9 ms·

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software j

I believe many people should attempt to create their own web extension, even if they don't publish it. In my younger years, I used to crack and hack software just for fun. Those were my Softice years. Later, when Opera was not Chromium based, I also had several site customisations, since it was very easy to add my own JS and CSS to any web site. Nowadays, I have 4 extensions created and tailored for my needs. One that deals with cookies (mostly "delete everything" outside of my white list) and three that add functionalities to specific sites (automating, managing lists, hiding or highlighting content, etc). Building them was fun, though not as much fun as playing against "copy protections" long ago: like going from competitive chess to creative DIY. The only pain with custom made extensions is that Firefox is very reluctant to load them. I don't want to upload them them on some Mozilla server, so I have to enter some cryptic "about:..." URL, then click and navigate to my extension, for every extension at every browser start. This is one of the main reasons I'm using more Vivaldi than Firefox these past months.

scarface74 7y ago
Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.
- chipperyman573 7y ago
  That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-use-every-day-are-selling-your-personal-information-at-an-astonishing-rate.html https://www.inc.com/jason-aten/the-browser-extensions-you-us...
  - scarface74 7y ago
    I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.
    - chipperyman573 7y ago
      The ad blocking changes also prevented blocking the request to the ad servers, which is what people were upset about (or at least, why I was upset). I don't remember seeing anyone be upset about anything related to browsing history.
      - scarface74 7y ago
        No one was upset about a plug in not getting access to your browsing history. People were upset about the declarative ad blocking that took away some of the features that they ad blockers previously had and said Google was doing it to protect their business. I’m not going to defend Google’s overall business practices, but from what I understand, it’s the same type of architecture that Apple has had for four years and no one said Apple’s intentions were nefarious.
        gildas 7y ago
        Some also claim that Google kills innovation. Synchronous interception of requests allows developers to program sophisticated rules to fight malicious resources. In the future, they will only have a regular expressions list to block domains. It will be much easier for malicious actors to bypass this feature.
        scarface74 7y ago
        It also allows developers to intercept your entire browsing history. If you care about your privacy, why would you let a random third party intercept all of your browsing history?
        gildas 7y ago
        I consider everything to be a matter of risk in terms for example of privacy. By installing an extension like uBlock, I am indeed taking the risk you mentioned. However, I consider that the risk will be much higher when installing an extension that is based only on a list of regular expressions for the reason I mentioned. If uBlock did a bad thing, I'll know very quickly and all I'll have to do is install an alternative extension. I am also a developer. I would like to continue to have the right to code such extensions for myself.
- cmroanirgo 7y ago
  I've been on both sides of the fence in this one, and agree with both arguments. Perhaps FF could add (if it doesn't have it already) an about:config setting that allows reloads, perhaps from a specific folder(s).
  - scarface74 7y ago
    It’s really not that hard to have a setting that allows an extension to run every time and hash the extension. If the hash changes, it’s disabled until you re-enable it.
- TeMPOraL 7y ago
  Adds friction. Ideally user-made extensions should be more trusted and easier to work with than Internet-sourced ones. I can understand that in practice, if user can make something, the user can also be convinced by an attacker to selfpwn through, but we ought to accept some level of that risk.
  - scarface74 7y ago
    Why is adding friction for advanced cases a bad thing? How is the browser suppose to know whether the user wrote the extension or downloaded it from the internet? We already see what happens when users download extensions and toolbars willy nilly.
    - TeMPOraL 7y ago
      Depends on your goal. If you want the computer to be "bicycle for the mind", you want to reduce friction so that "advanced" use isn't really "advanced", but normal. See also Hypercard, or how people use Excel in offices, or secretaries that extended Emacs because they didn't know writing Lisp was "programming", or countless other stories of end-user improvements. If you want the computer to be a digital television set, or a digital collection of appliances, then sure - let's lock everything down, so that you can only do what you're allowed to by the vendors, and only through means allowed by the vendors. This is the scenario in which you want to add friction to end-user "advanced" use. > How is the browser suppose to know whether the user wrote the extension or downloaded it from the internet? It cannot be done in general - if a user can do something manually, a sophisticated piece of malware running outside of the browser can simulate too. But I think there's ways to add warnings without increasing friction. Having to manually re-enable each and every user-created extension on browser restart is IMO way too much friction. Being shown a warning about those extensions on each browser restart, but keeping them running sounds more reasonable.
      - scarface74 7y ago
        Computers stopped being for enthusiasts by the early 90s - about the last time HyperCard was updated coincidentally. I remember the change well, it was around that time where the back of the InCider magazine stopped including code listings for interesting assembly language extensions for Basic and started listing “power users” tips. Yes, I agree that having to re-enable extensions every time is too much, but going through contortions once isn’t.
- wutbrodo 7y ago
  I feel like having a big scary warning would be sufficient instead of making it inconvenient. It's easy for a competent user to ignore a warning that they fully understand while it scares off those that are clueless.
  - scarface74 7y ago
    People ignore warnings - they have since the dawn of personal computers. You remember Vista UAC? Why optimize for the 1% instead of the 99%?
    - wutbrodo 7y ago
      UAC was simultaneously seemingly ubiquitous and not a particularly "scary" warning. It just sounded like bland computer jargon to the uninformed. I was envisioning something like the https warnings that Chrome gives: a clear warning sign that uses emotionally loaded terms like "go back to safety" and hides the proceed link under the fold. That being said, it's entirely possible that I'm overestimating the intelligence of the average user and that many of them wouldn't blink even in the face of a warning made up to look scary.
  - stordoff 7y ago
    It's also easy to ignore a warning you don't understand. I know from helping family they don't particularly care what warnings say - they have work to do, and they do know clicking OK makes it go away.
  - aswan 7y ago
    The issue isn't about having a sufficiently scary warning. It is that the browser has to store the fact that the user has agreed to this warning somewhere (ie, presumably in the user's profile). That means any other software running on the computer with regular user permissions can make the same modification to the profile and then install an unsigned extension without the user's consent. Typically, when Mozilla finds out about software installing extensions without user consent, the extension is added to the blocklist, but if the extension is unsigned it can just claim that it is ublock origin or adblock plus or some popular extension, leaving no practical way to block it. This is described in greater detail at https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/ https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte... (in full disclosure, I am a Mozilla employee)
danShumway 7y ago
I believe Firefox Dev edition allows you to disable the signing requirement[0]. I do wish the requirements around signing were less stringent, but I'm fine using Dev Edition as a daily driver for now. [0]: https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox#w_what-are-my-options-if-i-want-to-use-an-unsigned-add-on-advanced-users https://support.mozilla.org/en-US/kb/add-on-signing-in-firef...
- Wowfunhappy 7y ago
  But then you're using the beta channel instead of the stable channel. It's great that you're fine with that, but everyone shouldn't have to. At the absolute least, Mozilla should make Unbranded auto-update.
  - the_pwner224 7y ago
    I've been using FF nightly - the most untested version, hot off of git - for two years and have yet to encounter a single bug which I could not reproduce in normal FF (mainly rare crashes on certain sites some of the time).
    - Wowfunhappy 7y ago
      With all respect, I think that Mozilla has a lot more testers than just one person. If the beta channel (or nightly) was truly bug free, it would be turned into the release channel. In other words, there is presumably a reason the release channel exists. As long as it does, the desire to use the release version alongside unsigned extensions is reasonable, and there should be a supported pathway.
nodja 7y ago
Aside of your cookie extension, the other 3 could probably have been done with userscripts. I often find a missing feature in a website that I add with userscripts. There's also user created userscripts for several websites, like a webcomic reader that preloads pages from several webcomic websites so you don't have to wait on the slow ones.
dbandstra 7y ago
I think this is a great idea. I maintain a personal extension as well. I've experimented with a few ideas for augmenting browser experience, but so far I'm mostly just hiding obtrusive elements on various websites (mostly by CSS, with some JS where sites obfuscate class names). Even that would have taken multiple thirdparty extensions to accomplish - and probably would have required giving very broad permissions to them. Worth noting that Stylish, one of the extensions I might have used, was compromised with spyware a few years ago. As for publishing, I don't publish mine because it forms a kind of personal fingerprint. The more I add to it the more personal it gets. I rather support the idea of everyone having their own custom extension. You can really improve your online quality of life and with the WebExtension API it's pretty painless.
- heavenlyblue 7y ago
  Is Stylish still compromised?
- roryokane 7y ago
  Though Stylish was compromised, you can safely use the fork Stylus that was created in response: https://github.com/openstyles/stylus https://github.com/openstyles/stylus I use Stylus to add custom CSS to sites and Violentmonkey (https://violentmonkey.github.io/ https://violentmonkey.github.io/) to add custom JS. They both make it fairly easy to start writing code for a new site. However, there is no easy way to set up both custom CSS and custom JS for a single site – a custom browser extension like you made could potentially support that better.
hiccuphippo 7y ago
I make extensive use of the Tampermonkey (for javascript) and stylus (for css) extensions. I probably don't have access to some of the browser's APIs but it is easier to create and edit scripts with them.
- TeMPOraL 7y ago
  Seconded. Both of those plugins are excellent for end-user improvements, because they let you simply add code to be run on a given site or set of sites. No nonsense with packaging and building and programming environments; you can just write the code you need in the browser, as you need it.
  - nemosaltat 7y ago
    3rded. I use the @updateurl and @version and save my scripts in Google Drive with a public URL. To update, I can just increment the version in the hosted copy, then reload tamper monkey. Has the bonus of quick and dirty revision history.
- idoubtit 7y ago
  The irony is that I ported two of my old user scripts to web extensions. With old Opera, userJS was native, while TamperMonky is a (big) web extension. I had performance problems with TamperMonkey, so I rewrote my scripts to avoid this layer. Pros of TamperMonkey/userJS: - Allows live editing (with syntax highlighting) with immediate refresh, all in the browser. This is handy for minor changes on small files, but slow for big files. - Direct access to some HTML5 APIs that are restricted in extensions. I don't recall if that was the case with TamperMonkey, but OperaJS allowed plain AJAX and WebStorage usage, just as if the file was included in the web page. Cons: - Slower than extensions. - Less powerful (cannot add a button in a browser bar, etc) - Painful as code grows. An extension allows simple splitting of code into several files. I found UserJS harder to maintain. - Cannot load JS _and CSS_ like an extension does. Another extension like Stylus is needed.
zeta0134 7y ago
You can work around this by running Firefox Developer, which is able to disable Mozilla's signing requirements. That edition of the browser actually respects xpinstall.signatures.required, so just toggle that, zip your extension, rename to .xpi, and install. It'll warn you once, proceed, and persist through browser restarts just like any other extension. Obviously that's no help if you want to distribute the extension (we have to jump through hoops at our organization to push out a manifest) but for personal use I find it to be a good workaround.
- mehrdadn 7y ago
  I think unbranded builds work too. https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...
harshreality 7y ago
> One that deals with cookies (mostly "delete everything" outside of my white list) That sounds a lot like the "Cookie AutoDelete" FF extension.
chriswarbo 7y ago
As another anecdote, I made a couple of Chrome extensions years ago to improve my development workflow: - One would switch to an existing tab with the same URL, instead of opening a duplicate. This made it easier to click URLs in error/debug messages without making the browser unmanageable (IIRC this was just a copy/paste of someone else's extension, which didn't work without me fiddling it) - One would add keybindings to the output of Drupal integration tests. These tests would say things like 'visit X', 'click the Y button', 'enter Z in the form', etc. and would save each page, so if a test failed each step could be viewed in a browser. The only problem was this is tedious, so I made an extension which bound the left/right cursor keys to stepping through these pages. Made it much easier to skip through the setup and get to the bug (e.g. adding items to cart, when the problem is in checkout).

scarface74 7y ago

Besides having to do it on every restart, that’s a good thing. It should be convoluted to do unsafe operations to protect the average user but allow the advanced user flexibility.

chipperyman573 7y ago
That would be a good argument if using only the approved channels protected users, but a lot of extensions have malware that sell user data, including ones in stores. https://www.inc.com/jason-aten/the-browser-extensions-you-use-every-day-are-selling-your-personal-information-at-an-astonishing-rate.html https://www.inc.com/jason-aten/the-browser-extensions-you-us...
- scarface74 7y ago
  I’m the last person who is going to defend the security architecture of browser plugins. But, when Google tried to implement an ad blocking architecture that wouldn’t allow third parties access to your browsing history similar to that of Safari, geeks were up in arms.
  - chipperyman573 7y ago
    The ad blocking changes also prevented blocking the request to the ad servers, which is what people were upset about (or at least, why I was upset). I don't remember seeing anyone be upset about anything related to browsing history.
    - scarface74 7y ago
      No one was upset about a plug in not getting access to your browsing history. People were upset about the declarative ad blocking that took away some of the features that they ad blockers previously had and said Google was doing it to protect their business. I’m not going to defend Google’s overall business practices, but from what I understand, it’s the same type of architecture that Apple has had for four years and no one said Apple’s intentions were nefarious.
      - gildas 7y ago
        Some also claim that Google kills innovation. Synchronous interception of requests allows developers to program sophisticated rules to fight malicious resources. In the future, they will only have a regular expressions list to block domains. It will be much easier for malicious actors to bypass this feature.
        scarface74 7y ago
        It also allows developers to intercept your entire browsing history. If you care about your privacy, why would you let a random third party intercept all of your browsing history?
        gildas 7y ago
        I consider everything to be a matter of risk in terms for example of privacy. By installing an extension like uBlock, I am indeed taking the risk you mentioned. However, I consider that the risk will be much higher when installing an extension that is based only on a list of regular expressions for the reason I mentioned. If uBlock did a bad thing, I'll know very quickly and all I'll have to do is install an alternative extension. I am also a developer. I would like to continue to have the right to code such extensions for myself.
cmroanirgo 7y ago
I've been on both sides of the fence in this one, and agree with both arguments. Perhaps FF could add (if it doesn't have it already) an about:config setting that allows reloads, perhaps from a specific folder(s).
- scarface74 7y ago
  It’s really not that hard to have a setting that allows an extension to run every time and hash the extension. If the hash changes, it’s disabled until you re-enable it.
TeMPOraL 7y ago
Adds friction. Ideally user-made extensions should be more trusted and easier to work with than Internet-sourced ones. I can understand that in practice, if user can make something, the user can also be convinced by an attacker to selfpwn through, but we ought to accept some level of that risk.
- scarface74 7y ago
  Why is adding friction for advanced cases a bad thing? How is the browser suppose to know whether the user wrote the extension or downloaded it from the internet? We already see what happens when users download extensions and toolbars willy nilly.
  - TeMPOraL 7y ago
    Depends on your goal. If you want the computer to be "bicycle for the mind", you want to reduce friction so that "advanced" use isn't really "advanced", but normal. See also Hypercard, or how people use Excel in offices, or secretaries that extended Emacs because they didn't know writing Lisp was "programming", or countless other stories of end-user improvements. If you want the computer to be a digital television set, or a digital collection of appliances, then sure - let's lock everything down, so that you can only do what you're allowed to by the vendors, and only through means allowed by the vendors. This is the scenario in which you want to add friction to end-user "advanced" use. > How is the browser suppose to know whether the user wrote the extension or downloaded it from the internet? It cannot be done in general - if a user can do something manually, a sophisticated piece of malware running outside of the browser can simulate too. But I think there's ways to add warnings without increasing friction. Having to manually re-enable each and every user-created extension on browser restart is IMO way too much friction. Being shown a warning about those extensions on each browser restart, but keeping them running sounds more reasonable.
    - scarface74 7y ago
      Computers stopped being for enthusiasts by the early 90s - about the last time HyperCard was updated coincidentally. I remember the change well, it was around that time where the back of the InCider magazine stopped including code listings for interesting assembly language extensions for Basic and started listing “power users” tips. Yes, I agree that having to re-enable extensions every time is too much, but going through contortions once isn’t.
wutbrodo 7y ago
I feel like having a big scary warning would be sufficient instead of making it inconvenient. It's easy for a competent user to ignore a warning that they fully understand while it scares off those that are clueless.
- scarface74 7y ago
  People ignore warnings - they have since the dawn of personal computers. You remember Vista UAC? Why optimize for the 1% instead of the 99%?
  - wutbrodo 7y ago
    UAC was simultaneously seemingly ubiquitous and not a particularly "scary" warning. It just sounded like bland computer jargon to the uninformed. I was envisioning something like the https warnings that Chrome gives: a clear warning sign that uses emotionally loaded terms like "go back to safety" and hides the proceed link under the fold. That being said, it's entirely possible that I'm overestimating the intelligence of the average user and that many of them wouldn't blink even in the face of a warning made up to look scary.
- stordoff 7y ago
  It's also easy to ignore a warning you don't understand. I know from helping family they don't particularly care what warnings say - they have work to do, and they do know clicking OK makes it go away.
- aswan 7y ago
  The issue isn't about having a sufficiently scary warning. It is that the browser has to store the fact that the user has agreed to this warning somewhere (ie, presumably in the user's profile). That means any other software running on the computer with regular user permissions can make the same modification to the profile and then install an unsigned extension without the user's consent. Typically, when Mozilla finds out about software installing extensions without user consent, the extension is added to the blocklist, but if the extension is unsigned it can just claim that it is ublock origin or adblock plus or some popular extension, leaving no practical way to block it. This is described in greater detail at https://blog.mozilla.org/addons/2015/04/15/the-case-for-extension-signing/ https://blog.mozilla.org/addons/2015/04/15/the-case-for-exte... (in full disclosure, I am a Mozilla employee)

danShumway 7y ago

I believe Firefox Dev edition allows you to disable the signing requirement[0]. I do wish the requirements around signing were less stringent, but I'm fine using Dev Edition as a daily driver for now. [0]: https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox#w_what-are-my-options-if-i-want-to-use-an-unsigned-add-on-advanced-users https://support.mozilla.org/en-US/kb/add-on-signing-in-firef...

Wowfunhappy 7y ago
But then you're using the beta channel instead of the stable channel. It's great that you're fine with that, but everyone shouldn't have to. At the absolute least, Mozilla should make Unbranded auto-update.
- the_pwner224 7y ago
  I've been using FF nightly - the most untested version, hot off of git - for two years and have yet to encounter a single bug which I could not reproduce in normal FF (mainly rare crashes on certain sites some of the time).
  - Wowfunhappy 7y ago
    With all respect, I think that Mozilla has a lot more testers than just one person. If the beta channel (or nightly) was truly bug free, it would be turned into the release channel. In other words, there is presumably a reason the release channel exists. As long as it does, the desire to use the release version alongside unsigned extensions is reasonable, and there should be a supported pathway.

nodja 7y ago

Aside of your cookie extension, the other 3 could probably have been done with userscripts. I often find a missing feature in a website that I add with userscripts. There's also user created userscripts for several websites, like a webcomic reader that preloads pages from several webcomic websites so you don't have to wait on the slow ones.

dbandstra 7y ago

I think this is a great idea. I maintain a personal extension as well. I've experimented with a few ideas for augmenting browser experience, but so far I'm mostly just hiding obtrusive elements on various websites (mostly by CSS, with some JS where sites obfuscate class names). Even that would have taken multiple thirdparty extensions to accomplish - and probably would have required giving very broad permissions to them. Worth noting that Stylish, one of the extensions I might have used, was compromised with spyware a few years ago. As for publishing, I don't publish mine because it forms a kind of personal fingerprint. The more I add to it the more personal it gets. I rather support the idea of everyone having their own custom extension. You can really improve your online quality of life and with the WebExtension API it's pretty painless.

heavenlyblue 7y ago
Is Stylish still compromised?
roryokane 7y ago
Though Stylish was compromised, you can safely use the fork Stylus that was created in response: https://github.com/openstyles/stylus https://github.com/openstyles/stylus I use Stylus to add custom CSS to sites and Violentmonkey (https://violentmonkey.github.io/ https://violentmonkey.github.io/) to add custom JS. They both make it fairly easy to start writing code for a new site. However, there is no easy way to set up both custom CSS and custom JS for a single site – a custom browser extension like you made could potentially support that better.

hiccuphippo 7y ago

I make extensive use of the Tampermonkey (for javascript) and stylus (for css) extensions. I probably don't have access to some of the browser's APIs but it is easier to create and edit scripts with them.

TeMPOraL 7y ago
Seconded. Both of those plugins are excellent for end-user improvements, because they let you simply add code to be run on a given site or set of sites. No nonsense with packaging and building and programming environments; you can just write the code you need in the browser, as you need it.
- nemosaltat 7y ago
  3rded. I use the @updateurl and @version and save my scripts in Google Drive with a public URL. To update, I can just increment the version in the hosted copy, then reload tamper monkey. Has the bonus of quick and dirty revision history.
idoubtit 7y ago
The irony is that I ported two of my old user scripts to web extensions. With old Opera, userJS was native, while TamperMonky is a (big) web extension. I had performance problems with TamperMonkey, so I rewrote my scripts to avoid this layer. Pros of TamperMonkey/userJS: - Allows live editing (with syntax highlighting) with immediate refresh, all in the browser. This is handy for minor changes on small files, but slow for big files. - Direct access to some HTML5 APIs that are restricted in extensions. I don't recall if that was the case with TamperMonkey, but OperaJS allowed plain AJAX and WebStorage usage, just as if the file was included in the web page. Cons: - Slower than extensions. - Less powerful (cannot add a button in a browser bar, etc) - Painful as code grows. An extension allows simple splitting of code into several files. I found UserJS harder to maintain. - Cannot load JS _and CSS_ like an extension does. Another extension like Stylus is needed.

zeta0134 7y ago

You can work around this by running Firefox Developer, which is able to disable Mozilla's signing requirements. That edition of the browser actually respects xpinstall.signatures.required, so just toggle that, zip your extension, rename to .xpi, and install. It'll warn you once, proceed, and persist through browser restarts just like any other extension. Obviously that's no help if you want to distribute the extension (we have to jump through hoops at our organization to push out a manifest) but for personal use I find it to be a good workaround.

mehrdadn 7y ago
I think unbranded builds work too. https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded_Builds https://wiki.mozilla.org/Add-ons/Extension_Signing#Unbranded...

harshreality 7y ago

> One that deals with cookies (mostly "delete everything" outside of my white list) That sounds a lot like the "Cookie AutoDelete" FF extension.

chriswarbo 7y ago

As another anecdote, I made a couple of Chrome extensions years ago to improve my development workflow: - One would switch to an existing tab with the same URL, instead of opening a duplicate. This made it easier to click URLs in error/debug messages without making the browser unmanageable (IIRC this was just a copy/paste of someone else's extension, which didn't work without me fiddling it) - One would add keybindings to the output of Drupal integration tests. These tests would say things like 'visit X', 'click the Y button', 'enter Z in the form', etc. and would save each page, so if a test failed each step could be viewed in a browser. The only problem was this is tedious, so I made an extension which bound the left/right cursor keys to stepping through these pages. Made it much easier to skip through the setup and get to the bug (e.g. adding items to cart, when the problem is in checkout).