3 ms·

How much time on average do you spend on reviewing the source code of a given browser extension before you install it? Also, how do you make sure that the publi

• qlk1123 6y ago
  Why did this post get downvoted? they are fair enough questions to "given enough eyeballs, all bugs are shallow", especially for browser plugins.
  • rezonant 6y ago
    Yeah I'd go as far as to say "How are you sure that open code is what's in the actual package" is the most important question to ask here.
    • fsflover 6y ago
      https://reproducible-builds.org https://reproducible-builds.org
• someperson 6y ago
  You don't need to do a thorough code review to benefit from the source code: the Chrome/Chromium web browser allows the user to load unpacked extensions directly from any folder. So simply git clone the extension, have a quick look at the recently opened (and closed) issues/PRs for any red flags, git checkout the most recent tag, and load it as unpacked. Then you are guaranteed to have the source code of exactly the extension you're running, and have done a reasonable amount due diligence for malware. And if you're interested at any point in the future you can do a code review. It's a simple strategy. Here's an example: https://github.com/igrigorik/videospeed https://github.com/igrigorik/videospeed