3 ms·

I have on my browser several multilingual dictionary extensions and others by small developers that I do not completely trust. I do not have the inclination to

I have on my browser several multilingual dictionary extensions and others by small developers that I do not completely trust. I do not have the inclination to audit the code, and I want to keep the extensions updated. There is a very real possibility that the authors sell control over them to malicious actors. Manifest v3 deprecating remote-hosted code makes it more feasible to use such extensions without trusting these developers, only google's review process. For me this is more important than uBlock Origin being able to execute remote-hosted code for ad-blocking.

Timshel 2y ago
The beauty is if the extension are updated and compatible with FF you can switch and enjoy your dictionary using v3 and keeping uBlock Origin.
- aembleton 2y ago
  I don't think there's anyway to tell FF to stop an extension from updating using remote files so malicious code could still be deployed after passing any moderation.
raxxorraxor 2y ago
That is a made up threat with a lot of hypotheticals. A more straight forward consideration is not to have an ad company responsible to determine the capabilities of an ad blocker. Also because ad blockers are recommended to increase overall security.
- jhanschoo 2y ago
  I did a google search to respond to your comment because I was pretty sure that the threat was not a mere hypothetical. https://www.kaspersky.com/blog/dangerous-chrome-extensions-87-million/48562/ https://www.kaspersky.com/blog/dangerous-chrome-extensions-8... https://palant.info/2023/05/16/malicious-code-in-pdf-toolbox-extension/ https://palant.info/2023/05/16/malicious-code-in-pdf-toolbox... https://palant.info/2023/05/31/more-malicious-extensions-in-chrome-web-store/ https://palant.info/2023/05/31/more-malicious-extensions-in-...
aftbit 2y ago
If you keep the extensions updated, they could still have control sold to malicious actors and be updated to do malicious things without you noticing. Google's review process is not strong enough to protect from this. Besides, Google could still allow you to install Mv2 extensions in Developer mode. Just like with Apple's 30% app store tax, this is about making money not protecting users.
- jhanschoo 2y ago
  The first point you make can be perhaps substantiated with evidence, but the last one is a stretch and not a worry to me considering my use case. But I think moving to Mv3 will help google protect its chrome userbase from malicious actors.

Timshel 2y ago

The beauty is if the extension are updated and compatible with FF you can switch and enjoy your dictionary using v3 and keeping uBlock Origin.

aembleton 2y ago
I don't think there's anyway to tell FF to stop an extension from updating using remote files so malicious code could still be deployed after passing any moderation.

raxxorraxor 2y ago

That is a made up threat with a lot of hypotheticals. A more straight forward consideration is not to have an ad company responsible to determine the capabilities of an ad blocker. Also because ad blockers are recommended to increase overall security.

jhanschoo 2y ago
I did a google search to respond to your comment because I was pretty sure that the threat was not a mere hypothetical. https://www.kaspersky.com/blog/dangerous-chrome-extensions-87-million/48562/ https://www.kaspersky.com/blog/dangerous-chrome-extensions-8... https://palant.info/2023/05/16/malicious-code-in-pdf-toolbox-extension/ https://palant.info/2023/05/16/malicious-code-in-pdf-toolbox... https://palant.info/2023/05/31/more-malicious-extensions-in-chrome-web-store/ https://palant.info/2023/05/31/more-malicious-extensions-in-...

aftbit 2y ago

If you keep the extensions updated, they could still have control sold to malicious actors and be updated to do malicious things without you noticing. Google's review process is not strong enough to protect from this. Besides, Google could still allow you to install Mv2 extensions in Developer mode. Just like with Apple's 30% app store tax, this is about making money not protecting users.

jhanschoo 2y ago
The first point you make can be perhaps substantiated with evidence, but the last one is a stretch and not a worry to me considering my use case. But I think moving to Mv3 will help google protect its chrome userbase from malicious actors.