4 ms·
This is the reason. The code does look for a specific appname that is present on all medium blogs before running the code. If this were a closed source extensio
by jhot 9y ago
This is the reason. The code does look for a specific appname that is present on all medium blogs before running the code. If this were a closed source extension I would worry about it, but since it's open source you can verify it's not doing anything malicious. That said, I think I will copy the source and turn it into a user script so I don't have to install another extension.
- kiliankoe 9y agoCan one verify if the published source is the same as the published extension?
- Denvercoder9 9y agoYes, Chrome extensions are just packaged code. No compiling or anything necessary.
- kentonv 9y agoHowever, Chrome will automatically update the extension. Things that could go wrong: * The author could wake up in a bad mood one day and decide to push a malicious update. * The author's computer could be compromised, and someone could steal the signing keys and publish a malicious version of the extension. * The author could get bored of the extension and transfer ownership to someone who offers to maintain it for them, but who turns out to be malicious. * The author could be in need of some cash and could decide to accept one of the many offers they no doubt get from shady parties to buy their extension. I'm sure the author of this extension would never do any of these things... but I'm not sure enough to risk it. :/
- hota_mazi 9y agoOpen/close source is not going to help you here: nothing stops a malicious author from publishing one version open source while publishing the malicious one. The only way to find out is to run the extension in Chrome and inspect it with the debugger.