3 ms·
It seems like using a browser extension instead of a website gets you most of the way there: - Extensions are signed with a developer key - You can be pretty
by shitter 3y ago
It seems like using a browser extension instead of a website gets you most of the way there:
- Extensions are signed with a developer key
- You can be pretty sure any code changes pushed out to one user are pushed out to everyone
- You benefit from the Chrome Web Store review process (or whatever equivalent Apple and Mozilla do)
- Extensions are permissioned and sandboxed
- Andrex 3y agoMore relevant to the article, Chrome extensions can't just "open a zillion connections." Included scripts must be unminified and external scripts are strictly declared ahead of time with more secure default permissions. I like that idea.
- shitter 3y agoIndeed, Manifest V3 disallows remotely hosted scripts entirely: https://developer.chrome.com/docs/extensions/develop/migrate/improve-security https://developer.chrome.com/docs/extensions/develop/migrate...
- deleted 3y ago[deleted]
- Groxx 3y agoI mean, kinda. It's little more than a consumer-grade padlock or maybe "do not cross" tape - there are countless ways around it, it mostly just encourages normal cases to be more static (which is a good thing! but very far from a security tool)