3 ms·

All I'm seeing is that Chrome apparently is failing to properly sandbox websites against extension fingerprinting. Sure, this can be solved at the legal layer,

by lxgr 7mo ago

All I'm seeing is that Chrome apparently is failing to properly sandbox websites against extension fingerprinting. Sure, this can be solved at the legal layer, but in this case, there seems to be a much simpler and more effective technical solution, so why not pursue that instead?

streetfighter64 7mo ago
Well, the developers of Chrome aren't exactly incentivized to prevent tracking (though perhaps tracking done by their competitors). But anyway, you can try to prevent it with a technical solution while also being outraged that they did it. If someone has their home broken into, perhaps they should have better locks, but the burglar is still responsible for their actions.
- janalsncm 7mo ago
  Just because a farmer eats beef doesn’t mean he won’t fend off wolves. I agree on the practical aspect though.
  - hirak99 7mo ago
    Wrong analogy. It's a wolf who eats beef, and the "beef" doesn't go away if another wolf eats them.
traderj0e 7mo ago
Is it that easy? Chrome extensions can expose internal files to web pages through the web_accessible_resources field in their manifest.json. When an extension is installed and has exposed a resource, a fetch() request to chrome-extension://{id}/{file} will succeed. When the extension is not installed, Chrome blocks the request and the promise rejects. This looks intentional enough that I wonder if there's a legit reason for it.
robocat 7mo ago
Sister comment indicates it isn't as simple as you might think: https://news.ycombinator.com/item?id=47617972 https://news.ycombinator.com/item?id=47617972