6 ms·

Is there anything here that doesn't generalize effectively to a case for preventing the user from installing arbitrary software on their own devices ?

kgwxd 7y ago
Yes, all of it. The title is actually "The Case for Limiting Your Browser Extensions" and it suggest the user should limit them, not that the browser vendor should restrict what is allowed. The current HN title made me jump to that conclusion as well.
- seemslegit 7y ago
  But the entire article is a demonstration that most users don't have the ability to do meaningful due diligence on their extensions, and even then they are helpless when the ownership changes hands to nefarious actors.
  - danShumway 7y ago
    I'm not sure I agree. Krebs doesn't end this article saying that extension stores should lock down what they're offering. He ends it with a user-centric call to action: that users must do meaningful due diligence, that they should be highly conservative about installing extensions where they haven't vetted the authors, and that they should pay special attention to how extensions change over time. I'm pretty biased in this area, so I lean towards a certain worldview and interpretation. But having said that, another way to look at this article is as a repudiation of centralized, vendor-controlled moderation in general. Moderation has utterly failed to remove malware from browser extensions. The only way to keep yourself safe is with personal diligence. You can't trust Google or Mozilla to do it for you. When Krebbs of all people is saying that they're often too nervous to install extensions from these stores -- that means the store security is not working. That means that locking down devices/software has not made us safe.
    - 6510 7y ago
      I would call it the security by unplugging your computer argument. If google claims to review extensions they should do it and be held accountable. If it gets to hard for them they should develop better API's.
    - seemslegit 7y ago
      He's making this case against one of the least gate-kept stores in the ecosystem and is writing this from the perspective of the power user, and it is obvious to him and you (and me for that matter ) that users due diligence is non-substitutable, but in a corporate vendor context whether of a browser or OS this effectively makes a case for an ios-style walled garden and ripping the inherent benefits of revenue and ecosystem control.
      - danShumway 7y ago
        I won't dispute that a vendor could walk away with that conclusion. I will dispute that they'd be correct to do so. I suspect that everything I'm about to say is just violently agreeing with you, and every point I'm about to make is already obvious both to you and to most of the people on HN. But it's still worth saying -- if you can't protect advanced users, you can't protect normal users. A technical user is (usually) going to be safer about what they install than a normal user, they're going to recognize weird software behavior, they're going to react more quickly to threats, and be less prone to doing dumb things because a random website told them to. Making power users like Krebbs feel safe is the minimum bar. Krebbs should be the easiest person in the world to secure, because they're already being careful. So if Krebb's isn't willing to install software, then the security model is utterly broken, not just for power users but for everyone. I think there's some value in attacking app store monopolies from that angle -- pointing out that they're not just a threat to user freedom, they're also security theater. They don't work. Whether or not Krebbs actually got that point across effectively... :shrug:
  - Causality1 7y ago
    Frankly I'd be in favor of a piece of regulatory legislation requiring that all software which features an automatic update mechanism be required by law to inform their users of a change in ownership and obtain affirmative consent to begin receiving new versions from the new owner.
    - sneak 7y ago
      I don’t think the solution to “sometimes computers get malware” are laws requiring prior restraint on creative expression. Not the smallest hurdle there would be that it’s unconstitutional in the United States.
      - Causality1 7y ago
        Changing owners invalidates the EULA agreement, no?
        usr1106 7y ago
        Have you read one? I wouldn't be suprised if the lawyers have thought about that, and mention current or future owner of... The 3 or so extensions I have installed did not bring up an EULA.
    - Mirioron 7y ago
      This seems like a good idea to me. Maybe have some kind of a clause that this notification has to be easily understood by the user so that it won't be hidden in a wall of text.
    - TeMPOraL 7y ago
      I'd be in favor of a piece of regulation that requires the extension declare its scope of behavior (e.g. "no analytics", or "no data exfiltration"), and then any automatic update that breaks this declaration means the developer is subject to fines and/or imprisonment. Most of the extension problems boil down to either a) malicious developers, and b) developers of popular extensions which take money to include malicious functionality, or sell the extension to a third party.

kgwxd 7y ago

Yes, all of it. The title is actually "The Case for Limiting Your Browser Extensions" and it suggest the user should limit them, not that the browser vendor should restrict what is allowed. The current HN title made me jump to that conclusion as well.

seemslegit 7y ago
But the entire article is a demonstration that most users don't have the ability to do meaningful due diligence on their extensions, and even then they are helpless when the ownership changes hands to nefarious actors.
- danShumway 7y ago
  I'm not sure I agree. Krebs doesn't end this article saying that extension stores should lock down what they're offering. He ends it with a user-centric call to action: that users must do meaningful due diligence, that they should be highly conservative about installing extensions where they haven't vetted the authors, and that they should pay special attention to how extensions change over time. I'm pretty biased in this area, so I lean towards a certain worldview and interpretation. But having said that, another way to look at this article is as a repudiation of centralized, vendor-controlled moderation in general. Moderation has utterly failed to remove malware from browser extensions. The only way to keep yourself safe is with personal diligence. You can't trust Google or Mozilla to do it for you. When Krebbs of all people is saying that they're often too nervous to install extensions from these stores -- that means the store security is not working. That means that locking down devices/software has not made us safe.
  - 6510 7y ago
    I would call it the security by unplugging your computer argument. If google claims to review extensions they should do it and be held accountable. If it gets to hard for them they should develop better API's.
  - seemslegit 7y ago
    He's making this case against one of the least gate-kept stores in the ecosystem and is writing this from the perspective of the power user, and it is obvious to him and you (and me for that matter ) that users due diligence is non-substitutable, but in a corporate vendor context whether of a browser or OS this effectively makes a case for an ios-style walled garden and ripping the inherent benefits of revenue and ecosystem control.
    - danShumway 7y ago
      I won't dispute that a vendor could walk away with that conclusion. I will dispute that they'd be correct to do so. I suspect that everything I'm about to say is just violently agreeing with you, and every point I'm about to make is already obvious both to you and to most of the people on HN. But it's still worth saying -- if you can't protect advanced users, you can't protect normal users. A technical user is (usually) going to be safer about what they install than a normal user, they're going to recognize weird software behavior, they're going to react more quickly to threats, and be less prone to doing dumb things because a random website told them to. Making power users like Krebbs feel safe is the minimum bar. Krebbs should be the easiest person in the world to secure, because they're already being careful. So if Krebb's isn't willing to install software, then the security model is utterly broken, not just for power users but for everyone. I think there's some value in attacking app store monopolies from that angle -- pointing out that they're not just a threat to user freedom, they're also security theater. They don't work. Whether or not Krebbs actually got that point across effectively... :shrug:
- Causality1 7y ago
  Frankly I'd be in favor of a piece of regulatory legislation requiring that all software which features an automatic update mechanism be required by law to inform their users of a change in ownership and obtain affirmative consent to begin receiving new versions from the new owner.
  - sneak 7y ago
    I don’t think the solution to “sometimes computers get malware” are laws requiring prior restraint on creative expression. Not the smallest hurdle there would be that it’s unconstitutional in the United States.
    - Causality1 7y ago
      Changing owners invalidates the EULA agreement, no?
      - usr1106 7y ago
        Have you read one? I wouldn't be suprised if the lawyers have thought about that, and mention current or future owner of... The 3 or so extensions I have installed did not bring up an EULA.
  - Mirioron 7y ago
    This seems like a good idea to me. Maybe have some kind of a clause that this notification has to be easily understood by the user so that it won't be hidden in a wall of text.
  - TeMPOraL 7y ago
    I'd be in favor of a piece of regulation that requires the extension declare its scope of behavior (e.g. "no analytics", or "no data exfiltration"), and then any automatic update that breaks this declaration means the developer is subject to fines and/or imprisonment. Most of the extension problems boil down to either a) malicious developers, and b) developers of popular extensions which take money to include malicious functionality, or sell the extension to a third party.