3 ms·
> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. This seems like a good idea until y
by lbatx 7y ago
> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.
This seems like a good idea until you realize that the behavior you might want to modify is coming from a different domain loaded by the page and you have no control over how they set that up.
- jackfraser 7y agoSo the app should ask for a permission to a reasonable set of domains, and when you're installing it, you should get a clearly laid out permissions / privacy risk management worksheet to look at and agree to.
- Seb-C 7y agoThat would indeed be nice, but currently the domain list is hardcoded in the json file.
- lbatx 7y agoMany sites use dozens of domains. Some (probably most) are ads, tracking, and the like. But much of it is stuff needed to run the site. I don't think there is a reasonable set of defaults other than things not on an ad blocker blacklist. And asking the user to approve each domain on a page is too much -- how would they decide, and how would they know which one prevented the site from working properly?
- jackfraser 7y agoWhat if that's fundamentally a flawed way of building things? Maybe your site should provide all of the assets it needs...
- lbatx 7y agoIt's certainly flawed, but providing all of the assets creates a different class of problems. Both approaches have pros and cons, plus the original comment I replied to passed it off as a solution to the problem at hand, which it's not.