16 ms·

Browser extensions are underrated: the promise of hackable software

320 points by gklitt 7y ago

edgarvaldes 7y ago
I would say that maybe they are underused or not well known by the general public, but not underrated.
burtonator 7y ago
Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome for example has a ton of limitations: https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-Extension-Innovation.html https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E... If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates. You can't just push an update immediately that gets sent out. They take a week to approve your extension. This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. ESPECIALLY if something is broken. Imagine if you had a bug that destroys data and you need to rush out a fix. Nope.. You need to wait one week for that to go out.
- dessant 7y ago
  I experience the same one week delay with an extension. The publishing delay is always about a week, and that is highly unusual. They state that the extension update is under compliance review, which may take several business days, though the similar approval times indicate that this is actually an arbitrary publishing delay, and that no human review takes place in all cases, otherwise there would be more variation between approval times.
  - burtonator 7y ago
    It's always a week AND it's also applied at a week even if you change an image. They don't need to audit an image. I'm suspicious that they might be doing this for other reasons more likely to punish people for more aggressive permissions.
- gildas 7y ago
  The same applies for my own fork of SingleFile, called SingleFileZ. I can publish any update of SingleFile in 1 hour. For SingleFileZ, which requires less permissions, I have to wait 7 days for exactly the same update. That's very demotivating.
- throwaway5752 7y ago
  "This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. ESPECIALLY if something is broken." I get what you are saying, but this is more of an artifact of people being used to unregulated platform as a service and the - being blunt here - terrible quality practices that are rampant there. If a week is an "eternity" then try internally iterating a few times and shore up that test coverage if that extremely mild release cadence constraint is more than you can bear. Browser extensions are risk in security, authenticity of content, a new avenue for phishing (look alikes in low volume/poorly curated areas), and browser stability. It isn't Chrome's fault if someone pushes a bug that destroys data, it's the development teams fault. There responsibility is the the user of Chrome.
- modzu 7y ago
  at least in firefox, updates typically roll out immediately while any manual review happens asynchronously
  - filoleg 7y ago
    While I disagree with the 1-week review times that google imposes, doesn't the firefox approach defeat the purpose of the review in the first place? While async review is better than no review, if someone pushed a malicious update and it got caught in the async review a few days later, the damage has already been done. Just a trade-off to think about.
    - modzu 7y ago
      its a tradeoff for sure; i tend to think the risk of unpatched software outweighs the risk of software hijacked from the author, so i prefer the moz model. iirc, there are automatic checks (ie permission changes, certain api calls, etc) which trigger a manual review before publishing. that said even the manual review is no guarantee malicious software doesnt get published (from my experience the reviewers are not always experts)
- dnate 7y ago
  That has been the reality for the Apple AppStore for many years. Seems to not have hurt them. And Chrome has a much larger market share (or browser share) than iOS has. As long as you have that, you can pretty much do whatever you like to the devs as long as you don't piss off the users
  - bradknowles 7y ago
    Oh? How many billions of users are on Chrome?
    - Quarrel 7y ago
      Are you waiting for google to release a mobile operating system and put their browser on it? That'd show Apple.
    - saagarjha 7y ago
      At least one, as of 2016.
- TeMPOraL 7y ago
  > This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. Not so long ago, people distributed software on physical media. Time to update was counted in months to years. This had a nice side benefit of people not being able to "test in production"; software either worked mostly well, or it didn't sell. That wasn't a bad thing, because it forced companies to do actual QA - something that today is increasingly being pawned off to end-users, with help of deeply invasive telemetry.
- slg 7y ago
  Personal anecdote here, I have a Chrome extension with a few thousand users that has never been subject to this wait. That seems to be because I have a narrowly defined scope for my extension and therefore the permissions I request are relatively innocuous. That exact article you linked was posted to HN a few months back. I remember someone dug into it and found the permissions it requested. The full list was rather broad and as a result the extension could have basically hijacked the entire browsing experience. A malicious extension with those permissions would have been a potential goldmine. I think it is perfectly reasonable for Google to want to review extensions like that.
idoubtit 7y ago
I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One that deals with cookies (mostly "delete everything" outside of my white list) and three that add functionalities to specific sites (automating, managing lists, hiding or highlighting content, etc). Building them was fun, though not as much fun as playing against "copy protections" long ago: like going from competitive chess to creative DIY. The only pain with custom made extensions is that Firefox is very reluctant to load them. I don't want to upload them them on some Mozilla server, so I have to enter some cryptic "about:..." URL, then click and navigate to my extension, for every extension at every browser start. This is one of the main reasons I'm using more Vivaldi than Firefox these past months.
- scarface74 7y ago
  Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.
  - chipperyman573 7y ago
    That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-use-every-day-are-selling-your-personal-information-at-an-astonishing-rate.html https://www.inc.com/jason-aten/the-browser-extensions-you-us...
    - scarface74 7y ago
      I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.
Endy 7y ago
Browser extensions are being underrated deliberately by browser developers. Ever since we lost XUL Firefox, anyone who wants to really do anything worth doing around a web browser should have already switched to Pale Moon. Doubly so with Google's Manifest v3, which is going to kill selective content download management.
- eitland 7y ago
  Even as much as I want my old Firefox extensions back I reaaly don't feel I can trust a small bunch of developers to keep something as complicated as the old Firefox patched in this day and age. Am I wrong?
  - weaksauce 7y ago
    not even a little bit. the advances that were made in multi-process firefox and reducing memory usage and speeding up firefox are all on the backs of webextensions existing. it freed up the developers from having to worry that some internal api getting changed will break the extensions. it simply had to go.
    - pessimizer 7y ago
      Memory usage and speeding up firefox have nothing to do with keeping the browser patched. Plenty of people thought it was fast enough and fine with memory for their use case, but very few people will be fine with gaping security holes.
      - weaksauce 7y ago
        > Memory usage and speeding up firefox have nothing to do with keeping the browser patched yeah? they are tangential goals but that's the problem. in moving away from browser extensions to webextensions you have a completely diverging codebase that's almost impossible to keep patched because the architecture is fundamentally incompatible and the patches will not be able to be applied in all but the most trivial of cases.
miguelmota 7y ago
Sometimes popular abandoned browser extensions get bought up by malicious actors that inject malware into your browser without you ever knowing because extensions get automatically updated.
- megous 7y ago
  That's why you uncheck "update add-ons automatiocally' in the add-on manager.
  - paulryanrogers 7y ago
    This risks using a known-vulnerable extension unless you monitor releases another way
    - megous 7y ago
      Vulnerable extensions are exploited when you access websites that can abuse the holes in the extension (XSS for example). You have to visit the site that the extension targets that has the attack payload for the extension. I think that risking this by updating manually is more acceptable than getting the mallicious code directly auto-installed as soon as it's released by the attacker no matter what you do.
  - miguelmota 7y ago
    Standard users would have no idea they can do that or even bother. Extensions are risky additions to the browser because it's 3rd party code that can read your web pages and local storage values.
    - megous 7y ago
      Yes, but I didn't talk about standard users. Also, most of my extensions are not 3rd party code and I want them to have full access. For the rest I update them once in a while and go check ~/.mozilla/**/*.xpi for changes with something like this. find -maxdepth 1 -mindepth 1 -type d ! -name .git -print0 | xargs -0r rm -rf for f in ../extensions/*.xpi ; do unzip "$f" -d "$(basename "${f%.xpi}")" done git add -Af . git commit -m "Changes"
Arkdy 7y ago
I love that extensions turn the idea of browser differences into a strength. It's a reminder that the websites you make don't just go into a black box, they have to co-exist with individual user preferences/needs.
seanwilson 7y ago
I launched my side project (https://www.checkbot.io/ https://www.checkbot.io/, a website best practices checker) as a paid Chrome extension and have been happy with the experience so far. The browser extension platform lets me easily support Linux, Chrome OS, Mac and Windows, with automatic updates and small installation size (~1MB). I get traffic from people discovering the extension via the Chrome store, and users can install and launch the app in seconds which lowers onboarding friction. Compared to native apps, I think browser extension based apps reduce a lot of headaches for developers and users.
- ggurgone 7y ago
  Looks useful, how do you manage distribution and the payments? I am looking for examples and resources of successful paid extensions who offer subscriptions https://readmo.app https://readmo.app
  - seanwilson 7y ago
    I use https://paddle.com/ https://paddle.com/ for subscription payments. Paddle deal with EU VAT for you which is a big benefit for me. The Chrome store lets you take payments but it's not very flexible and it's tied to Chrome.
    - ggurgone 7y ago
      ah sweet, so the extension is hosted on the Chrome Web Store but you manage payments and licenses with paddle?
      - seanwilson 7y ago
        That's right. This gives more flexibility like selling a license that works on Firefox + Chrome, and selling team based licenses. I wouldn't be surprised if Google killed Chrome store payments in the future as well - I pretty much never hear mentions or updates about it. I wouldn't want to lose all my subscribers if that happened.
ggurgone 7y ago
Shameless self-promo – I built Refined Twitter Lite which customizes the new Twitter introducing features like Single Column layout. I primarily built it for myself but maybe some of you folks might find it useful too https://chrome.google.com/webstore/detail/refined-twitter-lite/adhbafkkfbonbogdlaebnoegpoogngcc?hl=en https://chrome.google.com/webstore/detail/refined-twitter-li... It is open source of course https://github.com/giuseppeg/refined-twitter-lite https://github.com/giuseppeg/refined-twitter-lite
anantdgoel 7y ago
We recently launched a browser extension (https://www.getnobias.com/ https://www.getnobias.com/) and have been happy with the use cases we've been able to build around existing websites. Much easier than convincing news publishers to integrate our products directly into their websites. Users get to choose their experience.
gnicholas 7y ago
Browser extensions are also really important for accessibility. People with many kinds of disabilities use extensions to make websites more readable, easier to navigate, or more accessible in other ways. Unfortunately, the big mobile browsers do not support extensions, which is a huge blow to accessibility. I think Firefox for Android is the only mainstream-ish browser that supports extensions. Apple prevents them from doing the same on iOS because it would be considered "an app store within an app", which is forbidden. The only thing Apple allows is action and share extensions, which have to be manually activated on every single page (2-3 taps to do so — which is super user-unfriendly, esp. for PWD). It's great that Apple does a lot for accessibility in general, but I really wish they would open things up a bit more so that users could customize the iOS experience to make it more accessible. As a dev, I would be more than happy to have my code scrutinized even further in order to ensure that what we're doing doesn't create security, privacy, or performance issues. We'd just like to make our accessibility software as useful for folks on mobile as it is on desktop!
- apsanz 7y ago
  Which specific extensions work well? My wife is visually impaired and she has tried a several extensions. All of them have cause more problems than they have solved. In addition, IE and firefox's attempts to change behavior when using windows high contrast mode also breaks many sites. Safari is the browser that works the most reliably.
  - paulryanrogers 7y ago
    "Dark Background and Light Text" for Firefox has worked for me. Some necessary background images are still invisible, though I chalk those up to bad implementions.
  - gnicholas 7y ago
    Well, I'm the founder of BeeLine Reader[1], and our extension is used for speed reading as well as accessibility (vision impairment, dyslexia, ADHD). I don't think it breaks websites, since we let the user decide how aggressively it should try to run. There are also night mode extensions, as well as site-specific ones (like for wikipedia) that are great. 1: http://www.beelinereader.com http://www.beelinereader.com
DiseasedBadger 7y ago
I haven't cared since XUL died, and I don't imagined I will. New extensions are just webpages. I can already make webpages.
modzu 7y ago
here's a shameless link to my small batch of extensions, hopefully some find useful. all open source of course! https://addons.mozilla.org/en-US/firefox/user/13170802 https://addons.mozilla.org/en-US/firefox/user/13170802
ohazi 7y ago
I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update that quietly adds a backdoor. There's at least some publicly documented evidence that Raymond Hill (uBlock Origin) isn't likely to cave to this sort of pressure, but do you really believe that none of the other authors of your fifteen favorite extensions would look the other way for $100k? Keep in mind that these offers don't look like "Here's some money, please let us roll out an evil update to your extension." They look like "Our company has a product with a similar name. We love your extension and would like to offer to acquire it from you so that we can use the name. We'll even let you keep the rights to your software so that you can re-release it under a different name if you'd like!" They'll make it really easy for the developer to remain in denial about what they're actually facilitating.
- kevingadd 7y ago
  Worse still, the design of the most popular extension API is intrinsically poor at protecting users from malicious extension developers (or extension resale to malicious developers). Until Google and Mozilla fix the design people shouldn't be installing more than a handful of extensions, because they end up usually having complete access to all your data for convenience reasons.
  - sp332 7y ago
    Extensions have a similar model to phone apps. They have a basic set of APIs available, and beyond that they have to ask for permission before they can use more. E.g. I have a Firefox addon called "t.co unmangler" that only has permission to access my data for twitter.com and can't read anything else. If an extension is compromised and tries to access more that it was allowed before, the browser will block it until I grant permissions.
    - kevingadd 7y ago
saurik 7y ago
I gave a highly related talk in 2010 called "Even Software Should Have Screws" at TEDxAmericanRiviera, based on my background working in the iOS jailbreaking community, where I maintained a software ecosystem similar to browser extensions, but for apps and system software. https://youtu.be/ReKCp9K_Jqw https://youtu.be/ReKCp9K_Jqw
andrenth 7y ago
Next (https://github.com/atlas-engineer/next https://github.com/atlas-engineer/next) might be a truly hackable browser.
- celeritascelery 7y ago
  All I really want is emacs for the web.
ardani 7y ago
Hacking extensions are underrated, your browser software is unbrowseable.
_trampeltier 7y ago
Not just browser extensions. I miss an API in all kind of software we use at work. No wonder the half of the companys in this world run on excel.
- quickthrower2 7y ago
  I am seriously considering learning emacs. As a lazy IDE guy, it feels like yak shaving and a lot of work, but I can sort of see how having that much control over your environment would be great, and setting up some cool workflows to make stuff quick and easy in the long run.
- TeMPOraL 7y ago
  Me too. It's a thought I keep repeating that is probably worth expanding into an article - modern software eschews interoperability, and in particular, SaaS is based on preventing interoperability. What used to be a desktop application operating on an independent source of data (filesystem) now vacuums the data and offers it back over an official interface and an extremely limited and locked-down API. Wrt. those APIs, note that what just a decade ago on desktop was considered normal interop, nowadays often requires the interoperating parties to sign contracts, adding a legal dimension that further shuts out end users.
falsedan 7y ago
We won an internal hackathon by writing the API and no front end, using a browser extension instead to manifest the client on the third-party page we couldn’t get API access to in time. It sure was easy to write.
0xDEFC0DE 7y ago
Anyone with a foot/feet in pentesting/appsec feel that there could be a good omni extension that encompasses cookie editing, header editing, local storage, proxy toggle, and has other potential features?
ignoramous 7y ago
Extensions can be uninstalled, revoked, disabled at will. Can't really bend BigTech to do your biding, and that trumps whatever the security argument brings to the table, imo. Extensions should be done in a security friendly way [0], and not the other way around of making software secure by disabling all extensibility [1]. Take the example of the Android ecosystem: If plugins were allowed for apps, pretty sure there'd be a better story around privacy today. An astonishing 40% of connections from an Oppo/Vivo or Xiaomi phones are to ad networks and trackers. And there's nothing you could do (without root) except to firewall it (apps have started working around pi-hole esque setups). XposedMod has brought plugin based development to Android [2], but it is niche and requires not just root, but replacing key framework components. Using it might still be worth it, though, given the relentlessness of OEMs and carriers. And that's just sad. [0] One way to tackle the problem of developers selling away rights to their extensions is to legally make it binding to publicly declare whenever ownership changes hands. Disable extensions across all installs, and let the users enable after the fact is made obvious to them. [1] https://www.eff.org/deeplinks/2019/06/adversarial-interoperability-reviving-elegant-weapon-more-civilized-age-slay https://www.eff.org/deeplinks/2019/06/adversarial-interopera... [2] https://www.xda-developers.com/best-xposed-modules/ https://www.xda-developers.com/best-xposed-modules/
- octosphere 7y ago
  Sometimes I like to inspect the code of existing addons to look for malicious code. My first sweep is regexing through the code for any URLs which means checking for (http?s://) and the next step is looking for any code that is deliberately obfuscated.
  - elliottcarlson 7y ago
    I built http://sublim.nl/crxviewer/ http://sublim.nl/crxviewer/ to do exactly that -- load in an extension and view the source, including doing a search through all files.
- on_and_off 7y ago
  > If plugins were allowed for apps, pretty sure there'd be a better story around privacy today . Honest question : Can you expand on how this would work please? If anything, extensions as in chrome extensions is something I try to avoid as much as possible : giving access to all of my data to a third party extension promising that is going to increase my privacy but that I need to trust 100% with a complete access is less than ideal.
calmchaos 7y ago
Check out some kickass WebExtensions by Nodetics: https://nodetics.com https://nodetics.com
simon_weber 7y ago
Browser extensions are an important part of my small business since there are some things I can't reasonably do without them. https://autoplaylists.simon.codes https://autoplaylists.simon.codes is a good example: Google Music just doesn't make some metadata available over their OAuth apis. I understand the broader extension security situation is pretty atrocious, but I like to think there's some small improvement from url-limited extensions like mine (that would otherwise exist as scripts that ask for plaintext credentials).
dman 7y ago
I would really like a browser which attempted to be extensible the way emacs is. No modern browser appears committed to extensibility as a key feature / differentiator.
- b3n 7y ago
  You mean like Next[1]? [1] https://github.com/atlas-engineer/next https://github.com/atlas-engineer/next
- imiric 7y ago
  Surf[1] is very extensible if you know some C and shell. WebKit-based, for better or worse. [1]: https://surf.suckless.org/ https://surf.suckless.org/
ocdtrekkie 7y ago
On the contrary: Browser extensions are horribly overrated. They're a massive security problem (the number one place malware is found on a computer) often for the benefit of replacing the word "cloud" with "butt". They are rarely adequately audited or restricted and have far more access to private data than anyone generally realizes.
- koverda 7y ago
  >> replacing the word "butt" with "butt" Do you mean to say that extensions do nothing?
- aiyodev 7y ago
  Agreed. Those who think extensions are harmless clearly have their heads in the butts.
- paulryanrogers 7y ago
  Making your own is still empowering though
- jsutton 7y ago
  It's disingenuous to imply that most extensions are just replacing "cloud" with "butt". There are plenty of browser extensions that are necessary and vital for millions of people. I agree that extensions do need to be adequately audited more, though Firefox does audit every browser extension they offer through their store. Safari similarly does, and Chrome just needs to catch up.
ggggtez 7y ago
> personally use Chrome extensions that fill in my passwords, help me read Japanese kanji, simplify the visual design of Gmail, let me highlight and annotate articles, save articles for later reading, play videos at 2x speed, and of course, block ads. So, autofill, autotranslate, HTML-only mode in gmail, (?), literally just bookmark it, any html5 video player, and of course, block ads (which most browsers seem to be moving to do by default). These are all either offered by the browser by default, or will be (though firefox seems more interested in adblocking than chrome right now). Obviously they may not do it the same, but as someone who is suggesting addons offer a lot of power, the writer is not actually using most of that power. I kind of agree with browser developers that more often than not, extensions just offer a new vector for malware and no one really understands what power they have so they make bad choices.
zmmmmm 7y ago
> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions. I can't help but cynically interpret the current situation as intentional on Google's part because having the security model be "trust Google to vet the extensions" happens to centralise all the power with them. If you can't trust an extension from the wild then they might as well not exist, right? People laughed Java out of the browser because it took 500ms to start, but at least it had an actual security model.
- im3w1l 7y ago
  The standard for plugins on windows was for a long time "go to shady website and download a dll with arbitrary code. drop it in the magic folder to run it with full permissions"
  - hybrids 7y ago
    I just had a horrid flashback to ActiveX plugin installation wizards in Windows 98...
  - throwaway2048 7y ago
    extensions could just as easily modify executable you download, or source code.
- crazygringo 7y ago
  +1000 Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an <img src="..."> tag if the src isn't just a data URL or local extension resource. E.g. I want to be able to install an extension that stops YouTube videos from playing as soon as I navigate to the page, without worrying my entire browsing history or worse is being sent to a third-party.
stevefan1999 7y ago
I was involved into developing a simple app for WebExtension. Not gonna lie, the experience is awful, for example, no IPC support, being way too complicated in terms of API design and that really hateful manifest schema file which echoes the horror of Android API permission XML. I give up at some point, but I could provide the source code if I could get a chance to recover my files.
- stevefan1999 7y ago
  well no it indeed had IPC with WebWorkers, however it is also very difficult to work with: data sharing between scripts is a complete clusterfuck. I had found my code, it is written in Vue/Vuex and I will attempt to convert it to using nuxt and upload it github maybe.
mikekchar 7y ago
Here's an opinion that is likely to be controversial: I like Gnome Shell for exactly the same reason. To be fair, it's something like 7 years since I used it, so maybe things have changed a lot. I ended up abandoning it because I don't like Gnome in general (I want something significantly more light weight). But I loved the idea that I could completely change the way my window manager worked by writing a surprisingly small amount of JS. Not only that, but it had (I hope still has) hooks into mutter, so you could do anything you want to the compositter as well. For example, one of the things I did was to have windows that zoomed the contents when I resized them rather than increasing the size of area in the window -- I did it because I have terrible vision and virtually every time I want a bigger window it's because I want it magnified. I just noticed Xlambda which was featured very recently on HN: https://news.ycombinator.com/item?id=20316920 https://news.ycombinator.com/item?id=20316920 I wonder if there is compositor I could talk to as well... compton doesn't do the kinds of things I want to do...

320 points by gklitt 7y ago

I would say that maybe they are underused or not well known by the general public, but not underrated.

Extensions are awesome but I think this article is a bit too optimistic. I mean I share the optimism but in practice a major challenge is the platform. Chrome for example has a ton of limitations: https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-Extension-Innovation.html https://getpolarized.io/2019/04/05/Google-Will-Kill-Chrome-E... If you want to do anything significant you have to get their 'permission' and at that point they throttle your extension release updates. You can't just push an update immediately that gets sent out. They take a week to approve your extension. This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. ESPECIALLY if something is broken. Imagine if you had a bug that destroys data and you need to rush out a fix. Nope.. You need to wait one week for that to go out.

dessant 7y ago
I experience the same one week delay with an extension. The publishing delay is always about a week, and that is highly unusual. They state that the extension update is under compliance review, which may take several business days, though the similar approval times indicate that this is actually an arbitrary publishing delay, and that no human review takes place in all cases, otherwise there would be more variation between approval times.
- burtonator 7y ago
  It's always a week AND it's also applied at a week even if you change an image. They don't need to audit an image. I'm suspicious that they might be doing this for other reasons more likely to punish people for more aggressive permissions.
gildas 7y ago
The same applies for my own fork of SingleFile, called SingleFileZ. I can publish any update of SingleFile in 1 hour. For SingleFileZ, which requires less permissions, I have to wait 7 days for exactly the same update. That's very demotivating.
throwaway5752 7y ago
"This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. ESPECIALLY if something is broken." I get what you are saying, but this is more of an artifact of people being used to unregulated platform as a service and the - being blunt here - terrible quality practices that are rampant there. If a week is an "eternity" then try internally iterating a few times and shore up that test coverage if that extremely mild release cadence constraint is more than you can bear. Browser extensions are risk in security, authenticity of content, a new avenue for phishing (look alikes in low volume/poorly curated areas), and browser stability. It isn't Chrome's fault if someone pushes a bug that destroys data, it's the development teams fault. There responsibility is the the user of Chrome.
modzu 7y ago
at least in firefox, updates typically roll out immediately while any manual review happens asynchronously
- filoleg 7y ago
  While I disagree with the 1-week review times that google imposes, doesn't the firefox approach defeat the purpose of the review in the first place? While async review is better than no review, if someone pushed a malicious update and it got caught in the async review a few days later, the damage has already been done. Just a trade-off to think about.
  - modzu 7y ago
    its a tradeoff for sure; i tend to think the risk of unpatched software outweighs the risk of software hijacked from the author, so i prefer the moz model. iirc, there are automatic checks (ie permission changes, certain api calls, etc) which trigger a manual review before publishing. that said even the manual review is no guarantee malicious software doesnt get published (from my experience the reviewers are not always experts)
dnate 7y ago
That has been the reality for the Apple AppStore for many years. Seems to not have hurt them. And Chrome has a much larger market share (or browser share) than iOS has. As long as you have that, you can pretty much do whatever you like to the devs as long as you don't piss off the users
- bradknowles 7y ago
  Oh? How many billions of users are on Chrome?
  - Quarrel 7y ago
    Are you waiting for google to release a mobile operating system and put their browser on it? That'd show Apple.
  - saagarjha 7y ago
    At least one, as of 2016.
TeMPOraL 7y ago
> This might sound reasonable until you realize that a week is an eternity for a continuous development shop. That might as well be a year. Not so long ago, people distributed software on physical media. Time to update was counted in months to years. This had a nice side benefit of people not being able to "test in production"; software either worked mostly well, or it didn't sell. That wasn't a bad thing, because it forced companies to do actual QA - something that today is increasingly being pawned off to end-users, with help of deeply invasive telemetry.
slg 7y ago
Personal anecdote here, I have a Chrome extension with a few thousand users that has never been subject to this wait. That seems to be because I have a narrowly defined scope for my extension and therefore the permissions I request are relatively innocuous. That exact article you linked was posted to HN a few months back. I remember someone dug into it and found the permissions it requested. The full list was rather broad and as a result the extension could have basically hijacked the entire browsing experience. A malicious extension with those permissions would have been a potential goldmine. I think it is perfectly reasonable for Google to want to review extensions like that.

idoubtit 7y ago

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One that deals with cookies (mostly "delete everything" outside of my white list) and three that add functionalities to specific sites (automating, managing lists, hiding or highlighting content, etc). Building them was fun, though not as much fun as playing against "copy protections" long ago: like going from competitive chess to creative DIY. The only pain with custom made extensions is that Firefox is very reluctant to load them. I don't want to upload them them on some Mozilla server, so I have to enter some cryptic "about:..." URL, then click and navigate to my extension, for every extension at every browser start. This is one of the main reasons I'm using more Vivaldi than Firefox these past months.

scarface74 7y ago
Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.
- chipperyman573 7y ago
  That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-use-every-day-are-selling-your-personal-information-at-an-astonishing-rate.html https://www.inc.com/jason-aten/the-browser-extensions-you-us...
  - scarface74 7y ago
    I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.

Endy 7y ago

Browser extensions are being underrated deliberately by browser developers. Ever since we lost XUL Firefox, anyone who wants to really do anything worth doing around a web browser should have already switched to Pale Moon. Doubly so with Google's Manifest v3, which is going to kill selective content download management.

eitland 7y ago
Even as much as I want my old Firefox extensions back I reaaly don't feel I can trust a small bunch of developers to keep something as complicated as the old Firefox patched in this day and age. Am I wrong?
- weaksauce 7y ago
  not even a little bit. the advances that were made in multi-process firefox and reducing memory usage and speeding up firefox are all on the backs of webextensions existing. it freed up the developers from having to worry that some internal api getting changed will break the extensions. it simply had to go.
  - pessimizer 7y ago
    Memory usage and speeding up firefox have nothing to do with keeping the browser patched. Plenty of people thought it was fast enough and fine with memory for their use case, but very few people will be fine with gaping security holes.
    - weaksauce 7y ago
      > Memory usage and speeding up firefox have nothing to do with keeping the browser patched yeah? they are tangential goals but that's the problem. in moving away from browser extensions to webextensions you have a completely diverging codebase that's almost impossible to keep patched because the architecture is fundamentally incompatible and the patches will not be able to be applied in all but the most trivial of cases.

miguelmota 7y ago

Sometimes popular abandoned browser extensions get bought up by malicious actors that inject malware into your browser without you ever knowing because extensions get automatically updated.

megous 7y ago
That's why you uncheck "update add-ons automatiocally' in the add-on manager.
- paulryanrogers 7y ago
  This risks using a known-vulnerable extension unless you monitor releases another way
  - megous 7y ago
    Vulnerable extensions are exploited when you access websites that can abuse the holes in the extension (XSS for example). You have to visit the site that the extension targets that has the attack payload for the extension. I think that risking this by updating manually is more acceptable than getting the mallicious code directly auto-installed as soon as it's released by the attacker no matter what you do.
- miguelmota 7y ago
  Standard users would have no idea they can do that or even bother. Extensions are risky additions to the browser because it's 3rd party code that can read your web pages and local storage values.
  - megous 7y ago
    Yes, but I didn't talk about standard users. Also, most of my extensions are not 3rd party code and I want them to have full access. For the rest I update them once in a while and go check ~/.mozilla/**/*.xpi for changes with something like this. find -maxdepth 1 -mindepth 1 -type d ! -name .git -print0 | xargs -0r rm -rf for f in ../extensions/*.xpi ; do unzip "$f" -d "$(basename "${f%.xpi}")" done git add -Af . git commit -m "Changes"

Arkdy 7y ago

I love that extensions turn the idea of browser differences into a strength. It's a reminder that the websites you make don't just go into a black box, they have to co-exist with individual user preferences/needs.

seanwilson 7y ago

I launched my side project (https://www.checkbot.io/ https://www.checkbot.io/, a website best practices checker) as a paid Chrome extension and have been happy with the experience so far. The browser extension platform lets me easily support Linux, Chrome OS, Mac and Windows, with automatic updates and small installation size (~1MB). I get traffic from people discovering the extension via the Chrome store, and users can install and launch the app in seconds which lowers onboarding friction. Compared to native apps, I think browser extension based apps reduce a lot of headaches for developers and users.

ggurgone 7y ago
Looks useful, how do you manage distribution and the payments? I am looking for examples and resources of successful paid extensions who offer subscriptions https://readmo.app https://readmo.app
- seanwilson 7y ago
  I use https://paddle.com/ https://paddle.com/ for subscription payments. Paddle deal with EU VAT for you which is a big benefit for me. The Chrome store lets you take payments but it's not very flexible and it's tied to Chrome.
  - ggurgone 7y ago
    ah sweet, so the extension is hosted on the Chrome Web Store but you manage payments and licenses with paddle?
    - seanwilson 7y ago
      That's right. This gives more flexibility like selling a license that works on Firefox + Chrome, and selling team based licenses. I wouldn't be surprised if Google killed Chrome store payments in the future as well - I pretty much never hear mentions or updates about it. I wouldn't want to lose all my subscribers if that happened.

ggurgone 7y ago

Shameless self-promo – I built Refined Twitter Lite which customizes the new Twitter introducing features like Single Column layout. I primarily built it for myself but maybe some of you folks might find it useful too https://chrome.google.com/webstore/detail/refined-twitter-lite/adhbafkkfbonbogdlaebnoegpoogngcc?hl=en https://chrome.google.com/webstore/detail/refined-twitter-li... It is open source of course https://github.com/giuseppeg/refined-twitter-lite https://github.com/giuseppeg/refined-twitter-lite

anantdgoel 7y ago

We recently launched a browser extension (https://www.getnobias.com/ https://www.getnobias.com/) and have been happy with the use cases we've been able to build around existing websites. Much easier than convincing news publishers to integrate our products directly into their websites. Users get to choose their experience.

gnicholas 7y ago

Browser extensions are also really important for accessibility. People with many kinds of disabilities use extensions to make websites more readable, easier to navigate, or more accessible in other ways. Unfortunately, the big mobile browsers do not support extensions, which is a huge blow to accessibility. I think Firefox for Android is the only mainstream-ish browser that supports extensions. Apple prevents them from doing the same on iOS because it would be considered "an app store within an app", which is forbidden. The only thing Apple allows is action and share extensions, which have to be manually activated on every single page (2-3 taps to do so — which is super user-unfriendly, esp. for PWD). It's great that Apple does a lot for accessibility in general, but I really wish they would open things up a bit more so that users could customize the iOS experience to make it more accessible. As a dev, I would be more than happy to have my code scrutinized even further in order to ensure that what we're doing doesn't create security, privacy, or performance issues. We'd just like to make our accessibility software as useful for folks on mobile as it is on desktop!

apsanz 7y ago
Which specific extensions work well? My wife is visually impaired and she has tried a several extensions. All of them have cause more problems than they have solved. In addition, IE and firefox's attempts to change behavior when using windows high contrast mode also breaks many sites. Safari is the browser that works the most reliably.
- paulryanrogers 7y ago
  "Dark Background and Light Text" for Firefox has worked for me. Some necessary background images are still invisible, though I chalk those up to bad implementions.
- gnicholas 7y ago
  Well, I'm the founder of BeeLine Reader[1], and our extension is used for speed reading as well as accessibility (vision impairment, dyslexia, ADHD). I don't think it breaks websites, since we let the user decide how aggressively it should try to run. There are also night mode extensions, as well as site-specific ones (like for wikipedia) that are great. 1: http://www.beelinereader.com http://www.beelinereader.com

DiseasedBadger 7y ago

I haven't cared since XUL died, and I don't imagined I will. New extensions are just webpages. I can already make webpages.

modzu 7y ago

here's a shameless link to my small batch of extensions, hopefully some find useful. all open source of course! https://addons.mozilla.org/en-US/firefox/user/13170802 https://addons.mozilla.org/en-US/firefox/user/13170802

ohazi 7y ago

I don't agree with the author. He pays lip service to security being important, but then proceeds to ignore the threat because he thinks extensions are great. I think people should be more hesitant to install a browser extension than just about any other piece of software. The threat is absolutely real. Bad actors regularly offer large paydays to lone developers with popular extensions so they can roll out an update that quietly adds a backdoor. There's at least some publicly documented evidence that Raymond Hill (uBlock Origin) isn't likely to cave to this sort of pressure, but do you really believe that none of the other authors of your fifteen favorite extensions would look the other way for $100k? Keep in mind that these offers don't look like "Here's some money, please let us roll out an evil update to your extension." They look like "Our company has a product with a similar name. We love your extension and would like to offer to acquire it from you so that we can use the name. We'll even let you keep the rights to your software so that you can re-release it under a different name if you'd like!" They'll make it really easy for the developer to remain in denial about what they're actually facilitating.

kevingadd 7y ago
Worse still, the design of the most popular extension API is intrinsically poor at protecting users from malicious extension developers (or extension resale to malicious developers). Until Google and Mozilla fix the design people shouldn't be installing more than a handful of extensions, because they end up usually having complete access to all your data for convenience reasons.
- sp332 7y ago
  Extensions have a similar model to phone apps. They have a basic set of APIs available, and beyond that they have to ask for permission before they can use more. E.g. I have a Firefox addon called "t.co unmangler" that only has permission to access my data for twitter.com and can't read anything else. If an extension is compromised and tries to access more that it was allowed before, the browser will block it until I grant permissions.
  - kevingadd 7y ago

saurik 7y ago

I gave a highly related talk in 2010 called "Even Software Should Have Screws" at TEDxAmericanRiviera, based on my background working in the iOS jailbreaking community, where I maintained a software ecosystem similar to browser extensions, but for apps and system software. https://youtu.be/ReKCp9K_Jqw https://youtu.be/ReKCp9K_Jqw

andrenth 7y ago

Next (https://github.com/atlas-engineer/next https://github.com/atlas-engineer/next) might be a truly hackable browser.

celeritascelery 7y ago
All I really want is emacs for the web.

ardani 7y ago

Hacking extensions are underrated, your browser software is unbrowseable.

_trampeltier 7y ago

Not just browser extensions. I miss an API in all kind of software we use at work. No wonder the half of the companys in this world run on excel.

quickthrower2 7y ago
I am seriously considering learning emacs. As a lazy IDE guy, it feels like yak shaving and a lot of work, but I can sort of see how having that much control over your environment would be great, and setting up some cool workflows to make stuff quick and easy in the long run.
TeMPOraL 7y ago
Me too. It's a thought I keep repeating that is probably worth expanding into an article - modern software eschews interoperability, and in particular, SaaS is based on preventing interoperability. What used to be a desktop application operating on an independent source of data (filesystem) now vacuums the data and offers it back over an official interface and an extremely limited and locked-down API. Wrt. those APIs, note that what just a decade ago on desktop was considered normal interop, nowadays often requires the interoperating parties to sign contracts, adding a legal dimension that further shuts out end users.

falsedan 7y ago

We won an internal hackathon by writing the API and no front end, using a browser extension instead to manifest the client on the third-party page we couldn’t get API access to in time. It sure was easy to write.

0xDEFC0DE 7y ago

Anyone with a foot/feet in pentesting/appsec feel that there could be a good omni extension that encompasses cookie editing, header editing, local storage, proxy toggle, and has other potential features?

ignoramous 7y ago

Extensions can be uninstalled, revoked, disabled at will. Can't really bend BigTech to do your biding, and that trumps whatever the security argument brings to the table, imo. Extensions should be done in a security friendly way [0], and not the other way around of making software secure by disabling all extensibility [1]. Take the example of the Android ecosystem: If plugins were allowed for apps, pretty sure there'd be a better story around privacy today. An astonishing 40% of connections from an Oppo/Vivo or Xiaomi phones are to ad networks and trackers. And there's nothing you could do (without root) except to firewall it (apps have started working around pi-hole esque setups). XposedMod has brought plugin based development to Android [2], but it is niche and requires not just root, but replacing key framework components. Using it might still be worth it, though, given the relentlessness of OEMs and carriers. And that's just sad. [0] One way to tackle the problem of developers selling away rights to their extensions is to legally make it binding to publicly declare whenever ownership changes hands. Disable extensions across all installs, and let the users enable after the fact is made obvious to them. [1] https://www.eff.org/deeplinks/2019/06/adversarial-interoperability-reviving-elegant-weapon-more-civilized-age-slay https://www.eff.org/deeplinks/2019/06/adversarial-interopera... [2] https://www.xda-developers.com/best-xposed-modules/ https://www.xda-developers.com/best-xposed-modules/

octosphere 7y ago
Sometimes I like to inspect the code of existing addons to look for malicious code. My first sweep is regexing through the code for any URLs which means checking for (http?s://) and the next step is looking for any code that is deliberately obfuscated.
- elliottcarlson 7y ago
  I built http://sublim.nl/crxviewer/ http://sublim.nl/crxviewer/ to do exactly that -- load in an extension and view the source, including doing a search through all files.
on_and_off 7y ago
> If plugins were allowed for apps, pretty sure there'd be a better story around privacy today . Honest question : Can you expand on how this would work please? If anything, extensions as in chrome extensions is something I try to avoid as much as possible : giving access to all of my data to a third party extension promising that is going to increase my privacy but that I need to trust 100% with a complete access is less than ideal.

calmchaos 7y ago

Check out some kickass WebExtensions by Nodetics: https://nodetics.com https://nodetics.com

simon_weber 7y ago

Browser extensions are an important part of my small business since there are some things I can't reasonably do without them. https://autoplaylists.simon.codes https://autoplaylists.simon.codes is a good example: Google Music just doesn't make some metadata available over their OAuth apis. I understand the broader extension security situation is pretty atrocious, but I like to think there's some small improvement from url-limited extensions like mine (that would otherwise exist as scripts that ask for plaintext credentials).

dman 7y ago

I would really like a browser which attempted to be extensible the way emacs is. No modern browser appears committed to extensibility as a key feature / differentiator.

b3n 7y ago
You mean like Next[1]? [1] https://github.com/atlas-engineer/next https://github.com/atlas-engineer/next
imiric 7y ago
Surf[1] is very extensible if you know some C and shell. WebKit-based, for better or worse. [1]: https://surf.suckless.org/ https://surf.suckless.org/

ocdtrekkie 7y ago

On the contrary: Browser extensions are horribly overrated. They're a massive security problem (the number one place malware is found on a computer) often for the benefit of replacing the word "cloud" with "butt". They are rarely adequately audited or restricted and have far more access to private data than anyone generally realizes.

koverda 7y ago
>> replacing the word "butt" with "butt" Do you mean to say that extensions do nothing?
aiyodev 7y ago
Agreed. Those who think extensions are harmless clearly have their heads in the butts.
paulryanrogers 7y ago
Making your own is still empowering though
jsutton 7y ago
It's disingenuous to imply that most extensions are just replacing "cloud" with "butt". There are plenty of browser extensions that are necessary and vital for millions of people. I agree that extensions do need to be adequately audited more, though Firefox does audit every browser extension they offer through their store. Safari similarly does, and Chrome just needs to catch up.

ggggtez 7y ago

> personally use Chrome extensions that fill in my passwords, help me read Japanese kanji, simplify the visual design of Gmail, let me highlight and annotate articles, save articles for later reading, play videos at 2x speed, and of course, block ads. So, autofill, autotranslate, HTML-only mode in gmail, (?), literally just bookmark it, any html5 video player, and of course, block ads (which most browsers seem to be moving to do by default). These are all either offered by the browser by default, or will be (though firefox seems more interested in adblocking than chrome right now). Obviously they may not do it the same, but as someone who is suggesting addons offer a lot of power, the writer is not actually using most of that power. I kind of agree with browser developers that more often than not, extensions just offer a new vector for malware and no one really understands what power they have so they make bad choices.

zmmmmm 7y ago

> The modern browser extension API has done a good job balancing extensibility with security No, it hasn't. Almost every single extension I install tells me some variant of "This extension can intercept and modify all of your browsing traffic". That's not "well balanced", it's completely broken. This is happening clearly for extensions by well intentioned people that do not need those permissions. I can't help but cynically interpret the current situation as intentional on Google's part because having the security model be "trust Google to vet the extensions" happens to centralise all the power with them. If you can't trust an extension from the wild then they might as well not exist, right? People laughed Java out of the browser because it took 500ms to start, but at least it had an actual security model.

im3w1l 7y ago
The standard for plugins on windows was for a long time "go to shady website and download a dll with arbitrary code. drop it in the magic folder to run it with full permissions"
- hybrids 7y ago
  I just had a horrid flashback to ActiveX plugin installation wizards in Windows 98...
- throwaway2048 7y ago
  extensions could just as easily modify executable you download, or source code.
crazygringo 7y ago
+1000 Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. And I'd also really like a way to track both injected scripts and elements so that they wouldn't be able to make any HTTP requests without additional permissions, not even an <img src="..."> tag if the src isn't just a data URL or local extension resource. E.g. I want to be able to install an extension that stops YouTube videos from playing as soon as I navigate to the page, without worrying my entire browsing history or worse is being sent to a third-party.

stevefan1999 7y ago

I was involved into developing a simple app for WebExtension. Not gonna lie, the experience is awful, for example, no IPC support, being way too complicated in terms of API design and that really hateful manifest schema file which echoes the horror of Android API permission XML. I give up at some point, but I could provide the source code if I could get a chance to recover my files.

stevefan1999 7y ago
well no it indeed had IPC with WebWorkers, however it is also very difficult to work with: data sharing between scripts is a complete clusterfuck. I had found my code, it is written in Vue/Vuex and I will attempt to convert it to using nuxt and upload it github maybe.

mikekchar 7y ago

Here's an opinion that is likely to be controversial: I like Gnome Shell for exactly the same reason. To be fair, it's something like 7 years since I used it, so maybe things have changed a lot. I ended up abandoning it because I don't like Gnome in general (I want something significantly more light weight). But I loved the idea that I could completely change the way my window manager worked by writing a surprisingly small amount of JS. Not only that, but it had (I hope still has) hooks into mutter, so you could do anything you want to the compositter as well. For example, one of the things I did was to have windows that zoomed the contents when I resized them rather than increasing the size of area in the window -- I did it because I have terrible vision and virtually every time I want a bigger window it's because I want it magnified. I just noticed Xlambda which was featured very recently on HN: https://news.ycombinator.com/item?id=20316920 https://news.ycombinator.com/item?id=20316920 I wonder if there is compositor I could talk to as well... compton doesn't do the kinds of things I want to do...