5 ms·

I pulled the Honey extension a while ago to poke through it in order to better understand it and the first interesting thing I found is that despite the Google

I pulled the Honey extension a while ago to poke through it in order to better understand it and the first interesting thing I found is that despite the Google order that they'll no longer allow obfuscated Chrome extensions[0] the Honey extension is still - a year later - a large 2MB+ Javascript blob (webpack compiled and minified) [1] I've been meaning to go back into it to figure out what exactly they're doing but never found the time $4B cash on an extension that is at the mercy of Google and it's ever-changing rules and sporadic enforcement seems a risk [0] https://blog.chromium.org/2018/10/trustworthy-chrome-extensions-by-default.html https://blog.chromium.org/2018/10/trustworthy-chrome-extensi... [1] https://robwu.nl/crxviewer/?crx=https%3A%2F%2Fchrome.google.com%2Fwebstore%2Fdetail%2Fhoney%2Fbmnlcjabgnpnenekpadlanbbkooimhnj%2Frelated https://robwu.nl/crxviewer/?crx=https%3A%2F%2Fchrome.google....

lacker 7y ago
AFAICT, Google allows minified extensions, just not obfuscated ones. A quick browse through the Honey source code suggests to me that they are appropriately minifying and not obfuscating, because many of their variable names are comprehensible.
- seanwilson 7y ago
  > appropriately minifying and not obfuscating, because many of their variable names are comprehensible Wouldn't most scripts run through a minifier have incomprehensible names?
  - meowface 7y ago
    Yes, if set to maximum minimization. They might retain the original names to help with debugging, possibly.
    - seanwilson 7y ago
      Chrome extensions allow minimisation, including destroying the original names. I'm curious how they review the extensions to be honest as they don't ask you to provide the source code or the source map.
  - grenoire 7y ago
    There are also JS maps which allow you to download the obfuscated blob but still view more or less what is the original code; used for debugging React/JSX code, for example.
    - np_tedious 7y ago
      Outside of OSS, these are not frequently shared with the public. Is Honey's?

lacker 7y ago

AFAICT, Google allows minified extensions, just not obfuscated ones. A quick browse through the Honey source code suggests to me that they are appropriately minifying and not obfuscating, because many of their variable names are comprehensible.

seanwilson 7y ago
> appropriately minifying and not obfuscating, because many of their variable names are comprehensible Wouldn't most scripts run through a minifier have incomprehensible names?
- meowface 7y ago
  Yes, if set to maximum minimization. They might retain the original names to help with debugging, possibly.
  - seanwilson 7y ago
    Chrome extensions allow minimisation, including destroying the original names. I'm curious how they review the extensions to be honest as they don't ask you to provide the source code or the source map.
- grenoire 7y ago
  There are also JS maps which allow you to download the obfuscated blob but still view more or less what is the original code; used for debugging React/JSX code, for example.
  - np_tedious 7y ago
    Outside of OSS, these are not frequently shared with the public. Is Honey's?