Hacker News Reader

Comment by TeMPOraL | Hacker News Reader

I'm torn on whether to see this "AI Kill switch" as a win on respecting the users, or something to keep us distractewd while they ship through "Trusted Types" API that sounds like further restriction of end-user computing freedoms.

View on HN

I would absolutely love to hear your reasoning that leads to type systems being considered a "restriction of end-user computing freedoms".

For those that don't know what trusted types are: Simply put, it splits the string type in to unsanitised_string_from_user and safe_escaped_string where unsafe strings can not be used in function parameters that only take a safe string That's heavily simplifying of course, but it's the basic idea.

Skimming the API docs on MDN, it makes sure the site vendor gets to run filtering code over anything you'd want to inject via e.g. user script or console, securing it with CSP. I expect this to make user scripts work as well as they do on Chrome now. If there's a workaround, I'd love to hear about it.

Worst case you just run your userscript before any policies are created, but in most cases it's not going to impact userscripts.

Oh just great. The web is bad enough already, I think I'll have to go live in the woods if userscripts get kneecapped

You may be thinking of the much-hated "Trusted Computing" initiative. "Trusted" here means that the JavaScript dev picks a sanitizing library they trust, not that Mozilla decides what software is trustworthy.

Nah, my issue isn't with users vs. Mozilla, but users vs. "JavaScript dev", specifically the difference of opinion on who should have final say on what gets executed and what doesn't.

Aren't those just overengineered sanitizers?

Question is, can you sidestep or disable them in user scripts or in developer tools, without disabling CSP entirely or doing something even more invasive (and generally precluding use of that browser instance for browsing)?

We made sure to exclude WebExtensions code from web pages's Trusted Types restrictions enforcement. (Bugs can happen of course)

Sorry, so you mean something like Violentmonkey scripts would be unaffected?

I sincerely thank you for doing that - and for saying it!

Reply on news.ycombinator.com