4 ms·

> string-based code execution has been removed from extension APIs. So will it just be impossible to have extensions like ViolentMonkey, TamperMonkey, GreaseMo

by thayne 4y ago

> string-based code execution has been removed from extension APIs. So will it just be impossible to have extensions like ViolentMonkey, TamperMonkey, GreaseMonkey, Stylus, etc. in Firefox as well as chrome? That wouldn't be as big of a problem if the browser had it's own way to add user scripts, but it doesn't. And making your own extension for little scripts isn't really viable either. Especially since firefox at least requires the extension to be signed to install permanently, and getting it signed is not only a pain, but may be a privacy problem if your userscript has something sensitive in it. If you take away these extensions please at least give us a native way to add user scripts (and by all means put it behind a big scary warning that you shouldn't use untrusted scripts and you should only do it if you really know what you are doing).

zzo38computer 4y ago
Would a metacircular interpreter help, or does that not work? What if the entire document is replaced, is that possible? (Replacing the entire document might be necessary to fix some other things too, although I read the documentation for WebRequest, and it seems that security details cannot be modified, and that might make some things difficult, although adding a proxy with your own certificate might do.) Alternatively you could use developer edition if you want to write your own extensions, I think. Still, it is too bad that you will need all of this mess just to get the computer to work.
franga2000 4y ago
Stylus likely won't be affected, as CSS isn't actually "code execution" and can be fully reduced to "make a <style> element and inject it into the page". As for userscripts, those could be done in the same way, but this would reduce functionality and security.
maxloh 4y ago
Simeon Vincent (from the Chrome team) stated that they are planning to support extensions that inject user-written scripts or styles last year. https://github.com/Tampermonkey/tampermonkey/issues/644#issuecomment-858224952 https://github.com/Tampermonkey/tampermonkey/issues/644#issu...

by thayne 4y ago

zzo38computer 4y ago

Would a metacircular interpreter help, or does that not work? What if the entire document is replaced, is that possible? (Replacing the entire document might be necessary to fix some other things too, although I read the documentation for WebRequest, and it seems that security details cannot be modified, and that might make some things difficult, although adding a proxy with your own certificate might do.) Alternatively you could use developer edition if you want to write your own extensions, I think. Still, it is too bad that you will need all of this mess just to get the computer to work.

franga2000 4y ago

Stylus likely won't be affected, as CSS isn't actually "code execution" and can be fully reduced to "make a <style> element and inject it into the page". As for userscripts, those could be done in the same way, but this would reduce functionality and security.

maxloh 4y ago

Simeon Vincent (from the Chrome team) stated that they are planning to support extensions that inject user-written scripts or styles last year. https://github.com/Tampermonkey/tampermonkey/issues/644#issuecomment-858224952 https://github.com/Tampermonkey/tampermonkey/issues/644#issu...