7 ms·

I would really like Firefox to implement granular permissions per extension. So, if I can choose to not give this extension permission to talk to external progr

I would really like Firefox to implement granular permissions per extension. So, if I can choose to not give this extension permission to talk to external programs. And hopefully the extension authors wrote it in a way that it degrades gracefully.

Teever 5y ago
I was thinking the same thing when I was reading this link too. Another thing I'd like is for Mozilla to not be able to deactivate extensions remotely.
rzzzt 5y ago
Bookmark access for the container extension is optional and there is a toggle button for it; for some reason, this one was added to the "Required permissions for core functionality" list which can not be modified.
- Vinnl 5y ago
  > for some reason I think these permissions cannot be optional: https://extensionworkshop.com/documentation/develop/request-the-right-permissions/#advised-permissions https://extensionworkshop.com/documentation/develop/request-... (Not sure though, I haven't worked with optional permissions for my extensions yet.)
Vinnl 5y ago
I'm not sure if it's possible for this permission yet, but it did become possible for extensions to dynamically requests access to page contents per site, rather than declaring them all up front. It requires the extension authors to use a different API though, which not everyone has switched to yet.
resoluteteeth 5y ago
This permission is harmless because native messaging only allows an extension to communicate with a specific native companion program that has to be installed/enabled outside if firefox. If you don't install the companion program, this permission won't do anything. It does not allow the extension to run arbitrary programs.
- dcormier 5y ago
  The permission request should probably be reworded to make that more clear.
- ComodoHacker 5y ago
  Where and how is this program specified? Can malware impersonate itself as a "companion program" and collect user activity data?
  - resoluteteeth 5y ago
    It's just specified in a manifest file in a specific location on Linux or referenced in a registry key on windows, so sure, if you already have malware running on your computer I suppose it could do that (assuming the messages sent by the extension contain browsing data) but there would probably be easier ways for it to collect your data.

Teever 5y ago

I was thinking the same thing when I was reading this link too. Another thing I'd like is for Mozilla to not be able to deactivate extensions remotely.

rzzzt 5y ago

Bookmark access for the container extension is optional and there is a toggle button for it; for some reason, this one was added to the "Required permissions for core functionality" list which can not be modified.

Vinnl 5y ago
> for some reason I think these permissions cannot be optional: https://extensionworkshop.com/documentation/develop/request-the-right-permissions/#advised-permissions https://extensionworkshop.com/documentation/develop/request-... (Not sure though, I haven't worked with optional permissions for my extensions yet.)

Vinnl 5y ago

I'm not sure if it's possible for this permission yet, but it did become possible for extensions to dynamically requests access to page contents per site, rather than declaring them all up front. It requires the extension authors to use a different API though, which not everyone has switched to yet.

resoluteteeth 5y ago

This permission is harmless because native messaging only allows an extension to communicate with a specific native companion program that has to be installed/enabled outside if firefox. If you don't install the companion program, this permission won't do anything. It does not allow the extension to run arbitrary programs.

dcormier 5y ago
The permission request should probably be reworded to make that more clear.
ComodoHacker 5y ago
Where and how is this program specified? Can malware impersonate itself as a "companion program" and collect user activity data?
- resoluteteeth 5y ago
  It's just specified in a manifest file in a specific location on Linux or referenced in a registry key on windows, so sure, if you already have malware running on your computer I suppose it could do that (assuming the messages sent by the extension contain browsing data) but there would probably be easier ways for it to collect your data.