5 ms·
This extension only requests access to HN's known domains. If one would try to request to a non white-listed domain it would trigger Access-Control-Allow-Origi
by hnux 3y ago
This extension only requests access to HN's known domains.
If one would try to request to a non white-listed domain it would trigger Access-Control-Allow-Origin error.
Also I think v3 makes it quite hard to use remote loaded code.
Any attempt to be malicious would probably be caught by store's review process eventually.
- tyingq 3y agoYeah, I'm not saying this extension is doing anything nefarious. I am saying that Google's propaganda about MV3 isn't right, and it's obviously spilling out to other people. MV3 blocks one specific api call in OnBeforeRequest()...the one that's useful mostly to ad blockers. The remote loaded code restriction is laudable, but the review process is weak. It's fairly easy to get shady things approved.
- xd1936 3y agoManifest V3 prohibits extensions from loading any remote code like JavaScript or Wasm files[1]. 1. https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#remotely-hosted-code https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...
- tyingq 3y agoRight, I acknowledged that in the comment you're replying to. But the review process is weak. And, I don't need to load external code to exfiltrate stuff. For example, I can load an image with a specific name/path, or hijack functionality already on the page, like Google Analytics code. Generally, non-trivial extensions cannot be both secure and useful at the same time.