You don’t need https for a web running locally; nothing goes into the network. Malicious browser extension can be real, but if that is true, you might have bigger problems than leaking the apple graph

▲

yubblegum 20 hours ago | parent [-]

> if that is true, you might have bigger problems than leaking the apple graph

That is certainly true, and it is equally true that that possibility places a responsibility on you to put that in a section in your readme.

So yeah, I may have a bad extension but that thing never had access to the possibly aptly named 'IntelligencePlatform' that's keeping tabs on my digital activities, until I ran your code. Correct?

▲

thomascountz 19 hours ago | parent [-]

I would go further and suggest that you do not access any website or open any files via your browser while you have malicious browser extensions installed. You do not need this project's README to tell you this.

▲

yubblegum 19 hours ago | parent [-]

That is a categorical error.

My evil extension|browser may know what porn I watch or which sites I am visiting or possibly lift some bits it is not supposed to have. But it does not have access to Apple's comprehensive graph of my digital activities on their devices. Only Apple Inc. has that access.

So in fact the OP needs to put in the readme that "malicious browser extensions are a potential attack surface."

As a matter of fact, one could argue that a posting like this on Hackernews could potentially be a very sophisticated 'human engineering' effort by parties that have backdoors to browsers but have been defeated by Apple's security features.

▲

jdiff 5 hours ago | parent | next [-]

My friend you need to trust your LLM less here, this is extremely off base. If you have malware installed, the problem is the malware. Far more is at risk from it than some brand new dashboard that no malware has been sitting around waiting for. Malware will be waiting for API keys, bank passwords, your Internet connection to resale as a residential proxy. Things that will actually make them money. Your concerns are unfounded and misplaced.

▲

eks391 18 hours ago | parent | prev | next [-]

When you install a browser extension, your browser will notify you if it can read or modify page content before you enable it the first time. Using OPs tool is not unique in that it becomes vulnerable when paired with nefarious browser extensions, because all pages are. Https doesn't even solve that.

This is akin to some medicine saying that if paired with another specific medicine, you won't get desired results, and you are upset that it doesn't include a warning against combining the medicine with cyanide because you might die. The pairing with cyanide is irrelevant to the medicine and is just a side effect of cyanide.

▲

thomascountz 18 hours ago | parent | prev [-]

I don't think your request is reasonable because I don't agree with your (or your LLM's) categorical assertion and risk assessment, not because I misunderstand the mechanics of the threat model, as niche as it is.

Also, small correction: any app with Full Disk Access can access this data.

	▲	yubblegum 5 hours ago \| parent [-]
		"[A]ny app with Full Disk Access" requires yours truly's personal approval. You acknowledge the threat is real yet say it is "niche". And frankly, given that Apple can not possibly 'iKnow' more about me than myself, it seems running your 'niche critical but whocares' python server can only be informative to potential 3rd parties locked out of my Apple machine because they do NOT have been give permission by me to have "Full Disk Access".