Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

301–310 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#301

Post by 1vuio0pswjnm7 »

bobajeff wrote: post #298
1vuio0pswjnm7 wrote: post #293

Earlier quoted context omitted.

"I do however see value in small simple software." Years ago on HN, I had commenters attack statements I made about the value of small, simple software. They literally challenged the terms "small" and "simple". After that I started prefacing these words with "relatively". "When evaluating software utility..." Another time, an HN commenter attacked a statement I made about how I evaluate software for myself. He sugges…

I think the presumption of what users want is a kind of classism. Users are humans and as humans we have a hierarchy of needs that can lead to certain tradeoffs. Doesn't mean only the techies appreciate things like privacy and having agency over software. Just because corporations don't give us a choice doesn't mean "the market has decided". So you aren't an outlier you are just aware and maybe more interested in the…

Amen.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#303

Post by wiseowise »

CharlesW wrote: post #211
wiseowise wrote: post #195

Earlier quoted context omitted.

> I'm happy to have guardrails if they improve non-technical users' safety. Not at the expense of expert freedom.

Safety is paramount for experts. Those who disregard the importance of safety are likely not experts in their field. If the "console" analogy doesn't resonate, think of Apple as NASCAR. NASCAR has created a private ecosystem. Participating in NASCAR as a team or a driver is a choice, contingent upon meeting their requirements and paying entry fees. NASCAR implements numerous safety measures — SAFER barriers, catch fe…

Sounds really cool, but I don’t buy it.

> Those wishing for NASCAR to resemble the Baja 1000 are tilting at windmills. Similarly, people who want iOS to be like Android aren't just wasting their time, but also disregarding the preferences of users who prioritize platform safety.

How providing ability to sideload and having ability to use custom browser engine compromise the system? How having ability to use terminal disregard platform safety?

All of those are artificial limitations and you know it.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#304

Post by account42 »

foobiekr wrote: post #107
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

4. They are required to make the web usable which makes points 1 to 3 irrelevant.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#305

Post by account42 »

Spivak wrote: post #122
syoc wrote: post #114

Earlier quoted context omitted.

Replace browser with operating system or computer and expand extensions to user installable programs and it mostly still rings true. I believe users should be empowered to modify their installed applications as they see fit.

It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people, desktop software is more difficult develop (for your average hacker wannabe), more difficult to get users to install, and has far less valuable data to go after. I actually very much like Apple's approach to browser extensions forcing them to be truly installed software and in the purv…

> It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people

... by allowing software from big corporations not matter how user-hostile it is while randomly flagging/deleting harmless software make by individuals/smaller groups who have not paid the protection racket.

The AV industry is a scam.

> desktop software is more difficult develop (for your average hacker wannabe)

Desktop software can be written in the same languages as webshit and more.

> and has far less valuable data to go after

All data available in browsers is also available to native programs running besides.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#306

Post by account42 »

Spivak wrote: post #125
dev1ycan wrote: post #124

Earlier quoted context omitted.

Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer. Well, maybe they didn't I hope they enjoy the eventual return of popups.

They never left they're just called modals now.

a) Those can be closed along with the website because they are all inside the same tab.

b) Extensions can remove them, which is the pont of this discussion.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#307

Post by account42 »

AJ007 wrote: post #138
Spivak wrote: post #125

Earlier quoted context omitted.

They never left they're just called modals now.

Endless EU Cookie modals that you have to always click through because you clear cookies.

All the more reason why we need to be able to automate our browser through extensions.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#308

Post by account42 »

sunshowers wrote: post #117
foobiekr wrote: post #107

Earlier quoted context omitted.

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

Ultimately, as a society, we have to decide what is more important: the best of us or the worst of us.

Exactly. We can either put bars on our windows to preven criminals from breaking in or we can go after the criminals directly so that we don't have to worsen our living conditions. Both kinds of societies exist - low trust and high trust ones. I prefer living in the latter.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#309

Post by account42 »

CharlesW wrote: post #211
wiseowise wrote: post #195

Earlier quoted context omitted.

> I'm happy to have guardrails if they improve non-technical users' safety. Not at the expense of expert freedom.

Safety is paramount for experts. Those who disregard the importance of safety are likely not experts in their field. If the "console" analogy doesn't resonate, think of Apple as NASCAR. NASCAR has created a private ecosystem. Participating in NASCAR as a team or a driver is a choice, contingent upon meeting their requirements and paying entry fees. NASCAR implements numerous safety measures — SAFER barriers, catch fe…

People don't join the Apple cult for the safety. They join it because it's a status symbol and they don't want to be bullied.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#310

Post by account42 »

Pxtl wrote: post #178
bee_rider wrote: post #173

Earlier quoted context omitted.

I’d be really curious about in a system where browser extensions are limited to ~200 lines of code. No mechanism for distribution beyond typing text in. No concerns about permission. It would be interesting to see what people can do in an ecosystem where extensions can actually do anything but it is expected that people will actually read the code before running it.

My reaction would be simpler: Anything that's identified as risky? Show the user. Extension is making an HTTP request? Show the body in a toast. Extension is reading the keyboard? Same thing. Extension is looking at the page? Little icon in the corner showing the name of the extension and that it looked. Can't be turned off. So extensions can still do all that crazy stuff, but they're noisy about it.

All these things are done by useful non-malicious extensions. Warning fatigue is a thing.
Post reply on HN