3 ms·

A web extension is an unnecessary security risk. A userscript will do it just fine. edit: one of my previous attempt: https://news.ycombinator.com/item?id=3522

by bmacho 1y ago

A web extension is an unnecessary security risk. A userscript will do it just fine. edit: one of my previous attempt: https://news.ycombinator.com/item?id=35229211 https://news.ycombinator.com/item?id=35229211 I actually have made it extensible, with closely coupled source of rules and domains; but then I lost it Edge forgot all my userscripts :(

londons_explore 1y ago
User scripts have super wide permissions. For example a user script scoped to YouTube.com can make payments from any cards you have saved in Google pay. And most user scripts are so long a typical user won't be able to spot a couple of malicious lines amongst 10k lines of minified webpacked libraries.
- bmacho 1y ago
  > And most user scripts are so long a typical user won't be able to spot a couple of malicious lines amongst 10k lines of minified webpacked libraries. Exactly! That's why you should use 3 lines for it instead, that are - inspectable - not updateable by the Chinese/Russians - written by you anyway
  - danielspace23 1y ago
    [flagged]
    - Muromec 1y ago
      Critique and distrust of an (authoritarian) government is not racism.
    - deleted 1y ago
      [deleted]
    - bmacho 1y ago
      I've chosen them as example elements of the larger group: people that would harm you. It's a type of synecdoche[0,1]. I was considering reformulating it, in $CURRENTYEAR there is always someone that claims that using Russian or Chinese as a synonym for 'enemy' is Russo- and Shinophobic. I've decided against it this time. [0] : https://en.wikipedia.org/wiki/Synecdoche#Part_referring_to_whole_(pars_pro_toto) https://en.wikipedia.org/wiki/Synecdoche#Part_referring_to_w... [1] : https://en.wikipedia.org/wiki/Pars_pro_toto https://en.wikipedia.org/wiki/Pars_pro_toto
    - add-sub-mul-div 1y ago
      Fear of people who look different or live on the other side of a line is having a moment.
- rvnx 1y ago
  You also have to weight the benefits versus the "risk". For example, if you use FreeTube with SponsorBlock to improve your privacy and block ads, in fact you are sending to Cloudflare 100% of your YouTube watch history, and to SponsorBlock ("sponsor.ajay.io"). With Piped instances it's even worse, essentially escaping Google's tracking just to give our data to random strangers. If you are worried, just run a second Chrome session with NordVPN and uBlock Origin in a loose jurisdiction and browse YouTube unlogged. It's easy, simple, and you have the benefits of an audited platform and that reasonably legally confirm they don't store logs unless the court forced them: "we never log their activity unless ordered by a court never log their activity unless ordered by a court", but for that, the court has to find you as a user, which can be very complicated in practice. So much better than random strangers.
  - latexr 1y ago
    > If you are worried, just run a second Chrome session with NordVPN I feel like I’m on YouTube already. It’s not like they are free of criticism either. https://en.wikipedia.org/wiki/NordVPN#Criticism https://en.wikipedia.org/wiki/NordVPN#Criticism
  - HK-NC 1y ago
    I'm happy to give my watch history to some unknown in exchange for never ever seeing an ad.
  - hashiyakshmi 1y ago
    >If you are worried, just run a second Chrome session with NordVPN and uBlock Origin in a loose jurisdiction and browse YouTube unlogged. If you actually did this you would know that it works for all of a week or two before YouTube stops letting you watch videos until you login.
    - Devorlon 1y ago
      I found that hopping to different VPN servers is a mildly inconvenient workaround for that.
  - heavensteeth 1y ago
eviks 1y ago
The extension links to 50+ services, your script - to 1. Do you now suggest that every single user should figure out how to do it properly and replicate the extension in a script for no better alternative (you could instead spend part of that time reading the extension code and using your private copy)
- bmacho 1y ago
  I don't think that not having all the services is a problem. On the contrary, I think it is an advantage for userscripts, that those only have the redirects a user explicitly adds. Tho I probably should've demonstrated first that it is possible, before advocating for it. The script I linked indeed only works for one website. Multiple websites with multiple rules, each with a list of instances (that often go offline for a time, so it is worth keeping them around, and make switching easy) indeed complicates it a bit.
  - eviks 1y ago
    So what exactly is the advantage of having to code all the rules yourself for every service you want to use?? > complicates it a bit a bit of an understatement
    - bmacho 1y ago
      > So what exactly is the advantage of having to code all the rules yourself for every service you want to use?? "having to code all the rules" is not that hard, in most cases you can just pass the whole URL, and the instance accepts it. Advantages: you don't get unwanted redirects from services, and you don't get unwanted redirects to instances. (Even tho the information about the instances will likely be concentrated at libredirect github issues. Chances are that some random person on the internet who has paranoid activities as a hobby will look into the instances, so you don't have to.) - - - I don't use many redirects. Nowadays I use exactly 0. But if I needed a redirect for example to xcancel, I would use my user-script as I had done it in the past before I lost it. I definitely wouldn't install a browser extension for it.
1oooqooq 1y ago
just disable auto update and have the same bad usability as user script.
- deleted 1y ago
  [deleted]
Akronymus 1y ago
I personally prefer to use redirector to do it. It has served me quite well so far. https://einaregilsson.com/redirector/ https://einaregilsson.com/redirector/
udev4096 1y ago
Totally unrealistic. Instead either lock down extension permissions, use different browser profile or better yet use QubesOS for spinning up disposable browser VMs
hexagonwin 1y ago
can a userscript run before the page loads...? afaik it's not possible, so the browser gets to make double requests.

by bmacho 1y ago

londons_explore 1y ago

User scripts have super wide permissions. For example a user script scoped to YouTube.com can make payments from any cards you have saved in Google pay. And most user scripts are so long a typical user won't be able to spot a couple of malicious lines amongst 10k lines of minified webpacked libraries.

bmacho 1y ago
> And most user scripts are so long a typical user won't be able to spot a couple of malicious lines amongst 10k lines of minified webpacked libraries. Exactly! That's why you should use 3 lines for it instead, that are - inspectable - not updateable by the Chinese/Russians - written by you anyway
- danielspace23 1y ago
  [flagged]
  - Muromec 1y ago
    Critique and distrust of an (authoritarian) government is not racism.
  - deleted 1y ago
    [deleted]
  - bmacho 1y ago
    I've chosen them as example elements of the larger group: people that would harm you. It's a type of synecdoche[0,1]. I was considering reformulating it, in $CURRENTYEAR there is always someone that claims that using Russian or Chinese as a synonym for 'enemy' is Russo- and Shinophobic. I've decided against it this time. [0] : https://en.wikipedia.org/wiki/Synecdoche#Part_referring_to_whole_(pars_pro_toto) https://en.wikipedia.org/wiki/Synecdoche#Part_referring_to_w... [1] : https://en.wikipedia.org/wiki/Pars_pro_toto https://en.wikipedia.org/wiki/Pars_pro_toto
  - add-sub-mul-div 1y ago
    Fear of people who look different or live on the other side of a line is having a moment.
rvnx 1y ago
You also have to weight the benefits versus the "risk". For example, if you use FreeTube with SponsorBlock to improve your privacy and block ads, in fact you are sending to Cloudflare 100% of your YouTube watch history, and to SponsorBlock ("sponsor.ajay.io"). With Piped instances it's even worse, essentially escaping Google's tracking just to give our data to random strangers. If you are worried, just run a second Chrome session with NordVPN and uBlock Origin in a loose jurisdiction and browse YouTube unlogged. It's easy, simple, and you have the benefits of an audited platform and that reasonably legally confirm they don't store logs unless the court forced them: "we never log their activity unless ordered by a court never log their activity unless ordered by a court", but for that, the court has to find you as a user, which can be very complicated in practice. So much better than random strangers.
- latexr 1y ago
  > If you are worried, just run a second Chrome session with NordVPN I feel like I’m on YouTube already. It’s not like they are free of criticism either. https://en.wikipedia.org/wiki/NordVPN#Criticism https://en.wikipedia.org/wiki/NordVPN#Criticism
- HK-NC 1y ago
  I'm happy to give my watch history to some unknown in exchange for never ever seeing an ad.
- hashiyakshmi 1y ago
  >If you are worried, just run a second Chrome session with NordVPN and uBlock Origin in a loose jurisdiction and browse YouTube unlogged. If you actually did this you would know that it works for all of a week or two before YouTube stops letting you watch videos until you login.
  - Devorlon 1y ago
    I found that hopping to different VPN servers is a mildly inconvenient workaround for that.
- heavensteeth 1y ago

eviks 1y ago

The extension links to 50+ services, your script - to 1. Do you now suggest that every single user should figure out how to do it properly and replicate the extension in a script for no better alternative (you could instead spend part of that time reading the extension code and using your private copy)

bmacho 1y ago
I don't think that not having all the services is a problem. On the contrary, I think it is an advantage for userscripts, that those only have the redirects a user explicitly adds. Tho I probably should've demonstrated first that it is possible, before advocating for it. The script I linked indeed only works for one website. Multiple websites with multiple rules, each with a list of instances (that often go offline for a time, so it is worth keeping them around, and make switching easy) indeed complicates it a bit.
- eviks 1y ago
  So what exactly is the advantage of having to code all the rules yourself for every service you want to use?? > complicates it a bit a bit of an understatement
  - bmacho 1y ago
    > So what exactly is the advantage of having to code all the rules yourself for every service you want to use?? "having to code all the rules" is not that hard, in most cases you can just pass the whole URL, and the instance accepts it. Advantages: you don't get unwanted redirects from services, and you don't get unwanted redirects to instances. (Even tho the information about the instances will likely be concentrated at libredirect github issues. Chances are that some random person on the internet who has paranoid activities as a hobby will look into the instances, so you don't have to.) - - - I don't use many redirects. Nowadays I use exactly 0. But if I needed a redirect for example to xcancel, I would use my user-script as I had done it in the past before I lost it. I definitely wouldn't install a browser extension for it.

1oooqooq 1y ago

just disable auto update and have the same bad usability as user script.

deleted 1y ago
[deleted]

Akronymus 1y ago

I personally prefer to use redirector to do it. It has served me quite well so far. https://einaregilsson.com/redirector/ https://einaregilsson.com/redirector/

udev4096 1y ago

Totally unrealistic. Instead either lock down extension permissions, use different browser profile or better yet use QubesOS for spinning up disposable browser VMs

hexagonwin 1y ago

can a userscript run before the page loads...? afaik it's not possible, so the browser gets to make double requests.