4 ms·

Mandatory sandboxing increasingly seems like a misfeature. Now you can't install an extension that does a lot of things that are useful, ostensibly to protect y

Mandatory sandboxing increasingly seems like a misfeature. Now you can't install an extension that does a lot of things that are useful, ostensibly to protect you from malware. Optional sandboxing can be good because users can have more confidence that something can't hurt them. But it can also be bad because users will have more confidence that something can't hurt them, and then it does anyway. Meanwhile the ability to exercise arbitrary permissions given the user's authorization is something we've lost. And what have we gained, when the user just runs how_to_actually_uninstall_mcafee.avi.exe and gets the malware regardless?

lxgr 2y ago
No, you can still grant permissions to web extensions, but the difference is that it's now explicit, and it is at least possible to design extensions with minimally-required privileges. This vastly reduces the blast radius of an extension publisher takeover or an insider attack, for example. > what have we gained, when the user just runs how_to_actually_uninstall_mcafee.avi.exe and gets the malware regardless? Nothing would happen if I double-click that file, since it doesn't run on my OS. On the other hand, a compromised browser extension could deal an incredible amount of damage to me. Are you saying that because we can't protect all users from all harm, we should just give up?
- AnthonyMouse 2y ago
  > No, you can still grant permissions to web extensions, but the difference is that it's now explicit, and it is at least possible to design extensions with minimally-required privileges. The problem is the reverse. Some permissions are now considered "too dangerous" for the extension, so there is no facility to grant them even if the user wants the extension to do that and it has a good reason to. > Nothing would happen if I double-click that file, since it doesn't run on my OS. In which case the website could have fingerprinted your browser and served you the one that does. > Are you saying that because we can't protect all users from all harm, we should just give up? I'm saying that we should give people the tools and information they need to decide if and to what extent they can trust something, instead of presuming to decide for them.
  - lxgr 2y ago
    I agree, and that mechanism is to introduce a new, permissioned API into Firefox's Web Extension API implementation. Requiring them to maintain two completely different extension APIs (the old XUL-based one and Web Extensions) would work too but seems excessive.
    - pseudalopex 2y ago
      > I agree, and that mechanism is to introduce a new, permissioned API into Firefox's Web Extension API implementation. The problem is new WebExtensions APIs are not welcome.
    - willywanker 2y ago
      If XUL were to continue as it does on Pale Moon, here is no need for Web Extensions given they are a reduced subset in terms of functionality compared to the previous XUL/XPCOM versions. And ironically for all the talk of making it more secure, the amount of cross browser malware has only shot up since Mozilla decided to dump XUL in favor of copying Chrome's extension system.

lxgr 2y ago

No, you can still grant permissions to web extensions, but the difference is that it's now explicit, and it is at least possible to design extensions with minimally-required privileges. This vastly reduces the blast radius of an extension publisher takeover or an insider attack, for example. > what have we gained, when the user just runs how_to_actually_uninstall_mcafee.avi.exe and gets the malware regardless? Nothing would happen if I double-click that file, since it doesn't run on my OS. On the other hand, a compromised browser extension could deal an incredible amount of damage to me. Are you saying that because we can't protect all users from all harm, we should just give up?

AnthonyMouse 2y ago
> No, you can still grant permissions to web extensions, but the difference is that it's now explicit, and it is at least possible to design extensions with minimally-required privileges. The problem is the reverse. Some permissions are now considered "too dangerous" for the extension, so there is no facility to grant them even if the user wants the extension to do that and it has a good reason to. > Nothing would happen if I double-click that file, since it doesn't run on my OS. In which case the website could have fingerprinted your browser and served you the one that does. > Are you saying that because we can't protect all users from all harm, we should just give up? I'm saying that we should give people the tools and information they need to decide if and to what extent they can trust something, instead of presuming to decide for them.
- lxgr 2y ago
  I agree, and that mechanism is to introduce a new, permissioned API into Firefox's Web Extension API implementation. Requiring them to maintain two completely different extension APIs (the old XUL-based one and Web Extensions) would work too but seems excessive.
  - pseudalopex 2y ago
    > I agree, and that mechanism is to introduce a new, permissioned API into Firefox's Web Extension API implementation. The problem is new WebExtensions APIs are not welcome.
  - willywanker 2y ago
    If XUL were to continue as it does on Pale Moon, here is no need for Web Extensions given they are a reduced subset in terms of functionality compared to the previous XUL/XPCOM versions. And ironically for all the talk of making it more secure, the amount of cross browser malware has only shot up since Mozilla decided to dump XUL in favor of copying Chrome's extension system.