64
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 15 Aug 2026
64 points (98.5% liked)
Ask Lemmy
40974 readers
1792 users here now
A Fediverse community for open-ended, thought provoking questions
Rules: (interactive)
1) Be nice and; have fun
Doxxing, trolling, sealioning, racism, toxicity and dog-whistling are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them
2) All posts must end with a '?'
This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?
3) No spam
Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.
4) NSFW is okay, within reason
Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com.
NSFW comments should be restricted to posts tagged [NSFW].
5) This is not a support community.
It is not a place for 'how do I?', type questions.
If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.
6) No US Politics.
Please don't post about current US Politics. If you need to do this, try !politicaldiscussion@lemmy.world or !uspolitics@lemmy.world
7) No Hit-and-Run questions.
Please don't delete your post for no apparent reason. If you plan on deleting a question later, say so in the post, or if you feel that you have a good reason to remove it, message a mod beforehand. It's not fair to the ones who took their time to answer, and it's not in the spirit of the community.
8) No Bots.
Posts or comments from bots, LLM's, AIs, Neural Networks, Transformers, or Marvin the Paranoid Android are not welcome in AskLemmy. Real humans only please.
Reminder: The terms of service apply here too.
Partnered Communities:
Logo design credit goes to: tubbadu
founded 3 years ago
MODERATORS
Extensions can have more access.
They can snoop / manipulate across tabs or even scan the local drive and execute system commands... when given the access.
I had to make one for work once to let a web app run a legacy command prompt system. The web app's search was better, but the users wanted to edit with the old tool.
It was kind of interesting the way it worked. Not remembering the full details, I created an extension and a batch script and had to register the batch script with a group policy and declare the extension's permission to run that batch script
Then the users could search a client in the web app and press a button to bring up their profile in the prompt app.
Not a recommended approach for public facing apps.
*Edit: No! It wasn't a batch script... exactly... it was a C# app compiled to .dll that accepted client id as an argument
When was the last time you wrote an extension? Long gone are the days when they could run system commands, and permissions must be declared in the manifest or they cannot be used, so if they aren't in there, they're not being used.
... 3 years ago ish?
I tried to clarify with the edit, you're sorta right, it wasn't a system command. It was "native messaging"
But you're sort of full of it too, as you can use this native messaging to execute arbitrary logic. Nobody said you don't need a manifest, and someone did say you needed a group policy entry too
I know what native messaging is, and I'm not "full of it" because native messaging does exactly nothing at all unless the user explicitly installs software at the system level to receive those messages and act upon them. If the user doesn't know the difference between installing an extension in a browser and downloading & executing local programs, that's an education problem, but having to do some separate installation step is a useful security obstacle. It's much safer compared to old school extensions.
Also, Firefox Quantum came out in 2017, which used the manifest permissions system (wasn't Chrome ahead of them?), so the tech you were originally talking about is older than 9 years, not 3.
๐ฉ semantic distinctions, extensions can run whatever when you register the logic in advance, as suggested in my first comment
If you think installing a downloaded program alongside your browser is a "๐ฉ semantic distinction" from a bit of script running inside your browsers sandboxing, then it's clear you either don't know what you're talking about, or you'd rather continue to to spread FUD than concede on basic facts.
It is he thing I suggested from the start.
I already get you're full of it. You don't have to jeep selling me
> Says they wrote an extension 3 years ago but doesn't seem to know about decade-old isolation.
> Tries to tell everyone that extensions like OP's can run system commands, despite their use case not having any need to do so.
> Accuses others of being full of it.
Jog on, mate.
All nonsense aside I recognize you were trying to be helpful in your own way.
I don't much care for that way but bear you no genuine ill will and wish you the best.
๐ฉ
You can call someone "full of it" and put as many cute little emojis as you like, but if you can't articulate a coherent argument about what you think they've said is factually incorrect, you may not be the brilliant bullshit detector you think you are. And repeating the insult with nothing of substance to back up the assertion just reduces your argument to ad hominem.
๐ฉ i get it, it's hard being so wrong and you really need a W from SOME angle
Sticking with the ad hominem, eh? Not the brightest choice.
Hypo๐ฉ
So you don't understand that, either? When your only argument is insult, that's ad hominem. You never addressed any of the valid criticism of your fear mongering, other than to repeat the same misinformation.
You're calling me wrong because you think I'm "full of it" without being able point to anything that's factually incorrect about what I've said.
You remember earlier when you said, "Still going," like it was absurd?
๐ฉ
It's alright, a career in tech isn't for everyone. Imm sure you have plenty of great skills
I'll be sure to tell my employer that my services are no longer need because some jerk on Lemmy thinks that
File.readAsArrayBuffer()andSubtleCrypto.encrypt()packaged up in an extension that needs no special permissions, no companion app, and is limited to activating on a single named website, is like totally gonna scan my whole hard drive, man, what a drag.You really are a dunce.
Don't worry, I'm here as long as you need me best buddy ๐ค
๐ฉ
For posterity, my original edit was in before his first comment.
So full of it
Still going. I never saw the very first edit of your content, but the bullshit is still there:
Extensions cannot scan local drives, other programs that one installs in addition can. like I already explained, OP wouldn't need a companion program, so you're incapable of admitting (or maybe understanding?) that you're spreading baseless FUD about OP's proposed idea.
Sure they can. By messaging a native tool. Pedantic ๐ฉ
Which don't exist unless you install them, too, which OP's extension wouldn't need. You're chronically unable to focus on the context, aren't you?