7 ms·

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code

by elaus 2y ago

> [...] but funnily enough require broad permissions I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.

skybrian 2y ago
And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.
- firtoz 2y ago
  > hey, I wrote a fun game that requires root access So... Just like AAA game studios, eh?
  - MOARDONGZPLZ 2y ago
    No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit node or any number of things.
    - gryn 2y ago
      yeah, I'm sure Genshin impact's creators went out of business when their Kernel access anti-cheat was hacked by ransomware or more recently the hacks mid live broadcasted tournaments (don't remember which game, I think it was apex). I mean that's what kids, teenagers, and young adults and non technical people in general are known for: their prudence and good technical decision making. lets not talk about the other risk vector that Tencent, a chinese company is the one buying most of these game studios that have Kernel access (not exclusively).
      - MOARDONGZPLZ 2y ago
        I don’t know what that is.
        dspillett 2y ago
        Which is the problem with games having kernel access for anti-cheat and <whatever-else-they-want-to-do-with-it>. You don't know what they are doing in there. You don't really know who they are. Even if you do, corporate machinations might mean who has access to the facility to <what-ever-they-want-to-do> on your PC could change at any moment without your knowledge. Most end-users are blissfully unaware of the potential consequences of these level of access (Games having kernel access, and browser extensions having all-sites/all-contexts access).
        techjamie 2y ago
        Can you imagine if one of the big anti-cheats got hit with a supply chain attack? That would be devastating.
      - dspillett 2y ago
        It doesn't even need to be a hack, or a malicious new owner taking over a game or other software package that has such access. The original company could be malicious/stupid/both. See https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... for the most famous example of “both”.
    - sandworm101 2y ago
      >> No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. Sony? Microsoft? EA? Apple? Exactly which giant megacorporation is beyond shady things? https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
      - ocodo 2y ago
        Apparently people are a telepathically interconnected species, who won't fall for corporate scams in waves. Sadly, both those things are untrue.
- oneeyedpigeon 2y ago
  Right, but Google is surely the one at fault here. There should be absolutely no reason that this extension can "change all my data on all websites", whatever the hell that actually means.
  - Retr0id 2y ago
    I was under the vague impression that Manifest V3 was supposed to prevent this sort of thing. But looking at the extension, it is using MV3. Maybe it really was just about weakening ad blockers.
  - tetromino_ 2y ago
    Not "change all my data on all websites" but "read the content of all websites I visit". Because an extension that finds all button elements on all websites you visit, must necessarily start by reading the content of all websites you visit.
    - oneeyedpigeon 2y ago
      Yes, I think that one's acceptable in this case. It's the "change all my data" that is problematic.
  - skybrian 2y ago
    I think both the developer and Google have some control over what appears in the Chrome store.
- beeboobaa3 2y ago
  What are you even talking about? Every piece of desktop software you have ever ran has more permissions than a browser extension. Is your stance that hobbyist developers should not be allowed to develop desktop software or CLI tools? The entire software development ecosystem would collapse in an instant. Or are you just not familiar with Windows & Macs (lack of a) permission system?
  - skybrian 2y ago
    The lack of sandboxing in desktop applications is bad, but you aren’t going to be writing code to read every web page a user visits by accident, and that’s what some browser extensions do on purpose. They’re inherently working with more sensitive data. So that’s worse in certain ways. (And they are more sandboxed in other ways.)
    - beeboobaa3 2y ago
      > but you aren’t going to be writing code to read every web page a user visits by accident No, instead you're just reading all files on the filesystem, including the browser's cookie store or whatever. The data you are, or can be, handling is just as, if not more, sensitive since it's literally a superset of what the browser has access to. > The lack of sandboxing in desktop applications is bad Some sandboxing would be nice, but the Google/Apple approach of needing to beg the vendor for every little permission isn't the way to go, either. I'd rather have software that can actually do things as opposed to only having useless sandboxed "apps".
      - skybrian 2y ago
        My Mac sometimes prompts me to see if a Mac application should have access to certain directories, such as “Downloads,” so I’m not sure that’s entirely true anymore? But in any case I think this is missing a distinction between what software developers can install in “developer mode” versus stuff that’s in the store for non-technical people to use. Apps in app stores see widespread use by people who barely know what a computer is, so I think there should be hoops you need to jump through to get distribution to the masses, at least for certain types of apps. And those apps aren’t useless, they do important but security-sensitive things like banking, things us developers need to do too sometimes. It’s a different world than hacking around on your Raspberry Pi or an old phone, and I think it should be different. Treating these situations the same muddies the issues.
- dougseismic 2y ago
  Gatekeeping hobbyist mentioned
jimvdv 2y ago
If chrome permissions made sense a user could choose to activate the extension when they visit a site. Also the extension could have no network access and have read-only access to the DOM to name a few improvements.
purple-leafy 2y ago
There is a way: 1) Extension could use the “activeTab” permission (would require user to click the extension once when inside the current tab to activate the extension, then the extension will run for any url they visit
- lofaszvanitt 2y ago
  And that is so annoying noone would do it.
deleted 2y ago
[deleted]
m3kw9 2y ago
hard to know if github code is the code it is being installed unless you build it from github. 1/10000 people check+install like this

by elaus 2y ago

skybrian 2y ago

And that’s why it shouldn’t be in the Chrome app store at all. As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.” At least limit it to people who know what Github is.

firtoz 2y ago
> hey, I wrote a fun game that requires root access So... Just like AAA game studios, eh?
- MOARDONGZPLZ 2y ago
  No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. This may not bear itself out in practice of course. But a game studio has something to lose, whereas hobbyist developer 73683 asking for root permissions for no real gain to you has nothing to lose from any number of things like scraping sites you visit or using your browser as a tor exit node or any number of things.
  - gryn 2y ago
    yeah, I'm sure Genshin impact's creators went out of business when their Kernel access anti-cheat was hacked by ransomware or more recently the hacks mid live broadcasted tournaments (don't remember which game, I think it was apex). I mean that's what kids, teenagers, and young adults and non technical people in general are known for: their prudence and good technical decision making. lets not talk about the other risk vector that Tencent, a chinese company is the one buying most of these game studios that have Kernel access (not exclusively).
    - MOARDONGZPLZ 2y ago
      I don’t know what that is.
      - dspillett 2y ago
        Which is the problem with games having kernel access for anti-cheat and <whatever-else-they-want-to-do-with-it>. You don't know what they are doing in there. You don't really know who they are. Even if you do, corporate machinations might mean who has access to the facility to <what-ever-they-want-to-do> on your PC could change at any moment without your knowledge. Most end-users are blissfully unaware of the potential consequences of these level of access (Games having kernel access, and browser extensions having all-sites/all-contexts access).
        techjamie 2y ago
        Can you imagine if one of the big anti-cheats got hit with a supply chain attack? That would be devastating.
    - dspillett 2y ago
      It doesn't even need to be a hack, or a malicious new owner taking over a game or other software package that has such access. The original company could be malicious/stupid/both. See https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... for the most famous example of “both”.
  - sandworm101 2y ago
    >> No. They are large and presumably have some sort of trust, and can lose the trust of people if they do particularly shady things. Sony? Microsoft? EA? Apple? Exactly which giant megacorporation is beyond shady things? https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
    - ocodo 2y ago
      Apparently people are a telepathically interconnected species, who won't fall for corporate scams in waves. Sadly, both those things are untrue.
oneeyedpigeon 2y ago
Right, but Google is surely the one at fault here. There should be absolutely no reason that this extension can "change all my data on all websites", whatever the hell that actually means.
- Retr0id 2y ago
  I was under the vague impression that Manifest V3 was supposed to prevent this sort of thing. But looking at the extension, it is using MV3. Maybe it really was just about weakening ad blockers.
- tetromino_ 2y ago
  Not "change all my data on all websites" but "read the content of all websites I visit". Because an extension that finds all button elements on all websites you visit, must necessarily start by reading the content of all websites you visit.
  - oneeyedpigeon 2y ago
    Yes, I think that one's acceptable in this case. It's the "change all my data" that is problematic.
- skybrian 2y ago
  I think both the developer and Google have some control over what appears in the Chrome store.
beeboobaa3 2y ago
What are you even talking about? Every piece of desktop software you have ever ran has more permissions than a browser extension. Is your stance that hobbyist developers should not be allowed to develop desktop software or CLI tools? The entire software development ecosystem would collapse in an instant. Or are you just not familiar with Windows & Macs (lack of a) permission system?
- skybrian 2y ago
  The lack of sandboxing in desktop applications is bad, but you aren’t going to be writing code to read every web page a user visits by accident, and that’s what some browser extensions do on purpose. They’re inherently working with more sensitive data. So that’s worse in certain ways. (And they are more sandboxed in other ways.)
  - beeboobaa3 2y ago
    > but you aren’t going to be writing code to read every web page a user visits by accident No, instead you're just reading all files on the filesystem, including the browser's cookie store or whatever. The data you are, or can be, handling is just as, if not more, sensitive since it's literally a superset of what the browser has access to. > The lack of sandboxing in desktop applications is bad Some sandboxing would be nice, but the Google/Apple approach of needing to beg the vendor for every little permission isn't the way to go, either. I'd rather have software that can actually do things as opposed to only having useless sandboxed "apps".
    - skybrian 2y ago
      My Mac sometimes prompts me to see if a Mac application should have access to certain directories, such as “Downloads,” so I’m not sure that’s entirely true anymore? But in any case I think this is missing a distinction between what software developers can install in “developer mode” versus stuff that’s in the store for non-technical people to use. Apps in app stores see widespread use by people who barely know what a computer is, so I think there should be hoops you need to jump through to get distribution to the masses, at least for certain types of apps. And those apps aren’t useless, they do important but security-sensitive things like banking, things us developers need to do too sometimes. It’s a different world than hacking around on your Raspberry Pi or an old phone, and I think it should be different. Treating these situations the same muddies the issues.
dougseismic 2y ago
Gatekeeping hobbyist mentioned

jimvdv 2y ago

If chrome permissions made sense a user could choose to activate the extension when they visit a site. Also the extension could have no network access and have read-only access to the DOM to name a few improvements.

purple-leafy 2y ago

There is a way: 1) Extension could use the “activeTab” permission (would require user to click the extension once when inside the current tab to activate the extension, then the extension will run for any url they visit

lofaszvanitt 2y ago
And that is so annoying noone would do it.

deleted 2y ago

[deleted]

m3kw9 2y ago

hard to know if github code is the code it is being installed unless you build it from github. 1/10000 people check+install like this