Hacker News Reader

Comment by derefr | Hacker News Reader

I don't think they're meant to be. If you can do something malicious with this currently, it's probably a bug or design flaw, and would likely be changed in later releases after it was pointed out.

This is the difference between NPAPI and PPAPI in Chrome, for example: while both are methods for writing native code and having it execute in the browser, NPAPI is like kernel extensions (you get whatever privileges the browser itself gets), while PPAPI puts you in the same sandbox browser extensions execute in; a sandbox which is supposed to have a level of isolation only slightly less than the one webpages themselves get. It can call a few more APIs, but it should still be in "ring 3", to follow the metaphor.

View on HN

You're basically arguing in favor of a walled garden that is safe but can only does what the API designers deem an acceptable use.

For some users that may be sufficient so they can sleep sound at night, not worrying about potential malware.

But powerusers often have eccentric use-cases that can only be tackled in ways that API designers didn't foresee and thus require unrestricted access to, well, everything. It's not malicious by default. It's dual-use.

If you want to be in the former group, fine. But you shouldn't argue that the latter group should be denied access to their tools.

What do you mean? ``If you can do something malicious''.

Browser extensions have a lot of abilities. People install browser extensions with no idea what they actually do, when content scripts in chrome extensions can scrape all your data on all sites you visit. There is no way to whitelist extensions to only some URLs and blacklist them from others.

If the browser is an OS, extensions have A LOT of abilities to avoid SAMEORIGIN policy, skirt CSP rules, and much much more.

Bottom line, if your browser is an OS, extensions can be malicious just like regular software.....whether or not you have NPAPI support or whatever else.

It depends on the browser.

In Chrome, extensions are sandboxed using similar technique as web pages are.

However, just because they are sandboxed doesn't mean they are safe. It just means they won't be able to get privileges beyond those explicitly granted to them.

Many extensions request very powerful privileges though, like the ability to read and write to web pages you visit. The browser will dutifully grant this privilege if the extension requests it and you allow it. It won't get the ability to run arbitrary native code though (unless it also requests that privilege).

Reply on news.ycombinator.com