This is just basically everyone using Slack, as Firefox, Chrome, and Safari support web extensions API
> - people who install extensions with permissions to run arbitrary JS on every page
I would bet that most people who use Chrome or Firefox install extensions that can run arbitrary JS on every page, like ad blockers, full page screenshot, or “nifty” discount-coupon-code extensions.
would be great if something like ublock is only able to disable dom elements, not insert them, for example, and has strong guarantees about not doing IO
permissions need to be 'shaped like' APIs -- users are much more able to audit permissions than to audit changing code
~Basically my point. I made allowances for people who use neither, but they’re a vanishingly small user share.
> I would bet that most people who use Chrome or Firefox install extensions that can run arbitrary JS on every page, like ad blockers, full page screenshot, or “nifty” discount-coupon-code extensions.
Pretty much my point. Along with the former point, the Venn diagram is roughly all Slack users.
- people who use both a Web Extensions-supporting browser and Slack
- people who install extensions with permissions to run arbitrary JS on every page
- people who install or use Slack bots/etc with excessive access to Slack data
… is likely very nearly a circle. The emoji use case isn’t one for which I’d personally take that combination of risks. But I can imagine a wide variety of more appealing/risk worthy and likely even higher risk “use [CLOUD_SERVICE_FOO_RESOURCES] seamlessly in GitHub” use cases where I’d pause to at least consider it.