It seems every now and again some popular Chrome or Firefox extension decides to “go evil” seemingly out of nowhere.

Stylish got caught logging browser history, The Great Suspender turned out to be spyware, and, in the case of “get cookies.txt”, which was endorsed by youtube-dl, apparently the user is not the only one “getting” the cookies.

In most of these cases, it seems that trustworthy extensions get sold off to some shady third parties, or the developers just “turns evil”. This got me wondering: would it be an effective security precaution to simply disable updates for browser extensions? i.e. to download the extension manually from the developer, instead of relying on chrome web store / firefox addon catalogue. It wouldn’t help much if the extension you’re using contains malware now, but it would prevent malware being installed in potential future updates.

So, what do you guys think?

  • amanwithausername@vlemmy.netOPEnglish
    1·
    1 year ago

    but if it’s public the odds of SOMEONE reading it and finding out it’s doing shady shit is substantially higher

    See, that’s the banger: The Great Suspender is licensed under GPL and its source code is available on GitHub. The malware was injected specifically into the chrome web store version. So that’s why I’m slightly paranoid of automatic updates.

    • cstine@lemmy.uncomfortable.businessEnglish
      1·
      1 year ago

      It looks like the problem here is you can “sell” the published version along with the code, and the new developer gets access to your already installed userbase.

      That uh, probably shouldn’t happen. I’ll even go so far as to say that’s completely insane and there should be NO WAY a purchaser of anything should get access to publish a new version of something under the same name and have it push out updates without manual user intervention.

      For example, Apple/iOS does it sanely where if a new person is going to publish even the exact same app, they consider it a completely separate and new piece of software and it won’t auto-update the previous incarnation of itself, and it’s checked for suspicious nonsense as if it was brand new and never seen before.