8 ms·

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chro

Just the framing of "browser extensions" is extremely problematic in the year 2024. Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second thought. I don't care to live in strategically lost situations like this, so I think the conversation should be about Firefox extensions. Which also don't have a great track record (the transition to Google Chrome compatibility a few short years ago still annoys me greatly), but are a qualitatively better counter-party to deal with.

swozey 3y ago
Has Firefox fixed its syncing feature? You used to have to literally move a profile file around. I remember working in IT a long time ago and Firefox was an absolute nightmare to deal with corporately. But then, back then, we couldn't control Chrome extension installations..
- akkartik 3y ago
  I'm only on Firefox because there's nothing better, but its sync at least has been pretty rock solid for me for several years now.
- mozman 3y ago
  Sync was fixed as part of quantum.
emodendroket 3y ago
> Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second thought. How unlike developing for literally any other environment.
- akkartik 3y ago
  I don't know if you're being sarcastic. There's a spectrum between developing for Lua (juggernaut is super friendly), Python (juggernaut is mostly friendly, even if 2->3 caused a lot of casualties), Go (in spite of the corporate backer, quite careful about not stomping) and Chrome. Yes, there's always a counter-party. My point is it saves a lot of later grief to consider up front the counter-party you're entering into a relationship with. Their incentives and track record.
  - crazygringo 3y ago
    Which, for plenty of Chrome extensions, is fine. Google has removed capabilities for certain categories and it's pretty easy to figure out what's going to be risky. But I use a set of very useful extensions, none of which present any problem to Google, all of which are extremely useful, and all of which I expect to stick around.
    - akkartik 3y ago
      You and I lack the imagination to see how those APIs might be hindering revenues. Are you really willing to bet Google will not find a way in the future? I'm not. The need for revenue doesn't just stop. Eventually they'll return to squeeze water from these stones.
- moffkalast 3y ago
  Quite right. Google and other commercial platforms may cut features or make breaking changes out of greed, while open source projects do it because they chase shiny things and can't be arsed to do legacy support. The end result is the same.
Animats 3y ago
Most browser extensions seem to be used on Firefox, because Google is so hostile to ones on Chrome. With the decline of Firefox, the extension world has shrunk. I had something called "Ad Limiter" on both Firefox and Chrome for a decade. Identical code, even. Google sent me threatening messages last year, as they tightened the screws on ad blockers, and I dropped it for Chrome.
- akkartik 3y ago
  That's a good point. Perhaps Firefox will benefit from an embrace/extinguish maneuver for once. Become compatible with Chrome extensions, then take over the space as Google retreats. This path too passes through no longer referring to "browser extensions".
  - Animats 3y ago
    Extensions were compatible for years until Google changed the manifest format and parts of the API.
- PurpleRamen 3y ago
  Firefox is not really less hostile now. You can't even install and maintain local add-ons anymore. You can either install them temporary, and they are removed when the app closes. Or you must upload and sign them to their store.
  - BenjiWiebe 3y ago
    I believe nightly edition and/or developer edition lets you install unsigned addons. Also there's a way to get an addon signed for private non-store use - can't speak to how that works, as my current project isn't quite to that stage yet.
foobiekr 3y ago
Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.
- syoc 3y ago
  Replace browser with operating system or computer and expand extensions to user installable programs and it mostly still rings true. I believe users should be empowered to modify their installed applications as they see fit.
  - Spivak 3y ago
    It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people, desktop software is more difficult develop (for your average hacker wannabe), more difficult to get users to install, and has far less valuable data to go after. I actually very much like Apple's approach to browser extensions forcing them to be truly installed software and in the purview of tools that protect the rest of the system. The Chrome browser extension ecosystem is perfectly fine in theory but suffers from reinventing installed software without taking any of the lessons we've learned about OS software. Nice cautionary tale but the web is different.
    - dvdkon 3y ago
      On a typical PC, installed software has even more permissions than a browser extension, and all any malware author has to do is write their own keylogger or upload the browser cookie database. Sure, it's a little more effort, but I think the only real advantage that malicious browser extensions have over native programs is the discoverability and auto-update Google and Mozilla give them "for free".
      - asjir 3y ago
        Wouldn't AV pick up uploading browser cookies?
1vuio0pswjnm7 3y ago
"I don't care to live in strategically lost situatios like this, so I think the conversation should be about Firefox extensions." Why would the conversation not be about editing the Firefox source code to add or remove "features" to meet one's personal needs. What is the point of "open source" if, to use the term from the submission title, the software is effectively un-"hackable". There is no small amount of "attack surface", and many unneeded "features", that could be removed from Firefox to someone's benefit, maybe it's only one user,^0 but but that will effectively never happen. Why. It is open source so anyone should be able to audit the code and change it to their liking. 0. To be clear, I am not commenting about "most users" or the majority of users or whatever. I am referring to the small class of users who are explicitly dissatisfied. In 1995, there were numerous non-commercial browsers. Netscape, the source of Mozilla, was one of the few attempting to commercialise. https://www.w3.org/Clients.html https://www.w3.org/Clients.html There is nothing wrong with having "all-in-one" programs. As long as other "not-all-in-one" programs also exist as alternatives. Arguably, the aim of the "all-in-one" program may be to obviate the existence of other programs, namely smaller, simpler ones. Those pushing gigantic web browsers might assume and argue, e.g., that it is inconvenient to have different programs for different tasks. This could be true. For some users. However it is also true that small programs can be made to work with each other. UNIX is the example. Over thirty years of continual growth. The companies behind the giant browsers probably could not survive without it. There is choice. Large "all-in-one" programs and small ones like UNIX utilities can co-exist. The two are not mutually exclusive. Personally, I prefer not to use a giant browser to make HTTP requests on the open internet. It is overkill and there is a profound lack of user control. (Hence "solutions" like "sandboxing", and an ever-incresing number of Band-Aids that serve only to add more needless complexity. The companies releasing these giant "all-in-one" programs are funded by advertising. Enough said.) For me the "modern" browser is more useful as an image viewer and media player. It is possible to "browse" the web without advertising, tracking or other annoyances, I do it every day,^1 but not with one of these giant advertising-supported "all-in-one" programs like the "modern" web browser. It is a losing battle to try. No amount of "extensions" can change the balance of power over those giant programs. Despite that these "browsers" are "open source", dissatisfied users who know how to program are not editing the source code to remove the bad bits. Instead they helplessly complain in forums like HN. 1. I am not a typical user. (Though I might be in 1995.) I prefer text over graphics. I like to read without distraction. Because text is easy for the user to manipulate, it seems to have a defense against advertising that is not available with graphics. For example, if text ads were inserted into response bodies, I can easily filter them out.
w3news 3y ago
There is a standard for browser extensions. I build also browser extensions before the standard. So you can build now a browser extension that works in Chrome, Firefox, Edge and Safari. But indeed, you can also use some specific api's for only a single browser. That is really bad, like you build a site only for a single browser. But the base should be compatible. And because you always can see the extension source code, you can modify a version for your own that works well in your browser. (And you can share it again off course)

swozey 3y ago

Has Firefox fixed its syncing feature? You used to have to literally move a profile file around. I remember working in IT a long time ago and Firefox was an absolute nightmare to deal with corporately. But then, back then, we couldn't control Chrome extension installations..

akkartik 3y ago
I'm only on Firefox because there's nothing better, but its sync at least has been pretty rock solid for me for several years now.
mozman 3y ago
Sync was fixed as part of quantum.

emodendroket 3y ago

> Most browser extensions by weight are Google Chrome extensions. Google Chrome is unambiguously demonstrating that no API is safe in its quest to juice revenues. Anybody who builds extensions using Chrome's APIs should be very aware that they're quite possibly putting effort into something a juggernaut will stomp away without a second thought. How unlike developing for literally any other environment.

akkartik 3y ago
I don't know if you're being sarcastic. There's a spectrum between developing for Lua (juggernaut is super friendly), Python (juggernaut is mostly friendly, even if 2->3 caused a lot of casualties), Go (in spite of the corporate backer, quite careful about not stomping) and Chrome. Yes, there's always a counter-party. My point is it saves a lot of later grief to consider up front the counter-party you're entering into a relationship with. Their incentives and track record.
- crazygringo 3y ago
  Which, for plenty of Chrome extensions, is fine. Google has removed capabilities for certain categories and it's pretty easy to figure out what's going to be risky. But I use a set of very useful extensions, none of which present any problem to Google, all of which are extremely useful, and all of which I expect to stick around.
  - akkartik 3y ago
    You and I lack the imagination to see how those APIs might be hindering revenues. Are you really willing to bet Google will not find a way in the future? I'm not. The need for revenue doesn't just stop. Eventually they'll return to squeeze water from these stones.
moffkalast 3y ago
Quite right. Google and other commercial platforms may cut features or make breaking changes out of greed, while open source projects do it because they chase shiny things and can't be arsed to do legacy support. The end result is the same.

Animats 3y ago

Most browser extensions seem to be used on Firefox, because Google is so hostile to ones on Chrome. With the decline of Firefox, the extension world has shrunk. I had something called "Ad Limiter" on both Firefox and Chrome for a decade. Identical code, even. Google sent me threatening messages last year, as they tightened the screws on ad blockers, and I dropped it for Chrome.

akkartik 3y ago
That's a good point. Perhaps Firefox will benefit from an embrace/extinguish maneuver for once. Become compatible with Chrome extensions, then take over the space as Google retreats. This path too passes through no longer referring to "browser extensions".
- Animats 3y ago
  Extensions were compatible for years until Google changed the manifest format and parts of the API.
PurpleRamen 3y ago
Firefox is not really less hostile now. You can't even install and maintain local add-ons anymore. You can either install them temporary, and they are removed when the app closes. Or you must upload and sign them to their store.
- BenjiWiebe 3y ago
  I believe nightly edition and/or developer edition lets you install unsigned addons. Also there's a way to get an addon signed for private non-store use - can't speak to how that works, as my current project isn't quite to that stage yet.

foobiekr 3y ago

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

syoc 3y ago
Replace browser with operating system or computer and expand extensions to user installable programs and it mostly still rings true. I believe users should be empowered to modify their installed applications as they see fit.
- Spivak 3y ago
  It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people, desktop software is more difficult develop (for your average hacker wannabe), more difficult to get users to install, and has far less valuable data to go after. I actually very much like Apple's approach to browser extensions forcing them to be truly installed software and in the purview of tools that protect the rest of the system. The Chrome browser extension ecosystem is perfectly fine in theory but suffers from reinventing installed software without taking any of the lessons we've learned about OS software. Nice cautionary tale but the web is different.
  - dvdkon 3y ago
    On a typical PC, installed software has even more permissions than a browser extension, and all any malware author has to do is write their own keylogger or upload the browser cookie database. Sure, it's a little more effort, but I think the only real advantage that malicious browser extensions have over native programs is the discoverability and auto-update Google and Mozilla give them "for free".
    - asjir 3y ago
      Wouldn't AV pick up uploading browser cookies?

1vuio0pswjnm7 3y ago

"I don't care to live in strategically lost situatios like this, so I think the conversation should be about Firefox extensions." Why would the conversation not be about editing the Firefox source code to add or remove "features" to meet one's personal needs. What is the point of "open source" if, to use the term from the submission title, the software is effectively un-"hackable". There is no small amount of "attack surface", and many unneeded "features", that could be removed from Firefox to someone's benefit, maybe it's only one user,^0 but but that will effectively never happen. Why. It is open source so anyone should be able to audit the code and change it to their liking. 0. To be clear, I am not commenting about "most users" or the majority of users or whatever. I am referring to the small class of users who are explicitly dissatisfied. In 1995, there were numerous non-commercial browsers. Netscape, the source of Mozilla, was one of the few attempting to commercialise. https://www.w3.org/Clients.html https://www.w3.org/Clients.html There is nothing wrong with having "all-in-one" programs. As long as other "not-all-in-one" programs also exist as alternatives. Arguably, the aim of the "all-in-one" program may be to obviate the existence of other programs, namely smaller, simpler ones. Those pushing gigantic web browsers might assume and argue, e.g., that it is inconvenient to have different programs for different tasks. This could be true. For some users. However it is also true that small programs can be made to work with each other. UNIX is the example. Over thirty years of continual growth. The companies behind the giant browsers probably could not survive without it. There is choice. Large "all-in-one" programs and small ones like UNIX utilities can co-exist. The two are not mutually exclusive. Personally, I prefer not to use a giant browser to make HTTP requests on the open internet. It is overkill and there is a profound lack of user control. (Hence "solutions" like "sandboxing", and an ever-incresing number of Band-Aids that serve only to add more needless complexity. The companies releasing these giant "all-in-one" programs are funded by advertising. Enough said.) For me the "modern" browser is more useful as an image viewer and media player. It is possible to "browse" the web without advertising, tracking or other annoyances, I do it every day,^1 but not with one of these giant advertising-supported "all-in-one" programs like the "modern" web browser. It is a losing battle to try. No amount of "extensions" can change the balance of power over those giant programs. Despite that these "browsers" are "open source", dissatisfied users who know how to program are not editing the source code to remove the bad bits. Instead they helplessly complain in forums like HN. 1. I am not a typical user. (Though I might be in 1995.) I prefer text over graphics. I like to read without distraction. Because text is easy for the user to manipulate, it seems to have a defense against advertising that is not available with graphics. For example, if text ads were inserted into response bodies, I can easily filter them out.

w3news 3y ago

There is a standard for browser extensions. I build also browser extensions before the standard. So you can build now a browser extension that works in Chrome, Firefox, Edge and Safari. But indeed, you can also use some specific api's for only a single browser. That is really bad, like you build a site only for a single browser. But the base should be compatible. And because you always can see the extension source code, you can modify a version for your own that works well in your browser. (And you can share it again off course)