8 ms·

So the solution is to give the extension access to your banking site? Doesn't seem ideal. Extension permissions still can't block an extension from making netw

So the solution is to give the extension access to your banking site? Doesn't seem ideal. Extension permissions still can't block an extension from making network requests if they have access to a site, right? (Not implying this extension does something nefarious, but more the general risk of such extensions especially when we hear that sometimes extensions get sold or their authors accounts get compromised...)

alexvoda 4y ago
I completely agree. At least on Firefox there is an extension that restores right click and it is open source. If you want to be extra sure you can audit the code and package it yourself. This on the other hand appears to be closed source. Even if it is benign now, there is no telling when it might be sold and new owners may have more nefarious intentions.
- lapcat 4y ago
  > Even if it is benign now, there is no telling when it might be sold and new owners may have more nefarious intentions. I'll never betray the trust of my users, and anyway it's not going to be sold. Nobody has ever made me an offer, and it's unlikely that anyone could afford to acquire it. The extension is worth more to me as an indie dev than it would be worth to anyone else.
  - withinboredom 4y ago
    Just playing Devil’s Advocate. This is your thoughts right now. If a real tangible offer came through for 10s of millions of dollars, would you still feel that way? What about when you die or become permanently offline for some other reason? Will your family sell it to the lowest bidder, delist it, or just leave it to bit rot? These are things everyone has to/should consider when granting software unfettered access to their machine.
    - lapcat 4y ago
      > Just playing Devil’s Advocate. You could just ask me questions without associating yourself with Satan. ;-) > If a real tangible offer came through for 10s of millions of dollars, would you still feel that way? I would definitely sell for 10s of millions of dollars! Indeed, I would sell for 1 million dollars. But nobody is going to offer me that LOL. > Will your family sell it to the lowest bidder, delist it, or just leave it to bit rot? They would have to leave it to "bit rot", because my source code is encrypted, and nobody else has my passwords. (The extension has no server component and should continue working fine indefinitely with no updates.)
      - withinboredom 4y ago
        One of my friends got offered 8 million for an extension a few years ago. The new owners put malware in it. Meanwhile, he’s still sailing around the Mediterranean on his yacht with his family… This is exactly the kind of thing people are worried about.
        lapcat 4y ago
        > One of my friends got offered 8 million for an extension a few years ago. The new owners put malware in it. Which extension? Was this in the news? There aren't actually that many really big extensions.
        withinboredom 4y ago
        I’ve been asked not to share the name. It wasn’t a big extension though, only a few million installs. FWIW, they put it up for sale as a lark, not intending to actually sell it, on some business sales/acquisitions/mergers site and got more than their asking price.
        lapcat 4y ago
        > I’ve been asked not to share the name. Asked by whom? Your (hopefully former?) friend who sold out millions of people for malware? Are those millions of people aware that they were infected with malware? Not sure how this can be a secret. > It wasn’t a big extension though, only a few million installs. That's big! Apparently there are only 300some Chrome extensions with over a million users. https://www.debugbear.com/blog/counting-chrome-extensions https://www.debugbear.com/blog/counting-chrome-extensions My user base is orders of magnitude less, so I wouldn't worry about my selling out for $millions.
sys_64738 4y ago
> So the solution is to give the extension access to your banking site? Doesn't seem ideal. I use a dedicated browser for all types of banking as you can't be too careful. Also, I don't run any extension on it for this same reason of being careful.
- lapcat 4y ago
  > you can't be too careful I think you actually can. ;-) There's a difference between being prudent and living in fear. The former is of course good, but the latter can make someone miss out on a lot of good things in life. Including good software.
- aaaaaaaaata 4y ago
  Same. I use GrapheneOS profiles for this.
lapcat 4y ago
You should definitely vet the developer before you install any software. I stake my reputation on my software, as a professional Mac developer for over 15 years. I'm pretty well known in that community, and my extension has also been well reviewed by the press.
- aaaaaaaaata 4y ago
  I was with you right until the end.
  - lapcat 4y ago
    Would you rather install unknown software that hasn't been reviewed?
    - rajamaka 4y ago
      I think it was probably moreso the mention of "press" as the reviewers.
      - lapcat 4y ago
        What's the alternative? Of course recommendations from friends are the best, but professional software reviews in the news media are 100% more reliable than anonymous crowdsourced App Store reviews, which are easily faked or purchased, and even when they aren't fake, they're often totally ignorant. I find it very sad that there are fewer software reviews in the news media now than there used to be. This makes it much more difficult for developers to get discovered.
        aaaaaaaaata 4y ago
        Discovery isn't the problem with these tools — it's trust. I don't trust MacRumors or PC World to vet...anything. I do sorta trust...I dunno...EFF. Bunnie. yadda yadda.
        4y ago

alexvoda 4y ago

I completely agree. At least on Firefox there is an extension that restores right click and it is open source. If you want to be extra sure you can audit the code and package it yourself. This on the other hand appears to be closed source. Even if it is benign now, there is no telling when it might be sold and new owners may have more nefarious intentions.

lapcat 4y ago
> Even if it is benign now, there is no telling when it might be sold and new owners may have more nefarious intentions. I'll never betray the trust of my users, and anyway it's not going to be sold. Nobody has ever made me an offer, and it's unlikely that anyone could afford to acquire it. The extension is worth more to me as an indie dev than it would be worth to anyone else.
- withinboredom 4y ago
  Just playing Devil’s Advocate. This is your thoughts right now. If a real tangible offer came through for 10s of millions of dollars, would you still feel that way? What about when you die or become permanently offline for some other reason? Will your family sell it to the lowest bidder, delist it, or just leave it to bit rot? These are things everyone has to/should consider when granting software unfettered access to their machine.
  - lapcat 4y ago
    > Just playing Devil’s Advocate. You could just ask me questions without associating yourself with Satan. ;-) > If a real tangible offer came through for 10s of millions of dollars, would you still feel that way? I would definitely sell for 10s of millions of dollars! Indeed, I would sell for 1 million dollars. But nobody is going to offer me that LOL. > Will your family sell it to the lowest bidder, delist it, or just leave it to bit rot? They would have to leave it to "bit rot", because my source code is encrypted, and nobody else has my passwords. (The extension has no server component and should continue working fine indefinitely with no updates.)
    - withinboredom 4y ago
      One of my friends got offered 8 million for an extension a few years ago. The new owners put malware in it. Meanwhile, he’s still sailing around the Mediterranean on his yacht with his family… This is exactly the kind of thing people are worried about.
      - lapcat 4y ago
        > One of my friends got offered 8 million for an extension a few years ago. The new owners put malware in it. Which extension? Was this in the news? There aren't actually that many really big extensions.
        withinboredom 4y ago
        I’ve been asked not to share the name. It wasn’t a big extension though, only a few million installs. FWIW, they put it up for sale as a lark, not intending to actually sell it, on some business sales/acquisitions/mergers site and got more than their asking price.
        lapcat 4y ago
        > I’ve been asked not to share the name. Asked by whom? Your (hopefully former?) friend who sold out millions of people for malware? Are those millions of people aware that they were infected with malware? Not sure how this can be a secret. > It wasn’t a big extension though, only a few million installs. That's big! Apparently there are only 300some Chrome extensions with over a million users. https://www.debugbear.com/blog/counting-chrome-extensions https://www.debugbear.com/blog/counting-chrome-extensions My user base is orders of magnitude less, so I wouldn't worry about my selling out for $millions.

sys_64738 4y ago

> So the solution is to give the extension access to your banking site? Doesn't seem ideal. I use a dedicated browser for all types of banking as you can't be too careful. Also, I don't run any extension on it for this same reason of being careful.

lapcat 4y ago
> you can't be too careful I think you actually can. ;-) There's a difference between being prudent and living in fear. The former is of course good, but the latter can make someone miss out on a lot of good things in life. Including good software.
aaaaaaaaata 4y ago
Same. I use GrapheneOS profiles for this.

lapcat 4y ago

You should definitely vet the developer before you install any software. I stake my reputation on my software, as a professional Mac developer for over 15 years. I'm pretty well known in that community, and my extension has also been well reviewed by the press.

aaaaaaaaata 4y ago
I was with you right until the end.
- lapcat 4y ago
  Would you rather install unknown software that hasn't been reviewed?
  - rajamaka 4y ago
    I think it was probably moreso the mention of "press" as the reviewers.
    - lapcat 4y ago
      What's the alternative? Of course recommendations from friends are the best, but professional software reviews in the news media are 100% more reliable than anonymous crowdsourced App Store reviews, which are easily faked or purchased, and even when they aren't fake, they're often totally ignorant. I find it very sad that there are fewer software reviews in the news media now than there used to be. This makes it much more difficult for developers to get discovered.
      - aaaaaaaaata 4y ago
        Discovery isn't the problem with these tools — it's trust. I don't trust MacRumors or PC World to vet...anything. I do sorta trust...I dunno...EFF. Bunnie. yadda yadda.
        4y ago