6 ms·

A few years ago I played around with Metamask - which is a popular browser extension which lets you use ether and ERC20 tokens on websites. Pretty soon afterwa

A few years ago I played around with Metamask - which is a popular browser extension which lets you use ether and ERC20 tokens on websites. Pretty soon afterwards I realised my browser just felt slow, so I looked into what was going on. Turns out metamask pulls in web3.js, which alone is 2.3mb of javascript. Simply parsing that much code in each chrome tab was taking hundreds of milliseconds per page load. Web3.js is so ineptly crafted. Some of its dependencies get bundled a lot of times at slightly different point releases, for no forseeable reason. I opened an issue about this years ago, and despite lots of attention and promises it still hasn't been fixed[1]. The bigger issue with metamask is that (at least at the time) it allowed any site you visit to silently query your crypto wallet address. Talk about a privacy invasion. Every website you visit gets an ID that I'll keep across all my devices, through which you can find out exactly how much money I have, in what cryptocurrencies. And they can use that to track my purchases. Forever. I raised this with the developers and they said "oh yeah we know about that and we'll fix it later". (Edit: sounds like this security problem was eventually fixed months or years later.) What on earth? People want to build the future of the web on this junk pile? Holy cow this is a house of cards. [1] https://github.com/ChainSafe/web3.js/issues/1178 https://github.com/ChainSafe/web3.js/issues/1178

judge2020 5y ago
If I’m not mistaken, MetaMask (fixed this via) prompts that ask you to allow a website to view your addresses now. At least, I see those anytime I need to connect to a site now.
- jeroenhd 5y ago
  Such functionality would still be very useful for criminals, because they can decide to focus their efforts on devices where the prompt exists in the first place, even if the user says no. That way your coin stealer doesn't get onto exploited machines where it's useless, so it'll take longer for AV to pick it up.
  - Tenoke 5y ago
    It'd be a pretty obvious red flag when a site with no 'web3' functionality opens the prompt.
pcthrowaway 5y ago
> The bigger issue with metamask is that (at least at the time) it allowed any site you visit to silently query your crypto wallet address. Maybe things were different then, but I believe at the present, sites you visit can't get your wallet address unless you've connected metamask to that site.
- josu 5y ago
  > The bigger issue with metamask is that (at least at the time) it allowed any site you visit to silently query your crypto wallet address. Yeah, that's not correct, and I don't think it was ever that way. However, websites can indeed know if you have Metamask installed, which still is a security concern. Chrome has mitigated that adding the option to only run Extensions when you click on them.
zitterbewegung 5y ago
That's not the worst part of it to be honest. One would guess that to deploy smart contracts you would just download the Ethereum client and write a smart contract and then deploy. Sure this can be technically done but in reality most developers use a centralized system that deploys smart contracts and it is called Infura [1]. I hold some ETH, DOGE and BTC but as these platforms become more and more mature it seems like you get either more governance that becomes centralized, developers use more and more centralized systems and lastly government will probably regulate it to the point where it becomes useful. As it stands right now making a DAO can't be done realistically in Ethereum. [1] https://infura.io/ https://infura.io/
- Osiris 5y ago
  My company deploys our smart contracts through our own nodes. Infura is really just an Ethereum node as a service.
- capnorange 5y ago
  there is practically no attack vector in using infura. Infura can't fake your can't fake your cryptographic signature. Worst case, they censor txs from your address at which point you can run your own node.
  - zitterbewegung 5y ago
    I'm not even talking about an attack vector. I'm talking about a centralized system that is recommended by other developers when Ethereum keeps on making claims of moving forward centralized systems.
Sevii 5y ago
Both of the problems you mention have been fixed.
- josephg 5y ago
  No it hasn't. Web3 hasn't gotten smaller. In the last year its gotten even worse. Its now nearly 3x as big as it was 4 years ago, when I first complained about it being slow and bloated. I re-ran some tests to check after reading your comment, and compared to last year web3 has regressed in every measure I took: - node_modules size: 59mb (was 53mb last year) - Non-minified bundle size: 3.2mb (was 2.4mb last year) - Minified bundle size: 1.85mb (was 1.15mb last year) - Number of copies of bn.js included in the bundle: 8 (was 6) The minified+gzipped size has increased by 88% in the last 12 months alone. Full details in the issue: https://github.com/ChainSafe/web3.js/issues/1178#issuecomment-995567079 https://github.com/ChainSafe/web3.js/issues/1178#issuecommen...
  - miracle2k 5y ago
    However, MetaMask no longer injects web3.js.

judge2020 5y ago

If I’m not mistaken, MetaMask (fixed this via) prompts that ask you to allow a website to view your addresses now. At least, I see those anytime I need to connect to a site now.

jeroenhd 5y ago
Such functionality would still be very useful for criminals, because they can decide to focus their efforts on devices where the prompt exists in the first place, even if the user says no. That way your coin stealer doesn't get onto exploited machines where it's useless, so it'll take longer for AV to pick it up.
- Tenoke 5y ago
  It'd be a pretty obvious red flag when a site with no 'web3' functionality opens the prompt.

pcthrowaway 5y ago

> The bigger issue with metamask is that (at least at the time) it allowed any site you visit to silently query your crypto wallet address. Maybe things were different then, but I believe at the present, sites you visit can't get your wallet address unless you've connected metamask to that site.

josu 5y ago
> The bigger issue with metamask is that (at least at the time) it allowed any site you visit to silently query your crypto wallet address. Yeah, that's not correct, and I don't think it was ever that way. However, websites can indeed know if you have Metamask installed, which still is a security concern. Chrome has mitigated that adding the option to only run Extensions when you click on them.

zitterbewegung 5y ago

That's not the worst part of it to be honest. One would guess that to deploy smart contracts you would just download the Ethereum client and write a smart contract and then deploy. Sure this can be technically done but in reality most developers use a centralized system that deploys smart contracts and it is called Infura [1]. I hold some ETH, DOGE and BTC but as these platforms become more and more mature it seems like you get either more governance that becomes centralized, developers use more and more centralized systems and lastly government will probably regulate it to the point where it becomes useful. As it stands right now making a DAO can't be done realistically in Ethereum. [1] https://infura.io/ https://infura.io/

Osiris 5y ago
My company deploys our smart contracts through our own nodes. Infura is really just an Ethereum node as a service.
capnorange 5y ago
there is practically no attack vector in using infura. Infura can't fake your can't fake your cryptographic signature. Worst case, they censor txs from your address at which point you can run your own node.
- zitterbewegung 5y ago
  I'm not even talking about an attack vector. I'm talking about a centralized system that is recommended by other developers when Ethereum keeps on making claims of moving forward centralized systems.

Sevii 5y ago

Both of the problems you mention have been fixed.

josephg 5y ago
No it hasn't. Web3 hasn't gotten smaller. In the last year its gotten even worse. Its now nearly 3x as big as it was 4 years ago, when I first complained about it being slow and bloated. I re-ran some tests to check after reading your comment, and compared to last year web3 has regressed in every measure I took: - node_modules size: 59mb (was 53mb last year) - Non-minified bundle size: 3.2mb (was 2.4mb last year) - Minified bundle size: 1.85mb (was 1.15mb last year) - Number of copies of bn.js included in the bundle: 8 (was 6) The minified+gzipped size has increased by 88% in the last 12 months alone. Full details in the issue: https://github.com/ChainSafe/web3.js/issues/1178#issuecomment-995567079 https://github.com/ChainSafe/web3.js/issues/1178#issuecommen...
- miracle2k 5y ago
  However, MetaMask no longer injects web3.js.