Comment by tyingq | Hacker News Reader

Comment by tyingq | Hacker News Reader

There's some interesting ideas here, like the column approach, inline comment replies, etc. However, this note:

>Hacker News UX is an early adopter of Manifest V3 which imposes stricter security to extensions.

I have to comment on that, as the Google line on MV3 being about security irks me a bit. In this case, the extensions loads for all urls with news.ycombinator.com/* and injects it's own build.js content script. It doesn't appear to do anything terrible, but it could if it wanted. It could keylog, exfiltrate data, steal your password, make HN posts on your behalf in the background, etc. Manifest V3 does nothing to police content scripts. Largely because many extensions need those kind of permissions to do anything useful.

This extension only requests access to HN's known domains.

If one would try to request to a non white-listed domain it would trigger Access-Control-Allow-Origin error.

Also I think v3 makes it quite hard to use remote loaded code.

Any attempt to be malicious would probably be caught by store's review process eventually.

Yeah, I'm not saying this extension is doing anything nefarious. I am saying that Google's propaganda about MV3 isn't right, and it's obviously spilling out to other people. MV3 blocks one specific api call in OnBeforeRequest()...the one that's useful mostly to ad blockers. The remote loaded code restriction is laudable, but the review process is weak. It's fairly easy to get shady things approved.

Manifest V3 prohibits extensions from loading any remote code like JavaScript or Wasm files[1].

1. https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...

Right, I acknowledged that in the comment you're replying to. But the review process is weak. And, I don't need to load external code to exfiltrate stuff. For example, I can load an image with a specific name/path, or hijack functionality already on the page, like Google Analytics code. Generally, non-trivial extensions cannot be both secure and useful at the same time.

Reply on news.ycombinator.com