Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There's a big difference between "can access your data on domain.com" and "can access your data on all websites". (And not all extensions need to modify pages, even Chrome ones.)

I didn't say you shouldn't install extensions that require content privileges (indeed I would highly recommend that you install at least one [1] [2]); just that you should do so with care, and decide whether you trust their authors, because of the broad access they have. The advantage of the Mozilla approach of reviewing every extension is that they (partially!) offload some of the trust decision from the user onto the reviewers.

As I said above, you can respond to a review with your own review, but that's a broken way of doing it: the author's response isn't visually distinguished, and there's no way to ensure it appears anywhere near the review it's responding to, so there's a high chance prospective users will just read the negative or misleading review without seeing the response.

(Concretely: someone can "review" your extension by saying "this extension is evil and spies on all the sites you visit", and your only options as an author are to leave another review halfway up the page saying "@anonymous: oh no it doesn't", or to abuse the "mark review as spam" button.)

[1] http://rapportive.com

[2] Disclaimer: this recommendation is not without bias, given I'm part of the team that develops this extension.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: