"Cookies" permission warning wrong

[adamlui]

This is a re-open of unresolved #72

Cookie permission is wrongly showing yellow for scripts that are only usefully deleting them

Fix is ONLY apply yellow if .set or val is included in payload of outbound request, otherwise leave alone as blue because there's nothing potentially dangerous to warn about

[adamlui]

I don’t think this means the script is being labeled as malicious. Like an antifeature label, it is intended to alert users.

By your own admission it is being lableled as potentially so ("High-risk permission — install with caution" @ #72 (comment)), not outright, but let's try to solve this st ep by step. Do you agree deleting cookies is not dangerous yes or no

If a script were actually malicious, it would be marked in red or removed.

Why would you mark scripts red instead of deletig them???? Also show me an example so I believe you (if you're lying yet again that means visitors can only see blue vs. yellow so yellow is very alarming penalty for honest scripts)

[CodFrm]

I don’t think this means the script is being labeled as malicious. Like an antifeature label, it is intended to alert users.

By your own admission it is being lableled as potentially so, not outright, but let's try to solve this st ep by step. Do you agree deleting cookies is not dangerous yes or no

I agree that deleting and setting cookies is not dangerous, and in this case, I can display it in blue.

However, the list operation poses a risk of cookie leakage, and I believe it should be marked in yellow to warn users.

If a script were actually malicious, it would be marked in red or removed.

Why would you mark scripts red instead of deletig them????

I'm referring to malicious scripts, such as those using GM_cookie.list to steal user cookies.

What I mean here is that malicious scripts should be deleted. Only blue and yellow tags should be displayed; red tags shouldn't exist and should be deleted outright. Please ignore this paragraph; perhaps my wording is incorrect.

[adamlui]

However, the list operation poses a risk of cookie leakage, and I believe it should be marked in yellow to warn users.

But cookies can't "leak" w/o network requests, I'm saying it is crazy to just make it yellow for listing cookies just for deletion, so you need logic to detect if these vals (i keep saying this over and over and over until it sinks in) are actually sent in outbound requests otheriwse there's literally and technically 0% of risk not the untrue high-risk warning you're scaring my users away with

[adamlui]

..and then this logic will auto-color yellow if next update, auithor adds network request, even if for legit purpose, then it is correctly yelow since technically he can perform maliec w/ the collected data if he wants (but before then, it is incorrectly yellow since it's not technically possible w/ list alone and no network requests)

[adamlui]

(my keybaord is scuffed i hope translation is fixing the typos)

[CodFrm]

However, the list operation poses a risk of cookie leakage, and I believe it should be marked in yellow to warn users.

But cookies can't "leak" w/o network requests, I'm saying it is crazy to just make it yellow for listing cookies just for deletion, so you need logic to detect if these vals (i keep saying this over and over and over until it sinks in) are actually sent in outbound requests otheriwse there's literally and technically 0% of risk not the untrue high-risk warning you're scaring my users away with

But how to detect it? There doesn't seem to be any good technical means.

For example, after retrieving GM_cookie.list, the cookies could be sent out via XHR/fetch or XSS.

These aren't easy to detect, although this is exaggerated.

[adamlui]

I know that I gave you the list of keywords to find already #72 (comment)

To fix, only make it yellow if (.list && exfil) || (.set) where exfil means the val got "exfiltrated" i.e. left the browser via network request (fetch, XHR, GM_xmlhttpRequest, GM.xmlHttpRequest, then you detect if the val was in the payload, otherwise there's no reason for concern)

--

These aren't easy to detect, although this is exaggerated.

THis is not an exaggeration that you are warning users of my hard work it is potentially "highly risky"

[adamlui]

I'm not gonna write the code for you but if I make my own site you can just copy it from there (but hopefully you start giving credit like evn the @ChinaGodMan started to do even though he calls us yankees)

[adamlui]

Also you can close this Issue again if you don't care because I am not your boss and you are the sole earner from your site not me so why should you listen to me, only your feelings matter

[CodFrm]

To fix, only make it yellow if (.list && exfil) || (.set) where exfil means the val got "exfiltrated" i.e. left the browser via network request (fetch, XHR, GM_xmlhttpRequest, GM.xmlHttpRequest, then you detect if the val was in the payload, otherwise there's no reason for concern)

How to detect "exfil"?

This is difficult.

Or we could change the color/style to remind the user.

[adamlui]

I really don't want to tell you how to code it because i don't feel comfortable given you are consistently denying stealing from me despite the timeline clearly shows you are stalking me + all the other design changes like the colors etc., so I leave this Issue up to you to fix or close it again if you want to be selfish but I will not be helping you sorry (had you apologized or even admitted it, then our relationship would be much different, your future would've even been spectacular, instead you are treating others as stupid to think you can trick them it is some "coincidence" on the same exact days the same exact features are being copied and you even lied and pretended "I do not know what AI summaries are" which is what thieves say when you obviously do know what they are, so I do not like to reward liars like that, you a really habitual liar bad to do business w/ people like that my last business partner was same way, also equally bad at lying, now he is struggling in life, he used to even be kinda famous even Google punished him now, maybe one day you will change who knows, but til that day I can't reward you w/ written code)

[adamlui]

Imagine I kept copying your code or feats. Then I ask you, "how to solve this technical problem becaues it is 'difficult'." What would you tell me? Why would you care how hard it is? Always think from other people's sides instead of be selfish to understand mysterious actions (some people are born w/ more empathy it is not controllable, but you can stlll actively make up for it by imagining the other side, so that much is controllable, and then an extreme example, the psychopaths that kill ppl etc. were born w/o the empathy so cannot feel victims' pain and choose not to control it because it feels too good that way, so i'm teaching you you can control being so crass and dishonest by start imagining what the other person feels otherwise it's like heading down the same path as killers w/ no feelings)

[adamlui]

THe gf owner is an old man I think (I was 20s when he made it) is why he doesn't care the site is dying btw (probably has wife and kids and wants to play) but you are not old yet strangely taking this situation for granted (or most likely, you don't understand which yo uadmitted already where new US traffic originates) is why you're not scared that I compete w/ a new US site (also I know why TM beats your extension but I'm not gonna teach you why, it's not just the code other obvious reasons are involved but to anyone that looks hard enough, you just don't care + take things for granted to look i.e it's like you're slowly becoming GF owner, the very guy you wanted to go against)

[adamlui]

Also I'm curious for my own reasons, if there are ants or flies in the house, do you try to push them out or smush them (normal people do both ways just curious)

[CodFrm]

Please stop making unsupported accusations of plagiarism. This has become absurd.

These are not the same type of feature:

• KudoAI/chatgpt.js PR #615 adds a CLI option that reads a local text file and sends its entire contents to an AI with the prompt Summarize the following file.
• ScriptCat commit 4b20a25 introduces an AI-assisted script review system. It produces review results, reasons, risk signals, tags, and a summary that may be displayed on a script page.

They solve different problems and have different implementations. The only superficial similarity is the generic concept and word “summary.”

You also previously cited issue #598, which was created on May 29 with no description beyond its title. The actual implementation was submitted and merged in PR #615 on June 2. ScriptCat’s public implementation commit was made on June 1.

If timestamps alone constituted proof, the same reasoning could just as easily be used to accuse you of copying ScriptCat. I am not making that accusation, because chronology alone does not prove access, copying, or causation.

Unless you can identify specific copied code, text, assets, or a distinctive implementation, please stop calling me a thief or a liar. I genuinely have no desire to continue participating in this ridiculous farce.