3 ms·
> Just read the source code if you don't trust it. No, that doesn't really work for Chrome extensions - they can silently auto-update, and will no longer match
by mappu 8y ago
> Just read the source code if you don't trust it.
No, that doesn't really work for Chrome extensions - they can silently auto-update, and will no longer match the published source.
It's just barely possible to run the extension directly from the source code - you either need to put up with popup warnings every single time you open the browser, or, need to install an entirely separate developer version of Chrome.
Certainly most people here aren't doing that.
> change style information on .github.com
It would be an improvement, but it turns out stylesheets can be used for malicious data exfiltration anyway (see parent).
- creatonez 8y ago>No, that doesn't really work for Chrome extensions - they can silently auto-update, and will no longer match the published source. As much as I hate Google, this is exactly how most people use free software linux distributions. The only difference is the barrier of entry for new/updated software. >need to install an entirely separate developer version of Chrome Heh, I'd probably expect anyone who audits all of the software they use to already be using chromium.
- mappu 8y agoThe salient difference is that bribing Google or Red Hat is practically impossible (a hypothetical billion-dollar exercise reserved for state actors); whereas bribing Chrome extension developers is definitely not hypothetical, maybe even commonplace (e.g. some friends were hit by https://www.ghacks.net/2013/12/26/hoverzooms-malware-controversy-imagus-alternative/ https://www.ghacks.net/2013/12/26/hoverzooms-malware-controv... ). For high-value targets, like full access to a software developer's private github repos, there's definitely an economic incentive to do this.