Hacker News Reader

Comment by jwells89 | Hacker News Reader

Yes. Because of this and the lack of fine-grained permissions mentioned by a sibling comment, I tend to use desktop apps where I can instead of extensions, keeping my extensions list quite slim — basically all I install are FOSS extensions by “big” known-good authors (e.g. Raymond Hill) or projects that aren’t going to sell out.

Of course risks exist with desktop apps too, but historically this kind of buy-and-exfiltrate scheme is comparatively rare with desktop apps, particularly on macOS where signed apps are sandboxed and can’t do a whole lot without user permissions.

View on HN

> I tend to use desktop apps where I can instead of extensions

How locked down are desktop apps now on Mac, Windows and Linux? I haven't kept up. Do they still a lot of access by default to do malicious things with? I recently saw someone install the Adobe Acrobat desktop app and it installed its own extension inside of Chrome without asking. Games can have scary DRM as well.

Chrome extensions can't read/write to arbitrary places on your hard disk without asking for example and you can isolate them within separate profiles. Not saying they're perfect but there is robust sandboxing of what they're allowed to do. I'm curious how this compares to an Electron-based desktop app i.e. which is running Chrome on the inside but with the standard restrictions Chrome places on tabs and extensions unlocked.

> How locked down are desktop apps now on Mac, Windows and Linux?

It’s hit or miss. There have been advancements on macOS and Linux where there are mobile-style permissions and sandboxing in some cases, but one needs to be aware of how apps are packaged to be able to leverage these advancements. Adobe stuff and Chrome on macOS for example have basically free reign still as they have specifically opted out of OS sandboxing, while a lot of small indie apps are sandboxed. Chrome I think can be put in a sandbox on Linux by way of Flatpak.

Windows has done practically nothing and is the same as it’s always been where desktop apps can do basically whatever they please, especially if given privileges with UAC (which seemingly every other Windows app needs for some reason).

Windows introduced better mobile-style permissions and sandboxing with the APPX format in Windows 8. However the only incentives to use it was the ability to build UWP apps and accessing the Windows Store. Everyone rejected the Windows Store, so developer adoption is close to zero (and now those incentives are gone too)

> on macOS where signed apps are sandboxed and can’t do a whole lot without user permissions

Mac App Store apps are (mostly) sandboxed. Developer ID signed Mac apps distributed outside the App Store are mostly not sandboxed.

The bar to write secure desktop software is significantly higher than for browser extensions. Especially with all the Electron crap these days, you're one XSS away from full-blown RCE.

Absolutely, but the short and long terms risk posed to most by installing random browser extensions willy-nilly is still almost certainly higher than that of instead opting for vetted desktop apps, especially if using PWAs in place of Electron apps where possible (which I do).

Desktop apps are no more vetted than Firefox extensions.

I’m talking about community vetting. It’s usually easier to find discussions on the internet where people have discussed and scrutinized desktop apps (e.g. “this app phones home”) than it is to find the same for most browser extensions (which are often only heard about after having been turned into malware).

The tooling is often better there too, e.g. one can keep a short leash on app network activity with Little Snitch and similar but I’m not aware of an equivalent for browser extensions.

It's not the lack of a fine grained permissions model, it's the total lack of a real threat model and any consideration at all for what happens as extensions change over time.

Reply on news.ycombinator.com