Hacker News Reader

Comment by samstave | Hacker News Reader

Would this be useful to Shopify Shop Owners, those who buy 3rd party/additional apps on the shopify app store (or any similar such services, like an etsy store)?

Can this be used as a pen-testing tool to Highlight-TraceRt through a {target url}?

Re:

Yeah, though what benefits would surmise a Shopify Shop Keeper could get from your service, or do you think this is a tool that Shopify Corporate should be using on their hosting infra?

View on HN

Our browser client would help with tracing what network requests are being made by said apps since it would capture all network requests. However, Shopify may restrict what our browser client can do in your frontend store (I'm guessing that the 3rd party apps are added to a shop as iframes or are otherwise sandboxed).

> I'm guessing that the 3rd party apps are added to a shop as iframes or are otherwise sandboxed

I build Shopify apps, it depends on what kind of app it is, but if it’s on the storefront then it’s generally just injected through an async javascript script tag. They don’t do any iframes or sandboxing on the storefront, although they’re definitely moving toward more privacy-conscious APIs.

Some additional thoughts. For Shopify store owners, they can definitely install Highlight if they have access to the site that they're hosting (we have some customers in this space!). This can help with optimizing their user experience, etc.. For our tracing SDKs in particular, they would only really work if the shopify developers have their own proprietary code running, however, because this requires application instrumentation.

>This can help with optimizing their user experience, etc.

Please, maybe have some success cases with a "how to implement on your shopify" page?

Reply on news.ycombinator.com