5 ms·

Chrome.userScripts API requires developer mode

79 points by navels 3y ago

dang 3y ago
Related ongoing thread: Tampermonkey: Dev Mode will become mandatory for running userscripts in Chromium - https://news.ycombinator.com/item?id=38533213 https://news.ycombinator.com/item?id=38533213 - Dec 2023 (75 comments)
haburka 3y ago
I have no clue why people are so shocked about this. Being able to run arbitrary code makes extensions nearly impossible to audit. There are so many malicious extensions out there, surely there has to be some checks on them. How else would the chrome extension store be able to prevent apps like Honey from harvesting all of your personal data? Also, users can check one box in chrome settings in order to go around this. It’s a bit too easy to bypass IMO.
navels 3y ago
Pertains to user scripts injected by MV3 extensions. Noticed this when my Tampermonkey extension updated today with this message: Enabling developer mode will soon become mandatory for running userscripts via Tampermonkey. Not a big deal for me, I have extension dev mode on all the time, but ymmv. Some discussion here: https://groups.google.com/a/chromium.org/g/chromium-extensions/c/bdnjlMNzQqA/m/BLaC7ONvAQAJ#BLaC7ONvAQAJ https://groups.google.com/a/chromium.org/g/chromium-extensio...
- RockRobotRock 3y ago
  They already make it hard enough that you need to get an extension to run extensions. That's so lame.
- chii 3y ago
  It simply puts up friction for the non-technical user from adopting these user scripts. The stated goal of google is to prevent malware from extensions, but i suspect the real goal is of course, prevent the browser from being changed by the user in a way that google doesn't like.
zlg_codes 3y ago
Shame, Google keeps alienating me further from their software. There isn't a single business on this planet qualified to tell me how my computing should be. If I want Hannah Montana GIFs on every form element then damnit I should have the ability to do it. Any browser that gets between me and control over what comes over the wire, or the filesystem, is obsolete and user hostile.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- weikju 3y ago
  > Shame, Google keeps alienating me further from their software. Then don't wait to jump ship, you know where things are going.. Otherwise you'll just get used to this latest round of user-hostile moves, then the next time you'll say the same thing after this is normalized.. and so on...
  - gruez 3y ago
    The flip side of this is that if you threaten to bail every time there's a "user-hostile move", you'll quickly run out of software/products to use. A few years ago there were users complaining about firefox being "user-hostile" because of [mr robot promo/pocket/addon signing/whatever], but if you bailed on firefox because those what are you going to use?
    - thomassmith65 3y ago
      In my case: Waterfox. The statement "if you threaten to bail every time there's a user-hostile move, you'll quickly run out of software/products to use" seems true at first, but the longer one thinks about it, the less it makes sense. If the argument is that all browsers have some user-hostile features, I disagree only meekly. If the argument is that all browsers are equally user-hostile, I disagree strongly.
mkl 3y ago
Currently I maintain a user script for myself and about 10 much-less-technical colleagues, which they install with Violent Monkey. With this change the ones who use Chrome will need to enable extension developer mode. Are there consequences to that, or is it just an extra step?
- gentleman11 3y ago
  Why not just use Firefox?
- porridgeraisin 3y ago
  Just an extra step, it's a single toggle in about:extensions. Bonus: it let's them use extensions on their filesystem instead of only the chrome webstore.
  - bugfix 3y ago
    It's a single step for now...
gentleman11 3y ago
Not an issue if you use Firefox like a cool kid
deleted 3y ago
[deleted]
devsda 3y ago
The requirement is not without side-effects. From the chrome developer group[1] > The devmode switch also enables other features e.g. chrome.declarativeNetRequest.onRuleMatchedDebug which may severely reduce the performance of the content blocking extensions, depending on how it's used. Unless they are happy with degraded performance or needing to switch to developer mode often, users may have to chose between ad-blocking and custom scripts. Chrome's current stance is that users have no right/legitimate business case running custom scripts on a site. You are allowed to do it only in the context of development. On the flip-side, this also means some features in development mode can potentially be restricted in the future saying they are non-essential for development. Given all these hostile decisions, it is still our choice on whether we want to switch to a better browser or become the proverbial frog in the pot. [1] https://groups.google.com/a/chromium.org/g/chromium-extensions/c/bdnjlMNzQqA/m/Kotb3-eVAAAJ https://groups.google.com/a/chromium.org/g/chromium-extensio...
- tzs 3y ago
  > Unless they are happy with degraded performance or needing to switch to developer mode often, users may have to chose between ad-blocking and custom scripts. Just going by the name, chrome.declarativeNetRequest.onRuleMatchedDebug, I'd expect that to be something that has to explicitly be used. Enabling developer mode would make it available which they say might reduce the performance "depending on how it's used", but would a production release of an ad-blocker extension be using it?
- devsda 3y ago
  I'm unable to edit. So quick update: As per [1], the chrome.declarativeNetRequest.onRuleMatchedDebug is available only for unpacked extensions i.e. local extensions with a specific permission. So, I'm not sure under what context there will be a performance impact. Anyone more familiar with internals of chrome and/or extension development in general can clarify if there are any downsides to enabling dev mode permanently. [1] https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest#event-onRuleMatchedDebug https://developer.chrome.com/docs/extensions/reference/api/d...
  - 3y ago

79 points by navels 3y ago

dang 3y ago

Related ongoing thread: Tampermonkey: Dev Mode will become mandatory for running userscripts in Chromium - https://news.ycombinator.com/item?id=38533213 https://news.ycombinator.com/item?id=38533213 - Dec 2023 (75 comments)

haburka 3y ago

I have no clue why people are so shocked about this. Being able to run arbitrary code makes extensions nearly impossible to audit. There are so many malicious extensions out there, surely there has to be some checks on them. How else would the chrome extension store be able to prevent apps like Honey from harvesting all of your personal data? Also, users can check one box in chrome settings in order to go around this. It’s a bit too easy to bypass IMO.

navels 3y ago

Pertains to user scripts injected by MV3 extensions. Noticed this when my Tampermonkey extension updated today with this message: Enabling developer mode will soon become mandatory for running userscripts via Tampermonkey. Not a big deal for me, I have extension dev mode on all the time, but ymmv. Some discussion here: https://groups.google.com/a/chromium.org/g/chromium-extensions/c/bdnjlMNzQqA/m/BLaC7ONvAQAJ#BLaC7ONvAQAJ https://groups.google.com/a/chromium.org/g/chromium-extensio...

RockRobotRock 3y ago
They already make it hard enough that you need to get an extension to run extensions. That's so lame.
chii 3y ago
It simply puts up friction for the non-technical user from adopting these user scripts. The stated goal of google is to prevent malware from extensions, but i suspect the real goal is of course, prevent the browser from being changed by the user in a way that google doesn't like.

zlg_codes 3y ago

Shame, Google keeps alienating me further from their software. There isn't a single business on this planet qualified to tell me how my computing should be. If I want Hannah Montana GIFs on every form element then damnit I should have the ability to do it. Any browser that gets between me and control over what comes over the wire, or the filesystem, is obsolete and user hostile.

deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
weikju 3y ago
> Shame, Google keeps alienating me further from their software. Then don't wait to jump ship, you know where things are going.. Otherwise you'll just get used to this latest round of user-hostile moves, then the next time you'll say the same thing after this is normalized.. and so on...
- gruez 3y ago
  The flip side of this is that if you threaten to bail every time there's a "user-hostile move", you'll quickly run out of software/products to use. A few years ago there were users complaining about firefox being "user-hostile" because of [mr robot promo/pocket/addon signing/whatever], but if you bailed on firefox because those what are you going to use?
  - thomassmith65 3y ago
    In my case: Waterfox. The statement "if you threaten to bail every time there's a user-hostile move, you'll quickly run out of software/products to use" seems true at first, but the longer one thinks about it, the less it makes sense. If the argument is that all browsers have some user-hostile features, I disagree only meekly. If the argument is that all browsers are equally user-hostile, I disagree strongly.

mkl 3y ago

Currently I maintain a user script for myself and about 10 much-less-technical colleagues, which they install with Violent Monkey. With this change the ones who use Chrome will need to enable extension developer mode. Are there consequences to that, or is it just an extra step?

gentleman11 3y ago
Why not just use Firefox?
porridgeraisin 3y ago
Just an extra step, it's a single toggle in about:extensions. Bonus: it let's them use extensions on their filesystem instead of only the chrome webstore.
- bugfix 3y ago
  It's a single step for now...

gentleman11 3y ago

Not an issue if you use Firefox like a cool kid

deleted 3y ago

[deleted]

devsda 3y ago

The requirement is not without side-effects. From the chrome developer group[1] > The devmode switch also enables other features e.g. chrome.declarativeNetRequest.onRuleMatchedDebug which may severely reduce the performance of the content blocking extensions, depending on how it's used. Unless they are happy with degraded performance or needing to switch to developer mode often, users may have to chose between ad-blocking and custom scripts. Chrome's current stance is that users have no right/legitimate business case running custom scripts on a site. You are allowed to do it only in the context of development. On the flip-side, this also means some features in development mode can potentially be restricted in the future saying they are non-essential for development. Given all these hostile decisions, it is still our choice on whether we want to switch to a better browser or become the proverbial frog in the pot. [1] https://groups.google.com/a/chromium.org/g/chromium-extensions/c/bdnjlMNzQqA/m/Kotb3-eVAAAJ https://groups.google.com/a/chromium.org/g/chromium-extensio...

tzs 3y ago
> Unless they are happy with degraded performance or needing to switch to developer mode often, users may have to chose between ad-blocking and custom scripts. Just going by the name, chrome.declarativeNetRequest.onRuleMatchedDebug, I'd expect that to be something that has to explicitly be used. Enabling developer mode would make it available which they say might reduce the performance "depending on how it's used", but would a production release of an ad-blocker extension be using it?
devsda 3y ago
I'm unable to edit. So quick update: As per [1], the chrome.declarativeNetRequest.onRuleMatchedDebug is available only for unpacked extensions i.e. local extensions with a specific permission. So, I'm not sure under what context there will be a performance impact. Anyone more familiar with internals of chrome and/or extension development in general can clarify if there are any downsides to enabling dev mode permanently. [1] https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest#event-onRuleMatchedDebug https://developer.chrome.com/docs/extensions/reference/api/d...
- 3y ago