3 ms·
> This would require vetting the code, rather than a fully automated check. Then it's a non-starter for the manifest format supported by the chrome web store.
by shadowgovt 3y ago
> This would require vetting the code, rather than a fully automated check.
Then it's a non-starter for the manifest format supported by the chrome web store. Because Google's goal is to automate as much as possible.
- bensecure 3y agoNaturally. Thus, it doesn't much matter whether code is shipped in the extension package, or downloaded off the internet, since nobody will be checking what it does regardless.
- shadowgovt 3y agoOf course it matters. One of them allows looping in data from arbitrary external sources, and the other one (Mv3) has a permissions model that disallows that. It's a completely different risk domain. Don't forget, the mere act of requesting data from an external uncontrolled third-party source is leaking user information. Under Mv3, those leaks are fully documented.