Hacker News Reader

Comment by mappu | Hacker News Reader

Looks great! Love the idea.

I'll buy the extension off you for $5/install count? I promise to wait at least a day before bundling malware, since you hit front page of HN there should be some great targets.

/Sarcasm obviously.

But there's just no way i'm installing something that can "read and change my data on github.com". Chrome extension permission granularity is just not sufficient. Especially since data exfiltration is possible using CSS only (e.g. https://blog.acolyer.org/2018/05/28/large-scale-analysis-of-... )

View on HN

>permission granularity is just not sufficient

This is a careful balance between extensions being almost completely useless and extensions being able to take over the whole browser...

Just read the source code if you don't trust it.

Edit: it seems this extension has no javascript code, just stylesheets that get applied by manifest.json. Seems this actually could be a good spot for more granular permissions. "change style information on *.github.com"

> Just read the source code if you don't trust it.

No, that doesn't really work for Chrome extensions - they can silently auto-update, and will no longer match the published source.

It's just barely possible to run the extension directly from the source code - you either need to put up with popup warnings every single time you open the browser, or, need to install an entirely separate developer version of Chrome.

Certainly most people here aren't doing that.

> change style information on .github.com

It would be an improvement, but it turns out stylesheets can be used for malicious data exfiltration anyway (see parent).

>No, that doesn't really work for Chrome extensions - they can silently auto-update, and will no longer match the published source.

As much as I hate Google, this is exactly how most people use free software linux distributions. The only difference is the barrier of entry for new/updated software.

>need to install an entirely separate developer version of Chrome

Heh, I'd probably expect anyone who audits all of the software they use to already be using chromium.

The salient difference is that bribing Google or Red Hat is practically impossible (a hypothetical billion-dollar exercise reserved for state actors); whereas bribing Chrome extension developers is definitely not hypothetical, maybe even commonplace (e.g. some friends were hit by https://www.ghacks.net/2013/12/26/hoverzooms-malware-controv... ).

For high-value targets, like full access to a software developer's private github repos, there's definitely an economic incentive to do this.

Then install it yourself? It's open source software. Get over yourself.

Reply on news.ycombinator.com