[Greasemonkey] Question: what would happen if Greasemonkey sentthe ID of every applicable user script with each request?

Matthew Gertner matthew at allpeers.com
Fri Apr 29 15:51:50 EDT 2005


Aaron,

Where this type of argument loses me is that it ignores the possibilities
for obfuscation (changing IDs, adding empty DIVs and SPANs, etc.) that could
disable a script without having to have direct influence over client-side
behavior. To me this invalidates your claim that we might as well tell site
operators that we are using GM, since they can't do anything about it
anyway.

At the same time, I still think that it would be a good idea to let site
operators know what is going on in the client. Maybe it would be useful to
separate GM usage into two categories: a) blocking ads and b) everything
else. The former is already a battlefield, and GM is just a new weapon that
doesn't do anything substantial to change the overall game rules. For
scripts in category b), however, I think it would be a good thing if sites
knew they were running and could take appropriate action (like preventing
them from doing anything harmful if the site structure changes).

Matt

> -----Original Message-----
> From: greasemonkey-bounces at mozdev.org [mailto:greasemonkey-
> bounces at mozdev.org] On Behalf Of Aaron Boodman
> Sent: Friday, April 29, 2005 4:01 AM
> To: greasemonkey at mozdev.org
> Subject: Re: [Greasemonkey] Question: what would happen if Greasemonkey
> sentthe ID of every applicable user script with each request?
> 
> Ok, my point is not really getting across here. I'll try once more and
> then give up.
> 
> GM-like applications are proveably not disableable. How? Write an
> application which instances a web browser, tells it to download a
> particular URL to disk, and then changes it programatically on disk
> and redisplays it. Voila! Slow perhaps, but totally undetectable.
> 
> Yes, currently GM is disableable, but that isn't particularly
> interesting. It is disableable only through implementation bugs and
> design shortcomings. This isn't sustainable even in the short term.
> The only reason I haven't fixed the issues brought up by Pilgrim's
> experiments is because there is no immediate need. There will be no
> arms race; user scripting won the day HTTP 1.0 was written.
> 
> What I am proposing is that GM simply notify the site on each request
> that it is active. Since we have already proven (see paragraph #1)
> that GM is not disableable, what might a publisher do with that
> information?
> 
> Well, he'd have several choices: deliver same webpage he would to
> anyone else, deliver a webpage somehow optimised for GM, or deliver no
> webpage.
> 
> Choice #2 is particulary interesting, and I wonder if choice #3 should
> be available to him.
> 
> --
> Aaron
> _______________________________________________
> Greasemonkey mailing list
> Greasemonkey at mozdev.org
> http://mozdev.org/mailman/listinfo/greasemonkey
> 
> 





More information about the Greasemonkey mailing list