In another post, you mention that there’s a header that can include an https link to POST a request to unsubscribe. So this extension and anything like it must be able to read email and send POSTs to arbitrary endpoints[0].
> ensuring your privacy
But only if we trust the extension author (and the authors of all of the transitive dependencies) to be neither malicious nor incompetent… right? I don’t know of resources that explain exactly what actions each permission in the manifest grants the extension to perform, nor a characterization of the execution environment of extensions. Do all browsers handle these matters similarly? Does some browser provide any more isolation or sandboxing than any other?
Edit: by no means did I mean to throw shade or cast doubt on your extension, I’m just grumpy in general and in particular about browser extensions, since nowadays “the browser is the OS”.
[0] or maybe there’s a gmail api that does it for you, and this extension actually can’t make arbitrary http connections?
> ensuring your privacy
But only if we trust the extension author (and the authors of all of the transitive dependencies) to be neither malicious nor incompetent… right? I don’t know of resources that explain exactly what actions each permission in the manifest grants the extension to perform, nor a characterization of the execution environment of extensions. Do all browsers handle these matters similarly? Does some browser provide any more isolation or sandboxing than any other?
Edit: by no means did I mean to throw shade or cast doubt on your extension, I’m just grumpy in general and in particular about browser extensions, since nowadays “the browser is the OS”.
[0] or maybe there’s a gmail api that does it for you, and this extension actually can’t make arbitrary http connections?