Little Rat
Security and privacy
browser extension monitoring
SHOW HN2023
How HN took it
10 positive, 18 neutral or asking, 1 mixed, 9 critical, out of 38 comments about the project. Thread score +0.08.
Execution: 0 for, 6 againstPrivacy: 2 for, 3 againstIdea: 4 for, 0 againstDocs: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for auditing extensions instead of doing it manually
From 2 comments
Thank you so much! This is so useful, now I don't have to audit extensions manually.
mickelsen on HNGreat extension. I already found that Midnight Lizard is a major offender when it comes to browser data harvesting. Here's an example: https://ibb.co/JQvgt3p
jimmychoozyx on HN
Source is short and easy to read
From 1 comment
I guess the answer is that you must be able to read the code and use your own judgement. Here the actual code of the extension is basically 2 files, one of 114 lines and the…
duiker101 on HN
Objections
Installing unknown extensions to audit extensions is risky
From 2 comments
How can I be assured that installing a random Chrome extension from a random person on the internet that has access to all my network data and can't get approved in the Chrome…
jedberg on HNVerifying Github source code is not sufficient, since you don't know the release contains that source code (when downloading fro the store). You'd have to verify signatures Also,…
meesles on HN
Installation from zip or crx is not easy
From 2 comments
Given that this extension is not very easy to install, I suggest adding a screenshot showing some actual captured network events. The current screenshot hides the most…
p1mrx on HNooh, love it. Would be great to have some installation information within the repo for people who aren't savvy at enabling dev mode in chrome extensions
bromuk on HN
Extension data is not visible in the store version
From 1 comment
Managed to get it in! [1] I added ability to do blocking and made the "management" and "declarativeNetRequestFeedback" permissions optional, requested via a button on the popup…
npace12 on HN
Requests
Add a screenshot showing captured network events
From 1 comment
Given that this extension is not very easy to install, I suggest adding a screenshot showing some actual captured network events. The current screenshot hides the most…
p1mrx on HN
Add installation instructions to the repo
From 1 comment
ooh, love it. Would be great to have some installation information within the repo for people who aren't savvy at enabling dev mode in chrome extensions
bromuk on HN
Add a license
From 1 comment
Depending on your intentions, the repo would benefit from a license instead of just using github for code hosting
mdaniel on HN
Refresh extension list when extensions are removed
From 1 comment
Downloaded the extension and tested that it's working. QQ: What does it mean when there is a "hit" (e.g., 1 appears), but when I click the extension to investigate all extensions…
scrum-treats on HN
Questions
Is there a Firefox equivalent or port
From 2 comments
sounds great, do you have plans to port it to Firefox? Does anyone know an equivalent that do the same thing on Firefox?
elashri on HNIn most cases, just adding "var chrome = browser;" to the top of each js files would make it work for firefox, which is just a copy of Chrome Extension APIs with slight changes
vdfs on HN
Why is it not on the Chrome store
From 1 comment
Why not on the chrome store?
leke on HN
Can extensions access other extensions' requests and expose sensitive data
From 2 comments
Neat. I'm surprised this is possible tbh. Not being familiar with exactly what data these APIs (or similar?) provide: could extensions' abilities to access other extensions'…
Groxx on HNThanks for sharing, would you mind explaining how it works and if there are any general concerns you have with Chrome not sandboxing between extensions? ie, what else is shared…
Daviey on HN
Alternatives named
Firefox browser console and network logging
From 1 comment
I believe that these connections should also appear in the browser console[1], otherwise you could always log the traffic[2] or inspect/debug any individual extension[3]. You…
krono on HN
Midnight Lizard
From 1 comment
Great extension. I already found that Midnight Lizard is a major offender when it comes to browser data harvesting. Here's an example: https://ibb.co/JQvgt3p
jimmychoozyx on HN