Live data from Hacker News

Using fake reviews to find dangerous extensions

krebsonsecurity.com

11–20 of 105 posts

Re: Using fake reviews to find dangerous extensions

#11
post #2

Reviews are mathematical garbage even there are real reviewers because we all have different expectations and it varies completely across cultures and geographies.

I once watched a movie where the rating was "do you like the item on the left more than on the right". I'm not sure if it is mathematically possible to create a rank from it. I assume, that new items appear and have less comparisons than others.

That would remove the bias of what is 5 point of 10 I think.

Re: Using fake reviews to find dangerous extensions

#12

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

I'm not sure what you mean by non-malicious extensions being intrusive. I use a number of extensions, mostly content-blocking and privacy-related and they mostly just get out of my way. The Firefox Extension Store also has a recommended extensions feature that shows that the extension has been reviewed by Mozilla for privacy and security. Most extensions I use have this seal.

Re: Using fake reviews to find dangerous extensions

#13

My team recently built a Chrome extension and expected to be grilled on permissions. We sailed through despite requesting access to all sorts of things. Their vetting seems strict from the outside, but does not seem like it after going through the process.

It seems but it doesn't seem? Sorry I can't figure out the typo

Re: Using fake reviews to find dangerous extensions

#14
post #2

Reviews are mathematical garbage even there are real reviewers because we all have different expectations and it varies completely across cultures and geographies.

I once watched a movie where the rating was "do you like the item on the left more than on the right". I'm not sure if it is mathematically possible to create a rank from it. I assume, that new items appear and have less comparisons than others.

This is a technique for "preference elicitation", and related to techniques like Elo scoring and social science fields such as psychometrics.

And yes, I think it's much better than reviews that ask for an absolute scale with no context.

Re: Using fake reviews to find dangerous extensions

#15
post #13

My team recently built a Chrome extension and expected to be grilled on permissions. We sailed through despite requesting access to all sorts of things. Their vetting seems strict from the outside, but does not seem like it after going through the process.

It seems but it doesn't seem? Sorry I can't figure out the typo

I took his meaning as, the vetting seems strict before you submit, but it actually turns out to be much less strict after you submit.

Re: Using fake reviews to find dangerous extensions

#16
post #2

Reviews are mathematical garbage even there are real reviewers because we all have different expectations and it varies completely across cultures and geographies.

I once watched a movie where the rating was "do you like the item on the left more than on the right". I'm not sure if it is mathematically possible to create a rank from it. I assume, that new items appear and have less comparisons than others.

That works when judging aesthetic, but how would that work for extensions though? You can only really judge extensions you have used, and even then how would you choose between your adblocker and your password manager? They do completely different things and I'm not willing to browse without either.

edit: I guess the signal "I tried this extension but replaced it with that other one which I like better" would be very informative though

Re: Using fake reviews to find dangerous extensions

#17
post #13

My team recently built a Chrome extension and expected to be grilled on permissions. We sailed through despite requesting access to all sorts of things. Their vetting seems strict from the outside, but does not seem like it after going through the process.

It seems but it doesn't seem? Sorry I can't figure out the typo

Google's vetting seems strict from the outside. However, now that GP has gone through the process, GP no longer believes it is strict.

Re: Using fake reviews to find dangerous extensions

#18

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

Five years ago I had a whole bunch of extensions, but that ended whenever it was that I first learned that there were bad actors buying legitimate extensions from their developers and filling them with malware. After that I dramatically reduced the number I had installed, down to basically a password manager and ublock origin. The brief install-time vetting I used to do would would do nothing to prevent an auto update from installing something malicious in the future. Nowadays malicious browser extensions are the most common thing I find on family and friends' computers when I'm helping them with an issue.

Re: Using fake reviews to find dangerous extensions

#19

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

It’s because the web is unusable without them. Need the ad blocker and the vertical tree of tabs plus extensions to make Reddit usable, etc…

Re: Using fake reviews to find dangerous extensions

#20
post #12

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

I'm not sure what you mean by non-malicious extensions being intrusive. I use a number of extensions, mostly content-blocking and privacy-related and they mostly just get out of my way. The Firefox Extension Store also has a recommended extensions feature that shows that the extension has been reviewed by Mozilla for privacy and security. Most extensions I use have this seal.

I should have said potentially intrusive. Giving any extension permission to "Access your data for all websites" would give me pause.
Post reply on HN