremely scary dialogs. Needs to be possible - perhaps you want your password manager with sync to be part of the keyboard app - but it's clearly a huge risk.

Until you want to be able to download language dictionaries or updated language model. Or if your keyboard is actually a remote keyboard or shared keyboard taking input from some other devices.

> Until you want to be able to download language dictionaries or updated language model.

You don't need the keyboard application to be able to communicate externally for that. You could have a separate, optional, downloader/installer. That's better for security all around.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#287

Earlier quoted context omitted.

> I’m biased right now because you assume stuff about me that you maybe shouldn’t. I only talked about "typical thought processes" because you said "we all" which I assume meant the general population. Didn't assume anything about you. Even though the base problem was given to me by another, everything I wrote about "what makes a resourceful idiot / how they are a problem" is based on my personal perception of the on…

At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical. The mind process you have described is pretty standard, even using some different things to recover information instead of saving it. There is no ne…

> People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical.

You would be surprised.

> The mind process you have described is pretty standard, even using some different things to recover information instead of saving it.

Well, I'm glad that it seems accurate at least. I was trying to describe a "standard" process, after all.

I should let you know, though, that my brain doesn't work that way. Reason why I say I'm biased is because I don't see what I described as a particularly interesting way to live life, so my description of it might be overly cynical / insulting.

> There is no neurodivergent path of extracting information and there is no neurodivergent understanding of reality or neurodivergent thought process.

I don't know about a neurodivergent path of extracting information either, but you should know for a fact that certain neurotypes, such as autistic ones, do have a different thought process than normal.

When I think about something, my brain will also pull up every possible related thing and assemble an entire picture for me automatically. This is usually called something like "increased associative ability". I'm just very good at considering very large quantities of facts simultaneously.

It's not the same as being reminded of something I know. It's recalling every thing I know simultaneously that could possibly have any effect or be related in any way. Anything that could possibly have relevance.

I get that "for free" as a part of my neurotype. A neurotypical person would likely have to do that consciously or go through some sort of mental process in order to reproduce the same result. I don't have to do that. It happens automatically and instantly.

But because it happens automatically, I can end up looking really awkward because I tend to not be conscious of my processing delays. For example, someone asks me a question, I go "what?" and then give them an answer anyway before they can repeat it. For a second I thought I didn't hear the question, but it was just processing in the background.

Everything processes in the background for me. Thoughts just evolve on their own, draw from relevant memories on their own. All I really have to do is watch.

Try telling me that everyone's thought process works that way.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#288

Earlier quoted context omitted.

At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical. The mind process you have described is pretty standard, even using some different things to recover information instead of saving it. There is no ne…

This comment is puzzling to me on several levels, but I'll just go to the centre of the topic. Do you feel that something needs to be addressed about the way LoganDark disclaimed that they were biased on account of their neurodivergency?

How did you jump from

> At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical

to

> Do you feel that something needs to be addressed about the way LoganDark disclaimed that they were biased on account of their neurodivergency

?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#289

Earlier quoted context omitted.

This comment is puzzling to me on several levels, but I'll just go to the centre of the topic. Do you feel that something needs to be addressed about the way LoganDark disclaimed that they were biased on account of their neurodivergency?

How did you jump from > At this point I don't really know if you understand what 'neurodivergent' means. People who suffer for neurodivergency does not have different mental mappings than those who are neurotypical. Also, the way they construct their own world does not differ from neurotypical to > Do you feel that something needs to be addressed about the way LoganDark disclaimed that they were biased on account of…

maybe they think the disclaimer was unnecessary or misguided if there's no actual difference between neurotypical and neurodivergent there?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#290

Earlier quoted context omitted.

Most browser extensions seem to be used on Firefox, because Google is so hostile to ones on Chrome. With the decline of Firefox, the extension world has shrunk. I had something called "Ad Limiter" on both Firefox and Chrome for a decade. Identical code, even. Google sent me threatening messages last year, as they tightened the screws on ad blockers, and I dropped it for Chrome.

Firefox is not really less hostile now. You can't even install and maintain local add-ons anymore. You can either install them temporary, and they are removed when the app closes. Or you must upload and sign them to their store.

I believe nightly edition and/or developer edition lets you install unsigned addons. Also there's a way to get an addon signed for private non-store use - can't speak to how that works, as my current project isn't quite to that stage yet.
Post reply on HN