3 ms·
How can the browser tell the difference between a random thing you want and a random thing you don't want?
by inigyou 3mo ago
How can the browser tell the difference between a random thing you want and a random thing you don't want?
- dotancohen 3mo agoThe permissions mechanism.
- inigyou 3mo agoHow can the permissions mechanism be fine grained enough to prevent bad random things, and coarse grained enough that you can understand it?
- dotancohen 3mo agoHave you seen AWS IAM? Power users who care about this don't need a GUI - a text file config in any format will do. Especially in this era of LLM assistance.
- lxgr 3mo agoRequesting site access by click or by URL really isn't rocket science. Not nearly every user will get it right, so extensions will probably still have to be monitored for malware for the foreseeable future, but it gives many users at least a chance at privilege minimization.
- feelamee 3mo agothis is not a solution. Running an untrusted software will always be a security drawback. Permissions/sandbox/etc can decrease risk, but not eliminate it
- lxgr 3mo agoSignificantly reducing the risk is enough for me in many cases. Chasing “zero risk” is often a fallacy.
- dotancohen 3mo agoExpressing intent is good enough for me for this purpose. I understand that there are additional implementation specific risks.