3 ms·

I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program. > Firefox is committed to helping protect you aga

I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program. > Firefox is committed to helping protect you against third-party software that may inadvertently compromise your data – or worse – breach your privacy with malicious intent. Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-... I know that Google hates to pay human beings, but this is an area that needs human eyes on code, not just automated scans.

Llamamoe 10mo ago
> I know that Google hates to pay human beings, but this is an area that needs human eyes on code, not automated scans. I think we need both human review and for somebody to create an antivirus engine for code that's on par with the heuristics of good AV programs. You could probably do even better than that since you could actually execute the code, whole or piecewise, with debugging, tracing, coverage testing, fuzzing and so on.
Santosh83 10mo ago
Yeah IT pros and tech aware "power" users can always take these measures but the very availability of poor or maliciously coded extensions and apps in popular app stores makes it a problem considering normies will get swayed by the swanky features the software promises and will click past all misgivings and warnings. Social engineering attacks are impossible to prevent using technical means alone. Either a critical mass of ordinary people need to become more safety/privacy conscious or general purpose computing devices will become more & more niche as the very industry which creates these problems in the first place by poor review will also sell the solution of universal thin-clients and locked down devices, of course with the very happy cooperation of govts everywhere.
deleted 10mo ago
[deleted]
Terr_ 10mo ago
> I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program. If you're feeling extra-paranoid, the XPI file can be unpacked (ZIP) and to check over the code for anything suspicious or unreasonably-complex, particularly if the browser-extension is supposed to be something simple like "move the up/down vote arrows further apart on HN". :P While that doesn't solve the overall ecosystem issue, every little bit helps. You'll know it's time to run away if extensions become closed-source blobs.
- insin 10mo ago
  You can also, more conveniently, plug an extension's URL into this viewer: https://robwu.nl/crxviewer/ https://robwu.nl/crxviewer/
  - Y_Y 10mo ago
    Now I have to trust that viewer doesn't hide the malicious code, nor that my browser does (presumably from an existing untrustworthy extension)
    - tetris11 10mo ago
      It'd have to be adept at spotting it in all its forms first in order to hide it, which seems expensive for a free viewer
dvratil 10mo ago
The question is, does Mozilla rigorously review every single update of every featured extension? Or did they just vet it once, and a malicious developer may now introduce data collection or similar "features" though a minor update of the extension and keep enjoying the "recommended" badge by Mozilla?
- pacifika 10mo ago
  This is just spreading FUD where an answer could have been provided. > Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...
  - nevon 10mo ago
    That link doesn't answer the question though. It states that the extension is reviewed before receiving the recommended status. It does not state that updates are reviewed.
    - insin 10mo ago
      They do, and it takes longer for updates to Recommended extensions to be reviewed as a result. This is what the Firefox add-ons team sent to me when one of my extensions was invited to the Recommended program: > If you’re interested in Control Panel for Twitter becoming a Firefox Recommended Extension there are a couple of conditions to consider: > 1) Mozilla staff security experts manually review every new submission of all Recommended extensions; this ensures all Recommended extensions remain compliant with AMO’s privacy and security standards. Due to this rigorous monitoring you can expect slightly longer review wait times for new version submissions (up to two weeks in some cases, though it’s usually just a few days). > 2) Developers agree to actively maintain their Recommended extension (i.e. make timely bug fixes and/or generally tend to its ongoing maintenance). Basically we don't want to include abandoned or otherwise decaying content, so if the day arrives you intend to no longer maintain Control Panel for Twitter, we simply ask you to communicate that to us so we can plan for its removal from the program.
alfiedotwtf 10mo ago
The same applies to code editor extensions!
wzdd 10mo ago
The article states that Google has done the same for this extension as part of providing its "Featured" badge.
j-bos 10mo ago
Funny enough the article mentions this extension was manially reviewed: > A "Featured" badge from Google, meaning it had passed manual review and met what Google describes as "a high standard of user experience and design."
- megous 10mo ago
  I at some point vetted the extensions for myself. What I saw in Mozilla extensions store was anything from using minified code (what is this? it might have been useful in the late 90's on the web, but it surely is not necessary as part of an extension, that doesn't download its code from anywhere), to just full on data stealing code (reported, and mozilla removed it after 2 weeks or so). I don't trust the review process one bit if they allow minified code in the store. For the same reason, "manual" review doesn't fill me with any extra warm confidence feeling. I can look at minified code manually myself, but it's just gibberish, and suspicious code is much harder to discern. Also, I just stopped using third party extensions, except for 2 (violentmonkey, ublock), so I no longer do reviews. I had a script that would extract the XPI into a git repository before update, do a commit and show me a diff. Friendly extension store for security conscious users would make it easy to review source code of the extension before hitting install or update. This is like the most security sensitive code that exists in the browser.
londons_explore 10mo ago
The problem is most codebase are huge - millions of lines when you include all the libraries etc. Often they're compiled with typescript etc making manual review almost impossible. And if you demand the developer send in the raw uncompiled stuff you have the difficulty of Google/Mozilla having to figure out how to compile an arbitrary project which could use custom compilers or compilation steps. Remember that someone malicious wont hide their malicious code in main.ts... it's gonna be deep inside a chain of libraries (which they might control too, or might have vendored).
- londons_explore 10mo ago
  For example, the following hidden anywhere in the codebase allows arbitrary code execution even under the most stringent JavaScript security policy (no eval etc): I=c=>c.map?c[0]?c.reduce((a,b)=>a[b=I(b)]||a(b),self):c[1]:c (How it works is an exercise to the reader) The actual code to run can be delivered as an innocuous looking JavaScript array from some server, and potentially only delivered to one high value target.
  - ikekkdcjkfke 10mo ago
    And the reason we can’t put execution of non-declared code behind a permission is because one anal developer at chrome thinks that we shouldn’t break existing sites even though no serious site would do this and you could just show a permission popup with triangle exclamation mark
    - johnebgd 10mo ago
      Users have largely been trained to click okay when asked to give permission without thinking.
    - londons_explore 10mo ago
      That's what's great about this - it is an interpreter which allows the attacker to do absolutely anything, but no non-declared code is directly run.
  - 10mo ago
jwr 10mo ago
The article says the extension has been "manually reviewed" by Google.
- tremon 10mo ago
  ...and we all know that Google never does anything "manually", so I'd take that with the appropriate serving of salt.

Llamamoe 10mo ago

> I know that Google hates to pay human beings, but this is an area that needs human eyes on code, not automated scans. I think we need both human review and for somebody to create an antivirus engine for code that's on par with the heuristics of good AV programs. You could probably do even better than that since you could actually execute the code, whole or piecewise, with debugging, tracing, coverage testing, fuzzing and so on.

Santosh83 10mo ago

Yeah IT pros and tech aware "power" users can always take these measures but the very availability of poor or maliciously coded extensions and apps in popular app stores makes it a problem considering normies will get swayed by the swanky features the software promises and will click past all misgivings and warnings. Social engineering attacks are impossible to prevent using technical means alone. Either a critical mass of ordinary people need to become more safety/privacy conscious or general purpose computing devices will become more & more niche as the very industry which creates these problems in the first place by poor review will also sell the solution of universal thin-clients and locked down devices, of course with the very happy cooperation of govts everywhere.

deleted 10mo ago

[deleted]

Terr_ 10mo ago

> I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program. If you're feeling extra-paranoid, the XPI file can be unpacked (ZIP) and to check over the code for anything suspicious or unreasonably-complex, particularly if the browser-extension is supposed to be something simple like "move the up/down vote arrows further apart on HN". :P While that doesn't solve the overall ecosystem issue, every little bit helps. You'll know it's time to run away if extensions become closed-source blobs.

insin 10mo ago
You can also, more conveniently, plug an extension's URL into this viewer: https://robwu.nl/crxviewer/ https://robwu.nl/crxviewer/
- Y_Y 10mo ago
  Now I have to trust that viewer doesn't hide the malicious code, nor that my browser does (presumably from an existing untrustworthy extension)
  - tetris11 10mo ago
    It'd have to be adept at spotting it in all its forms first in order to hide it, which seems expensive for a free viewer

dvratil 10mo ago

The question is, does Mozilla rigorously review every single update of every featured extension? Or did they just vet it once, and a malicious developer may now introduce data collection or similar "features" though a minor update of the extension and keep enjoying the "recommended" badge by Mozilla?

pacifika 10mo ago
This is just spreading FUD where an answer could have been provided. > Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts. https://support.mozilla.org/en-US/kb/recommended-extensions-program https://support.mozilla.org/en-US/kb/recommended-extensions-...
- nevon 10mo ago
  That link doesn't answer the question though. It states that the extension is reviewed before receiving the recommended status. It does not state that updates are reviewed.
  - insin 10mo ago
    They do, and it takes longer for updates to Recommended extensions to be reviewed as a result. This is what the Firefox add-ons team sent to me when one of my extensions was invited to the Recommended program: > If you’re interested in Control Panel for Twitter becoming a Firefox Recommended Extension there are a couple of conditions to consider: > 1) Mozilla staff security experts manually review every new submission of all Recommended extensions; this ensures all Recommended extensions remain compliant with AMO’s privacy and security standards. Due to this rigorous monitoring you can expect slightly longer review wait times for new version submissions (up to two weeks in some cases, though it’s usually just a few days). > 2) Developers agree to actively maintain their Recommended extension (i.e. make timely bug fixes and/or generally tend to its ongoing maintenance). Basically we don't want to include abandoned or otherwise decaying content, so if the day arrives you intend to no longer maintain Control Panel for Twitter, we simply ask you to communicate that to us so we can plan for its removal from the program.

alfiedotwtf 10mo ago

The same applies to code editor extensions!

wzdd 10mo ago

The article states that Google has done the same for this extension as part of providing its "Featured" badge.

j-bos 10mo ago

Funny enough the article mentions this extension was manially reviewed: > A "Featured" badge from Google, meaning it had passed manual review and met what Google describes as "a high standard of user experience and design."

megous 10mo ago
I at some point vetted the extensions for myself. What I saw in Mozilla extensions store was anything from using minified code (what is this? it might have been useful in the late 90's on the web, but it surely is not necessary as part of an extension, that doesn't download its code from anywhere), to just full on data stealing code (reported, and mozilla removed it after 2 weeks or so). I don't trust the review process one bit if they allow minified code in the store. For the same reason, "manual" review doesn't fill me with any extra warm confidence feeling. I can look at minified code manually myself, but it's just gibberish, and suspicious code is much harder to discern. Also, I just stopped using third party extensions, except for 2 (violentmonkey, ublock), so I no longer do reviews. I had a script that would extract the XPI into a git repository before update, do a commit and show me a diff. Friendly extension store for security conscious users would make it easy to review source code of the extension before hitting install or update. This is like the most security sensitive code that exists in the browser.

londons_explore 10mo ago

The problem is most codebase are huge - millions of lines when you include all the libraries etc. Often they're compiled with typescript etc making manual review almost impossible. And if you demand the developer send in the raw uncompiled stuff you have the difficulty of Google/Mozilla having to figure out how to compile an arbitrary project which could use custom compilers or compilation steps. Remember that someone malicious wont hide their malicious code in main.ts... it's gonna be deep inside a chain of libraries (which they might control too, or might have vendored).

londons_explore 10mo ago
For example, the following hidden anywhere in the codebase allows arbitrary code execution even under the most stringent JavaScript security policy (no eval etc): I=c=>c.map?c[0]?c.reduce((a,b)=>a[b=I(b)]||a(b),self):c[1]:c (How it works is an exercise to the reader) The actual code to run can be delivered as an innocuous looking JavaScript array from some server, and potentially only delivered to one high value target.
- ikekkdcjkfke 10mo ago
  And the reason we can’t put execution of non-declared code behind a permission is because one anal developer at chrome thinks that we shouldn’t break existing sites even though no serious site would do this and you could just show a permission popup with triangle exclamation mark
  - johnebgd 10mo ago
    Users have largely been trained to click okay when asked to give permission without thinking.
  - londons_explore 10mo ago
    That's what's great about this - it is an interpreter which allows the attacker to do absolutely anything, but no non-declared code is directly run.
- 10mo ago

jwr 10mo ago

The article says the extension has been "manually reviewed" by Google.

tremon 10mo ago
...and we all know that Google never does anything "manually", so I'd take that with the appropriate serving of salt.