Hacker News Reader

Comment by rtkwe | Hacker News Reader

For things you need to always run Grease Monkey seems like a prime choice. You could have your script run automatically for every visit to a nebula page.

View on HN

By default Greasemonkey can access all data on all pages. With extensions being routinely compromised to steal crypto that’s starting to look like a bad deal. (If you limit it to a single domain in Chrome it will nag you to unlock it on Chrome startup forever)

I am weirdly more afraid of installing chrome extensions than executables on my machine

Violetmonkey is opensource.

I only use a few and they're simple enough I can read them before updating to see if they're bringing in something weird. Also in GP's case they could just write their own since they're already making them. No exploitable surface there if it's not a remote updatable script.

It's not the bookmarklets that OP is warning about, it's the risk that the GreaseMonkey extension itself becomes compromised. Basically, it's good browser hygiene to keep the number of extensions you have installed to an absolute minimum.

A bookmarklet alone isn't so much a concern, both because it doesn't run automatically on all pages (only when clicked) and because, as you note, you can usually pretty easily audit what you add and you don't get automatic updates.

> you don't get automatic updates

Unless the bookmarklet updates itself by loading code from another URL. This is blocked by some websites but not all.

By default Chrome can access all data on all pages. With browsers being routinely compromised by advertising companies working against your interest that's starting to look like a bad deal.

This is an important point. The only solution we're ever offered for security concerns is centralizing more and more control in the platform companies hands even though those same companies are increasingly abusing their power.

Violentmonkey might be the better recommendation now, as it's still in active development, while Greasemonkey seems kinda dead.

Is there any real need for ongoing development? Seems like GM has the features you need to get the work done.

It's a matter of compatibility and bug fixing. Might be not a problem at the moment, but over time a dead project will degrade and make problems. So if one starts now, they can also just start with the more active project. After all there is AFAIK no disadvantage in using VM over GM.

Reply on news.ycombinator.com