3 ms·

And how do you know the browser plugin source code have not changed?

danShumway 8y ago
In Firefox you can turn off updates for individual plugins, so you only need to trust Mozilla and the extension author once. Chrome is currently looking into getting rid of the ability for extension authors to obfuscate code -- minification is the highest level of obfuscation they'll accept now, and (opinion me) minified Javascript code is not that hard to read. Chrome does still need to get on the "let people turn off automatic updates" train though. But I'm not sure what to tell you about that -- you should not be running Chrome as your main browser anyway if you care about security/privacy. I'm not sure if Mozilla is planning to follow suite on blocking obfuscation. Assuming they are, if you don't trust the extension author even for the initial download, install the extension, read through the source code natively on your own computer, and then set it to not update after that point. It would be better if you could download the unminified/unbundled source code and install the extension yourself locally, but for whatever reason Firefox and Chrome have decided that's insecure. I feel the opposite, since requiring signed extensions makes it harder for me to audit code or place additional safeguards around that code, but... eh, what do I know? In any case, the current situation for extensions on Firefox is not all that different from installing something in a standard software repository.
- O_H_E 8y ago
  >if you could download the unminified/unbundled source code and install the extension yourself locally Do you mean for a proprietary extension? AFAIK loading sources locally works fine in chrome.
  - danShumway 8y ago
    In Firefox, loading unsigned extensions is severely restricted. It's a separate process to install them, and they'll only last until you restart the browser. I'm not sure what Chrome's specific rules are; I think they allow loading local sources in dev mode, but warn you about it every time the browser launches? I generally advise people to avoid Chrome if they care about security/privacy anyway, so I've never checked in detail. But if Chrome does have a way for you to easily load extensions from source, and you're comfortable using it as a main browser, that could be a valid way for you to tackle a problem like this.
    - O_H_E 8y ago
      Interesting to see Mozilla restricting freedom that given their userbase.

In Firefox you can turn off updates for individual plugins, so you only need to trust Mozilla and the extension author once. Chrome is currently looking into getting rid of the ability for extension authors to obfuscate code -- minification is the highest level of obfuscation they'll accept now, and (opinion me) minified Javascript code is not that hard to read. Chrome does still need to get on the "let people turn off automatic updates" train though. But I'm not sure what to tell you about that -- you should not be running Chrome as your main browser anyway if you care about security/privacy. I'm not sure if Mozilla is planning to follow suite on blocking obfuscation. Assuming they are, if you don't trust the extension author even for the initial download, install the extension, read through the source code natively on your own computer, and then set it to not update after that point. It would be better if you could download the unminified/unbundled source code and install the extension yourself locally, but for whatever reason Firefox and Chrome have decided that's insecure. I feel the opposite, since requiring signed extensions makes it harder for me to audit code or place additional safeguards around that code, but... eh, what do I know? In any case, the current situation for extensions on Firefox is not all that different from installing something in a standard software repository.

O_H_E 8y ago
>if you could download the unminified/unbundled source code and install the extension yourself locally Do you mean for a proprietary extension? AFAIK loading sources locally works fine in chrome.
- danShumway 8y ago
  In Firefox, loading unsigned extensions is severely restricted. It's a separate process to install them, and they'll only last until you restart the browser. I'm not sure what Chrome's specific rules are; I think they allow loading local sources in dev mode, but warn you about it every time the browser launches? I generally advise people to avoid Chrome if they care about security/privacy anyway, so I've never checked in detail. But if Chrome does have a way for you to easily load extensions from source, and you're comfortable using it as a main browser, that could be a valid way for you to tackle a problem like this.
  - O_H_E 8y ago
    Interesting to see Mozilla restricting freedom that given their userbase.