Hacker News Reader

Exactly my same feeling. And what's worse, is that I don't really know what those entries (.js files) can do. Can they exec code whenever they want? Or every hour? Or every minute? Can they see what I do? Can they call home (and know my IP even if I'm not visiting those websites)? Why do I have to read a technical spec to learn about this?

View on HN

To my knowledge they can only execute code in response to a network event. Usually this means you need to take some action to trigger an outgoing network request, like returning to the site that installed the service worker. Code execution can also be triggered by incoming network events such as push notifications but these would require you to have allowed push notifications from that site.

Reply on news.ycombinator.com