3 ms·
How can you verify that your extension actually runs the code that's in the open source repository? Extensions' integrity can be signed and verified against som
by randunel 5y ago
How can you verify that your extension actually runs the code that's in the open source repository?
Extensions' integrity can be signed and verified against something that was also authored by the creator, but what verifies that the code in the linked repository is the same one, not a different one?
- forgotmypw17 5y agoI think you can build it yourself and install that?
- robbedpeter 5y agoChecksums are super useful, too - if you build the project yourself, you can get the checksum, and if it's different than the one in the store, you can ask questions. A web of trust style checksum confirmation network would be invaluable for browser extensions. Building that into a browser's security model would be great - an extension has to be validated with a minimum score or it's disabled unless manually activated.
- deleted 5y ago[deleted]