4 ms·

I might need some advice here. So, are you saying no one should ever build another browser extension? Or browser extensions can be built but no one should ever

I might need some advice here. So, are you saying no one should ever build another browser extension? Or browser extensions can be built but no one should ever use any of them? Is this specific to browser extensions only or is it applicable to every software being built currently?

TekMol 9y ago
Depends on the type of software and the trust you have in the vendor. Every type of software gives a different amount of control to the software vendor. A browser extension is a master key to all of the users web activity. I would never hand out that amount of control to a software vendor I don't know.
- PradeepKumar721 9y ago
  Regarding the master key part, it probably makes sense. May be this is the reason why IE does not have extensions. But browser vendors like Google, Mozilla and Opera know this even before I came to know what privacy on web is. Chrome extensions served from it's web store are analyzed by Google. Firefox and Opera extensions are code reviewed before they go into their stores. All these web stores combined, there are millions of browser extensions and billions of people are using on day to day basis. So can't we trust browser vendors' efforts in this case? And if I start a startup and develop some software, how can any user trust me on day one without using the software I developed? I am just curious to know
  - TekMol 9y ago
    Chrome extensions served from it's web store are analyzed by Google. Analyzed how? As far as I know, many have malware in them: http://lifehacker.com/many-browser-extensions-have-become-adware-or-malware-1505117457 http://lifehacker.com/many-browser-extensions-have-become-ad... https://kjaer.io/extension-malware/ https://kjaer.io/extension-malware/ Firefox and Opera extensions are code reviewed before they go into their stores. That approach might be better. I wouldn't trust them to find everything all the time though. An extension only has to somehow hide a "load external code and execute it" function to get around it. That could be just one line of code. And it might be obfuscated and spread throughout the codebase in clever ways. how can any user trust me Make a web app. Web apps are way less dangerous.
    - PradeepKumar721 9y ago
      Gotcha. Thankyou

TekMol 9y ago

Depends on the type of software and the trust you have in the vendor. Every type of software gives a different amount of control to the software vendor. A browser extension is a master key to all of the users web activity. I would never hand out that amount of control to a software vendor I don't know.

PradeepKumar721 9y ago
Regarding the master key part, it probably makes sense. May be this is the reason why IE does not have extensions. But browser vendors like Google, Mozilla and Opera know this even before I came to know what privacy on web is. Chrome extensions served from it's web store are analyzed by Google. Firefox and Opera extensions are code reviewed before they go into their stores. All these web stores combined, there are millions of browser extensions and billions of people are using on day to day basis. So can't we trust browser vendors' efforts in this case? And if I start a startup and develop some software, how can any user trust me on day one without using the software I developed? I am just curious to know
- TekMol 9y ago
  Chrome extensions served from it's web store are analyzed by Google. Analyzed how? As far as I know, many have malware in them: http://lifehacker.com/many-browser-extensions-have-become-adware-or-malware-1505117457 http://lifehacker.com/many-browser-extensions-have-become-ad... https://kjaer.io/extension-malware/ https://kjaer.io/extension-malware/ Firefox and Opera extensions are code reviewed before they go into their stores. That approach might be better. I wouldn't trust them to find everything all the time though. An extension only has to somehow hide a "load external code and execute it" function to get around it. That could be just one line of code. And it might be obfuscated and spread throughout the codebase in clever ways. how can any user trust me Make a web app. Web apps are way less dangerous.
  - PradeepKumar721 9y ago
    Gotcha. Thankyou