5 ms·
I build my own personal Chrome extensions to be used only by myself and I treat them as potentially malware every single time I type `npm install`. If I built a
by dataviz1000 5y ago
I build my own personal Chrome extensions to be used only by myself and I treat them as potentially malware every single time I type `npm install`. If I built an extension to share, I would likely make it completely with vanilla JavaScript.
- welder 5y agoYes, for open source extensions that don't update often I load them unpacked from my local filesystem.
- trutannus 5y agoOne approach would be to intercept your own traffic with Fiddler as a proxy for a few hours after installing and look for any nefarious requests. This is a pretty effective way to run a basic security audit.
- kortilla 5y agoOnly effective against ones that don’t have activation criteria.
- londons_explore 5y agoUsually the activation criteria will be "Contact this server and see what it tells me to do". An extension developer ought to know the exact purpose of every network request their extension makes, so inspecting network logs is indeed a good plan. Just remember there are ways to detect if the developer tools panel is open...
- ceejayoz 5y ago> Usually the activation criteria will be "Contact this server and see what it tells me to do". Right, but it could be set up to only do that starting six months after installation or something.
- trutannus 5y agoYep, but it's a good start. Why I called it a "basic audit".