“host_permissions”: “<all_urls>”
In its manifest means it can basically do anything on any webpage you visit, scrape data etc.
As an extension developer, no thanks. “Fun” pointless extensions like this that have no real utility, but funnily enough require broad permissions, are dangerous
I don't think there is a way to implement this without said permission. You can always check out the code from GitHub and install the extension locally to avoid any malicious changes in the future.
As a hobbyist developer, having that kind of access in other people’s browsers is not something I want, and I’m suspicious of developers who do seem to want it. It’s like “hey, I wrote a fun game that requires root access.”
At least limit it to people who know what Github is.
1) Extension could use the “activeTab” permission (would require user to click the extension once when inside the current tab to activate the extension, then the extension will run for any url they visit
Also the extension could have no network access and have read-only access to the DOM to name a few improvements.
2. Sell it to a company with malicious intentions
3. Get ad/spy/malware in your browser
I think the correct approach is to have the option to have a function isolated from the rest of the code. Then pay a trusted party to review the functionality of the function.
In this case said function may only 1) access the html on the website, 2) find the button and 3) return only that what makes the button.
Then the permission prompt, written by the trusted party, can be something accurate like: This extension wants to copy buttons from websites.
I'm calling it DEWISOTT computing: does exactly what it says on the tin
You can go wild update your extension 1000 times per day without touching the function.
But yeah i tested grammarly for 5 minutes and found it crazy.
there has to be a better way getting both worlds :|
Hell if you're that paranoid, sniff any remote connections with mitmproxy and generally just... understand what an extension does before you leave it on your machine.
Some extensions are just fun; this extension is wicked for me as design inspiration but yeah, salty take and hackernews PB+J
I‘ve heard that Firefox will only run signed extensions. Would you trust this process?
Mozilla does not manually review most extensions (only extensions which Mozilla recommended are manually reviewed: https://support.mozilla.org/en-US/kb/add-on-badges).
Chrome's policy is extensions are "reviewed periodically for compliance", but is unclear on how frequent is this periodic review (https://developer.chrome.com/docs/webstore/review-process).
Then you can just target the promise based webextension syntax and as long as you still stick to the calls also available in chrome your extension works with very little effort in both browsers.
Safari is a different story which basically amounts to Apple being Apple and sort of supporting webextensions but in such a roundabout way that it is barely worth it for the majority of extension devs.
btw i had a look at the code and it seems benign. no clue if there's a way to verify the same code is in the chrome extension store.
This could be recreated in a bookmarklet ideally, though it would require saving the button html snippets into a file that you'd have to make downloadable with some Blob weirdness.
