Browser extensions are underrated: the promise of hackable software (2019)

Original Article ↗ Hacker News Discussion ↗

Browser extensions are praised as a powerful way to “hack” and personalize the web, enabling everything from ad blocking and annotation to deep workflow automation across sites and browsers. Commenters, however, highlight serious trade-offs: weak permission granularity, opaque auto-updates, frequent takeovers by data brokers, and platform changes (like Chrome’s Manifest V3) that can abruptly break or neuter extensions. Many argue for tighter review, open‑source code, profile or device isolation, and even new standards or local‑first architectures to preserve extensibility without sacrificing security and privacy.

Monetization and ecosystem differences

  • Some argue “you can’t sell extensions”; others counter that’s a feature (should be open / donation-funded) or note there are paid and freemium extensions.
  • Chrome and Firefox removed built‑in payment systems, which reduced incentives to maintain paid extensions; Safari/iOS/macOS App Store is seen as an exception where users pay and developers can make a living.
  • Debate over paid vs free: paid doesn’t prevent later data-monetization, but charging up front may reduce incentive to sell out to data brokers.

Mobile and platform support

  • Lack of extension support on mobile, especially Chrome on Android and all Chromium-based iOS browsers, is seen as a major drawback.
  • Workarounds: Kiwi on Android, Orion and Safari on iOS/iPadOS, limited Firefox mobile support. APIs on mobile are often more restricted.

Developer experience and alternatives

  • Some find extension docs confusing and APIs unstable; manifest version changes force rewrites.
  • Userscripts and user styles (via Tampermonkey/Violentmonkey/Stylus) and bookmarklets are praised as lighter-weight, easier, and cross‑browser alternatives.
  • AI tools are already used to scaffold simple extensions and may lower the barrier further.

Security, privacy, and trust

  • Strong concern about extensions as high‑value targets: frequent stories of popular extensions being bought by data brokers and turned into spyware or ad injectors.
  • Auto-updates make one-time audits insufficient; a benign extension can become malicious later.
  • Many commenters restrict themselves to a tiny set of trusted, often open‑source or browser‑vetted extensions, and sometimes run them only in separate profiles or even separate VMs/OS users.

Permissions and auditing

  • The coarse “read and change all your data on all websites” permission is widely criticized; some developers say they’re forced to request overly broad access.
  • Desired improvements: finer‑grained, per‑site or per‑element permissions; visible logs or runtime indicators of extension actions; easy “view source” from the store; bans on obfuscation.
  • Tools exist to inspect extension code, but minification and continuous updates make real auditing hard; some suggest LLMs could help de‑minify and summarize behavior.

Platform politics and future

  • Chrome is seen as strategically risky (Manifest V3, ad‑blocking limits, possible future API removals); Firefox is viewed as more aligned with extensibility but still capable of breaking changes.
  • Some think extensions are essential to make the modern web usable (adblocking, UI fixes); others say they’re overrated, fragile, and massively increase attack surface.
  • The original article’s author (commenting in-thread) emphasizes security as the main bottleneck and argues that local‑first, client‑controlled apps and AI‑assisted programming could enable safer, more powerful customization beyond today’s extension model.