Hacker News new | past | comments | ask | show | jobs | submit login

More relevant to the article, Chrome extensions can't just "open a zillion connections." Included scripts must be unminified and external scripts are strictly declared ahead of time with more secure default permissions.

I like that idea.




Indeed, Manifest V3 disallows remotely hosted scripts entirely: https://developer.chrome.com/docs/extensions/develop/migrate...


I mean, kinda. It's little more than a consumer-grade padlock or maybe "do not cross" tape - there are countless ways around it, it mostly just encourages normal cases to be more static (which is a good thing! but very far from a security tool)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: