6 ms·

Hey HN! We made a chrome extension to notify you of new comments on your stories and comments. Once installed, it adds a bell to HN's header and shows new not

Hey HN! We made a chrome extension to notify you of new comments on your stories and comments. Once installed, it adds a bell to HN's header and shows new notifications in real-time. Clicking on the bell loads a notification inbox with easy access to all your notifications with a clear distinction between the read/unread ones. Unlike some other options like HN replies, here are the key differences We don't ask for your email address - we use the HN cookie to identify you. There is no setup beyond adding the extension. Apart from on-page notifications, you can also subscribe to web-push notifications. We are using HN Firebase API to get a real-time feed of notifications, and our startup, [MagicBell (YC W21)](https://magicbell.io https://magicbell.io), to power the notification inbox. We built this extension because we found it hard to keep track of our [Launch HN thread](https://news.ycombinator.com/item?id=26037645 https://news.ycombinator.com/item?id=26037645) comments. We want to build a version for Firefox & Safari, and if you'd like to know when they go live, please follow us on [Twitter](https://twitter.com/magicbell_io https://twitter.com/magicbell_io). Dozens of early users have tested the extension, but if you run into any issues, please tweet at us, and we'd be more than happy to help you with it. We'd also love to hear your ideas on additional functionality you'd like to see.

gruez 6y ago
>We don't ask for your email address - we use the HN cookie to identify you does this extension contact any servers apart from hn itself?
- unamashana 6y ago
  It contacts magicbell.io. HN does not provide an API that we can query in real-time to fetch your notifications.
  - gruez 6y ago
    I just checked the cookies on hn and there's only one, with the format of: user=gruez&[redacted] Are you sending the entire session cookie, or just the part with the username?
    - unamashana 6y ago
      The entire session cookie to validate your login. Unfortunately there is no other reliable way to do.
      - gruez 6y ago
        That sounds dangerous. By sending the full cookie you're allowing yourself to hijack any of your user's sessions. That's a big security risk. Is there a reason why you need to "validate" someone's login? If someone wants to get notified about my comments, so what? There's nothing secret about it, they can just go to https://news.ycombinator.com/threads?id=gruez https://news.ycombinator.com/threads?id=gruez and get a live feed.
        unamashana 6y ago
        While the comments themselves are open, their state in your MagicBell inbox isn’t. If we didn’t have a way to validate identity, we won’t be able to make sure your notifications can’t be deleted/marked read by someone else.
        usmannk 6y ago
        Why not drop a local cookie yourself for state?
        unamashana 6y ago
        That doesn’t prevent someone from being able to impersonate you. The only alternative would be for HN to provide oauth access to your profile info.
        jjeaff 6y ago
        Perhaps you could hash the session id, with a secret salt on server side. Then you could discard the original and store and pass along the hashed session id. That way, anyone you send it to would not be able to impersonate the hn user. You could also hash with a different salt before sending to a 3rd party so that they would not be able to impersonate someone's account in your extension.
  - koolba 6y ago
    Why do you need a cookie at all? All the HN comments are public so once you’ve ascertained the handle you can query the API for any user to diff for changes.

gruez 6y ago

>We don't ask for your email address - we use the HN cookie to identify you does this extension contact any servers apart from hn itself?

unamashana 6y ago
It contacts magicbell.io. HN does not provide an API that we can query in real-time to fetch your notifications.
- gruez 6y ago
  I just checked the cookies on hn and there's only one, with the format of: user=gruez&[redacted] Are you sending the entire session cookie, or just the part with the username?
  - unamashana 6y ago
    The entire session cookie to validate your login. Unfortunately there is no other reliable way to do.
    - gruez 6y ago
      That sounds dangerous. By sending the full cookie you're allowing yourself to hijack any of your user's sessions. That's a big security risk. Is there a reason why you need to "validate" someone's login? If someone wants to get notified about my comments, so what? There's nothing secret about it, they can just go to https://news.ycombinator.com/threads?id=gruez https://news.ycombinator.com/threads?id=gruez and get a live feed.
      - unamashana 6y ago
        While the comments themselves are open, their state in your MagicBell inbox isn’t. If we didn’t have a way to validate identity, we won’t be able to make sure your notifications can’t be deleted/marked read by someone else.
        usmannk 6y ago
        Why not drop a local cookie yourself for state?
        unamashana 6y ago
        That doesn’t prevent someone from being able to impersonate you. The only alternative would be for HN to provide oauth access to your profile info.
        jjeaff 6y ago
        Perhaps you could hash the session id, with a secret salt on server side. Then you could discard the original and store and pass along the hashed session id. That way, anyone you send it to would not be able to impersonate the hn user. You could also hash with a different salt before sending to a 3rd party so that they would not be able to impersonate someone's account in your extension.
- koolba 6y ago
  Why do you need a cookie at all? All the HN comments are public so once you’ve ascertained the handle you can query the API for any user to diff for changes.