Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

81–90 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#81

Post by redder23 »

Fogest wrote: post #56
a13o wrote: post #50

Earlier quoted context omitted.

In chrome go to chrome://extensions, enable developer mode, and now you can view source for any extension in devtools. The content scripts are already available in the regular web page's devtools without enabling developer mode. The total list of websites is available in the installation popup for the extension. The chrome web store already bans code obfuscation. minification is allowed as there's no meaningful way t…

It is very annoying to try and follow through minified code. I've tried to view the source and see what some extensions are doing but it can be a bit of a painful process. You can at least sometimes figure out what kind of GET/POST requests the extension may be making, but it's much more time consuming to try and ensure everything is safe. The other problem is that the extensions can update. You typically get zero no…

There is a button to format the code for minified files.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#82

Post by olejorgenb »

account-5 wrote: post #6

I quite like bookmarklets, easy to write. Tried a userscript but couldn't get into it. Never tried an extension, wouldn't know where to start.

How do you "compile" the bookmarklets? I know of https://bookmarkl.ink/ but then we're back trusting some third-party service again. I get that it's not rocket science, but this is definitively a small hurdle to overcome.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#83

Post by mnau »

lapcat wrote: post #66
throwaway63467 wrote: post #24

Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-) It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser e…

I will leave this as a gallery of emails with offers to buy extension hoverzoom: https://github.com/extesy/hoverzoom/discussions/670

Sidenote: The "collaboration" offers come from time to time even to non-extensions projects, if they are reasonably widely used. E.g. simple tools (rather widely used suite of android apps recently sold).

Re: Browser extensions are underrated: the promise of hackable software (2019)

#84

Post by justsomehnguy »

seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

On Windows you can use apps packaged by portableapps.com. Needs AllowMultipleInstances=true in the .ini.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#85

Post by swozey »

jlawrence6809 wrote: post #76
swozey wrote: post #68

Earlier quoted context omitted.

Cool extension. I love when devs open source stuff that makes their lives easier.

Thanks! Here is the repo if you have any issues/suggestions: https://github.com/jlawrence6809/CSS-Selector-Helper-for-Chr...

How far did you have to deviate from the demo extension to make this? I've written themes for vscode and intellij but never done an actual extension because it's js/ts and I don't really enjoy writing those.

I really wish they had a DSL for extensions to allow them to be more broadly written. Like, I feel like I have to basically learn js to learn to write a chrome extension and I'm a go/rust dev who will use it literally nowhere and I just want to make the AWS console not suck, for instance.

But I keep trying to will someone like me into existence to make this extension and nobody is appearing lmao.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#86

Post by akkartik »

Just the framing of "browser extensions" is extremely problematic in the year 2024.

Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second thought.

I don't care to live in strategically lost situations like this, so I think the conversation should be about Firefox extensions. Which also don't have a great track record (the transition to Google Chrome compatibility a few short years ago still annoys me greatly), but are a qualitatively better counter-party to deal with.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#87

Post by Sephr »

silvestrov wrote: post #32

I think what we need the most is a "view source" for browser extensions installed from the store: make it easy to view the source and to extract the browser extension into a folder. Make it easy to find out which web pages they access and which they modified. Minimized/encrypted code in extensions should be forbidden. It should be very easy to read the code. E.g. this extensions says "records user activity", but what…

You can view the source of browser extensions hosted on the Chrome Web Store without installing them. I've occasionally used this tool for that purpose: https://robwu.nl/crxviewer/

This won't help against intentionally-obfuscated code but it should help with security & privacy research for most extensions.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#88

Post by swozey »

akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Has Firefox fixed its syncing feature? You used to have to literally move a profile file around. I remember working in IT a long time ago and Firefox was an absolute nightmare to deal with corporately. But then, back then, we couldn't control Chrome extension installations..

Re: Browser extensions are underrated: the promise of hackable software (2019)

#89

Post by akkartik »

swozey wrote: post #88
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Has Firefox fixed its syncing feature? You used to have to literally move a profile file around. I remember working in IT a long time ago and Firefox was an absolute nightmare to deal with corporately. But then, back then, we couldn't control Chrome extension installations..

I'm only on Firefox because there's nothing better, but its sync at least has been pretty rock solid for me for several years now.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#90

Post by mcoliver »

sidwyn wrote: post #80

> Compatibility: Because extensions hook into websites in unsupported ways, updates to websites often result in extensions temporarily breaking, and extension authors scrambling to fix them. Has anyone who's built a browser extension solved this?

The best you can do is get an early warning by running your extension via an automation framework and getting alerts on errors then publishing a fix and waiting for approval from Google.

Too many unknown unknowns. You're searching for an element to modify or take an action on based on the text content/class/id/aria-label/type? Someone changed apple to train. Or completely changes the element hierarchy. How would you predict or recognize that to modify your logic and be certain it works before publishing to your hundreds/thousands/millions of users?

Post reply on HN