3 ms·

This was unclear to me as well. I think the article is talking specifically about downloading and running scripts for working around a particular site dynamica

by dwaite 3y ago

This was unclear to me as well. I think the article is talking specifically about downloading and running scripts for working around a particular site dynamically, such as Youtube ad blockers. That said, I don't know if this really is a technical block from e.g. adding a script tag to a YouTube page to pull in a third party resource. My impression was that it was blocking arbitrary scripts specifically within the extension context, and not in the browser context.

delroth 3y ago
> I think the article is talking specifically about downloading and running scripts for working around a particular site dynamically The article specifically mentions "filter lists" being subject to review time. > All updates, even to benign things like a filtering list, will need to happen through full extension updates through the Chrome Web Store. > Is a filtering list update, which is essentially just a list of websites, really something that needs to be limited by the "no remotely hosted code" policy? > So since all filter list updates now need to go through the Chrome Web Store, how long does a review take?
- charcircuit 3y ago
  https://developer.chrome.com/docs/extensions/migrating/improve-security/#configuration-drive https://developer.chrome.com/docs/extensions/migrating/impro... Chrome explicitly recommends downloading remote configuration.
mlyle 3y ago
https://developer.chrome.com/docs/extensions/migrating/improve-security/#remove-execution-of-strings https://developer.chrome.com/docs/extensions/migrating/impro... To me, this seems pretty clear: don't inject anything "executable" into a webpage except CSS. It does look like you could maybe use a sandboxed iframe and ask it about page features and whether they should be blocked, and that this might be permitted.
- buildbot 3y ago
  CSS3 is turing complete: https://accodeing.com/blog/2015/css3-proven-to-be-turing-complete https://accodeing.com/blog/2015/css3-proven-to-be-turing-com...
  - Dylan16807 3y ago
    Arithmetic + iteration is enough to be Turing complete. CSS has arithmetic. It does not have iteration. And even if it had full compute capabilities, the output is still just choosing CSS rules to apply.
    - buildbot 3y ago
      Can you explain how the blog post/other results people have on CSS being turing complete are wrong? Edit - would it be considered cheating to use: <meta http-equiv="refresh" content="10">
      - Dylan16807 3y ago
        [flagged]
        buildbot 3y ago
        That seems needlessly rude to those people. Okay, refresh probably won’t help, but you can build logic gates in css, and css has for example, the ability to animate things forever: animation-iteration-count: infinite; Hypothesis - you can find a way to use animations and logic gates to build a very crappy cpu complete with program counter, and then use that to run arbitrary code.
        Dylan16807 3y ago
        It's a bit rude, sure. If I'm trying to be gentler and more useful: I think some people are too excited to find Turing completeness, and don't really think through the necessary components and what you can and can't fudge before it doesn't count anymore. Many Turing machines are so barely functional to begin with that even slight reductions in capability will ruin their computational ability. As to your hypothesis, you'd need a way to have an animation conditionally turn other animations on and off each time it loops. I don't think anything like that exists in CSS.

by dwaite 3y ago

delroth 3y ago

> I think the article is talking specifically about downloading and running scripts for working around a particular site dynamically The article specifically mentions "filter lists" being subject to review time. > All updates, even to benign things like a filtering list, will need to happen through full extension updates through the Chrome Web Store. > Is a filtering list update, which is essentially just a list of websites, really something that needs to be limited by the "no remotely hosted code" policy? > So since all filter list updates now need to go through the Chrome Web Store, how long does a review take?

charcircuit 3y ago
https://developer.chrome.com/docs/extensions/migrating/improve-security/#configuration-drive https://developer.chrome.com/docs/extensions/migrating/impro... Chrome explicitly recommends downloading remote configuration.

mlyle 3y ago

https://developer.chrome.com/docs/extensions/migrating/improve-security/#remove-execution-of-strings https://developer.chrome.com/docs/extensions/migrating/impro... To me, this seems pretty clear: don't inject anything "executable" into a webpage except CSS. It does look like you could maybe use a sandboxed iframe and ask it about page features and whether they should be blocked, and that this might be permitted.

buildbot 3y ago
CSS3 is turing complete: https://accodeing.com/blog/2015/css3-proven-to-be-turing-complete https://accodeing.com/blog/2015/css3-proven-to-be-turing-com...
- Dylan16807 3y ago
  Arithmetic + iteration is enough to be Turing complete. CSS has arithmetic. It does not have iteration. And even if it had full compute capabilities, the output is still just choosing CSS rules to apply.
  - buildbot 3y ago
    Can you explain how the blog post/other results people have on CSS being turing complete are wrong? Edit - would it be considered cheating to use: <meta http-equiv="refresh" content="10">
    - Dylan16807 3y ago
      [flagged]
      - buildbot 3y ago
        That seems needlessly rude to those people. Okay, refresh probably won’t help, but you can build logic gates in css, and css has for example, the ability to animate things forever: animation-iteration-count: infinite; Hypothesis - you can find a way to use animations and logic gates to build a very crappy cpu complete with program counter, and then use that to run arbitrary code.
        Dylan16807 3y ago
        It's a bit rude, sure. If I'm trying to be gentler and more useful: I think some people are too excited to find Turing completeness, and don't really think through the necessary components and what you can and can't fudge before it doesn't count anymore. Many Turing machines are so barely functional to begin with that even slight reductions in capability will ruin their computational ability. As to your hypothesis, you'd need a way to have an animation conditionally turn other animations on and off each time it loops. I don't think anything like that exists in CSS.