News for hackers. Stuff that matters.

A comment on Emails a browser extension developer gets from scammers. Parent comment

Re:Emails a browser extension developer gets from scammers by stefan_ on Saturday January 23, 2021 @10:09PM (#25888731)
It's laziness on the browser makers side. We used to have real extension frameworks, then it turned out just having extensions load arbitrary JS in the context of every webpage is a super easy way to have "rich extensions" so they did that and went shopping.

Now the result is that to implement "backspace for back", your extension needs to be able to load arbitrary JS on every domain.

[ Parent | on HN ]
Re:Emails a browser extension developer gets from scammers by duskwuff on Sunday January 24, 2021 @02:02AM (#25889961)
You're viewing the past with rose-colored glasses. If by "real extension frameworks" you mean XUL, that gave significantly more power to extensions than is even possible under Chrome extensions / WebExtensions.
[ Parent | on HN ]
Re:Emails a browser extension developer gets from scammers by JoshTriplett on Sunday January 24, 2021 @02:03AM (#25889972)
> We used to have real extension frameworks

Those "real extension frameworks" had even more permissions, often to run arbitrary local code as the user.

[ Parent | on HN ]
Re:Emails a browser extension developer gets from scammers by craig131 on Sunday January 24, 2021 @04:33AM (#25890644)
Browser extensions can still run local code as the user. Example of a Chrome extension loading an arbitrary .dll: https://twitter.com/evilsocket/status/1339566046265696256
[ Parent | on HN ]