I've always wondered if part of the root issue is that Same-Origin Policy, and CORS by extension, were not very intuitively designed abstractions/APIs to begin with.
How do they determine whether a PR is AI-assisted and therefore requires senior review? A junior engineer could still copy-paste AI-generated code and claim it as their own.
Would this also affect chrome extensions? For example, when an extension makes a request to a 3rd-party domain, browsers by default pass all the cookies associated with that domain to the server. AFAIU, these cookies are considered to be 3rd-party.
Shameless plug: I've built the unofficial "Hide My Email" browser extension [0], available both in Firefox [1] and Chromium [2]. Tried to make it as frictionless as the Safari UX, which proved to be a challenge given the lack of native HME APIs.
It's funny that geohot/tinygrad chooses to not meet the PEP8 standards [0] just to stay on brand (<1000 lines). Black [1] or any other python autoformatter would probably 2x the lines of code.
Well, in this instance remote code actually means remote. In V3 one can no longer use the tabs.executeScript API [1] in which you could pass an arbitrary server rendered string.
V3 not allowing remote code execution is actually a serious benefit. Of course, this does not negate the fact that V3 is mainly there to boost the ad ecosystem of Google, but I'd never want my screen casting extension to be mining bitcoin on the background. That said, I'm not sure how this is going to scale long term, given that it sometimes takes 2+ weeks for the web store review team to approve a genuine one-line change. Lack of RCE is only going to make this review backlog bigger.
> With Manifest V2, it was possible to inject a "Referrer" HTTP header if necessary. With Manifest V3, it's no longer possible.
Not entirely sure of how this is true. A recent V3 extension I've built is able to inject both the "Referer" and "Origin" headers using a declarative net request ruleset:
Statically (and proudly) generated by Hakyll. Hosted on my personal AWS account, using Route53 + Cloudfront + s3. Source sits within a private GitHub repo of mine, along with some Actions workflow that compiles and pushes the build to s3.
To avoid any potential issue with signal propagation a good practice is to always use a lightweight init system such as dumb-init [1]. One could assume that the node process would register signal handlers for all possible signals, but I prefer to not have to make this assumption and use an init system instead.
https://twitter.com/dedoussis
[ my public key: https://keybase.io/dedoussis; my proof: https://keybase.io/dedoussis/sigs/aCZmbR_w310duxoiLDb8IbaFoSI6n_MY5m0vZMDXwp0 ]