9 ms·
> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about th
by jessriedel 3y ago
> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read all the code to see how this extension works, and what it's [not] doing with your data.
The problem is that even if I read the code, or more likely chose to trust that someone has, it's not guaranteed to remain true for future updates. The author's scruples may weaken with time, or they might sell the extension, etc. (I think Chrome's extensions auto-update, but even if they didn't I'd still have to remember that this extension is one that I can't assume it's safe to update.)
- jdthedisciple 3y agothen u can simply clone the repo and locally load the extension ... bye bye auto-updates
- Hackbraten 3y agoThat's exactly why I use my system package manager to install and update browser extensions. And whenever the package repository is missing a browser extension I need, I contribute the package and take responsibility for its ongoing vetting and maintenance.
- mrd3v0 3y agoYou mean the permissions system is broken and most extensions do suffer from the same issue? Nah mate, we at Google, (bless them Mozilla crooks giving us control over their extensions), don't care about actual issues, we only update extensions to make money and limit user freedom.
- 1oooqooq 3y agothat argument only matters if you're using it on Firefox if you're using it under chrome you're already working under the profit making goal of a failing advertising company. how worse do you think it can get?
- junar 3y agoNot sure why OP linked to a fork instead of the original. But the original has a bookmarklet version if you would prefer an alternative. https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-file#bookmarklet https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-fi...
- zettabomb 3y agoThis one is the version linked by the Firefox addon [0]. Honestly can't tell if one or the other is better but I like having it automatically enabled. Considering it hasn't been updated for years (but still works) I'm not particularly worried. [0] https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
- pimlottc 3y agoIt is also not at all clear to me why it "needs to know when you change active tabs".
- ipaddr 3y agoYou need to detect and stop sound. You swap out active memory.
- pimlottc 3y agoWhat does any of that have to do with making sure input fields are pasteable?
- Vorh 3y agoI just read through the 65LOC source, and it's because it swaps out an active or inactive extension icon based on your active tab. https://github.com/aaronraimist/DontFuckWithPaste/blob/8cb68e1a99d098d1dfe99d35ef4657d668e56738/background.js#L5-L19 https://github.com/aaronraimist/DontFuckWithPaste/blob/8cb68...
- jessriedel 3y agoHuh. That seems not super important to me. Presumably he could make a option/version where the icon didn't change?
- deleted 3y ago[deleted]
- kortilla 3y agoYeah, seems like a lame excuse to permissions grab crazy privilege.
- Leszek 3y agoYou should have read a few more lines of that source - it also sends an "active" message to the tab, which is what adds and removes the copy/cut/paste event handlers.
- pants2 3y agoDoes Chrome have a "Developer Tools" feature for extensions, so you can dive in to the code and network requests?
- styxfrix 3y agoYes https://developer.chrome.com/docs/extensions/get-started/tutorial/debug https://developer.chrome.com/docs/extensions/get-started/tut...
- varenc 3y agoI get around that by downloading the extension source and then using Chrome extension developer mode to “load unpacked extension”. Then I’m confident the extension won’t change on me. (But for this extension I don’t give it all site permissions anyway. I just enable on site by site basis)
- quickslowdown 3y agoThat's terrible for security, but great for convenience :)
- varenc 3y agoCan you explain what you mean by this more?
- zeofig 3y ago[flagged]
- lukan 3y agoProbably because "no automatic updates means bad"? Which might be true in general, but maybe not here. Depends how complex the source is.
- quickslowdown 3y agoThis is exactly the point I was making. I personally don't care that this is how some people manage their chrome extensions. It's clever, and will help if the source suddenly changes. If there is a vulnerability in the version you've downloaded & keep installing, it'll never be fixed because no automatic updates. Plenty of examples of extension vulnerabilities in Chrome, but the stability of your plugins not auto updating is definitely appealing to avoid unexpected changes/behavior
- Nifty3929 3y agoThis is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.
- bee_rider 3y agoIt would be more transparent to be candid about the limitation of what they can provide. It isn’t the developer’s fault that the ecosystem is dumb, but they could just note the limitation.
- tsimionescu 3y agoSo you're saying they shouldn't add the feature rather than asking for the permission?
- bee_rider 3y agoNo, they should just note the issue in a parenthetical aside.
- jessriedel 3y agoNope. People are being asked to give a bunch of deep access to their system, it's not enough for the author to have pure intensions and explain why they asked. The user should understand the risks, many of which are non-obvious (like the extension being sold).
- dotancohen 3y agoSounds to me like GP is complaining about Chrome's permission model, not this particular extension.
- Nifty3929 3y agoThat isn't my interpretation having just reread it, but if that poster comes back to clarify otherwise I'll edit my post accordingly.
- nextlevelwizard 3y agoThe thing is there is no alternative way to do this. I have written some extensions my self and often you cant do anything without having full read and write access to every page. For example I have an extension that lets you right click an image and rotate it by -90/+90/180 degrees. All I want is for the browser to hit me up when there is a `<img>` tag, but that is not an option. Either I have to white list every page separately in the code or ask the user to white list every single page or just ask for full read and write permissions for every single web page the user visits.
- hahn-kev 3y agoFor the lay person being able to access any image on any page is pretty much the same thing as being able to access all pages.
- stefan_ 3y agoI have an extension to replace the "backspace for back" keybind they intentionally broke after 30 or how many years and of course it needs access to everything everywhere, because apparently they can't envision extension functionality that isn't "inject JavaScript".
- vsnf 3y agoOn Firefox this is an option in about:config, no need for an extension. I’m on mobile rn so I don’t have an reference to the specific key, but it’s something like “enhanced backspace”
- enriquto 3y ago> The thing is there is no alternative way to do this. Maybe. But this is not clear at all from the given explanation: > In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. The "smoothest experience"... This is corporate wooden language, and sounds disrespectful towards the users. Why does the extension need, precisely, to deal with tabs at all? A smooth experience would allow the users the choice to disable this permission while still working correctly on a single tab (as the previous version did). If this is not clearly explained upfront, it sounds like bullshit, even if it isn't. Maybe there is no alternative way to do this. But certainly there is an better way to explain this.