4 ms·

How can I be assured that installing a random Chrome extension from a random person on the internet that has access to all my network data and can't get approve

How can I be assured that installing a random Chrome extension from a random person on the internet that has access to all my network data and can't get approved in the Chrome store is safe? :)

devilsAdv0cate 3y ago
[dead]
npace12 3y ago
I'm with you on that one, that's why the code is on github. The best way to install it is to check out the code for any risks, download the repo as a ZIP file and install it.
duiker101 3y ago
I guess the answer is that you must be able to read the code and use your own judgement. Here the actual code of the extension is basically 2 files, one of 114 lines and the other 66. Plain js, easy to digest. Looks pretty safe.
BowBun 3y ago
Verifying Github source code is not sufficient, since you don't know the release contains that source code (when downloading fro the store). You'd have to verify signatures Also, plenty of these extensions have been acquired by data firms or other sketchy places to then add your browser to botnets. If these are absolutely necessary for you, I highly recommend downloading the source and dumping it into Chrome/Edge via developer mode. At least then you know they can't update it in the background and you know what you're running.
- SoKamil 3y ago
  .crx is just a .zip underneath. You can unzip it and inspect the code.
  - throwaway290 3y ago
    I thought it's just installed and that's it, cool...
- Exuma 3y ago
  It's not in the store, you download it
- snowycat 3y ago
  You could always download it from github, turn on developer mode in chrome (there's a little switch in the top right corner of the chrome://extensions ui), and then load it as an unpacked extension from source without ever touching the chrome web store.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
teakie 3y ago
[dead]
spread_love 3y ago
By reading the source code? No wonder reddit used to go down so often...
- jedberg 3y ago
  I don't pretend to be a security expert in every language. > No wonder reddit used to go down so often... That's uncalled for. If this were reddit I'd have a much spicier retort.
  - spread_love 3y ago
    just a joke, apologies :( you leaving is actually part of the reason I left at the time, you were one of the few admins who regularly participated (it seemed)
    - jedberg 3y ago
      No worries, I know it was a joke. You can't be a reddit admin for years and not a have a thick skin. :)

How can I be assured that installing a random Chrome extension from a random person on the internet that has access to all my network data and can't get approved in the Chrome store is safe? :)

devilsAdv0cate 3y ago

[dead]

npace12 3y ago

I'm with you on that one, that's why the code is on github. The best way to install it is to check out the code for any risks, download the repo as a ZIP file and install it.

duiker101 3y ago

I guess the answer is that you must be able to read the code and use your own judgement. Here the actual code of the extension is basically 2 files, one of 114 lines and the other 66. Plain js, easy to digest. Looks pretty safe.

BowBun 3y ago

Verifying Github source code is not sufficient, since you don't know the release contains that source code (when downloading fro the store). You'd have to verify signatures Also, plenty of these extensions have been acquired by data firms or other sketchy places to then add your browser to botnets. If these are absolutely necessary for you, I highly recommend downloading the source and dumping it into Chrome/Edge via developer mode. At least then you know they can't update it in the background and you know what you're running.

SoKamil 3y ago
.crx is just a .zip underneath. You can unzip it and inspect the code.
- throwaway290 3y ago
  I thought it's just installed and that's it, cool...
Exuma 3y ago
It's not in the store, you download it
snowycat 3y ago
You could always download it from github, turn on developer mode in chrome (there's a little switch in the top right corner of the chrome://extensions ui), and then load it as an unpacked extension from source without ever touching the chrome web store.

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

teakie 3y ago

[dead]

spread_love 3y ago

By reading the source code? No wonder reddit used to go down so often...

jedberg 3y ago
I don't pretend to be a security expert in every language. > No wonder reddit used to go down so often... That's uncalled for. If this were reddit I'd have a much spicier retort.
- spread_love 3y ago
  just a joke, apologies :( you leaving is actually part of the reason I left at the time, you were one of the few admins who regularly participated (it seemed)
  - jedberg 3y ago
    No worries, I know it was a joke. You can't be a reddit admin for years and not a have a thick skin. :)