Submitted 1 week ago by gnufuu@lemmy.ca to [deleted]
https://lemmy.ca/pictrs/image/5c5b0db5-0eef-4568-b175-e9b796a79500.png
Can I deny an addon certain permissions listed as “required”?
Can I deny it to phone home, as in block any custom outbound connection it tries to establish?
More toggle switches for things like that would be nice compared to “The developer says this extension doesn’t require data collection”
If this is the actual extension by Raymond Hill, it’s pretty trustworthy. They’ve been committed to keeping uBlock Origin open source, won’t sell data, and has stated they’ll never hand the project over, but simply archive the repo and let someone fork.
Ray got stung years ago when they tried to step away from uBlock (the original project, before uBlock Origin) and uBlock ended up getting taken over by the AdblockPlus lot. Ray doesn’t want to go through that again.
They’ve previously archived projects like uMatrix too, an example that they’re not looking to hand over projects to anyone again and leave it to the community to fork and maintain if they want to keep it alive without Ray.
If you’re concerned, fork the repo and maintain your own version so you can be sure it’s trustable.
I think you should be able to edit permissions in the extension’s manifest.json. I don’t know if they will be overwritten by updates though. I was working on an experimental local add-on, so I had more control over it.
floquant@lemmy.dbzer0.com 1 week ago
Usually those required permissions are directly derived from the APIs the extension uses, so you probably could but not without losing some functionality. For example, if you completely blocked network requests uBlock itself makes it would be unable to fetch the blocklists. I think auditing the code and disabling autoupdates if you’re concerned about the dev’s trustworthiness would be a better approach, but afaik it has a spotless track record
gnufuu@lemmy.ca 1 week ago
I could have used a better example than uBlock. Think of an addon that lets you change your browser’s locale. Those hardly ever need to be updated, yet I can’t find a way to keep them offline.
Creat@discuss.tchncs.de 1 week ago
Or not really about updates or checking for them. Any browser addon that is supposed to interact with all websites needs that permission. It is basically a filter for when you visit a website, if an addon is allowed to “see” the page/traffic. Even for changing the locale, this is needed.