undefined | Better HN

0 pointsNoZebra120vClip2y ago0 comments

Tell me, is it a sound security architecture that allows extensions like that to read and write to every web page I will ever see? Or perhaps that is a desperate hack to get'er done and there may be a safer way to implement that kind of thing?

Sure, Google wants to architect things so that ad blockers as we know them now aren't really feasible. But I think that we can conceded that Google has a good point in saying these world-read-write-anything extensions are not good for us.

0 comments

5 comments · 2 top-level

autoexec2y ago· 3 in thread

Besides the fact that Google doesn't stop extensions from seeing everything, there's nothing wrong with allowing extensions to do that. You should have the ability to selectively block/allow/modify content however you want before it's displayed in your browser.

The biggest issues with extensions are things like silent updates (perhaps after the developer sold their extension to a bad actor) and extensions that depend on online resources. An extension that you've verified does what it claims to and nothing else, can read/write everything, doesn't update automatically, and never sends data to random servers isn't a problem at all.

NoZebra120vClipOP2y ago

> You should have the ability to selectively block/allow/modify content however you want before it's displayed in your browser.

Conceivably, this could mostly be accomplished without the extension being able to see all content. Such as manipulation by regexp.

autoexec2y ago

I can't have an extension remove every line that contains the string "google" if it can't see every line. It'd still have to be able to access all the content to be able to parse through it for a match.

NoZebra120vClipOP2y ago

Sure you could. The browser could have an API that says "give me a list of regexps and substitutions" and then the extension supplies that list, and the browser itself does the parsing and processing. This is flexible because the extension can specify the modifications.

It's like a pipeline in Bash. You could work with an end-user to build some patterns to match, then pass them to "grep" or "perl" for processing, and neither the user nor shell need to be privy to a file's contents.

plorkyeran2y ago

Manifest v3 does not remove the ability for an extension to spy on all of your network traffic; only the part where it can block the network requests it's observing.

j / k navigate · click thread line to collapse