It should start with access permissions being limited to user-specified (even if prefilled) list of sites/domains. There are extensions clearly meant for a single page (e.g. improving the UX), or a class of pages. I never install them, because even if those pages are not critical, the permission request is always scoped to "all data, every site", which means that e.g. this nice plugin decluttering YouTube could also exfil data from my bank's webapp.
Re:Show HN: Use Slack Emoji on GitHub
by awinter-py on Monday November 14, 2022 @07:11PM
(#33603370)
pretty sure chrome provides this? or at least whatever build of chromium I am on, at least for local-unbundled extensions
would be great if something like ublock is only able to disable dom elements, not insert them, for example, and has strong guarantees about not doing IO
permissions need to be 'shaped like' APIs -- users are much more able to audit permissions than to audit changing code