Hacker Newsnew | past | comments | ask | show | jobs | submit | zukerpie's commentslogin

Do you know about some way to check whether what I install from Extension Store is exactly the same as on Github?


I think you could use the source code on Github and compile it and install it manually yourself on a browser


Thanks for the hint. Yeah, I will do this :)


Added a quick domain check to avoid the issue that you've mentioned :)


I believe you could use a sub tree mutation observer instead of polling.


Yes, definitely use mutation observers. Far faster to react and doesn't require polling, they're better in essentially every way when things aren't changing many times per second.


This is just the straightforward idea of waiting for some element to appear on the website. But once the element is found, this thing stops. It won't stop for YouTube if you are on Facebook though but it's just a first implementation and it could actually be very easy to recognize the site. Thanks for the helpful suggestion!


hey just curious, can't the mutationobserver catch this instead of that approach?

https://developer.mozilla.org/en-US/docs/Web/API/MutationObs...


Definitely! The current implementation is supposed to just do the work. It's not meant to be optimized or anything.


I wrote an extension that did something similar for Twitter, back when Twitter had "So-and-so liked this" tweet, which was inevitably something awful. It's archived now, because it's no longer relevant. But you might find something useful in the code.

I tried polling, but it was against the Chrome extension guidelines at the time, so I used a "mutationObserver" on page load and then a "scrollListener". I don't remember if I ever tried an "intersectionObserver" but that might be worth looking at.

https://github.com/rendall/twitter-like-hider/blob/master/co...


Haha, that should be definitely possible, but would require a bit more knowledge :)


The advantage that speaks to me, is that I control everything. I'm not sharing my data with the developer of the extension so it's one person less that I have to trust. I can also very easily adjust it to my needs, but I can program, so it's not valid case for everyone.


The current version just grabs the whole feed and removes it from the website. If you can program, it won't be hard for you to extend it so you can remove only the content you want.


thanks appreciate response


Unhook looks nice, since it's only restricted to accessing YouTube. Strange that I didn't stumble upon it while looking for options.


The main problem that I have with extensions is: "It can: Read and change all your data on all websites" Having my own, local extension I don't have to actually think whether I added some sensitive stuff to be exempt from permissions or not.


At this point of time, uBlock Origin is probably more trustworthy than some browser (read Chrome) themselves.


It's only "your own" to you. Neither uBlock Origin nor your extension from Github are "my own". See?


The whole point is to actually have installed locally so you don't share any data with the developer of the extension. The problem with extensions is that in many cases the access that you give them is way too broad. If you install it by yourself, you control everything. The only thing that I thought about is maybe some kind of configurator that would allow you to pick some already existing rules that the users would share through github.


There isn't really a special protection if you install a extension in developer mode.

More the opposite because you have to totally trust the source.

Web stores search for certain malware patterns and get at leat some.


Thanks for pointing this out. The whole discussion around "the developer doesn't see my data" confused me, as the question of whether the code is malicious is orthogonal to installation method.

Given that uBlock Origin can do this, I'd recommend that route. uBlock Origin is probably the most trustworthy extension I've ever run across, and Gorhill has proven that he is trustworthy over many years.


You're not wrong, but in this case the total source code is like 30 lines long so it's not hard to verify what it's doing yourself


But that is independent from the way you install an extension.

You gain no security from an unpacked extension.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: