4 ms·
What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily
by c7DJTLrn 3y ago
What does that mean in reality? Pretty sure Chrome Web Store extensions are reviewed, but since they're all minified and obfuscated garbage, I wonder how easily malicious code could slip through. I'm surprised there hasn't been a mass cookie stealing attack yet.
- GeekyBear 3y ago> What does that mean in reality? It means taking malware seriously, even if that means you have to pay human beings to vet code manually. I realize that Google wants to avoid paying human beings at all costs, but too bad.
- sfink 3y agoThat's why AMO requires extensions to be uploaded with their source code and disallows obfuscation. They do allow minification for compression, and I don't know what stops someone from uploading different source code from the shipped addon.
- kevingadd 3y agoCWS doesn't review every extension submission, at best they do some % of them along with anything that sets off red flags. Out of hundreds of times I pushed updates to my extension (~100k monthly users by the end) it was delayed for human review maybe... twice?
- c7DJTLrn 3y agothat's scary.
- DesiLurker 3y agomaybe its time for a LLM based security review open source framework. this could be adapted for extensions to see what information they'd be sending over.