> I want my browser to prevent random extensions from directly reading web page data.
To be honest, to me it sounds like you don't want browser extensions then.
To me, directly messing with web page data and browser behaviour is the whole point of a browser extension - what else is a browser extension for?
The purpose of browser extensions is to build up an install base then sell out to some corporation that then promptly leverages that user base to exfiltrate data and monetize it.
No thanks. They should have to declare to the browser what it is they want done instead.
This point would be far more credible if browsers weren't in business to do what you claimed extensions are there to do.
I'd also argue that creating a full browser without a profit motive is more unrealistic than creating an extension and uploading it - for free - to a web store.
Right, basically no web browser has a profitable business model except through licensing or being subsidized through some other branch of the business.
The best pure browser company in history was Opera, and they didn't fail because they weren't innovating. It is simply not a survivable model. People don't remember anything, but during Google's recent anti trust case, one floated "solution" was to spin Chrome off as a separate company, but that was regarded as unrealistic partly because such a company would not have a credible path to profitability separate from Google.
I happen to disagree, they could have collected a search licensing fee just like Firefox but that model is already being regarded as monopoly adjacent.
I think you're confusing the extension and the browser. The browsers are generally in the business of supporting an advertising company.
And extensions do exactly that in Firefox. When installing (or updating) extensions you're notified of any and all permissions the extension is requesting from the browser and you're given the choice to proceed with the installation or not. Google goes a step further and just straight up denies user choice entirely.
It still sounds like you don't want browser extensions then.
... But they do that. The declaration is written in a language called JavaScript.
Javascript is not a declarative language.
Sure it is.
Here's how you can write a declaration that you want to exfiltrate cookies:
Bro, they have to declare there Firefox's policy. What the heck are you doing? Hallucinating claim after claim to support your weak defense. Just stop
"Declare" means the extension tells the browser what they want to filter and then the browser does it internally without ever allowing the extension to read and write private information.
The argument has nothing at all to do with declaring permissions in a manifest.
LOL brother, it won't work the way you wish it to work.
Why should there not be a middle ground between “can do absolutely everything with all my data” and “is basically a glorified bookmark button” based on the level of trust I have for an extension?
Because security is the pretext, not the goal here. I'm sure browsers could have better security controls for extensions, but giving users extra control over software doesn't seem to be very popular among corpos nowadays.
Because the browser already has bookmark buttons