3 ms·
This really implies that the whole idea of chrome extensions is broken: a mix of attempted malware and adware. It seems like they should be more carefully sand
by bobm_kite9 5y ago
This really implies that the whole idea of chrome extensions is broken: a mix of attempted malware and adware.
It seems like they should be more carefully sandboxed in some way.
Are there any proposals for fixing this?
- tomComb 5y agoAll new extensions are manually vetted now, and there is manifest v3, but there has been a lot of concern about the effect of this on adblockers so progress has been slow.
- dataflow 5y agoHow is manual vetting supposed to prevent malicious updates? Are all updates vetted?
- geofft 5y agoMost of the work that the Chrome folks have been doing on web extensions recently has specifically been to make finer-grained APIs to do the sorts of things extensions do without giving them full access to edit pages etc. For instance, see the new "Declarative Net Request" API, which allows you to specify certain transformations on requests in JSON, like blocking them if they match a regex, without knowing what the request is: https://blog.chromium.org/2019/06/web-request-and-declarative-net-request.html https://blog.chromium.org/2019/06/web-request-and-declarativ... In theory, this allows you to implement things like ad blockers without having high levels of access to the user's browsing behavior. In practice, it's very hard to make these APIs complete enough.
- notsureaboutpg 5y agoGoogle should fund popular extensions and label them as "Trusted, Secured by Google" etc. Easy fix. Then when people ask to buy the extensions or inject updates the developer won't (be allowed to) accept.