2 ms·
Confiks comment above proposes > For example, they could have chosen a system where privacy-sensitive information like visited URLs are fed into a part of the
by neolog 6y ago
Confiks comment above proposes
> For example, they could have chosen a system where privacy-sensitive information like visited URLs are fed into a part of the extension which is a side-effect free function returning limited information. As they already have capability-based extension permissions, this would not be terribly hard to add if they would set their mind to it.
- danShumway 6y agoOn one hand, no, I don't think this would work, because part of what advanced adblockers like Ublock Origin allow is script insertion into pages and source rewrites when you request HTML pages. There's not a good, simple way I'm aware of to prevent data exfiltration in that kind of environment. Once I have the ability to change a page's source code before the browser loads it, I suspect I can kind of do anything. On the other hand, that proposal would make it at least marginally harder for malicious scripts to go undetected, and it's at least as much (if not more) of an improvement to privacy than the system Manifest V3 is going with, given that V3 doesn't prevent request monitoring, network requests from extensions, or script injection into the page. And there are probably ways to implement what you're talking about without breaking a huge number of extensions. So I don't think that's a solution, but it's significantly better than what Manifest V3 is trying to do.