4 ms·
I'd say most such issues with extensions could be solved if they were "read-only", i.e. were prevented from inserting data into documents, making or adding data
by TheChaplain 6y ago
I'd say most such issues with extensions could be solved if they were "read-only", i.e. were prevented from inserting data into documents, making or adding data into outbound requests.
- pkulak 6y agoIt could block ads with monads!
- ketzu 6y agoUnfortunately that would also remove the reason that people are using the extension in the first place.
- _puk 6y agoKind of, but you can still leak a lot of information in a simple read-only GET GET /realylongstringwithmeaningfulbits/{user identifier} This is basically what tracking pixels have been doing for years (1x1 transparent PNG).
- TheChaplain 6y agoSorry, I wasn't clear, I meant making _any_ outbound connections from the extension. If it can read or simply drop (such as for blockers) requests it should be fine, and make it harder to leak data.