3 ms·
So it effectively runs arbitrary javascript in the current page? I mean, if I run it on my online banking page, it'll have access to everything. The extension i
by comntr 7y ago
So it effectively runs arbitrary javascript in the current page? I mean, if I run it on my online banking page, it'll have access to everything. The extension isn't ideal either - access to the current URL is too much - but at least it can't run arbitrary JS in the page itself.
- Jaruzel 7y agoIf you look at the bookmarklet, you'll see that the JS in it only fetches the URL and appends it to an Algolia search query. Nothing is sent to any other server. It's all done in your browser. Hacker News has exactly the same type of bookmarklet on their 'bookmarklet' link at the bottom of every page[1]. Arguably this method is safer than an Extension. --- [1] https://news.ycombinator.com/bookmarklet.html https://news.ycombinator.com/bookmarklet.html