61–70 of 105 posts
Earlier quoted context omitted.
But the question is, how can I install uBlock Origin knowing I got the official version and not a malware infested one.
You can follow ublock origin subreddit
Earlier quoted context omitted.
This isn't my experience. I created my dev account years ago with a non-gmail account. Admittedly, it is a corporate account that is managed by google, but I don't think there was any step in the process that required this. It's possible that things have changed since I created my account nearly a decade ago, or that somehow I got a pass because google manages my domain's email. But they definitely do not force @gmai…
> it is a corporate account that is managed by google All the counter-examples I could find in the linked thread are Google Mail (for Business), which is functionally the same as requiring a gmail account in that it requires Google to be your mail-provider.
A lot of people in corporations set things up without necessarily understanding what they're setting up. This includes apps. If you're thinking, "Wouldn't Microsoft know how to set things up correctly?" the answer is "Not necessarily". It's not "Microsoft" setting up some app account, it's a random guy on a random team somewhere in Microsoft, who might not have ever published an app before, much less gotten any training or done much investigation into it.
Earlier quoted context omitted.
I'm not sure what you mean by non-malicious extensions being intrusive. I use a number of extensions, mostly content-blocking and privacy-related and they mostly just get out of my way. The Firefox Extension Store also has a recommended extensions feature that shows that the extension has been reviewed by Mozilla for privacy and security. Most extensions I use have this seal.
I should have said potentially intrusive. Giving any extension permission to "Access your data for all websites" would give me pause.
Granted, such a service wouldn't have the resources to review all extensions, but it could probably handle vetting the most popular and updates to those popular extensions. I can even imagine some kind of market that would let a group of people get this service to begin vetting a new extension.
The data source basically contained account IDs, billing addresses, credit card hashes and whether an account was identified as fraudulent or not.
Using that data, I built a quick GraphDB prototype that showed clusters of fake/fraud accounts. It was simple stuff, but back then said execs were pretty impressed.
I don’t know what came of that because I left shortly after, but it was an interesting little experiment. I had fun building it!
> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…
Do you think reporting these requests to the store(s) in question might result in investigation, or at the least, a list of suspicious investors to use to vet extensions/apps?
Earlier quoted context omitted.
I build my own personal Chrome extensions to be used only by myself and I treat them as potentially malware every single time I type `npm install`. If I built an extension to share, I would likely make it completely with vanilla JavaScript.
One approach would be to intercept your own traffic with Fiddler as a proxy for a few hours after installing and look for any nefarious requests. This is a pretty effective way to run a basic security audit.
> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…
Do you think reporting these requests to the store(s) in question might result in investigation, or at the least, a list of suspicious investors to use to vet extensions/apps?
1. What rules are being violated by these offers? It is what happens after the sale might break the rules but I can't report someone for having bad intentions.
2. I do not believe Google would be interested in spending even a minute of their precious human time to do any real investigation. If they can't automate the solution then they ignore the problem.
> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…
Woah indeed. Just doing the math it's about $1k per year for 10k-$15k users? Roughly? That could be very enticing for a lot of developers. Thanks for sharing this.
Ah, this takes me back! On my first job, our CEO asked me to look at some fraud transaction data from an airline and use a graph database to gather some insights from it. His idea was to show that to some executives from the airline as a prototype to get some buy-in to build a fraud detection tool from them. The data source basically contained account IDs, billing addresses, credit card hashes and whether an account…