3 ms·
Cool idea but it's unfortunate the Chrome extension can read and change data on all sites you visit (as well as the intrinsic phishing risk for a DNS/search sub
by mmahemoff 3y ago
Cool idea but it's unfortunate the Chrome extension can read and change data on all sites you visit (as well as the intrinsic phishing risk for a DNS/search substitute). There's a history of such extensions ending up in the hands of bad actors.
Ironic that open-source extensions become obscenely dangerous once you install them from the Chrome store, a platform that's meant to improve security. The store should let you install directly from a repo and that should really be the default distribution mechanism, just as Obsidian does with plugins for example. The store could still monitor said repo for suspicious changes, cautiously roll out new updates, etc.
Not to claim open source is perfect (as recent events illustrate), but transparent code is far safer than opening the kimono to a black box.
- caymanjim 3y agoIt sucks that Chrome's permission model requires "read and change all data on all sites" for so many plugins. I don't mean to trivialize the difficulty in compartmentalizing permissions, but I wish we'd see some progress on it.
- godzillabrennus 3y agoIt’d be nice if chrome users could manually override the plugin permissions (downward only) in the browser gui and see if an extension still works as needed. Even better if those permissions would sync between browsers.
- fragmede 3y agoyou can restrict plugins to only run on sites you actually enable it on.
- cyberlurker 3y agoI had to look up “opening the kimono” and it’s kind of an interesting tangent. https://www.npr.org/sections/codeswitch/2014/11/02/360479744/why-corporate-executives-talk-about-opening-their-kimonos https://www.npr.org/sections/codeswitch/2014/11/02/360479744...
- digging 2y agoSeems my initial vibe on reading that phrase was exactly correct, thanks. Hope to never read or hear that expression again.
- Pxtl 2y agoWait, even after Chrome's extension security got revamped into something so strict that it functionally killed adblockers, extensions still have to grab that vague-ass permission for decent functionality? Seriously?