Hacker News Reader

Comment by roansh | Hacker News Reader

Why does it need permission to Read and Change the data on _all_ of the websites that a user visits?

There are so many cool extensions but most of them need access to every single domain - even if its functionality doesn't need it. Which is what keeps me (and probably a lot many other people) away from installing them.

View on HN

I opened a PR to limit permissions to youtube.com; hopefully it will get merged: https://github.com/darajava/youtube-smooth/pull/24

Thanks!

Any idea when you will push the new version to the Chrome Web Store?

If your PR is merged, then I will try this out.

Looks like it has been merged.

It still asks to change and access data on all the websites.

I don't think you have the option to say "this app needs Read and Change for just this one domain," it's pretty much an all or nothing sort of deal. This one uses it to edit the page on YouTube, so it has to require it for all.

There is! In extension's manifest.json you can mention for which URLs your extension needs permission. This extension is asking for "http://*/*", "https://*/*". Which is all of them.

You do have that option. WikiTube, mentioned elsewhere in this thread, only requires read & change permissions for "all wikipedia.org sites".

Indeed, that one was an insta-add for me, this one however I will pass on until it is similarly restricted to youtube domains.

a pull request has already been merged: https://github.com/darajava/youtube-smooth/pull/24

I don't think merge has been updated on the store yet, has it?

No, it'll be a day or two before I get around to that I'm afraid

I'm genuinely curious - where did you get this idea from? It's definitely not the case, so I'm wondering how you arrived at it.

Moreover why would they have so confidently made a comment full of such misinformation?

I don't know where you're from but in my experience when people use "I think" it implies that they aren't completely sure what they are saying is correct. It's used similarly to "to the best of my knowledge".

I was under the same impression. I've never developed a chrome extension, but just from following developer communities I thought I had seen complaints in the past about broad access to website data that the Chrome extension API required you to request.

Now that I look, it's probably a misunderstanding most of us have because of the lack of granularity in Chrome extension permissions: http://lifehacker.com/5990769/why-do-chrome-extensions-need-...

If you install an otherwise-compatible Greasemonkey user script in Chrome without appropriately adjusting the metadata, it will default to requesting access to all domains. I think these were more commonly used in the earlier days of Chrome, and contributed to this misunderstanding.

For what it's worth, the last time I worked on an extension was in 2012, and a friend did most of the work setting it all up, I just wrote some of the code. This was the impression that I was under, but apparently it isn't the case.

Reply on news.ycombinator.com