4 ms·
You could also just turn off extension autoupdate.
by sneak 3y ago
You could also just turn off extension autoupdate.
- captn3m0 3y agoThat only makes a difference if you’re auditing each extension update. Switching to extensions with per-site permissions reduces the attack surface drastically and you don’t have to worry about auditing or disabling updates.
- FiloSottile 3y agoI considered that a few times, but eventually complex things like modern ad-blockers rot, so I would be forced to update every once in a while, and let's be honest: I am neither qualified nor prepared to audit the diff. I guess deferring updates would give me lead time to let others get targeted / detect an issue before it's likely I would get the update. Still, installing the permission-less version is so much simpler and reassuring.
- sneak 3y agoI rely on the latter. I am much more concerned about supply chain attacks of mass exploitation than I am about 0day in my Signal client or my browser extensions. If there is something big enough to warrant quick update, my HN addiction will make sure I find out about it before it is a 1day. There really isn't a great configuration for browser security rn, is there? The gold standard I think is Qubes, which afaict is not practical.
- huydotnet 3y agoTurn off extension autoupdate sounds like a bad choice, not all updates are mallware injected, many of them may contains security updates anyway