> are the existing addons downloading and using server-provided JS? One would hope not, but that's hardly a safe assumption these days This reminds me of a ver

> are the existing addons downloading and using server-provided JS? One would hope not, but that's hardly a safe assumption these days This reminds me of a very brief security review I did of a 3rd-party browser extension that was being installed on everybody's laptop at a previous job. The extension itself had very little code, it was just something that bootstrapped with code from the company's servers. There was no real way to review it or freeze a reviewed version. The kicker was that the server-provided JS was being loaded over plain http (and no, nothing was checking signatures or anything like that).