4 ms·

I really want to use things like this, but the permissions model is scary, it wants access to everything. I'm sure most plugins are benign, but it might not be

ssivark 6y ago
I felt/feel the same, but I am greatly comforted by the add-on making an attempt to clearly communicate what it uses/needs each of those permissions for: https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim/ https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim... Even though there’s no guarantee that the explanation corresponds exactly to what is implemented behind the scenes, this unusual pattern of user respect and consideration makes the add-on/developers feel more trustworthy than other sketchier ones.
renewiltord 6y ago
It's open source, just read it and use the source-code release https://github.com/tridactyl/tridactyl https://github.com/tridactyl/tridactyl
- lajawfe 6y ago
  Is it possible to validate what I am running in browser is an unaltered version of what is there in Github? Otherwise, I will have to trust the package author to not be malicious. Another option might be to personally package and sideload the extension which I don't know how.
  - bovine3dom 6y ago
    Tridactyl exists in the Arch community repos [1] if you would rather use that; you're effectively shifting your trust to an Arch trusted user away from some random person (me) and Mozilla. [1]: https://www.archlinux.org/packages/community/any/firefox-tridactyl/ https://www.archlinux.org/packages/community/any/firefox-tri...
  - renewiltord 6y ago
    Yes, that's what I meant! It's very easy to sideload. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Your_first_WebExtension#:~:text=In%20Firefox%3A%20Open%20the%20about,stay%20until%20you%20restart%20Firefox https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web....
dotancohen 6y ago
I'm really glad that other people feel that permissions over-reach is a problem. Specifically in the case of Tridactyl, as an interface to the entire webbrowser is needs access to the entire web browser. It does manage bookmarks, it does modify webpages (by adding link hints).
lrem 6y ago
This is about the only type of addon that genuinely needs full access to everything - the type that replaces your browsing interface. It needs to be able to interact in all the possible ways with every single element on the page. There's no way around it having scary powers, because using them is its base purpose.

ssivark 6y ago

I felt/feel the same, but I am greatly comforted by the add-on making an attempt to clearly communicate what it uses/needs each of those permissions for: https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim/ https://addons.mozilla.org/en-US/firefox/addon/tridactyl-vim... Even though there’s no guarantee that the explanation corresponds exactly to what is implemented behind the scenes, this unusual pattern of user respect and consideration makes the add-on/developers feel more trustworthy than other sketchier ones.

renewiltord 6y ago

It's open source, just read it and use the source-code release https://github.com/tridactyl/tridactyl https://github.com/tridactyl/tridactyl

lajawfe 6y ago
Is it possible to validate what I am running in browser is an unaltered version of what is there in Github? Otherwise, I will have to trust the package author to not be malicious. Another option might be to personally package and sideload the extension which I don't know how.
- bovine3dom 6y ago
  Tridactyl exists in the Arch community repos [1] if you would rather use that; you're effectively shifting your trust to an Arch trusted user away from some random person (me) and Mozilla. [1]: https://www.archlinux.org/packages/community/any/firefox-tridactyl/ https://www.archlinux.org/packages/community/any/firefox-tri...
- renewiltord 6y ago
  Yes, that's what I meant! It's very easy to sideload. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Your_first_WebExtension#:~:text=In%20Firefox%3A%20Open%20the%20about,stay%20until%20you%20restart%20Firefox https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web....

dotancohen 6y ago

I'm really glad that other people feel that permissions over-reach is a problem. Specifically in the case of Tridactyl, as an interface to the entire webbrowser is needs access to the entire web browser. It does manage bookmarks, it does modify webpages (by adding link hints).

lrem 6y ago

This is about the only type of addon that genuinely needs full access to everything - the type that replaces your browsing interface. It needs to be able to interact in all the possible ways with every single element on the page. There's no way around it having scary powers, because using them is its base purpose.