Surrogates vs Greasemonkey

General discussion about the NoScript extension for Firefox
Post Reply
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Surrogates vs Greasemonkey

Post by Thrawn »

So, apart from providing a couple of shortcuts like GM_xmlHttpRequest(),
is there anything that Greasemonkey can do and surrogate scripts can't?
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3369
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: Surrogates vs Greasemonkey

Post by GµårÐïåñ »

Surrogates depend on whatever platform framework that is provided to them, so their efficiency is dependent on that much like the functionality of client-side scripting is dependent on GM's API and framework. A few things that might be different might be that surrogates usually depend on a framework that has more access to the core of the browser and its secure layers since its usually internally run as a chrome delegate while GM is inherently prevented from accessing the internals of a browser beyond some DOM and networking capabilities. So depends on what you are trying to achieve really. Just my two cents ;)
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/6.9 (Windows NT 6.9; Win64; x64; rv:66.9) Gecko/20130609 Firefox/69.0
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Surrogates vs Greasemonkey

Post by Giorgio Maone »

Thrawn wrote:So, apart from providing a couple of shortcuts like GM_xmlHttpRequest(),
is there anything that Greasemonkey can do and surrogate scripts can't?
There's a big intersection (in both case scripts can act as if they were hosted by the page), but
  1. Greasemonkey advantages
    APIs that give userscripts some "superpowers" over regular scripts, most notable of which are cross-site XMLHttpRequest and persistent preferences (the latter can be emulated via cookies or localstorage, the former using server-side helpers).
  2. Surrogate advantages
    They are more flexible about call time, i.e. there's no way for a Greasemonkey script to replace a 3rd party script or be aware whether scripting is blocked or not. And they are safer, i.e. a Greasemonkey script trying to manipulate content-provided objects like surrogates usually do exposes itself to be exploited in subtle ways which give content scripts access to the aforementioned "superpowers" to do nasty things. Therefore userscripts authors are severely warned against "touching" expandoes or bare (unwrapped) DOM objects, to prevent such attacks, which OTOH can't affect surrogates.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: Surrogates vs Greasemonkey

Post by Thrawn »

Thanks both!

Surrogates have lots of untapped potential...I'm going to look into them some more.
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Post Reply