search

joelacus / RedditEnhancer

A browser extension to tweak the user interface on Reddit
83 stars 1 forks source link

Block content on any website #70

Closed eirnym closed 2 months ago

eirnym commented 2 months ago

Hi, Firefox notified, that new version of this plugin want to block content on any website. I use uBlock Origin and don't allow any other plugin to block anything. I prefer to have a separate custom subscription rather than to have it builtin into a plugin

joelacus commented 2 months ago

Hi. I understand your concern. I try not to use permissions I don't need, but this is caused by the "declarativeNetRequest" permission for the redirect to preferred UI feature. This redirects the URL before the page even loads, so it makes this feature a lot faster, rather than waiting for some javascript to load to determine if it should be redirected or not. It doesn't actually block any content, nor will it touch any site that isn't www/old/new/sh.reddit.com, the popup should be more clear. I suppose it thinks redirecting is blocking the page it was redirected from?

Here is the addon manifest file for Firefox if you would like to check. It can only access URLs matching "://.reddit.com/*": https://github.com/joelacus/RedditEnhancer/blob/main/src-webpack/src/manifest_v2/manifest.json (I can't make declarativeNetRequest an optional permission unfortunately)

Here are the rulesets for the declarativeNetRequest: https://github.com/joelacus/RedditEnhancer/tree/main/src-webpack/src/common/rules

I hope this alleviates any concerns.

eirnym commented 2 months ago

There's redirect bypasser and many other similar addons out there. I understand your idea to put everything into a single plugin, but I prefer different addons for different responsibilities.

joelacus commented 2 months ago

Someone else wanted this redirect feature improved so they don't have to use multiple addons. I guess I can't please everyone. You can easily turn off the redirect feature though and continue using this other addon if you wish. Otherwise, you can stay on version 1.9.0, or compile your own version of Reddit Enhancer without the redirect feature. I'm not sure what else I can do.

eirnym commented 2 months ago

I worry about permissions I give each plugin and how they interfere between each other. There's many other plugins which doesn't require web filtering feature but do their job and I prefer other methods of doing the same thing.

joelacus commented 2 months ago

I would have used "webRequestBlocking", but Google has deprecated this in manifest version 3, and suggests instead to use "declarativeNetRequest". Using this allows the redirect feature to work on all browsers with the same code. If you are worried about it interfering with other redirecting addons, you can disable this feature. If you have any security concerns, the code is open source so you can check the code. I try to use as fewer permissions as possible, but I needed this one. I understand I could lose some users, but I don't know what else I can do.

eirnym commented 2 months ago

Even without webRequestBlocking. For example take a plugin for Indie Wiki as an example.

It does the job without invasive operations. You can do the same

joelacus commented 2 months ago

Even if I rewrote the redirect feature to use webRequest, I would still need the declarativeNetRequest permission for Chrome/Edge users for the "Just Open The Image" feature, due to "webRequestBlocking" being deprecated in manifest version 3. Chrome/Edge users would then need the additional webRequest permission. I'd be just shifting the extra permission from Firefox users to Chrome/Edge users. I'm not going to maintain two different pieces of code which do the same job.

Anyway, webRequest is arguably more invasive, less secure, and slower. It gives the extension access to all traffic and it's up to the extension to deal with the logic. declarativeNetRequest on the other hand has a defined set of rules managed by the browser, making it more secure as the extension can't read the traffic, and also much faster and easier to maintain. webRequest is only still required for the "Just Open The Image" feature on Firefox. I may eventually make it use the same code as in the Chrome/Edge version as it would simplify the overall code and remove the necessity for the webRequest permission from Firefox.

Like I said before, if you are concerned about it interfering with other redirecting addons, or would prefer to use another for redirection, you can disable this feature.