Hacker News Reader

The fact that third-party addons can even touch sensitive settings in the user.js prefs is a massive security flaw in Mozilla's implementation of the WebExtensions API. Addons should be sandboxed/containerized or require privilege escalation before touching files on the disk.

View on HN

It uses native messaging with a Python script: https://github.com/tridactyl/tridactyl/blob/master/native/na...

I don't think anyone who uses Tridactyl is worried about its security, it has a permissions list 15+ lines long.

This. The whole point of this security feature is to prevent extensions from interfering with Mozilla pages. What's the point of this when addons can bypass turn it off themselves?

Only extensions that have a native messenger can do this (which requires users to accept a scary sounding permission and install a separate application on their computer)

Reply on news.ycombinator.com