3 ms·
There is a method. Designing plugin and system API in such a way that allows users a granular control over plugins or apps permissions and network activity.
by YeBanKo 3y ago
There is a method. Designing plugin and system API in such a way that allows users a granular control over plugins or apps permissions and network activity.
- chii 3y agoBut that doesn't solve the problem of a plugin developer selling out. Under the granular permission control, your existing, granted permissions _should_ be revoked, but there's no way you could know to revoke it.
- YeBanKo 3y agoSomething like a plugin is a fairly well defined thing and ideally should not need a lot of permissions. E.g. an ad blocker has a simple flow: occasionally update filters from a number of specified endpoints and then match and block web pages’ request urls against downloaded lists. Between update it should have zero web traffic and filter updates are expected to be from known whitelisted sources and asymmetrical in size: very few bytes sends and a lot received. If all of a sudden after an update your plugin wants to send a bunch of data to a new URL you know immediately something is fishy. With respect to granularity, in this case the plugin might not even need to know the entire URL but just the host/domain name - this makes it less attractive to adtech.