5 ms·
The author mentions that Chrome Extensions are a bad distribution method. I think he is wrong. First, there are more users of Chrome Extensions than the users o
by codedokode 9y ago
The author mentions that Chrome Extensions are a bad distribution method. I think he is wrong. First, there are more users of Chrome Extensions than the users of npm, second, most of them don't care what those extensions send over the network. And I guess CSP doesn't apply to browser extensions.
So if you want to steal passwords, make some extension like "Mp3 Youtube Downloader" or "Ad Blocker" and get access to millions of happy users' browsers.
CSP looks like an ugly hack rather than a good solution. Why would you need to specify allowed sources for scripts if you control your HTML code? I don't understand why the author praises it. What a stupid time-wasting technology.
- throwaway2048 9y agoyou dont always control your html due to XSS and CSRF.
- dkersten 9y ago> CSP look like an ugly hack rather than a good solution ... I don’t understand why the author praises it. Because it appears to be the ONLY solution to the problem described, unless you never use any third party code that you didn’t build from source and audit.
- prh8 9y agoI think you misunderstand the role of NPM in this concept. Using NPM ensures that web sites distribute the code to their users. So it doesn't matter if there's only a few hits using NPM, if they are good hits. As the article mentions, neither Amazon nor eBay are protecting against this. If they somehow added the package to their app, that provides access to every credit card added to those sites. That is much broader than user's installing Chrome extensions.