3 ms·

Things have gotten bad enough that I've stopped using extensions that haven't been through a code vetting process. > Recommended extensions differ from other e

Things have gotten bad enough that I've stopped using extensions that haven't been through a code vetting process. > Recommended extensions differ from other extensions that are regularly reviewed by Firefox staff in that they are curated extensions that meet the highest standards of security, functionality, and user experience. Firefox staff thoroughly evaluate each extension before it receives Recommended status. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-... If your browser doesn't have a code vetting process for extensions, I'm not interested in your browser.

c7DJTLrn 3y ago
What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily malicious code could slip through. I'm surprised there hasn't been a mass cookie stealing attack yet.
- GeekyBear 3y ago
  > What does that mean in reality? It means taking malware seriously, even if that means you have to pay human beings to vet code manually. I realize that Google wants to avoid paying human beings at all costs, but too bad.
- sfink 3y ago
  That's why AMO requires extensions to be uploaded with their source code and disallows obfuscation. They do allow minification for compression, and I don't know what stops someone from uploading different source code from the shipped addon.
- kevingadd 3y ago
  CWS doesn't review every extension submission, at best they do some % of them along with anything that sets off red flags. Out of hundreds of times I pushed updates to my extension (~100k monthly users by the end) it was delayed for human review maybe... twice?
  - c7DJTLrn 3y ago
    that's scary.
  - DesiLurker 3y ago
    maybe its time for a LLM based security review open source framework. this could be adapted for extensions to see what information they'd be sending over.
extesy 3y ago
Mozilla's review process is much more strict than Chrome's: they required me to produce original source code for all libraries that I am using (like jquery), forced me to get rid of some leftover eval's in javascript, etc. I don't think they read all source code, but they definitely look for some patterns.
- GeekyBear 3y ago
  Did your extension go through the normal vetting process or the extended review necessary to become a recommended extension?
  - extesy 3y ago
    If by recommended you mean "featured" flag on Chrome webstore then I believe that happens automatically if the extension satisfies their "best practices" criteria.
    - GeekyBear 3y ago
      I was referring to Mozilla's extended manual review process necessary to become one of their "Recommended" extensions. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...

c7DJTLrn 3y ago

What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily malicious code could slip through. I'm surprised there hasn't been a mass cookie stealing attack yet.

GeekyBear 3y ago
> What does that mean in reality? It means taking malware seriously, even if that means you have to pay human beings to vet code manually. I realize that Google wants to avoid paying human beings at all costs, but too bad.
sfink 3y ago
That's why AMO requires extensions to be uploaded with their source code and disallows obfuscation. They do allow minification for compression, and I don't know what stops someone from uploading different source code from the shipped addon.
kevingadd 3y ago
CWS doesn't review every extension submission, at best they do some % of them along with anything that sets off red flags. Out of hundreds of times I pushed updates to my extension (~100k monthly users by the end) it was delayed for human review maybe... twice?
- c7DJTLrn 3y ago
  that's scary.
- DesiLurker 3y ago
  maybe its time for a LLM based security review open source framework. this could be adapted for extensions to see what information they'd be sending over.

extesy 3y ago

Mozilla's review process is much more strict than Chrome's: they required me to produce original source code for all libraries that I am using (like jquery), forced me to get rid of some leftover eval's in javascript, etc. I don't think they read all source code, but they definitely look for some patterns.

GeekyBear 3y ago
Did your extension go through the normal vetting process or the extended review necessary to become a recommended extension?
- extesy 3y ago
  If by recommended you mean "featured" flag on Chrome webstore then I believe that happens automatically if the extension satisfies their "best practices" criteria.
  - GeekyBear 3y ago
    I was referring to Mozilla's extended manual review process necessary to become one of their "Recommended" extensions. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...