from Hacker News

Chrome.userScripts API requires developer mode

by navels on 12/5/23, 2:27 AM with 22 comments

  • by devsda on 12/5/23, 5:17 AM

    The requirement is not without side-effects.

    From the chrome developer group[1]

    > The devmode switch also enables other features e.g. chrome.declarativeNetRequest.onRuleMatchedDebug which may severely reduce the performance of the content blocking extensions, depending on how it's used.

    Unless they are happy with degraded performance or needing to switch to developer mode often, users may have to chose between ad-blocking and custom scripts.

    Chrome's current stance is that users have no right/legitimate business case running custom scripts on a site. You are allowed to do it only in the context of development. On the flip-side, this also means some features in development mode can potentially be restricted in the future saying they are non-essential for development.

    Given all these hostile decisions, it is still our choice on whether we want to switch to a better browser or become the proverbial frog in the pot.

    [1] https://groups.google.com/a/chromium.org/g/chromium-extensio...

  • by navels on 12/5/23, 2:27 AM

    Pertains to user scripts injected by MV3 extensions. Noticed this when my Tampermonkey extension updated today with this message:

    Enabling developer mode will soon become mandatory for running userscripts via Tampermonkey.

    Not a big deal for me, I have extension dev mode on all the time, but ymmv.

    Some discussion here: https://groups.google.com/a/chromium.org/g/chromium-extensio...

  • by mkl on 12/5/23, 3:16 AM

    Currently I maintain a user script for myself and about 10 much-less-technical colleagues, which they install with Violent Monkey. With this change the ones who use Chrome will need to enable extension developer mode. Are there consequences to that, or is it just an extra step?

  • by haburka on 12/5/23, 8:12 PM

    I have no clue why people are so shocked about this. Being able to run arbitrary code makes extensions nearly impossible to audit. There are so many malicious extensions out there, surely there has to be some checks on them. How else would the chrome extension store be able to prevent apps like Honey from harvesting all of your personal data?

    Also, users can check one box in chrome settings in order to go around this. It’s a bit too easy to bypass IMO.

  • by dang on 12/5/23, 9:26 PM

    Related ongoing thread:

    Tampermonkey: Dev Mode will become mandatory for running userscripts in Chromium - https://news.ycombinator.com/item?id=38533213 - Dec 2023 (75 comments)

  • by gentleman11 on 12/5/23, 3:52 AM

    Not an issue if you use Firefox like a cool kid

  • by zlg_codes on 12/5/23, 2:54 AM

    Shame, Google keeps alienating me further from their software. There isn't a single business on this planet qualified to tell me how my computing should be. If I want Hannah Montana GIFs on every form element then damnit I should have the ability to do it.

    Any browser that gets between me and control over what comes over the wire, or the filesystem, is obsolete and user hostile.