4 ms·
It's even open-source [0], makes me feel better since I'm quite paranoid when it comes to chrome extensions. [0] https://github.com/kholid060/automa https://gi
by jedimind 5y ago
It's even open-source [0], makes me feel better since I'm quite paranoid when it comes to chrome extensions.
[0] https://github.com/kholid060/automa https://github.com/kholid060/automa
- schleck8 5y agoAnd rightfully so
- Ginden 5y agoBrowser extension stores should be more transparent about open source and licensing. And probably they should collaborate with CI providers - eg. make contract with GitHub to sign artifacts with "these files were built using following pipeline from commit XYZ in repository JohnSmith/UserBase".
- randunel 5y agoHow can you verify that your extension actually runs the code that's in the open source repository? Extensions' integrity can be signed and verified against something that was also authored by the creator, but what verifies that the code in the linked repository is the same one, not a different one?
- forgotmypw17 5y agoI think you can build it yourself and install that?
- robbedpeter 5y agoChecksums are super useful, too - if you build the project yourself, you can get the checksum, and if it's different than the one in the store, you can ask questions. A web of trust style checksum confirmation network would be invaluable for browser extensions. Building that into a browser's security model would be great - an extension has to be validated with a minimum score or it's disabled unless manually activated.
- deleted 5y ago[deleted]