3 ms·

It's a nice idea, but I have mostly stopped using/installing any software that is not open-source a long time ago. So, please open-source it, especially if you

It's a nice idea, but I have mostly stopped using/installing any software that is not open-source a long time ago. So, please open-source it, especially if you want users to truly trust it. Even then, I would recommend anyone to install (small to mid) browser extensions by cloning and inspecting the source and just then loading it yourself - if you don't know: any browser extension can read input/password fields across all site(s) you gave it access to (yeah, it's crazy but unfortunately true).

smusamashah 7mo ago
This could become/converted to a userscript making it easy to inspect and more cross compatible. It's very easy these days.
- deleted 7mo ago
  [deleted]
- imiric 7mo ago
  To be fair, the .xpi is just a .zip file, and the JS isn't minimized. I vibe-converted it to a userscript[1], but it doesn't work for me in qutebrowser because it depends on profile data fetched from `https://hn-trustspark.com/alltrust.json https://hn-trustspark.com/alltrust.json`, which seems to be periodically updated by the author, and qutebrowser has limited userscript support. :( It could probably be worked around by fetching the data externally, but I don't want to depend on hn-trustspark.com. It would be great if the profile updating tool could be published as well. Anyway, hope it helps someone else :) FWIW, after a quick review of the script, it looks safe to me. As long as you trust that the served profile data is correct, and don't mind leaking your IP to it. Great idea and kudos to the author! We need more tools like this to help us deal with spam, and not just on HN, but everywhere. [1]: https://gist.github.com/imiric/a5d1cd187e91eb0b725c4661250e5af5 https://gist.github.com/imiric/a5d1cd187e91eb0b725c4661250e5...
  - defrost 7mo ago
    It's a good idea, provided nothing sketchy goes on either now or in a future update ... I'm playing about with it but will likely unload it soon enough. One issue: New accounts with Zero submissions get a full green stack for "Submission Trust" (0 submissions in 0 days). That comes across as three flat red lines and a singl tall green stack - not sure if that's the right message. Submissions is an odd one ... those people that submit a story seen on the tech blogs once a day get bucketed together with habitual spammers of poor quality posts.
  - solaire_oa 7mo ago
    Thanks! Nice, you found the alltrust.json file ha. Yes, a bg job running on an rpi leverages HN APIs and builds the alltrust file by the minute, for all "active" accounts. Technically fetching that data is all you'd need to make your own script/plugin. It's centralized for a few reasons though, first being that client-side API requests would be discourteous to the APIs (flood/ddos), and a whole new level of error handling would be required. Shared IPs, like those in a tech company building, would easily and quickly reach the API limits. So that's the reasoning, if you're curious.
password4321 7mo ago
Wow "trust as in trust me bro", thanks for the heads-up. Only Y Combinator is allowed that level of access to HN karma metadata right now; what a gold mine.
solaire_oa 7mo ago
Author here. This is a good callout, there are a few reasons why it's a plugin and not open source (yet). First is that I didn't want to make a plugin in the first place, I wanted to make a bookmarklet, but HN's CSP policy was too strict. So that was a bummer. Second is that I have very mixed feelings about open source these days, and so open-sourcing feels less and less like the sensible default state. One of the sibling comments here discovered the alltrust.json and vibecoded around it, which is really a case in point about why open sourcing feels like I'd be leaving myself "open" to be domineered (not just by users, but by bots and companies as well). Third is that the system/plugin is partly LLM-assisted itself (even though the code is minuscule), and I'm self conscious of being a slop-slinger. Or at least, pushing up repos with LLM code just feels, idk... lazy and asymmetrical (despite this plugin having clear utility, which I think it does). But it's completely fair to say "oh look, a plugin about trust that's closed source, how hypocritical." I get that. If there's enough interest I'll open source it, sure.
- imiric 7mo ago
  Hey, that's a perfectly reasonable stance, and I can relate to it. Apologies for working around it and putting the code out there against your wishes. If you check my post history, you can see how opposed I am to these new tools, and "vibe coding" specifically. In my defense, I really didn't want to spend a lot of time on this, and LLMs do a decent job at this type of mechanical conversion. And I really don't judge anyone for using them mindfully, as you've clearly done in this case. The code didn't read like slop to me, if it's any consolation. :) Besides, this "closed source" criticism is really a non-issue in this case considering it's a browser extension with clear JS, which anyone can inspect if they were really interested. Cheers! EDIT: I've deleted the gist. :)
  - solaire_oa 7mo ago
    No problem at all! I didn't mean to be accusatory. And I wouldn't say inspecting the plugin code is against my wishes at all, no, definitely keep that hacker spirit alive! And feel free to reload the gist. I suppose that my point is more that creating a GitHub repo has some strings attached to it nowadays, is all.

smusamashah 7mo ago

This could become/converted to a userscript making it easy to inspect and more cross compatible. It's very easy these days.

deleted 7mo ago
[deleted]
imiric 7mo ago
To be fair, the .xpi is just a .zip file, and the JS isn't minimized. I vibe-converted it to a userscript[1], but it doesn't work for me in qutebrowser because it depends on profile data fetched from `https://hn-trustspark.com/alltrust.json https://hn-trustspark.com/alltrust.json`, which seems to be periodically updated by the author, and qutebrowser has limited userscript support. :( It could probably be worked around by fetching the data externally, but I don't want to depend on hn-trustspark.com. It would be great if the profile updating tool could be published as well. Anyway, hope it helps someone else :) FWIW, after a quick review of the script, it looks safe to me. As long as you trust that the served profile data is correct, and don't mind leaking your IP to it. Great idea and kudos to the author! We need more tools like this to help us deal with spam, and not just on HN, but everywhere. [1]: https://gist.github.com/imiric/a5d1cd187e91eb0b725c4661250e5af5 https://gist.github.com/imiric/a5d1cd187e91eb0b725c4661250e5...
- defrost 7mo ago
  It's a good idea, provided nothing sketchy goes on either now or in a future update ... I'm playing about with it but will likely unload it soon enough. One issue: New accounts with Zero submissions get a full green stack for "Submission Trust" (0 submissions in 0 days). That comes across as three flat red lines and a singl tall green stack - not sure if that's the right message. Submissions is an odd one ... those people that submit a story seen on the tech blogs once a day get bucketed together with habitual spammers of poor quality posts.
- solaire_oa 7mo ago
  Thanks! Nice, you found the alltrust.json file ha. Yes, a bg job running on an rpi leverages HN APIs and builds the alltrust file by the minute, for all "active" accounts. Technically fetching that data is all you'd need to make your own script/plugin. It's centralized for a few reasons though, first being that client-side API requests would be discourteous to the APIs (flood/ddos), and a whole new level of error handling would be required. Shared IPs, like those in a tech company building, would easily and quickly reach the API limits. So that's the reasoning, if you're curious.

password4321 7mo ago

Wow "trust as in trust me bro", thanks for the heads-up. Only Y Combinator is allowed that level of access to HN karma metadata right now; what a gold mine.

solaire_oa 7mo ago

Author here. This is a good callout, there are a few reasons why it's a plugin and not open source (yet). First is that I didn't want to make a plugin in the first place, I wanted to make a bookmarklet, but HN's CSP policy was too strict. So that was a bummer. Second is that I have very mixed feelings about open source these days, and so open-sourcing feels less and less like the sensible default state. One of the sibling comments here discovered the alltrust.json and vibecoded around it, which is really a case in point about why open sourcing feels like I'd be leaving myself "open" to be domineered (not just by users, but by bots and companies as well). Third is that the system/plugin is partly LLM-assisted itself (even though the code is minuscule), and I'm self conscious of being a slop-slinger. Or at least, pushing up repos with LLM code just feels, idk... lazy and asymmetrical (despite this plugin having clear utility, which I think it does). But it's completely fair to say "oh look, a plugin about trust that's closed source, how hypocritical." I get that. If there's enough interest I'll open source it, sure.

imiric 7mo ago
Hey, that's a perfectly reasonable stance, and I can relate to it. Apologies for working around it and putting the code out there against your wishes. If you check my post history, you can see how opposed I am to these new tools, and "vibe coding" specifically. In my defense, I really didn't want to spend a lot of time on this, and LLMs do a decent job at this type of mechanical conversion. And I really don't judge anyone for using them mindfully, as you've clearly done in this case. The code didn't read like slop to me, if it's any consolation. :) Besides, this "closed source" criticism is really a non-issue in this case considering it's a browser extension with clear JS, which anyone can inspect if they were really interested. Cheers! EDIT: I've deleted the gist. :)
- solaire_oa 7mo ago
  No problem at all! I didn't mean to be accusatory. And I wouldn't say inspecting the plugin code is against my wishes at all, no, definitely keep that hacker spirit alive! And feel free to reload the gist. I suppose that my point is more that creating a GitHub repo has some strings attached to it nowadays, is all.