4 ms·

Is there a good browser plugin that tracks changes to sources of js files? That way you could mark certain sources as trusted, but whenever they change, they wo

Is there a good browser plugin that tracks changes to sources of js files? That way you could mark certain sources as trusted, but whenever they change, they would be blocked until you mark them as trusted again.

O_H_E 8y ago
But how is it going to know the authentic source?
- fredley 8y ago
  The source doesn't matter, only the content. If the hash of the file matches the hash you've already approved for jquery-3.3, then the file is (unless someone's found a collision in the hashing algorithm that hasn't been disclosed) jquery-3.3.
  - sprt 8y ago
    I think what they meant is how do you identify the authentic content the first time around?
    - throwaway899 8y ago
      By manually reviewing the said file or by trusting a central authority of some sort.
fredley 8y ago
This would be really neat, and not that hard to build from what I know about building extensions. Basically just store a hash of file, whenever external files are loaded see if their hash exists in your list, if not block it from loading until it's been reviewed. As an extra (paid-for?) feature hook into an online system that keeps track of hashes of known-good popular libs, and can mark as untrusted when a vulnerability is found with a version of e.g. jQuery and auto-flag that for users.
paraditedc 8y ago
And how do you know the browser plugin source code have not changed?
- danShumway 8y ago
  In Firefox you can turn off updates for individual plugins, so you only need to trust Mozilla and the extension author once. Chrome is currently looking into getting rid of the ability for extension authors to obfuscate code -- minification is the highest level of obfuscation they'll accept now, and (opinion me) minified Javascript code is not that hard to read. Chrome does still need to get on the "let people turn off automatic updates" train though. But I'm not sure what to tell you about that -- you should not be running Chrome as your main browser anyway if you care about security/privacy. I'm not sure if Mozilla is planning to follow suite on blocking obfuscation. Assuming they are, if you don't trust the extension author even for the initial download, install the extension, read through the source code natively on your own computer, and then set it to not update after that point. It would be better if you could download the unminified/unbundled source code and install the extension yourself locally, but for whatever reason Firefox and Chrome have decided that's insecure. I feel the opposite, since requiring signed extensions makes it harder for me to audit code or place additional safeguards around that code, but... eh, what do I know? In any case, the current situation for extensions on Firefox is not all that different from installing something in a standard software repository.
  - O_H_E 8y ago
    >if you could download the unminified/unbundled source code and install the extension yourself locally Do you mean for a proprietary extension? AFAIK loading sources locally works fine in chrome.
    - danShumway 8y ago
      In Firefox, loading unsigned extensions is severely restricted. It's a separate process to install them, and they'll only last until you restart the browser. I'm not sure what Chrome's specific rules are; I think they allow loading local sources in dev mode, but warn you about it every time the browser launches? I generally advise people to avoid Chrome if they care about security/privacy anyway, so I've never checked in detail. But if Chrome does have a way for you to easily load extensions from source, and you're comfortable using it as a main browser, that could be a valid way for you to tackle a problem like this.
deleted 8y ago
[deleted]

O_H_E 8y ago

But how is it going to know the authentic source?

fredley 8y ago
The source doesn't matter, only the content. If the hash of the file matches the hash you've already approved for jquery-3.3, then the file is (unless someone's found a collision in the hashing algorithm that hasn't been disclosed) jquery-3.3.
- sprt 8y ago
  I think what they meant is how do you identify the authentic content the first time around?
  - throwaway899 8y ago
    By manually reviewing the said file or by trusting a central authority of some sort.

fredley 8y ago

This would be really neat, and not that hard to build from what I know about building extensions. Basically just store a hash of file, whenever external files are loaded see if their hash exists in your list, if not block it from loading until it's been reviewed. As an extra (paid-for?) feature hook into an online system that keeps track of hashes of known-good popular libs, and can mark as untrusted when a vulnerability is found with a version of e.g. jQuery and auto-flag that for users.

paraditedc 8y ago

And how do you know the browser plugin source code have not changed?

danShumway 8y ago
In Firefox you can turn off updates for individual plugins, so you only need to trust Mozilla and the extension author once. Chrome is currently looking into getting rid of the ability for extension authors to obfuscate code -- minification is the highest level of obfuscation they'll accept now, and (opinion me) minified Javascript code is not that hard to read. Chrome does still need to get on the "let people turn off automatic updates" train though. But I'm not sure what to tell you about that -- you should not be running Chrome as your main browser anyway if you care about security/privacy. I'm not sure if Mozilla is planning to follow suite on blocking obfuscation. Assuming they are, if you don't trust the extension author even for the initial download, install the extension, read through the source code natively on your own computer, and then set it to not update after that point. It would be better if you could download the unminified/unbundled source code and install the extension yourself locally, but for whatever reason Firefox and Chrome have decided that's insecure. I feel the opposite, since requiring signed extensions makes it harder for me to audit code or place additional safeguards around that code, but... eh, what do I know? In any case, the current situation for extensions on Firefox is not all that different from installing something in a standard software repository.
- O_H_E 8y ago
  >if you could download the unminified/unbundled source code and install the extension yourself locally Do you mean for a proprietary extension? AFAIK loading sources locally works fine in chrome.
  - danShumway 8y ago
    In Firefox, loading unsigned extensions is severely restricted. It's a separate process to install them, and they'll only last until you restart the browser. I'm not sure what Chrome's specific rules are; I think they allow loading local sources in dev mode, but warn you about it every time the browser launches? I generally advise people to avoid Chrome if they care about security/privacy anyway, so I've never checked in detail. But if Chrome does have a way for you to easily load extensions from source, and you're comfortable using it as a main browser, that could be a valid way for you to tackle a problem like this.

deleted 8y ago

[deleted]