That’s true. On the other hand, the extension gains a much larger attack surface since it has access to a lot more data (every site you visit vs. only the site that serves the JS code). At the end of the day, people wouldn’t use your site if they didn’t trust your site, especially if they use it for privacy and integrity reasons, so for most users I think JS is the better option. I suppose there’s no reason you can’t offer both though.

Is their JS code open source? If so, I don’t see any real differences between an extension and JS code. Unless extensions have less privileges or something. The user will have to either trust the code or inspect it themselves regardless if it’s an extension or JS code.

Update: Yamtrack is great, thanks for the suggestion! I haven’t gotten the webhook to work yet though but I haven’t had much time to troubleshoot.

They refused my refund request for Rust when they pulled Linux support. This was a few years ago though so maybe they’ve changed policies since.

In Sweden they can (and do). The police here take about 55 000 blood and urine samples per year for drug use convictions. It’s awful.

I might give Yamtrack a try, thank you!

I’ve used Arch on and off since around 2006 or so. I’ve used most distributions, including Gentoo, and in recent years things like Debian and atomic Fedora. I’ve settled for NixOS now though and I don’t see it changing unless a better declarative OS/language comes along (Guix is a good contender with its Scheme).

Thanks guys! I ended up ordering them. :)

Path of Exile 2 might be relevant here, the Souls games were what first came to mind when they introduced dodge roll, and the eldritch horror aesthetic is certainly there (albeit to a lesser extent compared to Path of Exile 1). It’s online though.

Does anyone know if the NixOS packages are safer from these types of attacks? As far as I know many packages are missing maintainers.