Hacker News Reader

Comment by tiborsaas | Hacker News Reader

Build a scraper / content extractor service. But you still can't inject anything without those permissions.

It would be nice if Firefox provided an API that only exposed the static HTML of sites you're visiting. I don't care if an extension wants that data, it's nowhere near as sensitive.

I guess this doesn't solve injection, but there must be other ways to solve "display some additional data."

Great idea, after all it's impossible to render sensitive data server side :)

I said it's less sensitive.

Does it matter?

Btw here is your API:

    document.body.innerHTML

And which permission do I take to access that?

As a bookmarklet, none :) That's the best you can get.

Reply on news.ycombinator.com