3 ms·

It would not be about detecting the change of hands but about detecting the (malicious) monetization. Depending on the type of extension this might still be har

It would not be about detecting the change of hands but about detecting the (malicious) monetization. Depending on the type of extension this might still be hard to do, but I could well imagine heuristics triggering a manual check from the extension store providers.

londons_explore 7y ago
With many extensions having hundreds of thousands of lines of minified code, a manual check is unlikely to find anything nefarious if it's been well hidden.
- geofft 7y ago
  IMO, extension authors should not be allowed to submit minified code alone to the extension stores for review. (Options include having standard minifiers that the extension stores run themselves, allowing extension authors to provide a .travis.yml or something where the sources to the build pipeline are themselves auditable, etc.) I can see an argument for withholding source from end users for things like paid extensions or clients to proprietary services (to be clear, I wouldn't agree with such arguments but I can see them), but I don't see the argument for withholding source from the browser manufacturers themselves. Put another way, if the browser manufacturers run an extension store, they are (or ought to, at least) endorse the extensions in that store as reasonable to install. I don't see how they can do that without source. I think they could sort of make that endorsement without proactive auditing if they can remove extensions they discover are malicious, but if they can't even human-audit the source in response to a report of problems, I don't think there's any way they can responsibly offer extensions to their users.
  - wolco 7y ago
    Minified code is easy to beautify. More important what side effects the extensoon does.
  - zaarn 7y ago
    IIRC Mozilla requires that you submit unminified code plus the minified code and how you compiled it, so they can reproduce it durign review. And they do Human Reviews using Volunteers. Mozilla does a lot to protect users from malicious extensions, thousands times more than Google.

londons_explore 7y ago

With many extensions having hundreds of thousands of lines of minified code, a manual check is unlikely to find anything nefarious if it's been well hidden.

geofft 7y ago
IMO, extension authors should not be allowed to submit minified code alone to the extension stores for review. (Options include having standard minifiers that the extension stores run themselves, allowing extension authors to provide a .travis.yml or something where the sources to the build pipeline are themselves auditable, etc.) I can see an argument for withholding source from end users for things like paid extensions or clients to proprietary services (to be clear, I wouldn't agree with such arguments but I can see them), but I don't see the argument for withholding source from the browser manufacturers themselves. Put another way, if the browser manufacturers run an extension store, they are (or ought to, at least) endorse the extensions in that store as reasonable to install. I don't see how they can do that without source. I think they could sort of make that endorsement without proactive auditing if they can remove extensions they discover are malicious, but if they can't even human-audit the source in response to a report of problems, I don't think there's any way they can responsibly offer extensions to their users.
- wolco 7y ago
  Minified code is easy to beautify. More important what side effects the extensoon does.
- zaarn 7y ago
  IIRC Mozilla requires that you submit unminified code plus the minified code and how you compiled it, so they can reproduce it durign review. And they do Human Reviews using Volunteers. Mozilla does a lot to protect users from malicious extensions, thousands times more than Google.