> On the other hand, blindly accepting browser extension upgrades is a huge security vulnerability. That argument can be applied to any software, being allowed

> On the other hand, blindly accepting browser extension upgrades is a huge security vulnerability. That argument can be applied to any software, being allowed to run code on your devices comes not just with the freedom, but also the risks. I don't think restricting people's freedoms is the right way to somewhat reduce the occurrence of malware. > There was a post some time ago about how popular extension projects often get bought by adware/spyware companies and they were able to publish malicious changes directly to user's browsers without any validation. I think you're referring to one of my blog posts. :) https://news.ycombinator.com/item?id=20587440 https://news.ycombinator.com/item?id=20587440 https://armin.dev/blog/2019/08/supporting-browser-extension-developers/ https://armin.dev/blog/2019/08/supporting-browser-extension-...