I thought plug-ins can be scoped to only work on a single domain or only work when you click them.

It’s how I run grammerly, which is a descent enough grammar checker except I never want it to correct my chat posts, or GitHub comments.

I have never heard about such a restriction for plugins.

And on the plugin page for Grammarly, it says it gets "Access your data for all websites":

https://addons.mozilla.org/en-US/firefox/addon/grammarly-1/

You've never seen the popups? If a WebExtension doesn't request access to all sites, it can only access sites that it's activated on by pressing the toolbar button (MDN refers to them as action buttons if you want to take a look). The problem is that most extensions that aren't site-specific are useful because they have access to all sites, but that doesn't mean that's a requirement of the system.

Ok. Then it's probably that every time I looked at an extension it wanted access to any site.

Heads up about Grammarly: https://news.ycombinator.com/item?id=30470457

You can turn it off for specific sites (via Grammarly settings) OR you can turn it on only for specific sites (via browser settings). The process is different depending on whether you are using a browser extension or desktop integration. Here is an example for the browser extension: https://support.grammarly.com/hc/en-us/articles/115000091612...

Yeah, it's wild to me that no major browser vendor has moved to expand the permissions system to addons.

We already have the system in place for things like Camera, Mic, and Location access. Why not extend that to anything an addon can do?

It seems like the bulk of it is only a few lines going by the GitHub. I don't know enough to know how to do it, but if you do, you might offer a bookmarklet version for privacy-conscious people as a pull request.

https://github.com/rugk/mastodon-simplified-federation

Phew, there are so many files and lines in that repo.

As far as I understand it, all that has to be done is something like:

    document.body.innerHTML.replace(/<some_regex>/,'<some_string>')

Where <some_regex> matches strings of type

    @[email protected]

and '<some_string>' turns that into

    <a href=https://yourinstance/web/@[email protected]>@[email protected]</a>

Is it possible for a bookmarklet to be able to find RSS autodiscovery[1] links? I've thought about building something like that but I've always been turned off by the "allow reading everything" permission.

[1]: https://www.rssboard.org/rss-autodiscovery

Sure. It's just an element in the DOM. Try this:

    javascript:url=document.querySelector('link[type="application/rss+xml"]')?.href ?? 'None'; alert("RSS found: "+url);{}

Slick, I'll have to think about that some.

I've made a bookmarklet to toggle between the website for the instance you use and the one the post/user used:

https://homepages.inf.ed.ac.uk/imurray2/code/mastodon.html

It's maybe easier to just use a separate app though, and avoid the faff of separate webpages entirely.