3 ms·

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source c

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock Plus. Could other extensions access sensitive information? I'm not sure, but I hate not being able to see the source code of apps which need so many permissions.

mcdevilkiller 6y ago
Given the reputation of ABP, I'd be worried too.
mafuy 6y ago
Re AdblockPlus, I can recommend Ublock Origin instead. The UBO developer (Raymond Hill) repeatedly chose ethical behavior over money.
leonroy 6y ago
Alas the Great Suspender just fell prey to malware after its creator sold it off: https://news.ycombinator.com/item?id=25846504 https://news.ycombinator.com/item?id=25846504 I think Apple have the right idea with app review on browser extensions for Safari.
- teddyh 6y ago
  I hear that a lot of companies are doing unethical things. Maybe the government should only grant corporations to form which are headed by approved people? /s
  - emayljames 6y ago
    Not a bad idea, even if sarcastic.
- josho 6y ago
  The other nice thing about Safari’s approach is that for common extension functionality it is just a set of rules that are executed. So no malware can be run because extension code isn’t actually reading the dom. Nor does it have access to load remote resources.
tonyedgecombe 6y ago
At least with LastPass you know they have a commercial model and reputation to incentivise better behaviour. If you download something that is free then that pressure doesn't exist.
- asiachick 6y ago
  have you read their privacy policy? They layout they can spy on everything and share with anyone they want. You'd think if they were serious about privacy their privacy policy would just say "we spy on nothing and collect nothing and share with no one". 1password effectively has that privacy policy, lastpass does not. https://www.logmeininc.com/legal/privacy/us https://www.logmeininc.com/legal/privacy/us https://1password.com/jp/legal/privacy/ https://1password.com/jp/legal/privacy/
- deleted 6y ago
  [deleted]
martin_a 6y ago
AdBlock Plus is owned by a company who is selling ads. Use uBlock Origin instead, please.
- martin_a 6y ago
  To be more precise: You can pay them to get your ads listed as "acceptable ads" which will then pass the filter rules of ABP. Would be a real shame if some software would block your ads because you didn't want to pay, wouldn't it?
oauea 6y ago
> I wish the browser vendors supported some kind of pinning to source code for open source extensions. Chrome used to. You used to be able to just download the source code of an extension, point Chrome at it, and done you are. Well, you still can. But Chrome will CONSTANTLY nag you about it and try to forget you added that extension using source, like it's some vile crime. They removed it because of "security", which is a hilarious reason because it just made everything so much worse.

mcdevilkiller 6y ago

Given the reputation of ABP, I'd be worried too.

mafuy 6y ago

Re AdblockPlus, I can recommend Ublock Origin instead. The UBO developer (Raymond Hill) repeatedly chose ethical behavior over money.

leonroy 6y ago

Alas the Great Suspender just fell prey to malware after its creator sold it off: https://news.ycombinator.com/item?id=25846504 https://news.ycombinator.com/item?id=25846504 I think Apple have the right idea with app review on browser extensions for Safari.

teddyh 6y ago
I hear that a lot of companies are doing unethical things. Maybe the government should only grant corporations to form which are headed by approved people? /s
- emayljames 6y ago
  Not a bad idea, even if sarcastic.
josho 6y ago
The other nice thing about Safari’s approach is that for common extension functionality it is just a set of rules that are executed. So no malware can be run because extension code isn’t actually reading the dom. Nor does it have access to load remote resources.

tonyedgecombe 6y ago

At least with LastPass you know they have a commercial model and reputation to incentivise better behaviour. If you download something that is free then that pressure doesn't exist.

asiachick 6y ago
have you read their privacy policy? They layout they can spy on everything and share with anyone they want. You'd think if they were serious about privacy their privacy policy would just say "we spy on nothing and collect nothing and share with no one". 1password effectively has that privacy policy, lastpass does not. https://www.logmeininc.com/legal/privacy/us https://www.logmeininc.com/legal/privacy/us https://1password.com/jp/legal/privacy/ https://1password.com/jp/legal/privacy/
deleted 6y ago
[deleted]

martin_a 6y ago

AdBlock Plus is owned by a company who is selling ads. Use uBlock Origin instead, please.

martin_a 6y ago
To be more precise: You can pay them to get your ads listed as "acceptable ads" which will then pass the filter rules of ABP. Would be a real shame if some software would block your ads because you didn't want to pay, wouldn't it?

oauea 6y ago

> I wish the browser vendors supported some kind of pinning to source code for open source extensions. Chrome used to. You used to be able to just download the source code of an extension, point Chrome at it, and done you are. Well, you still can. But Chrome will CONSTANTLY nag you about it and try to forget you added that extension using source, like it's some vile crime. They removed it because of "security", which is a hilarious reason because it just made everything so much worse.