Hacker News Reader

It seems like using a browser extension instead of a website gets you most of the way there:

- Extensions are signed with a developer key

- You can be pretty sure any code changes pushed out to one user are pushed out to everyone

- You benefit from the Chrome Web Store review process (or whatever equivalent Apple and Mozilla do)

- Extensions are permissioned and sandboxed

More relevant to the article, Chrome extensions can't just "open a zillion connections." Included scripts must be unminified and external scripts are strictly declared ahead of time with more secure default permissions.

I like that idea.

Indeed, Manifest V3 disallows remotely hosted scripts entirely: https://developer.chrome.com/docs/extensions/develop/migrate...

I mean, kinda. It's little more than a consumer-grade padlock or maybe "do not cross" tape - there are countless ways around it, it mostly just encourages normal cases to be more static (which is a good thing! but very far from a security tool)

Reply on news.ycombinator.com