Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

71–80 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#71

Post by Terr_ »

imhoguy wrote: post #46
seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

Firefox user here, I wish Multi-Account Containers had a way to disable extensions per container. I don't need any on my banking site. Sure I could use separate Profile but UX hurts here.

It may be a little paranoid, but I use a separate local user account for those kinds of things.

Perhaps not convenient, but it certainly helps keep me on task when I'm in official-paperwork mode. :p

Re: Browser extensions are underrated: the promise of hackable software (2019)

#72

Post by sidwyn »

seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

The "read and change all your data" permission is a huge hurdle for our shopping extension, especially since we only need to identify shopping pages. What I've tried to build trust is to open source our tracking analytics (e.g. https://github.com/Score-Extension/score-extension-analytics...).

Hopefully transparency is one way to overcome this trust barrier.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#73

Post by jwells89 »

seanwilson wrote: post #48
jwells89 wrote: post #42

Earlier quoted context omitted.

Yes. Because of this and the lack of fine-grained permissions mentioned by a sibling comment, I tend to use desktop apps where I can instead of extensions, keeping my extensions list quite slim — basically all I install are FOSS extensions by “big” known-good authors (e.g. Raymond Hill) or projects that aren’t going to sell out. Of course risks exist with desktop apps too, but historically this kind of buy-and-exfilt…

> I tend to use desktop apps where I can instead of extensions How locked down are desktop apps now on Mac, Windows and Linux? I haven't kept up. Do they still a lot of access by default to do malicious things with? I recently saw someone install the Adobe Acrobat desktop app and it installed its own extension inside of Chrome without asking. Games can have scary DRM as well. Chrome extensions can't read/write to arb…

> How locked down are desktop apps now on Mac, Windows and Linux?

It’s hit or miss. There have been advancements on macOS and Linux where there are mobile-style permissions and sandboxing in some cases, but one needs to be aware of how apps are packaged to be able to leverage these advancements. Adobe stuff and Chrome on macOS for example have basically free reign still as they have specifically opted out of OS sandboxing, while a lot of small indie apps are sandboxed. Chrome I think can be put in a sandbox on Linux by way of Flatpak.

Windows has done practically nothing and is the same as it’s always been where desktop apps can do basically whatever they please, especially if given privileges with UAC (which seemingly every other Windows app needs for some reason).

Re: Browser extensions are underrated: the promise of hackable software (2019)

#74

Post by Springtime »

seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

> I sell a browser extension where the permission I really want to ask for is "can only observe the network traffic it sends/receives in its own tabs" but I'm lumped with having to ask for the "read and write all your data" permission

Yeah it would be nice there were a way to limit the entire scope of an addon's permissions to a whitelist of domains. Chromium has a way of whitelisting domains an addon can run on[1] but I've assumed it doesn't affects the broader permissions you mention (general history, etc).

[1] Click 'Details' of the addon and switch the 'Allow this extension to read and change all your data on websites you visit' option to 'On specific sites' then add the sites to the whitelist.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#75

Post by swozey »

monkellipse wrote: post #23

I love the idea of browser extensions but they don’t appear to be worth the security/privacy risk for my use cases. I wonder how many others are like me and too paranoid to risk extensions at all?

I honestly can't imagine not using extensions. I'm 39 and have been on the web since Netscape etc in the early 90s and I honestly care more about the extensions than I do anything the browser actually does. Like, if there were no extensions I don't think I'd care at all if I used Firefox, Chrome, Opera, etc. But Chrome and Firefox have this massive, massive ecosystem of productitivy improving extensions.

I'll give an example since I'm tooting so loudly about this, my job entails a lot of R&D and distributing knowledge to other engineers in a concise manner. I use an app called hypothesis- https://web.hypothes.is/ which is very popular in research groups.

What it does is it lets me essentially annotate websites. So for instance I have an application with a front end UI, instead of writing readmes with no interaction to the front end UI I can actually annotate each page like a how-to, or a help doc. You go to that specific URL and get notified that there's a hypothesis doc on it to read.

When I used to work at a k8s distro company I used it to help teach people how to deploy clusters, etc.

Another one is Dark Reader that makes every single website dark mode.. Ublock I can't even remember a time of my life not using to block ads.. I do have null stuff via cloudflare dns as well but still use ublock everywhere since it's also a massive security improvement blocking chaotic javascript.

It's amazing for training situations.

https://web.hypothes.is/

Re: Browser extensions are underrated: the promise of hackable software (2019)

#76

Post by jlawrence6809 »

swozey wrote: post #68
jlawrence6809 wrote: post #59

I built a chrome extension that is featured on the chrome web store[1] and the number of requests I get from shady data brokers looking to buy my extension and fill it with spyware is really concerning. A naive dev could build something cool and sell it off to someone thinking they'll maintain if for them but instead just cause a hazard for users. Google seems to do a decent job of reviewing the use of permissions bu…

Cool extension. I love when devs open source stuff that makes their lives easier.

Thanks! Here is the repo if you have any issues/suggestions: https://github.com/jlawrence6809/CSS-Selector-Helper-for-Chr...

Re: Browser extensions are underrated: the promise of hackable software (2019)

#77

Post by gymbeaux »

I've had some ideas for browser extensions over the years, most recently a few months ago. I remember looking at Mozilla docs for making a Firefox browser extension and, as a SWE w/10 YoE (mostly fullstack web), I was left confused. The documentation felt incomplete and I left the article with more questions than I had before.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#78

Post by jwells89 »

lapcat wrote: post #66
throwaway63467 wrote: post #24

Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-) It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser e…

Something that’d help here is if extension galleries displayed price tags and let you filter by paid (bonus points for being able to distinguish between one-time and subscription).

Re: Browser extensions are underrated: the promise of hackable software (2019)

#79

Post by redder23 »

Retr0id wrote: post #25
PaulDavisThe1st wrote: post #12

> Browser extensions remind us what it’s like to have deep control over how we use our computers. Uh. Linux users would like a word here. But more generally, there's a significant component of this that seems isomorphous to the question I was trying to discuss in a post I wrote several years ago called "Is Open Source a diversion from what users really want?" There seems to be much more excitement about ways to "hack…

> Uh. Linux users would like a word here. As a Linux user, I disagree. It's not quite the same. Yes, I could recompile my kernel if I wanted to. I can recompile most of userspace too. But it's a hassle, especially if you want to diverge from upstream, and maintain that divergence on a long-term basis. You can do some fun hacks with LD_PRELOAD et al, but it's nowhere near the degree of flexibility and ease of access o…

What has compiling the kernel to do with it, its about the fact that Linux let you control ever single aspect of your OS and tweak it to your liking. Its a pretty good example of what shows you how it is to control your PC, more so then browser extensions. Just look at what a pain in the ass it is to remove Edge from windows, even now the EU has mandated it, its still a 10+ step guide that requires some tool from Github ... and b4 that you could not even to that. Your start menu in win11 is polluted with "news" and Bing AI crap ... with no simple way to just disable it. If you use Linux you are in control and there are no annoyances and almost no proprietary code from the very start.

You have endless different Desktop Endorsements ... Linux offer way more control over the OS then any browser extensions do. Firefox killed the system where you could more modify the look of the Browser, I do not mind, but I am still making this point when we talk about feeling in control.

You make no sense.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#80

Post by sidwyn »

> Compatibility: Because extensions hook into websites in unsupported ways, updates to websites often result in extensions temporarily breaking, and extension authors scrambling to fix them.

Has anyone who's built a browser extension solved this?

Post reply on HN