Hacker News new | past | comments | ask | show | jobs | submit login

It is worth noting that revamping the browser extension permissions model is something that should definitely be done. Browser extensions up until this point have been a massive security hole: they basically get read/write permissions on every web page you visit.

Of course, content blocking could've been part of that new security model.

As Google tightens its grip, I wouldn't be surprised if someone starts a genuine fork of Chromium. Not just Chromium plus some extra stuff like Brave and Vivaldi, but a real, doesn't-rely-on-upstream-changes-fork. Microsoft seems like the most likely candidate for doing so.




> Browser extensions up until this point have been a massive security hole

No, that's a very misleading use of the term "security hole". By that definition, every piece of software on your computer is a "massive security" risk. Heck, even Chrome itself is a massive security hole since it can see the content of every page you visit.

I think it's worth reacting strongly to this argument because it's exactly the kind of statement that muddies the waters to convincing people that they shouldn't have the option of having full control of their own devices.

And I'm not saying there haven't been huge security issues with extensions. Just as there have been massive issues with any manner of software downloaded and installed. But requiring them to be open source and needing explicit user approval before install (unlike in older IE versions) addressed those issues pretty well, imo.

Edit: I would like to see changes that make it easier to observe when an extension is active and/or communicating with third party servers and/or writing to local storage for later transmittal (if that's possible).


> By that definition, every piece of software on your computer is a "massive security" risk.

Well, yes. There’s a reason sandboxing is coming more and more to the desktop.


I think Huawei should start an open-source community-based fork of Chrome and Android as an offset to Google and American monopoly on the web. (kidding, sort of).


No need to be kidding IMHO. This could be a perfect opportunity for Huawei to show that there is life without google. Basically the only thing ROMs like Cyanogenmod were lacking was the support of a hardware maker, coming preinstalled by default. Today with F-Droid, Nextcloud, Openstreetmaps and Mastodon it would be doable.


Content blocking is definitely part of the new security model; they wrote a "declarativeNetRequest" API designed to enable content blocking. The debate is just over whether that API is sufficiently expressive.


>they basically get read/write permissions on every web page you visit.

But you can select on which sites the extension is active. You can even make it only active when you click on it.


This isn't a browser feature, it's an AdBlock Plus feature. You're just switching off the blocking for certain sites, not turning off the extension itself in any meaningful way.


You are wrong, sir. This is a browser feature.

https://www.ghacks.net/2018/10/01/chrome-70-features-option-...


No, I'm talking about the browser feature in Chrome that can be applied to all extensions.


Is this a new thing? Most of the time when I've installed extensions I've just seen an initial prompt that says the extension can view and modify your data on any page, so either agree & add, or get out.


Depends on whether you consider a 7 months old feature new or not.

https://www.ghacks.net/2018/10/01/chrome-70-features-option-...


Oh wow yeah that's recent. I haven't installed new extensions in a while. Thanks.

Edit: I don't like that it seems to not be the default though... if you don't see this option then it's the same situation as before.


Wouldn't that defeat the purpose of an adblocker?


For an adblocker maybe, for other maybe less.

And even the adblocker might be disabled on the online banking site.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: