4 ms·

Having just started on creating chrome extensions recently: a) I was surprised that they don't require access to the source code in order to review. I wrote ev

Having just started on creating chrome extensions recently: a) I was surprised that they don't require access to the source code in order to review. I wrote everything using typescript and uploaded the packed/obfuscated output, which wasn't a problem at all. I'm sure they have software that unpacks and attempts to detect hazardous patterns, but clearly humans are not actually trying to understand the code's structure. It would be a low bar to require well commented source code (and even to require certain coding conventions) to make extension code more reviewable. Want to be on our platform? Write it this way. Show us the source. b) On the flip side, trying to do anything interesting requires adding permission after permission to the manifest, which of course results in the scary messaging at install time. While you're asked to justify each permission when you upload, as far as I'm aware extension authors have to provide their own copy to end users attempting to explain permissions - I've certainly never seen it as an end user when installing an extension. Including these explanations either in the initial install dialog, or on first usage of each permission, would be beneficial. Of course this would require that extension reviewers verify the usage of each of the permissions, but since they're universally accessed through the chrome api, they should be easy to spot in the source (and #a would help this significantly).

apozem 3y ago
Mozilla does (a). I just published my first Firefox extension and they require a zip of un-obfuscated source code if you minify or bundle in any way.
- eviks 3y ago
  how do they verify it's the same as the bundled version? does it affect updates as well?
  - gorhill 3y ago
    They require to provide all the details of how the code was minified/bundled so that they probably try to reproduce the resulting code on their side, and if there is a mismatch you will not pass review.
- StayTrue 3y ago
  How does this work? Do they publish your minified/bundled code and trust it’s a direct derivation of the un-obfuscated zip provided for review?
  - palant 3y ago
    Note: I am the author of this article. Yes, Mozilla doesn’t publish the source code. Back when I was reviewing add-ons there (a long time ago), I did compile the supplied source and compared it with the submitted one. It was sometimes awkward when the tool in question didn’t produce reproducible builds but mostly ok.
    - teddyh 3y ago
      Diffoscope should help with that nowadays.
  - 3np 3y ago
    Another Mozilla requirement is reproducible builds. This enables the to verify that a build from the supplied sources matches the release bit-by-bit.
  - pabs3 3y ago
    Hopefully they try to automatically reproduce the build and reject when it fails: https://reproducible-builds.org/ https://reproducible-builds.org/
ocdtrekkie 3y ago
It's shockingly easy to baffle automated security with a bit of obfuscation. I saw a phishing page a few weeks ago which evaded detection by base64encode(htmlencode(maliciouscontent)) and having the browser decode it on load with JavaScript. The security software identified it immediately out of my Notepad++ draft decoding it... Unfortunately Google believes their scale means having a human involved in anything is unacceptable, which is why the Chrome Web Store will eternally be the leading source of malware for computers.
- smallerfish 3y ago
  > Unfortunately Google believes their scale means having a human involved in anything is unacceptable Yeah, I mean they've had a solid 14 years to give it a fair shot, and have evidently failed. Browser authors are unhappy, moderately technical users are suspicious, and unaware users can get taken advantage of. Even a moderate pay-per-review fee would be a cut above the current situatioin.
  - Avamander 3y ago
    Which would kill small indie extensions that are harmless but keeps the profitable affiliate malware ones. The boring truth is that automation or not, it's difficult. Manifest v3 in some aspects improves the situation (but it's not that great). It would certainly be more trustworthy if they'd add identity verification. eIDAS makes it low-cost to implement in the EU. At least it'd require a new malicious company or person willing to taint their name to continue operations.
    - smallerfish 3y ago
      > Which would kill small indie extensions that are harmless but keeps the profitable affiliate malware ones. Any indie extension that has an audience could get a donor base, but yeah - smaller first-time extensions that only underwent automated review could either fly unlisted / or with a non-"blue-star", or even with an "unverified" banner. The small fee could make looping humans into the loop relatively revenue neutral, and increase the chance of detection of stuff like this. The more misses by the automated system, the more the platform suffers, and the less chance any of us have of getting users.
frou_dh 3y ago
Paying qualified people to audit code would not exactly be cheap. Needs to be done every time the extension is updated too.
- neom 3y ago
  Isn't that why publishing verified code re: Apple costs $99/$299? (I actually have no clue, I just presumed that's part of why you pay Apple, to verify your code?)
  - cj 3y ago
    Chrome requires a $5 fee to submit chrome extensions. 1 time fee that's non-recurring.
  - frou_dh 3y ago
    Well we're talking about source code here. Apple has no expectation that applications for their platforms are open-source and so they don't get to see the source code either. Scanning of the binaries, "Notarization", Developer ID signing and all that stuff is something different.
    - neom 3y ago
      Got it, then I guess in the Apple instance I mean "confirm it's not malicious"? But sure, Apple and Oranges. BTW, I checked out the video in your bio a couple of days ago, absolutely fantastic! Thanks for the recommendation.
      - frou_dh 3y ago
        Oh, great. Makes me happy to catch people with it :)
    - supriyo-biswas 3y ago
      Apple uses some combination of static analysis and manual reviews for applications, unfortunately I don't have a reputable source to link right now.

apozem 3y ago

Mozilla does (a). I just published my first Firefox extension and they require a zip of un-obfuscated source code if you minify or bundle in any way.

eviks 3y ago
how do they verify it's the same as the bundled version? does it affect updates as well?
- gorhill 3y ago
  They require to provide all the details of how the code was minified/bundled so that they probably try to reproduce the resulting code on their side, and if there is a mismatch you will not pass review.
StayTrue 3y ago
How does this work? Do they publish your minified/bundled code and trust it’s a direct derivation of the un-obfuscated zip provided for review?
- palant 3y ago
  Note: I am the author of this article. Yes, Mozilla doesn’t publish the source code. Back when I was reviewing add-ons there (a long time ago), I did compile the supplied source and compared it with the submitted one. It was sometimes awkward when the tool in question didn’t produce reproducible builds but mostly ok.
  - teddyh 3y ago
    Diffoscope should help with that nowadays.
- 3np 3y ago
  Another Mozilla requirement is reproducible builds. This enables the to verify that a build from the supplied sources matches the release bit-by-bit.
- pabs3 3y ago
  Hopefully they try to automatically reproduce the build and reject when it fails: https://reproducible-builds.org/ https://reproducible-builds.org/

ocdtrekkie 3y ago

It's shockingly easy to baffle automated security with a bit of obfuscation. I saw a phishing page a few weeks ago which evaded detection by base64encode(htmlencode(maliciouscontent)) and having the browser decode it on load with JavaScript. The security software identified it immediately out of my Notepad++ draft decoding it... Unfortunately Google believes their scale means having a human involved in anything is unacceptable, which is why the Chrome Web Store will eternally be the leading source of malware for computers.

smallerfish 3y ago
> Unfortunately Google believes their scale means having a human involved in anything is unacceptable Yeah, I mean they've had a solid 14 years to give it a fair shot, and have evidently failed. Browser authors are unhappy, moderately technical users are suspicious, and unaware users can get taken advantage of. Even a moderate pay-per-review fee would be a cut above the current situatioin.
- Avamander 3y ago
  Which would kill small indie extensions that are harmless but keeps the profitable affiliate malware ones. The boring truth is that automation or not, it's difficult. Manifest v3 in some aspects improves the situation (but it's not that great). It would certainly be more trustworthy if they'd add identity verification. eIDAS makes it low-cost to implement in the EU. At least it'd require a new malicious company or person willing to taint their name to continue operations.
  - smallerfish 3y ago
    > Which would kill small indie extensions that are harmless but keeps the profitable affiliate malware ones. Any indie extension that has an audience could get a donor base, but yeah - smaller first-time extensions that only underwent automated review could either fly unlisted / or with a non-"blue-star", or even with an "unverified" banner. The small fee could make looping humans into the loop relatively revenue neutral, and increase the chance of detection of stuff like this. The more misses by the automated system, the more the platform suffers, and the less chance any of us have of getting users.

frou_dh 3y ago

Paying qualified people to audit code would not exactly be cheap. Needs to be done every time the extension is updated too.

neom 3y ago
Isn't that why publishing verified code re: Apple costs $99/$299? (I actually have no clue, I just presumed that's part of why you pay Apple, to verify your code?)
- cj 3y ago
  Chrome requires a $5 fee to submit chrome extensions. 1 time fee that's non-recurring.
- frou_dh 3y ago
  Well we're talking about source code here. Apple has no expectation that applications for their platforms are open-source and so they don't get to see the source code either. Scanning of the binaries, "Notarization", Developer ID signing and all that stuff is something different.
  - neom 3y ago
    Got it, then I guess in the Apple instance I mean "confirm it's not malicious"? But sure, Apple and Oranges. BTW, I checked out the video in your bio a couple of days ago, absolutely fantastic! Thanks for the recommendation.
    - frou_dh 3y ago
      Oh, great. Makes me happy to catch people with it :)
  - supriyo-biswas 3y ago
    Apple uses some combination of static analysis and manual reviews for applications, unfortunately I don't have a reputable source to link right now.