safebrowsing-notes.md

Safe Browsing Update API (v4) affords fetching Safe Browsing lists for local usage. https://developers.google.com/safe-browsing/v4/update-api

General idea is to make a client of that API, which manages keeping updated and affording checking functionality.

Two main ways to go about making the client:

Server

• have a centralized server run as the API client, managing it's own lists
• expose bulk URL check endpoint which extensions can request to

Pros:

• can use the existing Go client: https://github.com/google/safebrowsing
• only need to keep server updated; single source of truth
• could be set-up as a opt-in checkbox in the ext

Cons:

• imports calcs time may be signficantly impacted (network request)
• server needs to be able to handle a lot of checks and scale with user growth

In-extension

• write our own API client for the browser (probably as a separate project to Memex)
• checking would happen in-extension, no network requests to check

Pros:

• fast; no network req
• no need to worry about maintaining another server

Cons:

• non-trivial; see Go client for bit of an idea of project size
• less control; extensions not all guaranteed to have same lists
• not convinced about feasibility: users would have to supply their own Google dev API keys (def opt-in feature)

Both ways would also need to implement some way of regularly updating to keep in-sync with Google's API.