3 ms·
Slightly orthogonal to this, but I feel like extension stores vendors should create some sort of open standard to let the community check the source code and ve
by jakub_g 7y ago
Slightly orthogonal to this, but I feel like extension stores vendors should create some sort of open standard to let the community check the source code and verify code in source repo is the same as uploaded to the extension store. It could work like this:
- source code must be in a public git repo (github, gitlab etc.)
- some config file is inside the repo which describes how the extension is built
- the store in question either builds and uploads the extension itself via the config file, or at least verifies that submitted file is identical to the output of the build (the upload needs to provide a name of git tag/sha1 used for the build)
- (some Travis CI/Circle CI integration could be used for the above perhaps)
- if the verification is fine, the store displays a badge "verified opensource build" (wording to be decided) + a link to the given git tag
- "verify opensource build" option works like 2FA: when extension author enables it, they can't disable anymore later
- once uploaded, there's a regular check (nightly? weekly?) that the git repo is still up and the latest used git tag still exists and points to same sha1; and that the commit pointed to by the git tag is merged into `master`
It doesn't solve the issue of blatantly malicious extensions, but it prevents (or makes it harder) for good ones to become malicious (after change of owner etc), and hopefully shortens review times for those extensions' updates.
The problem is that extension stores don't care if extensions are opensource or not. Probably most are not.
- diego_moita 7y agoWell, technically anyone can have access to Chrome/Firefox extensions source. They're just zipped files with javascript & html content.
- jakub_g 7y agoYes, but you then need to unzip it, perhaps unminify code, find github repo yourself, and diff all the stuff manually. If the extension is complex and the original source undergoes a massive complex build step, making sure that final bundle is functionally the same as the code in github is the work few people want to do. I don't want to do it (especially not for every update), hence I don't install extensions except absolutely necessary ones. If I had more trust in this, I'd be more keen to install niche exceptions.
- seanwilson 7y agoFor what it's worth, you can install a Chrome extension into a Chrome profile that is different from your regular one to isolate it from your data. For example, I have one Chrome profile I use for web development (where lots of development extensions need wide ranging permissions) and another for personal email + banking.
- lovasoa 7y agoNowadays, the javascript files often come minified, as the result of a build process. I think only the original files used for compilation can be considered as the "source" of the extension.
- byte1918 7y agoI guess he means before you install the extension.
- gorhill 7y ago> source code must be in a public git repo (github, gitlab etc.) > > some config file is inside the repo which describes how the extension is built There is an extension which allows to review the code of other extensions, CRX Viewer[1]. You just need to visit an extension installation page and the CRX Viewer icon becomes available. You can beautify the code, search for a string/regex through all files, etc. * * * [1] https://github.com/Rob--W/crxviewer https://github.com/Rob--W/crxviewer