4 ms·
> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum. They already can: extension authors
by hota_mazi 7y ago
> Extensions should be able to have their permissions limited by domain (e.g. to customize YouTube or Reddit) at a minimum.
They already can: extension authors can specify that their extension only operates on specific URL's.
The problem is that most extensions are designed to work on all web sites, so you have to choose between security and convenience.
Most users pick the latter and trust the former.
This model works pretty well overall since harmful extensions never take long before getting flagged by the community.
- TuringTest 7y ago> This model works pretty well overall since harmful extensions never take long before getting flagged by the community. No, this model works pretty well for stealthy extensions which take malicious actions without getting detected.
- jsutton 7y agoIt also works well for normal useful extensions. We can figure out ways to eliminate stealthy malicious extensions without removing the most useful feature of extensions.
- lozenge 7y agoNacho Analytics just shut down after slurping all full URLs from 2 million extension installs for over six months.