4 ms·

What is being crippled here? The API is being moved to another objects and restructured in a way that's not as haphazard for actual extension development and di

by meibo 5y ago

What is being crippled here? The API is being moved to another objects and restructured in a way that's not as haphazard for actual extension development and distribution. If this doesn't work for your specific use case, write a wrapper object - your point is that the API was stable with V2, but it will still be with V3 and you should be able to rely on that. Am I missing something?

comex 5y ago
Read the post more closely. It’s not just an API reshuffle. Chrome is restricting the ability for extensions to run JavaScript code that is dynamically generated or loaded, limiting them (in many cases) to static scripts embedded in the extension itself.
- martinsbalodis 5y ago
  They are only disallowing code execution within content script sandbox. You can still create a <script> tag with custom code. The script will be run in page sandbox. The main difference is that it won't be able to access chrome.* APIs but it could be affected by CSP. I doubt that tampermonkey executes custom scripts within content script sandbox since a script could take over the extension itself. They should be fine. Please note that as an extension developer I receive at least once a month a cash offer to inject scripts that track users.
foob 5y ago
What is being crippled here? The ability to execute arbitrary JavaScript in content scripts at runtime. Remote-browser works by making it very easy to run code in content and background script contexts from a remote client. Typical browser automation tasks like filling out an input, clicking a button, or extracting the HTML of an element are accomplished by marshaling code and results between the browser and the client. your point is that the API was stable with V2 My point isn't that the API was stable, it's that Google is moving towards removing key features from the API because they consider them to be too powerful. Blocking webRequest and executeScript are two notable examples.

by meibo 5y ago

comex 5y ago

Read the post more closely. It’s not just an API reshuffle. Chrome is restricting the ability for extensions to run JavaScript code that is dynamically generated or loaded, limiting them (in many cases) to static scripts embedded in the extension itself.

martinsbalodis 5y ago
They are only disallowing code execution within content script sandbox. You can still create a <script> tag with custom code. The script will be run in page sandbox. The main difference is that it won't be able to access chrome.* APIs but it could be affected by CSP. I doubt that tampermonkey executes custom scripts within content script sandbox since a script could take over the extension itself. They should be fine. Please note that as an extension developer I receive at least once a month a cash offer to inject scripts that track users.

foob 5y ago

What is being crippled here? The ability to execute arbitrary JavaScript in content scripts at runtime. Remote-browser works by making it very easy to run code in content and background script contexts from a remote client. Typical browser automation tasks like filling out an input, clicking a button, or extracting the HTML of an element are accomplished by marshaling code and results between the browser and the client. your point is that the API was stable with V2 My point isn't that the API was stable, it's that Google is moving towards removing key features from the API because they consider them to be too powerful. Blocking webRequest and executeScript are two notable examples.