Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

311–320 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#311

Post by account42 »

lapcat wrote: post #66
throwaway63467 wrote: post #24

Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-) It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser e…

Upfront payment does not exclude further monetization at the expense of the user. If anything, it is a signal that the developer is motivated by money.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#312

Post by account42 »

sidwyn wrote: post #72
seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

The "read and change all your data" permission is a huge hurdle for our shopping extension, especially since we only need to identify shopping pages. What I've tried to build trust is to open source our tracking analytics (e.g. https://github.com/Score-Extension/score-extension-analytics... ). Hopefully transparency is one way to overcome this trust barrier.

> What I've tried to build trust is to open source our tracking analytics

That's like being upfront about what kind of getaway car you are going to use for the robbery.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#313

Post by account42 »

BenjiWiebe wrote: post #291
lmm wrote: post #200

Earlier quoted context omitted.

> Uh. Linux users would like a word here. The shift of Linux to systemd was a very similar experience to the decline of browser extensions. Yes, you can change how your computer works. But unless you're willing to put a lot of effort into maintaining those changes, the APIs you use will be cut out from under you and it'll be harder and harder to make your computer do what you wanted rather than what someone else thou…

Just my own experience, but I've actually had more fun and more success using systemd to do funny stuff with my PC than with sysvinit. Can't speak to the other init systems though.

I think your response kind of misses the point. It's not that you can't do things with systemD, it's that your previous hacks suddenly no longer work. The same will be true for your system-d stuff once redhad decides that they want something else.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#314

Post by lapcat »

account42 wrote: post #311
lapcat wrote: post #66

Earlier quoted context omitted.

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-) It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser e…

Upfront payment does not exclude further monetization at the expense of the user. If anything, it is a signal that the developer is motivated by money.

> If anything, it is a signal that the developer is motivated by money.

Duh?

Who isn't motivated by money, though? The frequent acquisition of free extensions proves that even open source developers are motivated by money too.

The issue, again, is the identity of the customer. Is the customer you, the extension user, or is the customer the advertisers, making you the product?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#315

Post by mosselman »

fritzo wrote: post #119
mosselman wrote: post #94

I wanted to build an internal company extension, but for that (chrome) you still need to go through the review process with Google and it is even worse than Apple’s App Store reviews.

Would it be too much friction to host internally and require your users to "load unpacked"?

It would mean re-loading manually at every update no?

Otherwise it would be great. Any pointers?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#316

Post by gsuuon »

Hackbraten wrote: post #162
gsuuon wrote: post #123

Earlier quoted context omitted.

That'd help, but a problem is they could still go closed-source and you wouldn't know - the store itself has no concept of open or closed source so it's not like you could check an "uninstall if it goes closed source" box. Maybe there's room for a browser extension that hosts other browser extensions but with a much better security model than what Google allows.

You don’t have to use the store to install and update the extension. You monitor the upstream GitHub release feed, and build and install the extension yourself on every update.

This would make a great host extension - just add new extensions to the list and it automatically pull/build/installs the extension.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#317

Post by Pxtl »

account42 wrote: post #310
Pxtl wrote: post #178

Earlier quoted context omitted.

My reaction would be simpler: Anything that's identified as risky? Show the user. Extension is making an HTTP request? Show the body in a toast. Extension is reading the keyboard? Same thing. Extension is looking at the page? Little icon in the corner showing the name of the extension and that it looked. Can't be turned off. So extensions can still do all that crazy stuff, but they're noisy about it.

All these things are done by useful non-malicious extensions. Warning fatigue is a thing.

There are legitimate reasons to read GPS signal but we still show a notice when it happens.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#318

Post by akkartik »

crazygringo wrote: post #206
akkartik wrote: post #101

Earlier quoted context omitted.

I don't know if you're being sarcastic. There's a spectrum between developing for Lua (juggernaut is super friendly), Python (juggernaut is mostly friendly, even if 2->3 caused a lot of casualties), Go (in spite of the corporate backer, quite careful about not stomping) and Chrome. Yes, there's always a counter-party. My point is it saves a lot of later grief to consider up front the counter-party you're entering int…

Which, for plenty of Chrome extensions, is fine. Google has removed capabilities for certain categories and it's pretty easy to figure out what's going to be risky. But I use a set of very useful extensions, none of which present any problem to Google, all of which are extremely useful, and all of which I expect to stick around.

You and I lack the imagination to see how those APIs might be hindering revenues. Are you really willing to bet Google will not find a way in the future? I'm not. The need for revenue doesn't just stop. Eventually they'll return to squeeze water from these stones.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#319

Post by dugite-code »

madacol wrote: post #295
dugite-code wrote: post #226

Earlier quoted context omitted.

Well that's a handy site you have there. Last time I fiddled with bookmarklets they didn't work on Firefox for Android, but now they do. This is going to be handy combining it with my Node-red instance. Got any good bookmarklets you want to share?

edit any text on webpage javascript: (function() { document.body.contentEditable = true; document.body.spellcheck = false; })(); Open on wayback machine javascript:location.href='https://web.archive.org/web/*/'+document.location.href.replace(/\/$/, ''); Others that are longer https://github.com/madacol/web-automation/tree/master/bookma...

Oh that's just awesome. Using this with the send to obsidian addon sounds like the best of ideas

Re: Browser extensions are underrated: the promise of hackable software (2019)

#320

Post by FormulatedEdits »

imbnwa wrote: post #207
FormulatedEdits wrote: post #163

Earlier quoted context omitted.

Hello. I used to use Dark Reader but then some it changed hands and a very questionable update appeared and freaked many people out, so I uninstalled. IIRC the changes were removed, or the additional code was not correctly activated, maybe both. Anyway, you may wish to check the status of that particular extension. I use some flag in config now to do approximately the same thing, it’s not as effective, but it’s close…

Link to Dark Reader changing hands and questionable update?

I’ve had a search around and cannot find a single thing about it.

This is quite strange to me as I was very upset to uninstall it, and distinctly recall reading about the security concerns on this very website. But, whatever it was, I must infer that it was a flash in the pan about nothing.

Post reply on HN