Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

61–70 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#61

Post by swozey »

I program (not js/ts), use a massive number extensions and consider myself an absolute power user of them and refuse to ever use a browser WITHOUT the chrome/firefox extension ecosystem, I've written themes for Chrome and VScode, but I'm still here- (like pink/cyan? get on in! https://marketplace.visualstudio.com/items?itemName=mikejk8s...).

I have no idea via the Chrome prompts what extensions are able to do, read, see, access, etc. "Allowed to access data on all websites" - Is this literally all data? Like what I'm typing? Like does it know when I go URL to URL? it is just reading the assets? Is there a chrome API that limits their access that I can see? What do I actually need to worry about? I have a video zoomer that lets me zoom in on any video on any website, do I need to literally audit each extension myself and make sure it's not mirroring my data elsewhere or something?

I have no idea. How would a non technical user know any of this?

Re: Browser extensions are underrated: the promise of hackable software (2019)

#62

Post by davidy123 »

dboreham wrote: post #5

No support on mobile devices is the big drawback.

On Android I use a two fisted approach; Chrome for things that require auth/payments, Kiwi for everything else. Kiwi is an open source fork of Chrome, and it allows extensions. Unfortunately it's not up to date to the latest (secure) Chrome, but I accept that because not having control over the browser is its own form of exploit.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#63

Post by thisislife2 »

imhoguy wrote: post #46
seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

Firefox user here, I wish Multi-Account Containers had a way to disable extensions per container. I don't need any on my banking site. Sure I could use separate Profile but UX hurts here.

Yeah, as you figured out, a separate profile is currently the only workaround. In case you aren't aware, there is an easy way to quickly launch it though in Firefox or Pale Moon - go to about:profiles and you can easily create / launch any profiles quickly in a new window.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#64

Post by davidy123 »

Retr0id wrote: post #9
dboreham wrote: post #5

No support on mobile devices is the big drawback.

Mobile Firefox supports extensions just fine.

You have to jump through extra hoops, at least. I was able to install my own custom, unpublished extension easily with Kiwi.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#65

Post by ysavir »

empiricus wrote: post #36

Is there a way to use browser extensions safely? Any extension that looks interesting needs access to everything I see on the screen (and even modify it), which to me seems a huge security risk. My understanding is that random extension is able to read and send somewhere almost all my data when I read my email, do online banking, etc. Do I understand correctly the situation?

Not really, I don't think. I hear a lot of people saying that you can inspect the source if you follow steps X, Y, and Z, but that's not a one time thing. Each time the extension is updated you have to do a full audit. You can install it independently to avoid updates, but then you run the risk of things breaking or falling behind (such as adblocker lists). Happy to learn from more experienced people that I'm wrong on this, but that's my current expectation from decades of using browsers and extensions.

For me, an extension can only require so much hands on effort before that effort outweighs the rewards of the extension. Years ago I had the Vimium plugin and loved it, but the provided functionality isn't worth the necessary audits. Not wanting to have to trust that it never sells out or gets hacked, I got rid of it. These days I just use a small handful of extensions (ublock origin, noscript, vuejs devtools) that I feel comfortable trusting and that make a significant impact on my browsing experience. I can manage without the rest.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#66

Post by lapcat »

throwaway63467 wrote: post #24

Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated

I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-)

It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser extensions is due to the difficulty in monetizing extensions directly. If you're making nothing from an extension, and someone offers you a nice check to acquire the extension, it can be difficult to turn down that money, especially if the extension is a support burdern for the developer. Of course I have my price too, as almost everyone does, but at this point the price would have to be 7 figures (maybe 8??), which I don't think anyone would ever pay for my extension. My user base is relatively small, and thus doesn't provide a huge opportunity for data collection or other nefarious schemes, precisely because the extension is paid rather than free.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#67

Post by dvdkon »

capitainenemo wrote: post #30
Retr0id wrote: post #25

Earlier quoted context omitted.

> Uh. Linux users would like a word here. As a Linux user, I disagree. It's not quite the same. Yes, I could recompile my kernel if I wanted to. I can recompile most of userspace too. But it's a hassle, especially if you want to diverge from upstream, and maintain that divergence on a long-term basis. You can do some fun hacks with LD_PRELOAD et al, but it's nowhere near the degree of flexibility and ease of access o…

I feel gentoo reduces that hassle a fair amount since you can just toss the patches in and the distro pulls them in on updates. So long as you're not messing with APIs it's not too bad in terms of bitrot. ... I suppose you could do the same thing with debian too. You'd just need to maintain an overlay repo that rebuilds off the upstream deb sources for the packages you touched. At that point you're pretty much doing…

It's similar with NixOS, patching a package is just adding a few lines in a persistent (and generally short) config file. You "only" pay for that patch by having to update it for newer versions and by compile time.

The developer experience isn't as good as browser extensions yet, though. Iterating on a patch means downloading that package to a local directory and building it there, which won't be enough for, say, patches to system libraries. You have to actually apply the system configuration for that, which means recompiling.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#68

Post by swozey »

jlawrence6809 wrote: post #59

I built a chrome extension that is featured on the chrome web store[1] and the number of requests I get from shady data brokers looking to buy my extension and fill it with spyware is really concerning. A naive dev could build something cool and sell it off to someone thinking they'll maintain if for them but instead just cause a hazard for users. Google seems to do a decent job of reviewing the use of permissions bu…

Cool extension. I love when devs open source stuff that makes their lives easier.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#69

Post by mg »

I prefer bookmarklets because they

- Are easy to edit

- Are inactive until clicked

- Work in all browsers

- Work on mobile

- Integrate nicely into the UI. I can move them around, put them into any bookmark folder, assign shortcuts.

I wrote this bookmarlet editor which makes it easy to convert between clean code and a bookmarklet:

https://www.gibney.org/bookmarklet_editor

Re: Browser extensions are underrated: the promise of hackable software (2019)

#70

Post by redder23 »

Talking about how bad Google is limiting ad blocker, then going ahead and saying "I use Chrome extensions" I am assuming that means in Chrome. Its your fault then. Move to Brave (has ad Blocker without limitations build in, you can use all Chrome extensions) or Firefox or whatever browser but if you continue to use Googles shit then you are helping them kill what makes extensions great. They do not even support extensions on mobiles, obviously with the excuse of performance but its so most people who are actually on mobile can't block ads and otherwise remove commercial toxicity from the web.
Post reply on HN