26 ms·
Verifying Github source code is not sufficient, since you don't know the release contains that source code (when downloading fro the store). You'd have to verif
by BowBun 3y ago
Verifying Github source code is not sufficient, since you don't know the release contains that source code (when downloading fro the store). You'd have to verify signatures
Also, plenty of these extensions have been acquired by data firms or other sketchy places to then add your browser to botnets. If these are absolutely necessary for you, I highly recommend downloading the source and dumping it into Chrome/Edge via developer mode. At least then you know they can't update it in the background and you know what you're running.
- SoKamil 3y ago.crx is just a .zip underneath. You can unzip it and inspect the code.
- throwaway290 3y agoI thought it's just installed and that's it, cool...
- Exuma 3y agoIt's not in the store, you download it
- snowycat 3y agoYou could always download it from github, turn on developer mode in chrome (there's a little switch in the top right corner of the chrome://extensions ui), and then load it as an unpacked extension from source without ever touching the chrome web store.