Hacker News Reader

Comment by a13o | Hacker News Reader

In chrome go to chrome://extensions, enable developer mode, and now you can view source for any extension in devtools. The content scripts are already available in the regular web page's devtools without enabling developer mode.

The total list of websites is available in the installation popup for the extension.

The chrome web store already bans code obfuscation. minification is allowed as there's no meaningful way to enforce the quality of variable names

View on HN

It is very annoying to try and follow through minified code. I've tried to view the source and see what some extensions are doing but it can be a bit of a painful process. You can at least sometimes figure out what kind of GET/POST requests the extension may be making, but it's much more time consuming to try and ensure everything is safe.

The other problem is that the extensions can update. You typically get zero notification an extension was updated. Most extensions start off safe, but later get sold and used to farm data.

There is a button to format the code for minified files.

Formatting isn't the issue. Just more time consuming to try and read the code when it's all got garbage variable and function names. Not that you can't do it, just slightly more effort. Also the bigger issue I mentioned in my comment relates to the problem of extensions updating without any notice.

I expect that LLMs will help to make a breakthrough in reverse engineering by helping giving meaningful names to variables/functions.

Is there any legitimate reason to minify code for extensions? The size gains are minimal since it's a one time thing. But I agree that it would be hard to enforce, though google "manages" to enforce even more ambiguous requirements on their play store haha. I guess they could make it a guideline or a requirement, and "good faith" devs would comply even if it would be hard to enforce.

It would be waay easier than e.g. deciding if a YT video is for kids. You can immediately generate all the data by taking all unminified chrome extensions and minifying them, so you can validate your detection accuracy, then flag those that are minified on the store page, and provide some appeal option for devs just in case.

Come to think of it, it could be a chrome extension...

Reply on news.ycombinator.com