4 ms·

There's some interesting ideas here, like the column approach, inline comment replies, etc. However, this note: >Hacker News UX is an early adopter of Manifes

by tyingq 3y ago

There's some interesting ideas here, like the column approach, inline comment replies, etc. However, this note: >Hacker News UX is an early adopter of Manifest V3 which imposes stricter security to extensions. I have to comment on that, as the Google line on MV3 being about security irks me a bit. In this case, the extensions loads for all urls with news.ycombinator.com/* and injects it's own build.js content script. It doesn't appear to do anything terrible, but it could if it wanted. It could keylog, exfiltrate data, steal your password, make HN posts on your behalf in the background, etc. Manifest V3 does nothing to police content scripts. Largely because many extensions need those kind of permissions to do anything useful.

hnux 3y ago
This extension only requests access to HN's known domains. If one would try to request to a non white-listed domain it would trigger Access-Control-Allow-Origin error. Also I think v3 makes it quite hard to use remote loaded code. Any attempt to be malicious would probably be caught by store's review process eventually.
- tyingq 3y ago
  Yeah, I'm not saying this extension is doing anything nefarious. I am saying that Google's propaganda about MV3 isn't right, and it's obviously spilling out to other people. MV3 blocks one specific api call in OnBeforeRequest()...the one that's useful mostly to ad blockers. The remote loaded code restriction is laudable, but the review process is weak. It's fairly easy to get shady things approved.
  - xd1936 3y ago
    Manifest V3 prohibits extensions from loading any remote code like JavaScript or Wasm files[1]. 1. https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#remotely-hosted-code https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...
    - tyingq 3y ago
      Right, I acknowledged that in the comment you're replying to. But the review process is weak. And, I don't need to load external code to exfiltrate stuff. For example, I can load an image with a specific name/path, or hijack functionality already on the page, like Google Analytics code. Generally, non-trivial extensions cannot be both secure and useful at the same time.

by tyingq 3y ago

hnux 3y ago

This extension only requests access to HN's known domains. If one would try to request to a non white-listed domain it would trigger Access-Control-Allow-Origin error. Also I think v3 makes it quite hard to use remote loaded code. Any attempt to be malicious would probably be caught by store's review process eventually.

tyingq 3y ago
Yeah, I'm not saying this extension is doing anything nefarious. I am saying that Google's propaganda about MV3 isn't right, and it's obviously spilling out to other people. MV3 blocks one specific api call in OnBeforeRequest()...the one that's useful mostly to ad blockers. The remote loaded code restriction is laudable, but the review process is weak. It's fairly easy to get shady things approved.
- xd1936 3y ago
  Manifest V3 prohibits extensions from loading any remote code like JavaScript or Wasm files[1]. 1. https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#remotely-hosted-code https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...
  - tyingq 3y ago
    Right, I acknowledged that in the comment you're replying to. But the review process is weak. And, I don't need to load external code to exfiltrate stuff. For example, I can load an image with a specific name/path, or hijack functionality already on the page, like Google Analytics code. Generally, non-trivial extensions cannot be both secure and useful at the same time.