That’s true. On the other hand, the extension gains a much larger attack surface since it has access to a lot more data (every site you visit vs. only the site that serves the JS code). At the end of the day, people wouldn’t use your site if they didn’t trust your site, especially if they use it for privacy and integrity reasons, so for most users I think JS is the better option. I suppose there’s no reason you can’t offer both though.

Is their JS code open source? If so, I don’t see any real differences between an extension and JS code. Unless extensions have less privileges or something. The user will have to either trust the code or inspect it themselves regardless if it’s an extension or JS code.

Update: Yamtrack is great, thanks for the suggestion! I haven’t gotten the webhook to work yet though but I haven’t had much time to troubleshoot.

It’s not an option for me if it can’t run GrapheneOS unfortunately.

I might give Yamtrack a try, thank you!

Nowadays I only really use Jellyfin, but before that I exclusively used mpv. As for why, I just felt it worked a bit better (not sure if it has to do with codecs) and I liked how it suited terminal based workflows.

Does anyone know if the NixOS packages are safer from these types of attacks? As far as I know many packages are missing maintainers.