41–50 of 320 posts
Earlier quoted context omitted.
Extensions in general are a massive security issue and it’s impossible to fix without crippling them beyond uselessness. Or maybe having approved extensions only.
Sounds like the Apple app store.
Wait until you see what’s possible with executables! I like this project, but I also worry that eventually we’re going to lose access to extensions entirely because people will take away the wrong message. Safeguards are good, but at a certain point I want my devices to trust that I know what I’m doing.
The problem is not a single person is capable of making informed decisions on extensions. One day they could be good and reputable, next day they have been sold to a malware company. Maybe the middle ground is all extensions have a legal entity in your country so you can sue them for spyware.
Or pwned
The code below this text is highly inefficient and may lead the user detection solely from page interactivity slowdown alone. A more efficient implementation could read input using the 'input' event[1]. For example, here[2] is how you would use the input event to detect changes to any fields in a page.
1. https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement...
2. https://gist.github.com/eligrey/615fcc9fa9edbfb5153478109b5b...
> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…
> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.
I do agree about the permission UI box. Surely that's a completely simple fix on Google's part to force the user to scroll through the permissions box before accepting.
Earlier quoted context omitted.
> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. There should be liability for negligence. If you were told about a security hole and you have not fixed it, and you have not informed your users, in months, you should pay statutory damages. And if you lied about your app (claim…
Well, you can get a full refund. I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything. I'm not saying you should never go there - GDPR does and it's a net impro…
Furthermore, Chromium is free software, Chrome isn't. Perhaps Google should be liable for distributing Chrome in such a sorry state, but not for what lands in Chromium.
Earlier quoted context omitted.
> The chain of humans who've been responsible for developing and testing Chrome Extension functionality and security has been asleep at the wheel this whole time, for something like 15 years. There should be liability for negligence. If you were told about a security hole and you have not fixed it, and you have not informed your users, in months, you should pay statutory damages. And if you lied about your app (claim…
Well, you can get a full refund. I see where you are coming from, but increasing liability for free software does not feel like a good idea to me at all. There's basically no way you could extract money protected by Googles lawyers army, but any small open-source project or even medium sized company will be extremely vary of releasing anything. I'm not saying you should never go there - GDPR does and it's a net impro…
Wait until you see what’s possible with executables! I like this project, but I also worry that eventually we’re going to lose access to extensions entirely because people will take away the wrong message. Safeguards are good, but at a certain point I want my devices to trust that I know what I’m doing.
The problem is not a single person is capable of making informed decisions on extensions. One day they could be good and reputable, next day they have been sold to a malware company. Maybe the middle ground is all extensions have a legal entity in your country so you can sue them for spyware.
The same can happen with any piece of software in the world. Why single out extensions?
Wait until you see what’s possible with executables! I like this project, but I also worry that eventually we’re going to lose access to extensions entirely because people will take away the wrong message. Safeguards are good, but at a certain point I want my devices to trust that I know what I’m doing.
> Wait until you see what’s possible with executables! The most important thing is whay you tell the user - Windows says "We don't know where Trojan.exe came from, it could be a virus, are you sure you want to run it?" Chrome says: "You downloaded Trojan.exe from our store, we manage it and check it for viruses. It only asks for harmless permission, install it!" One is warning you, the other is entrapment.
> It only asks for harmless permission, install it!
Not true. It lists all the permissions being requested. Sure the scrollbar issue is real and should be an easy fix.
I don't understand why people are so confused about permissions. If the user grants your extension permission to read your browsing history so it can provide value to them, why is that a problem? It's not. The problem is if the user grants a malicious extension the same permission because the extension is fraudulent. The author said this extension would never pass chrome store review, so it seems that the user would never be in this position in the first place and your example doesn't really match reality.
> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…
I agree it's egregious, but it's quite easy to believe.
It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which makes it even clearer. And/or that testers never caught it on a Mac because they themselves never realized there were more.
I would hope somebody sees this now and prioritzes a Chromium bug for it. Because on a Mac at least, this is pretty serious.
(And I'm well aware this is a good example of a negative side effect of Apple's choice to make scroll bars visible by default only while scrolling.)