3 ms·

Although I trust Algolia not to abuse their service, I understand why you do not. Maybe the "number of comments" display could be opt-in as well? Unfortunately,

Although I trust Algolia not to abuse their service, I understand why you do not. Maybe the "number of comments" display could be opt-in as well? Unfortunately, I don't think there's a way to get that particular UI feature without sending all URLs to some external server.

nerdponx 9y ago
You can at least start by stripping all query parameters and anchors off of the URL. And instead of automatically piping everything to Algolia, just give the user a damn button.
- onli 9y ago
  Having to click a button to see if there are any comments completely changes the usefulness of the addon, doesn't it? zevebs hash approach is the better solution.
  - dagurp 9y ago
    I'd prefer it like that though
sunaurus 9y ago
Algolia doesn't even have to (intentionally) abuse their service. Request logs can be leaked through software bugs, malicious actors can gain access to their servers, etc. Trying to find matches for URL hashes would be a much nicer approach, but you would need a database of hashed URLs for that, so it's not a trivial fix.
zeveb 9y ago
> Unfortunately, I don't think there's a way to get that particular UI feature without sending all URLs to some external server. Look up the protocol that Google's SafeBrowsing[0] project uses. The short version is that your extension should check visited URLs against a locally-downloaded database of HN-posted URLs. For SafeBrowsing there's a bit more optimisation (e.g. hashing URLs & storing only hash prefixes to reduce the size of the database), but that's the short version. This secures the end user's privacy. [0] https://safebrowsing.google.com/ https://safebrowsing.google.com/
- jdormit 9y ago
  Cool, thanks for the link! Sounds like there a bunch of security and privacy improvements I can make.