16 ms·

I've always wondered what happens if a browser extension gets taken over by an entity someday that puts in bad code after millions of people have it installed a

by ck2 11y ago

I've always wondered what happens if a browser extension gets taken over by an entity someday that puts in bad code after millions of people have it installed and it gets auto-updated. Sure it's open-source and will get noticed eventually, but there will be days if not weeks of exposure. Same thing for all those android apps you have installed. If it doesn't add permissions, you'll never get a warning that something has really changed.

huntermeyer 11y ago
I'm placing 80% of my bet on Google (Alphabet). The remaining 20% on Yahoo.
- ck2 11y ago
  Didn't get that for a moment, you mean you think Google or Yahoo bought the very product that blocks their income? Despite all the alternatives that can be installed instantly?
  - cmcnally 11y ago
    Adblock does not block Google ads by default.
    - hullo 11y ago
      by Google ads do you mean ads on Google? Or AdSense ads placed across the web (AFS? AFC?)? or do you mean AdSense + Doubleclick (DFA, DFP, ...) + AdExchange + AdMob + I could go on for a long while. Bottom line is google, more than anyone else, has a lot of skin in this game.
- eli 11y ago
  oh who purchased the plugin? I'll take the other side of both those bets.
redredred 11y ago
http://www.pcworld.com/article/2089580/spammers-buy-chrome-extensions-and-turn-them-into-adware.html http://www.pcworld.com/article/2089580/spammers-buy-chrome-e...
makecheck 11y ago
That's what's funny about some of our security mechanisms today...for instance the browser tries to help you ensure that this is the site you really meant to reach but it has no information about whether the site is under "new management" (which you tend to care about for something like a restaurant). Maybe companies should be mandated to update their key stores every time they change their board members, say, so that the old keys are revoked and you must take some action to "approve" of the new people running the company.
- shabble 11y ago
  It'd also be kinda neat if you could somehow tag your trust conditional on a content hash of the service's ToC or Privacy Policy. It'd be rather impractical in today's world, although maybe machine readable policy formats would make matching easier additions/deletions of key items rather than just a text hash. Balancing the user effort of reading and flagging each policy term (and considering all the weird implications of each change) vs the utility of being notified would be tricky though. Maybe some sort of collaborative/curated lists of 'substantial T&C changes' similar to adblocker filterlists could be produced? (Or maybe they already are?)
bzbarsky 11y ago
This is why Mozilla addon updates get reviewed before getting pushed out to users. It's not foolproof, but it's designed to at least have a chance of catching this sort of issue.
- ck2 11y ago
  If you think a mozilla review is good enough, you are going to be disappointed. Pretty easy to do code obfuscation that a human will miss and automated testing will have no idea how to handle.
ycitera 11y ago
This is one reason why Google should stop asking you to update all software automatically (and they are asking you, what seems like, multiple times a day?).
shwetank 11y ago
With the [Opera addons catalog](https://addons.opera.com https://addons.opera.com), every update goes through a moderation process to prevent this kind of situation from happening (which is one of the reasons why we encourage everyone to install extensions from the official addons catalog site rather than from other sources).

by ck2 11y ago

huntermeyer 11y ago

I'm placing 80% of my bet on Google (Alphabet). The remaining 20% on Yahoo.

ck2 11y ago
Didn't get that for a moment, you mean you think Google or Yahoo bought the very product that blocks their income? Despite all the alternatives that can be installed instantly?
- cmcnally 11y ago
  Adblock does not block Google ads by default.
  - hullo 11y ago
    by Google ads do you mean ads on Google? Or AdSense ads placed across the web (AFS? AFC?)? or do you mean AdSense + Doubleclick (DFA, DFP, ...) + AdExchange + AdMob + I could go on for a long while. Bottom line is google, more than anyone else, has a lot of skin in this game.
eli 11y ago
oh who purchased the plugin? I'll take the other side of both those bets.

redredred 11y ago

http://www.pcworld.com/article/2089580/spammers-buy-chrome-extensions-and-turn-them-into-adware.html http://www.pcworld.com/article/2089580/spammers-buy-chrome-e...

makecheck 11y ago

That's what's funny about some of our security mechanisms today...for instance the browser tries to help you ensure that this is the site you really meant to reach but it has no information about whether the site is under "new management" (which you tend to care about for something like a restaurant). Maybe companies should be mandated to update their key stores every time they change their board members, say, so that the old keys are revoked and you must take some action to "approve" of the new people running the company.

shabble 11y ago
It'd also be kinda neat if you could somehow tag your trust conditional on a content hash of the service's ToC or Privacy Policy. It'd be rather impractical in today's world, although maybe machine readable policy formats would make matching easier additions/deletions of key items rather than just a text hash. Balancing the user effort of reading and flagging each policy term (and considering all the weird implications of each change) vs the utility of being notified would be tricky though. Maybe some sort of collaborative/curated lists of 'substantial T&C changes' similar to adblocker filterlists could be produced? (Or maybe they already are?)

bzbarsky 11y ago

This is why Mozilla addon updates get reviewed before getting pushed out to users. It's not foolproof, but it's designed to at least have a chance of catching this sort of issue.

ck2 11y ago
If you think a mozilla review is good enough, you are going to be disappointed. Pretty easy to do code obfuscation that a human will miss and automated testing will have no idea how to handle.

ycitera 11y ago

This is one reason why Google should stop asking you to update all software automatically (and they are asking you, what seems like, multiple times a day?).

shwetank 11y ago

With the [Opera addons catalog](https://addons.opera.com https://addons.opera.com), every update goes through a moderation process to prevent this kind of situation from happening (which is one of the reasons why we encourage everyone to install extensions from the official addons catalog site rather than from other sources).