Browser extensions are underrated: the promise of hackable software

Browser extensions are an important part of my small business since there are some things I can't reasonably do without them. https://autoplaylists.simon.codes is a good example: Google Music just doesn't make some metadata available over their OAuth apis.

I understand the broader extension security situation is pretty atrocious, but I like to think there's some small improvement from url-limited extensions like mine (that would otherwise exist as scripts that ask for plaintext credentials).

Me too.

It's a thought I keep repeating that is probably worth expanding into an article - modern software eschews interoperability, and in particular, SaaS is based on preventing interoperability. What used to be a desktop application operating on an independent source of data (filesystem) now vacuums the data and offers it back over an official interface and an extremely limited and locked-down API.

Wrt. those APIs, note that what just a decade ago on desktop was considered normal interop, nowadays often requires the interoperating parties to sign contracts, adding a legal dimension that further shuts out end users.

Some also claim that Google kills innovation. Synchronous interception of requests allows developers to program sophisticated rules to fight malicious resources. In the future, they will only have a regular expressions list to block domains. It will be much easier for malicious actors to bypass this feature.

Depends on your goal.

If you want the computer to be "bicycle for the mind", you want to reduce friction so that "advanced" use isn't really "advanced", but normal. See also Hypercard, or how people use Excel in offices, or secretaries that extended Emacs because they didn't know writing Lisp was "programming", or countless other stories of end-user improvements.

If you want the computer to be a digital television set, or a digital collection of appliances, then sure - let's lock everything down, so that you can only do what you're allowed to by the vendors, and only through means allowed by the vendors. This is the scenario in which you want to add friction to end-user "advanced" use.

> How is the browser suppose to know whether the user wrote the extension or downloaded it from the internet?

It cannot be done in general - if a user can do something manually, a sophisticated piece of malware running outside of the browser can simulate too. But I think there's ways to add warnings without increasing friction. Having to manually re-enable each and every user-created extension on browser restart is IMO way too much friction. Being shown a warning about those extensions on each browser restart, but keeping them running sounds more reasonable.

It's worked well on safari because most of its users are people who don't care about those limits. Traditionally safari has been a relatively closed ecosystem (I haven't used it in a long time but I remember an entire lack of support for extensions at one point), so the people who would care about these changes never used it to begin with.

So now, when safari comes in with these changes that only add value compared to their previous offering (which again was substantially behind the competitors), users respond positively because the only users that remain don't know the difference between blocking the rendering of an ad and blocking the request to the ad server. So, when they hear "Ads are blocked", they don't understand the nuances that reveal to you that ads are not really blocked at all from a privacy perspective.

The reason Chrome didn't have a similar response is because the people who cared about these changes were already using chrome. So, when chrome announced an update that removes these privacy-protecting features, the users were knowledgeable enough to realize what the changes actually meant from a privacy perspective, and so responded poorly.

And even if the users were the same, safari added a feature (you can now kind of block ads in safari, compared to the zero adblocking you could do before), whereas chrome is removing a feature (you can no longer block requests to ad servers, something you could do for years). So of course the reaction to safari will be at worst lukewarm, because compared to the previous editions of safari it was an improvement.