"Cookies" permission warning wrong

[adamlui]

like https://scriptcat.org/en/script-show-page/7229

    deleteOpenAIcookies() { // requires <app|env> + GM_<cookie|deleteValue>
        log.caller = 'session.deleteOpenAIcookies()'
        log.debug('Deleting OpenAI cookies...')
        GM_deleteValue(app.configKeyPrefix + '_openAItoken')
        if (env.scriptManager.name != 'Tampermonkey') return
        GM_cookie.list({ url: app.apis.OpenAI.endpoints.auth }, (cookies, error) => {
            if (!error)
                for (const cookie of cookies)
                    GM_cookie.delete({ url: app.apis.OpenAI.endpoints.auth, name: cookie.name })
        })
    },

Checks if stale OpenAI cookie, if so delete for more guaranteed response, also this is old code anyway I don't implement OpenAI

i.e. it's only potentially unsafe if authors are writing not deleting (or listing and sending to self) so you are punishing authors for improving customers' UX

[adamlui]

To fix, only make it yellow if (.list && exfil) || (.set) where exfil means the val got "exfiltrated" i.e. left the browser via network request (fetch, XHR, GM_xmlhttpRequest, GM.xmlHttpRequest, then you detect if the val was in the payload, otherwise there's no reason for concern)

[adamlui]

(otherwise you are forcing me to delete a useful feature to accommodate broken labels that is so backwards)

[CodFrm]

This label only indicates that the script has this capability; it does not attempt to determine how that capability is used. I can revise the wording “High-risk permission — install with caution” to make it less alarming, but we still need to clearly disclose that the script has this capability.

[adamlui]

This label only indicates that the script has this capability; it does not attempt to determine how that capability is used

I know that, I said you colored it YELLOW (copying my color coding where yellow = alarm from my repo scripts) so you are scaring my users for no reason, and I'm telling you to "attempt to determine how that capability is used" to fix this problem

I can revise the wording “High-risk permission — install with caution” to make it less alarming

Are you telling me, my users are being warned “High-risk permission — install with caution” when installing my software, EVEN AFTER I EXPLAINED and SHOWED you the code it is not a risk but literal BENEFIT to users, you still want to warn them (thus force me to remove a feature to accommodate your illogical reasoning)

we still need to clearly disclose that the script has this capability

did I say delete the label? or you 're wrongly coloring it to punish authors of useful features

[adamlui]

dude I'm sorry but I have to compete with you, just letting you know I am creating a competing site this is just nuts how your brain works

[CodFrm]

GM_cookie is a sensitive permission that can affect users, so I believe it is necessary to bring it to users’ attention, regardless of what it is actually used for.

I can’t satisfy everyone. I also created SC because of my experience with GF. I look forward to seeing your site.

[adamlui]

dude I'm sorry but I have to compete with you, just letting you know I am creating a competing site this is just nuts how your brain works

.. the reason is you keep stealing/copying me (fist AI summaries now this) then when I tell you how wrong things are, you try to fight/warn me like some enemy instead of ally ( I didn't even agree to let you copy me, only my advised fix is voluntary) instead of understand from the perspective of other side, that's why I feel as the site builds/grows and you keep copying me it's going to be the same thing repeating over and over

[adamlui]

I also created SC because of my experience with GF

Why are you telling me this sir? (I already know you told me a lready before)

[adamlui]

GM_cookie is a sensitive permission that can affect users, so I believe it is necessary to bring it to users’ attention, regardless of what it is actually used for.

You're not listening, do you know how cookies work. They store passwords etc., if I delete it I didn't hack them but improved their UX, and now you're bizarrely fighting like this is a bad thing, like you're not understanding there are different ways to "bring it to users’ attention" like not warn them or use yellow that's crazy for deleting cookie only, like your site makes no sense at all you fake all the stats then let the cheaters win I'm starting to really hate Chinese people sorry just copying and faking all the time

[adamlui]

Did you know, when gf owner made his site (when userscripts.org closed) I had a big hand in making it blow up (I was in a supergroup of MTurk hackers, that was the 1st type of script to attract evergreen traffic, becausew we chose him over his competitor openuserjs.org, compare the sites if you don't understand, which one is more popular, then my ChatGPT ones helped brand it as an AI destination 10y later, then I left and now look there is no chatgpt.com match traffic anymore:

Do you see. Used to be thousands of daily downloads. Even #4 is a pirated clone of my most popular one, proving what a big difference happened when I left. You're still 20s maybe inexperienced and can't see the future as easily or understand what evergreen traffic means, but me stopping helping you (let alone competing) is a big L long-term...

[CodFrm]

I don’t know what you mean when you say that I copied you, or what you mean by “AI summaries.” If I accept a suggestion you made, you say that I copied you; if I don’t accept it, you say that I am treating you as an enemy. In that situation, I honestly don’t know what else to say.

I know what GM_cookie does, and I understand that you use it to delete cookies. However, other scripts may use the same permission to access or steal sensitive user information. An automated system cannot reliably determine whether a script is acting maliciously or using the permission for a legitimate purpose, so I believe users should be made aware of it. This is not intended as a punishment against you or your script.

Honestly, I don’t want to argue about anything unrelated to the feature itself.

If you think a feature is inappropriate but my view is different, you can convince me, or I can convince you through discussion, instead of bringing unrelated matters into it.

[adamlui]

I don’t know what you mean when you say that I copied you, or what you mean by “AI summaries.”

You copy many features from me (don't act surprised you are not alone, I have thousands of stalkers) for example, few days after I added AI summaries to chatgpt.js, you added the same thing to your site. Another example, everything became color coded after I color coded everything in my projects. (I don't care I'm numb to it, I only bring it up for perspective, like you are copying from me yet fighting me)

If I accept a suggestion you made, you say that I copied you; if I don’t accept it, you say that I am treating you as an enemy

Nope, suggestions are not copies, only copies are copies, suggestion is brought up to show you only those are voluntary contributions (i.e. stop copying everything you see against people's permissions it's not nice just bad karma)

I know what GM_cookie does, and I understand that you use it to delete cookies. However, other scripts may use the same permission to access or steal sensitive user information.

So you only make it yellow for the ones sending the cookies IN A NETWORK REQUEST (or using .set() which is not stealing but tracking them)

An automated system cannot reliably determine whether a script is acting maliciously or using the permission for a legitimate purpose, so I believe users should be made aware of it.

You don't need to determine malice only the val was sent in a payload via outbound network request (if they're not being sent out or written, no malice can technically occur)

This is not intended as a punishment against you or your script.

Your intentions don't matter only the effect does (you are punishing authors of useful features, what does intention have to do with it)

Honestly, I don’t want to argue about anything unrelated to the feature itself.

Then don't do it sir, I bring up you copy me just to show you perspective only not argue (pretend I copy you a lot to improve my site, I would need reminder to stop punishing you even if unintentional)

If you think a feature is inappropriate but my view is different, you can convince me, or I can convince you through discussion, instead of bringing unrelated matters into it.

Nothing I brought was unrelated, are you threatening me sir?

[adamlui]

I'm not complaining about your copying. You're allowed to copy me. You're allowed to deny it (but looks very unbelievable to the public, there is a saying "fool me once" meaning when the same "coincidence" happens again and again, people understand they're not stupid). I only mention it to remind you, I'm the last person you should try to fight, it's just really bad karma for this reason of you copy me a lot (i.e. it's not like I'm some random user, then step on him all you want because they are not contributors, involuntary or not)

[CodFrm]

I wasn't aware of any of this. I don't use either ChatGPT or YouTube. Around that time, I was already adding a number of features to the website. The project is open source, so you can review the development history here: https://github.com/scriptscat/scriptlist-frontend

Before this, I wasn't even aware of your script, so any similarities are purely coincidental.

[adamlui]

What script?