3 ms·

I'm not sure I agree. Krebs doesn't end this article saying that extension stores should lock down what they're offering. He ends it with a user-centric call to

I'm not sure I agree. Krebs doesn't end this article saying that extension stores should lock down what they're offering. He ends it with a user-centric call to action: that users must do meaningful due diligence, that they should be highly conservative about installing extensions where they haven't vetted the authors, and that they should pay special attention to how extensions change over time. I'm pretty biased in this area, so I lean towards a certain worldview and interpretation. But having said that, another way to look at this article is as a repudiation of centralized, vendor-controlled moderation in general. Moderation has utterly failed to remove malware from browser extensions. The only way to keep yourself safe is with personal diligence. You can't trust Google or Mozilla to do it for you. When Krebbs of all people is saying that they're often too nervous to install extensions from these stores -- that means the store security is not working. That means that locking down devices/software has not made us safe.

6510 7y ago
I would call it the security by unplugging your computer argument. If google claims to review extensions they should do it and be held accountable. If it gets to hard for them they should develop better API's.
seemslegit 7y ago
He's making this case against one of the least gate-kept stores in the ecosystem and is writing this from the perspective of the power user, and it is obvious to him and you (and me for that matter ) that users due diligence is non-substitutable, but in a corporate vendor context whether of a browser or OS this effectively makes a case for an ios-style walled garden and ripping the inherent benefits of revenue and ecosystem control.
- danShumway 7y ago
  I won't dispute that a vendor could walk away with that conclusion. I will dispute that they'd be correct to do so. I suspect that everything I'm about to say is just violently agreeing with you, and every point I'm about to make is already obvious both to you and to most of the people on HN. But it's still worth saying -- if you can't protect advanced users, you can't protect normal users. A technical user is (usually) going to be safer about what they install than a normal user, they're going to recognize weird software behavior, they're going to react more quickly to threats, and be less prone to doing dumb things because a random website told them to. Making power users like Krebbs feel safe is the minimum bar. Krebbs should be the easiest person in the world to secure, because they're already being careful. So if Krebb's isn't willing to install software, then the security model is utterly broken, not just for power users but for everyone. I think there's some value in attacking app store monopolies from that angle -- pointing out that they're not just a threat to user freedom, they're also security theater. They don't work. Whether or not Krebbs actually got that point across effectively... :shrug:

6510 7y ago

I would call it the security by unplugging your computer argument. If google claims to review extensions they should do it and be held accountable. If it gets to hard for them they should develop better API's.

seemslegit 7y ago

He's making this case against one of the least gate-kept stores in the ecosystem and is writing this from the perspective of the power user, and it is obvious to him and you (and me for that matter ) that users due diligence is non-substitutable, but in a corporate vendor context whether of a browser or OS this effectively makes a case for an ios-style walled garden and ripping the inherent benefits of revenue and ecosystem control.

danShumway 7y ago
I won't dispute that a vendor could walk away with that conclusion. I will dispute that they'd be correct to do so. I suspect that everything I'm about to say is just violently agreeing with you, and every point I'm about to make is already obvious both to you and to most of the people on HN. But it's still worth saying -- if you can't protect advanced users, you can't protect normal users. A technical user is (usually) going to be safer about what they install than a normal user, they're going to recognize weird software behavior, they're going to react more quickly to threats, and be less prone to doing dumb things because a random website told them to. Making power users like Krebbs feel safe is the minimum bar. Krebbs should be the easiest person in the world to secure, because they're already being careful. So if Krebb's isn't willing to install software, then the security model is utterly broken, not just for power users but for everyone. I think there's some value in attacking app store monopolies from that angle -- pointing out that they're not just a threat to user freedom, they're also security theater. They don't work. Whether or not Krebbs actually got that point across effectively... :shrug: