Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser extensions are underrated: the promise of hackable software (2019)

geoffreylitt.com

Post reply on HN
Print view View original

91–100 of 320 posts

Re: Browser extensions are underrated: the promise of hackable software (2019)

#91

Post by seanwilson »

Springtime wrote: post #74
seanwilson wrote: post #29

I wish browser extensions had more fine-grained permissions but it's a tricky problem verifying if software is using permissions maliciously (see the Obfuscated C Code Contest and the Underhand C Contest) and how to communicate nuanced permissions to users (most users don't read and/or understand tech stuff, and can be easily mislead). A tip in Chrome that I never see mentioned if you want to be extra safe when tryin…

> I sell a browser extension where the permission I really want to ask for is "can only observe the network traffic it sends/receives in its own tabs" but I'm lumped with having to ask for the "read and write all your data" permission Yeah it would be nice there were a way to limit the entire scope of an addon's permissions to a whitelist of domains. Chromium has a way of whitelisting domains an addon can run on[1] b…

> Yeah it would be nice there were a way to limit the entire scope of an addon's permissions to a whitelist of domains.

You can do this for the network read/write permissions, where the permission request dialog on install will tell you the URL patterns the extension wants access to.

I can't do this for my specific extension though. My extension checks web pages for problems like broken links, so it needs to be able to fetch any web page URL you give it and then it has to fetch any URLs that are linked to on the page, so I have to ask for access to http://\\\* and https://\\\* (I could maybe get away with just the `activeTab` permission to check the domain of the current tab if the checks were more limited though).

The extension is only doing operations like this within its own tab, when you have the extension open, and for it's own network requests, so it's frustrating there isn't a more granular permission I can ask for as I've isolated it as much as I could.

It's a tricky problem though. Browser makers will have certain kinds of extensions in mind, and optimise to make the permission system and permission request messages friendly for those kinds of extensions. Less standard extensions usually have to settle for broader permissions with less friendly permission descriptions, until hopefully the permission system gets iterated on based on how it's being used in the wild (Manifest V3 in Chrome for example).

Re: Browser extensions are underrated: the promise of hackable software (2019)

#92

Post by lapcat »

mnau wrote: post #83
lapcat wrote: post #66

Earlier quoted context omitted.

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-) It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser e…

I will leave this as a gallery of emails with offers to buy extension hoverzoom: https://github.com/extesy/hoverzoom/discussions/670 Sidenote: The "collaboration" offers come from time to time even to non-extensions projects, if they are reasonably widely used. E.g. simple tools (rather widely used suite of android apps recently sold).

"Your real profit per day will be $ 9000."

LOL

Re: Browser extensions are underrated: the promise of hackable software (2019)

#93

Post by Rapzid »

swozey wrote: post #61

I program (not js/ts), use a massive number extensions and consider myself an absolute power user of them and refuse to ever use a browser WITHOUT the chrome/firefox extension ecosystem, I've written themes for Chrome and VScode, but I'm still here- (like pink/cyan? get on in! https://marketplace.visualstudio.com/items?itemName=mikejk8s... ). I have no idea via the Chrome prompts what extensions are able to do, read,…

I'm pretty sure it's as bad as it sounds haha.

Like another user mentioned because of this I only trust a few key extensions(and like that user uBlock, Bitwarden, etc) with this sorta access.

I'd be very wary of those scrapy screen/session recording startups if for no other reason than they could be particularly vulnerable to supply chain attacks.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#95

Post by emodendroket »

akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

> Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second thought.

How unlike developing for literally any other environment.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#96

Post by swozey »

Rapzid wrote: post #93
swozey wrote: post #61

I program (not js/ts), use a massive number extensions and consider myself an absolute power user of them and refuse to ever use a browser WITHOUT the chrome/firefox extension ecosystem, I've written themes for Chrome and VScode, but I'm still here- (like pink/cyan? get on in! https://marketplace.visualstudio.com/items?itemName=mikejk8s... ). I have no idea via the Chrome prompts what extensions are able to do, read,…

I'm pretty sure it's as bad as it sounds haha. Like another user mentioned because of this I only trust a few key extensions(and like that user uBlock, Bitwarden, etc) with this sorta access. I'd be very wary of those scrapy screen/session recording startups if for no other reason than they could be particularly vulnerable to supply chain attacks.

Yeah I always go to the source/project URL in the chrome store and IDEALLY it's a github repo with a bunch of contribs but I'm sure I've played loose with a few that had no other options.

I just had one big extension I use get bought by someone last week when it updated. I gotta dig through that now.. I used to hide that extension update popup screen but now I'm glad I didn't.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#97

Post by emodendroket »

lapcat wrote: post #66
throwaway63467 wrote: post #24

Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated, I think you have to be pretty careful as the extension security/privacy model is/was pretty awful. I e.g. know screenshotting extensions (Awesome Screenshot) that would vacuum up your browser history and send it to a data broker in Israel. So probably better to have that as a…

> Many popular browser extensions were bought up by data brokers that use them to exfiltrate browser history, so not sure if they’re underrated I would say, as the developer of an upfront paid web browser extension, that upfront paid web browser extensions are underrated. ;-) It's a truism that if you're not the customer, you're the product. But what if you are the customer? I think a lot of the mistrust of browser e…

> It's a truism that if you're not the customer, you're the product.

Though, even if you are, paid products are often monetized in all the exact same ways. Why not.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#98

Post by [deleted] »

silvestrov wrote: post #32

I think what we need the most is a "view source" for browser extensions installed from the store: make it easy to view the source and to extract the browser extension into a folder. Make it easy to find out which web pages they access and which they modified. Minimized/encrypted code in extensions should be forbidden. It should be very easy to read the code. E.g. this extensions says "records user activity", but what…

[deleted]

Re: Browser extensions are underrated: the promise of hackable software (2019)

#99

Post by mozman »

swozey wrote: post #88
akkartik wrote: post #86

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second…

Has Firefox fixed its syncing feature? You used to have to literally move a profile file around. I remember working in IT a long time ago and Firefox was an absolute nightmare to deal with corporately. But then, back then, we couldn't control Chrome extension installations..

Sync was fixed as part of quantum.

Re: Browser extensions are underrated: the promise of hackable software (2019)

#100

Post by wongarsu »

jwells89 wrote: post #73
seanwilson wrote: post #48

Earlier quoted context omitted.

> I tend to use desktop apps where I can instead of extensions How locked down are desktop apps now on Mac, Windows and Linux? I haven't kept up. Do they still a lot of access by default to do malicious things with? I recently saw someone install the Adobe Acrobat desktop app and it installed its own extension inside of Chrome without asking. Games can have scary DRM as well. Chrome extensions can't read/write to arb…

> How locked down are desktop apps now on Mac, Windows and Linux? It’s hit or miss. There have been advancements on macOS and Linux where there are mobile-style permissions and sandboxing in some cases, but one needs to be aware of how apps are packaged to be able to leverage these advancements. Adobe stuff and Chrome on macOS for example have basically free reign still as they have specifically opted out of OS sandb…

Windows introduced better mobile-style permissions and sandboxing with the APPX format in Windows 8. However the only incentives to use it was the ability to build UWP apps and accessing the Windows Store. Everyone rejected the Windows Store, so developer adoption is close to zero (and now those incentives are gone too)
Post reply on HN