11 ms·

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities

Forget all that. 1. They increase the attack surface of the browser 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole extension thing is a mess.

syoc 3y ago
Replace browser with operating system or computer and expand extensions to user installable programs and it mostly still rings true. I believe users should be empowered to modify their installed applications as they see fit.
- Spivak 3y ago
  It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people, desktop software is more difficult develop (for your average hacker wannabe), more difficult to get users to install, and has far less valuable data to go after. I actually very much like Apple's approach to browser extensions forcing them to be truly installed software and in the purview of tools that protect the rest of the system. The Chrome browser extension ecosystem is perfectly fine in theory but suffers from reinventing installed software without taking any of the lessons we've learned about OS software. Nice cautionary tale but the web is different.
  - dvdkon 3y ago
    On a typical PC, installed software has even more permissions than a browser extension, and all any malware author has to do is write their own keylogger or upload the browser cookie database. Sure, it's a little more effort, but I think the only real advantage that malicious browser extensions have over native programs is the discoverability and auto-update Google and Mozilla give them "for free".
    - asjir 3y ago
      Wouldn't AV pick up uploading browser cookies?
      - dvdkon 3y ago
        I don't know, it would simple enough to catch, but would also flag access by file managers. Probably the only way is to test. Generally I've found writing malware from scratch is enough to get it through AV, but I only tested on what I had installed.
  - account42 3y ago
    > It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people ... by allowing software from big corporations not matter how user-hostile it is while randomly flagging/deleting harmless software make by individuals/smaller groups who have not paid the protection racket. The AV industry is a scam. > desktop software is more difficult develop (for your average hacker wannabe) Desktop software can be written in the same languages as webshit and more. > and has far less valuable data to go after All data available in browsers is also available to native programs running besides.
sunshowers 3y ago
Ultimately, as a society, we have to decide what is more important: the best of us or the worst of us.
- loktarogar 3y ago
  Framing it like that makes it much more simplistic than reality. While there are some people you can clearly place into "best" or "worst", most people fit somewhere along a spectrum where their placement changes day to day. You ever had a bad day where you forgot to do something you would have done any other day? Do you want software that allows you to do anything on a good day but is potentially catastrophic on a bad day? The answer may still be yes, but regardless it's a more complicated a question than best vs worst.
  - sunshowers 3y ago
    That's fair, I was being more flippant than necessary. :)
- userbinator 3y ago
  "Those who give up freedom for security deserve neither."
  - CharlesW 3y ago
    The real quote is more nuanced: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety". It's a balance, obviously. I'm happy to have guardrails if they improve non-technical users' safety.
    - wiseowise 3y ago
      > I'm happy to have guardrails if they improve non-technical users' safety. Not at the expense of expert freedom.
      - 3y ago
moolcool 3y ago
Small price to pay for adblock
dev1ycan 3y ago
Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer. Well, maybe they didn't I hope they enjoy the eventual return of popups.
- Spivak 3y ago
  They never left they're just called modals now.
  - AJ007 3y ago
    Endless EU Cookie modals that you have to always click through because you clear cookies.
    - account42 3y ago
      All the more reason why we need to be able to automate our browser through extensions.
  - account42 3y ago
    a) Those can be closed along with the website because they are all inside the same tab. b) Extensions can remove them, which is the pont of this discussion.
- wiseowise 3y ago
  > Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer. I wouldn’t be surprised if Gen Z didn’t live through it.
everdrive 3y ago
Forget all that. 1. They increase the attack surface of the operating system 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole web browser thing is a mess.
Pxtl 3y ago
Honestly as much as I love Firefox this is an underrated concern. Firefox allows their extensions to be far more powerful than Chrome's, but that power means they are also far more dangerous. If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever? Chrome, for all its faults, has ruined their extension framework at least in part because they were trying to prevent this threat. How do we make this work? Endless notification spam from the plug-ins? Expensive certifications for each plug-in release?
- bee_rider 3y ago
  I’d be really curious about in a system where browser extensions are limited to ~200 lines of code. No mechanism for distribution beyond typing text in. No concerns about permission. It would be interesting to see what people can do in an ecosystem where extensions can actually do anything but it is expected that people will actually read the code before running it.
  - Pxtl 3y ago
    My reaction would be simpler: Anything that's identified as risky? Show the user. Extension is making an HTTP request? Show the body in a toast. Extension is reading the keyboard? Same thing. Extension is looking at the page? Little icon in the corner showing the name of the extension and that it looked. Can't be turned off. So extensions can still do all that crazy stuff, but they're noisy about it.
    - bee_rider 3y ago
      I don’t really see this as simpler: 1) “identified as risky” seems like it could hide some significant complexity (and room for error). 2) An extension might need to read from the keyboard. I don’t want to OK it every time. If I check once and then mark it as OK, I’d be worried that it could do something evil with that permission somehow, in a far-flung bit of the code.
      - 3y ago
account42 3y ago
4. They are required to make the web usable which makes points 1 to 3 irrelevant.

syoc 3y ago

Replace browser with operating system or computer and expand extensions to user installable programs and it mostly still rings true. I believe users should be empowered to modify their installed applications as they see fit.

Spivak 3y ago
It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people, desktop software is more difficult develop (for your average hacker wannabe), more difficult to get users to install, and has far less valuable data to go after. I actually very much like Apple's approach to browser extensions forcing them to be truly installed software and in the purview of tools that protect the rest of the system. The Chrome browser extension ecosystem is perfectly fine in theory but suffers from reinventing installed software without taking any of the lessons we've learned about OS software. Nice cautionary tale but the web is different.
- dvdkon 3y ago
  On a typical PC, installed software has even more permissions than a browser extension, and all any malware author has to do is write their own keylogger or upload the browser cookie database. Sure, it's a little more effort, but I think the only real advantage that malicious browser extensions have over native programs is the discoverability and auto-update Google and Mozilla give them "for free".
  - asjir 3y ago
    Wouldn't AV pick up uploading browser cookies?
    - dvdkon 3y ago
      I don't know, it would simple enough to catch, but would also flag access by file managers. Probably the only way is to test. Generally I've found writing malware from scratch is enough to get it through AV, but I only tested on what I had installed.
- account42 3y ago
  > It doesn't ring true for installed software anymore — "virus scanners" have gotten to the point where they just work for most people ... by allowing software from big corporations not matter how user-hostile it is while randomly flagging/deleting harmless software make by individuals/smaller groups who have not paid the protection racket. The AV industry is a scam. > desktop software is more difficult develop (for your average hacker wannabe) Desktop software can be written in the same languages as webshit and more. > and has far less valuable data to go after All data available in browsers is also available to native programs running besides.

sunshowers 3y ago

Ultimately, as a society, we have to decide what is more important: the best of us or the worst of us.

loktarogar 3y ago
Framing it like that makes it much more simplistic than reality. While there are some people you can clearly place into "best" or "worst", most people fit somewhere along a spectrum where their placement changes day to day. You ever had a bad day where you forgot to do something you would have done any other day? Do you want software that allows you to do anything on a good day but is potentially catastrophic on a bad day? The answer may still be yes, but regardless it's a more complicated a question than best vs worst.
- sunshowers 3y ago
  That's fair, I was being more flippant than necessary. :)
userbinator 3y ago
"Those who give up freedom for security deserve neither."
- CharlesW 3y ago
  The real quote is more nuanced: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety". It's a balance, obviously. I'm happy to have guardrails if they improve non-technical users' safety.
  - wiseowise 3y ago
    > I'm happy to have guardrails if they improve non-technical users' safety. Not at the expense of expert freedom.
    - 3y ago

moolcool 3y ago

Small price to pay for adblock

dev1ycan 3y ago

Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer. Well, maybe they didn't I hope they enjoy the eventual return of popups.

Spivak 3y ago
They never left they're just called modals now.
- AJ007 3y ago
  Endless EU Cookie modals that you have to always click through because you clear cookies.
  - account42 3y ago
    All the more reason why we need to be able to automate our browser through extensions.
- account42 3y ago
  a) Those can be closed along with the website because they are all inside the same tab. b) Extensions can remove them, which is the pont of this discussion.
wiseowise 3y ago
> Actually hilarious that we have people here defending removing extensions, as if they didn't live through the days of Internet explorer. I wouldn’t be surprised if Gen Z didn’t live through it.

everdrive 3y ago

Forget all that. 1. They increase the attack surface of the operating system 2. They have routinely been transferred to (for money) or taken over by malicious entities 3. Often they subtly break things in ways that are fine for expert users but which result in support reach out by others The whole web browser thing is a mess.

Pxtl 3y ago

Honestly as much as I love Firefox this is an underrated concern. Firefox allows their extensions to be far more powerful than Chrome's, but that power means they are also far more dangerous. If Firefox were to really take off (like it should, imho), are we really ready for a web full of people being attacked by the worst spyware ever? Chrome, for all its faults, has ruined their extension framework at least in part because they were trying to prevent this threat. How do we make this work? Endless notification spam from the plug-ins? Expensive certifications for each plug-in release?

bee_rider 3y ago
I’d be really curious about in a system where browser extensions are limited to ~200 lines of code. No mechanism for distribution beyond typing text in. No concerns about permission. It would be interesting to see what people can do in an ecosystem where extensions can actually do anything but it is expected that people will actually read the code before running it.
- Pxtl 3y ago
  My reaction would be simpler: Anything that's identified as risky? Show the user. Extension is making an HTTP request? Show the body in a toast. Extension is reading the keyboard? Same thing. Extension is looking at the page? Little icon in the corner showing the name of the extension and that it looked. Can't be turned off. So extensions can still do all that crazy stuff, but they're noisy about it.
  - bee_rider 3y ago
    I don’t really see this as simpler: 1) “identified as risky” seems like it could hide some significant complexity (and room for error). 2) An extension might need to read from the keyboard. I don’t want to OK it every time. If I check once and then mark it as OK, I’d be worried that it could do something evil with that permission somehow, in a far-flung bit of the code.
    - 3y ago

account42 3y ago

4. They are required to make the web usable which makes points 1 to 3 irrelevant.