> I am down to zero third-party developers that can get compromised and silently push an update that compromises all my web sessions Yeah, but is this really a

> I am down to zero third-party developers that can get compromised and silently push an update that compromises all my web sessions Yeah, but is this really a risk for anyone who isn't the sort to have installed Bonzi Buddy back in the day? That attack surface, compared to that of brew, npm, pip, gem, etc., is miniscule. And browser plugins don't yank in obscure dependencies at install time. I only run uBlock, and I suspect I'm in the majority here, and my choice of browser is predicated on the availability of a non-crippled ad blocker, because malicious ads are the primary threat.