3 ms·

It is worth noting that revamping the browser extension permissions model is something that should definitely be done. Browser extensions up until this point ha

by _bxg1 7y ago

It is worth noting that revamping the browser extension permissions model is something that should definitely be done. Browser extensions up until this point have been a massive security hole: they basically get read/write permissions on every web page you visit. Of course, content blocking could've been part of that new security model. As Google tightens its grip, I wouldn't be surprised if someone starts a genuine fork of Chromium. Not just Chromium plus some extra stuff like Brave and Vivaldi, but a real, doesn't-rely-on-upstream-changes-fork. Microsoft seems like the most likely candidate for doing so.

devoply 7y ago
I think Huawei should start an open-source community-based fork of Chrome and Android as an offset to Google and American monopoly on the web. (kidding, sort of).
- trickstra 7y ago
  No need to be kidding IMHO. This could be a perfect opportunity for Huawei to show that there is life without google. Basically the only thing ROMs like Cyanogenmod were lacking was the support of a hardware maker, coming preinstalled by default. Today with F-Droid, Nextcloud, Openstreetmaps and Mastodon it would be doable.
Mirioron 7y ago
>they basically get read/write permissions on every web page you visit. But you can select on which sites the extension is active. You can even make it only active when you click on it.
- hu3 7y ago
  Wouldn't that defeat the purpose of an adblocker?
  - johannes1234321 7y ago
    For an adblocker maybe, for other maybe less. And even the adblocker might be disabled on the online banking site.
- mehrdadn 7y ago
  Is this a new thing? Most of the time when I've installed extensions I've just seen an initial prompt that says the extension can view and modify your data on any page, so either agree & add, or get out.
  - 15characterslon 7y ago
    Depends on whether you consider a 7 months old feature new or not. https://www.ghacks.net/2018/10/01/chrome-70-features-option-to-restrict-extension-access/ https://www.ghacks.net/2018/10/01/chrome-70-features-option-...
    - mehrdadn 7y ago
      Oh wow yeah that's recent. I haven't installed new extensions in a while. Thanks. Edit: I don't like that it seems to not be the default though... if you don't see this option then it's the same situation as before.
- _bxg1 7y ago
  This isn't a browser feature, it's an AdBlock Plus feature. You're just switching off the blocking for certain sites, not turning off the extension itself in any meaningful way.
  - 15characterslon 7y ago
    You are wrong, sir. This is a browser feature. https://www.ghacks.net/2018/10/01/chrome-70-features-option-to-restrict-extension-access/ https://www.ghacks.net/2018/10/01/chrome-70-features-option-...
  - Mirioron 7y ago
    No, I'm talking about the browser feature in Chrome that can be applied to all extensions.
steve76 7y ago
Maybe they have something better? That flutter paint the screen, just do that in the browser. Speed problem solved. Tracking, well hopefully, with mutual discussions with China, perhaps that leads to a day where a school shooter finds all traffic lights turn red, and the school doors locked, and he just throws his rifle in the dumpster and falls asleep in his car. Only a kind providence provides kindness.
SpicyLemonZest 7y ago
Content blocking is definitely part of the new security model; they wrote a "declarativeNetRequest" API designed to enable content blocking. The debate is just over whether that API is sufficiently expressive.
ballenf 7y ago
> Browser extensions up until this point have been a massive security hole No, that's a very misleading use of the term "security hole". By that definition, every piece of software on your computer is a "massive security" risk. Heck, even Chrome itself is a massive security hole since it can see the content of every page you visit. I think it's worth reacting strongly to this argument because it's exactly the kind of statement that muddies the waters to convincing people that they shouldn't have the option of having full control of their own devices. And I'm not saying there haven't been huge security issues with extensions. Just as there have been massive issues with any manner of software downloaded and installed. But requiring them to be open source and needing explicit user approval before install (unlike in older IE versions) addressed those issues pretty well, imo. Edit: I would like to see changes that make it easier to observe when an extension is active and/or communicating with third party servers and/or writing to local storage for later transmittal (if that's possible).
- Redoubts 7y ago
  > By that definition, every piece of software on your computer is a "massive security" risk. Well, yes. There’s a reason sandboxing is coming more and more to the desktop.

by _bxg1 7y ago

devoply 7y ago

I think Huawei should start an open-source community-based fork of Chrome and Android as an offset to Google and American monopoly on the web. (kidding, sort of).

trickstra 7y ago
No need to be kidding IMHO. This could be a perfect opportunity for Huawei to show that there is life without google. Basically the only thing ROMs like Cyanogenmod were lacking was the support of a hardware maker, coming preinstalled by default. Today with F-Droid, Nextcloud, Openstreetmaps and Mastodon it would be doable.

Mirioron 7y ago

>they basically get read/write permissions on every web page you visit. But you can select on which sites the extension is active. You can even make it only active when you click on it.

hu3 7y ago
Wouldn't that defeat the purpose of an adblocker?
- johannes1234321 7y ago
  For an adblocker maybe, for other maybe less. And even the adblocker might be disabled on the online banking site.
mehrdadn 7y ago
Is this a new thing? Most of the time when I've installed extensions I've just seen an initial prompt that says the extension can view and modify your data on any page, so either agree & add, or get out.
- 15characterslon 7y ago
  Depends on whether you consider a 7 months old feature new or not. https://www.ghacks.net/2018/10/01/chrome-70-features-option-to-restrict-extension-access/ https://www.ghacks.net/2018/10/01/chrome-70-features-option-...
  - mehrdadn 7y ago
    Oh wow yeah that's recent. I haven't installed new extensions in a while. Thanks. Edit: I don't like that it seems to not be the default though... if you don't see this option then it's the same situation as before.
_bxg1 7y ago
This isn't a browser feature, it's an AdBlock Plus feature. You're just switching off the blocking for certain sites, not turning off the extension itself in any meaningful way.
- 15characterslon 7y ago
  You are wrong, sir. This is a browser feature. https://www.ghacks.net/2018/10/01/chrome-70-features-option-to-restrict-extension-access/ https://www.ghacks.net/2018/10/01/chrome-70-features-option-...
- Mirioron 7y ago
  No, I'm talking about the browser feature in Chrome that can be applied to all extensions.

steve76 7y ago

Maybe they have something better? That flutter paint the screen, just do that in the browser. Speed problem solved. Tracking, well hopefully, with mutual discussions with China, perhaps that leads to a day where a school shooter finds all traffic lights turn red, and the school doors locked, and he just throws his rifle in the dumpster and falls asleep in his car. Only a kind providence provides kindness.

SpicyLemonZest 7y ago

Content blocking is definitely part of the new security model; they wrote a "declarativeNetRequest" API designed to enable content blocking. The debate is just over whether that API is sufficiently expressive.

ballenf 7y ago

> Browser extensions up until this point have been a massive security hole No, that's a very misleading use of the term "security hole". By that definition, every piece of software on your computer is a "massive security" risk. Heck, even Chrome itself is a massive security hole since it can see the content of every page you visit. I think it's worth reacting strongly to this argument because it's exactly the kind of statement that muddies the waters to convincing people that they shouldn't have the option of having full control of their own devices. And I'm not saying there haven't been huge security issues with extensions. Just as there have been massive issues with any manner of software downloaded and installed. But requiring them to be open source and needing explicit user approval before install (unlike in older IE versions) addressed those issues pretty well, imo. Edit: I would like to see changes that make it easier to observe when an extension is active and/or communicating with third party servers and/or writing to local storage for later transmittal (if that's possible).

Redoubts 7y ago
> By that definition, every piece of software on your computer is a "massive security" risk. Well, yes. There’s a reason sandboxing is coming more and more to the desktop.