Browser extensions are a major security risk and you should not install any that you wouldn’t trust with your login cookies on every site you visit.
I built a platform for discovering and sharing Chrome extension collections
61–68 of 68 posts
Re: I built a platform for discovering and sharing Chrome extension collections
#62Earlier quoted context omitted.
> I found it more trustworthy to code my own extensions I used to have a ton of little single use extensions that I barely ever used but thought at the time of installation, ”that could be useful one day". Then I started noticing I was liking really random shit on Facebook. That immediately ceased when I uninstalled all but Bitwarden, Leechblock and uBlock Origin. I will never install another random 3rd party extensi…
Which of your single use extensions was causing you to like things on Facebook?
I can't answer that question I'm afraid. I disabled somewhere in the region of 5-10 extensions and it would have required more effort than I cared to exert to figure out which was the culprit. This means that I can't categorically state an extension was to blame, but there was a strong correlation between my removing them and the spurious likes stopping.
Re: I built a platform for discovering and sharing Chrome extension collections
#63Nice work I find it useful since I like to use a few extensions for development. Do you have any insights over the market share for extensions between Chrome and Firefox. I'm developing an extension and I don't know if it's worth to maintain both versions?
Re: I built a platform for discovering and sharing Chrome extension collections
#64Nice work I find it useful since I like to use a few extensions for development. Do you have any insights over the market share for extensions between Chrome and Firefox. I'm developing an extension and I don't know if it's worth to maintain both versions?
For me, your Focus Chrome extension is enough. No need to overthink about making both versions. Chromium has huge opportunities including Chrome, Brave, Opera...
Re: I built a platform for discovering and sharing Chrome extension collections
#65I found it more trustworthy to code my own extensions via ChatGPT. These are the last 2 ones. I pretty much dont care if people use them, as the mostly fulfill my own usecases. https://chromewebstore.google.com/detail/comparative-chatgpt... https://thisismy.franzai.com/ The cost of (small) software is fast approaching 0, and it can be faster now to code your own solution, instead of looking for one that nearly mostly…
Interesting that extensions are not seen as trustworthy. I installed a third-party one for work, and it kept opening up the developers website which was blocked by our firewall. Why try to do a web action the user didn't request? It devolves trust.
Re: I built a platform for discovering and sharing Chrome extension collections
#66I found it more trustworthy to code my own extensions via ChatGPT. These are the last 2 ones. I pretty much dont care if people use them, as the mostly fulfill my own usecases. https://chromewebstore.google.com/detail/comparative-chatgpt... https://thisismy.franzai.com/ The cost of (small) software is fast approaching 0, and it can be faster now to code your own solution, instead of looking for one that nearly mostly…
> I found it more trustworthy to code my own extensions I used to have a ton of little single use extensions that I barely ever used but thought at the time of installation, ”that could be useful one day". Then I started noticing I was liking really random shit on Facebook. That immediately ceased when I uninstalled all but Bitwarden, Leechblock and uBlock Origin. I will never install another random 3rd party extensi…
I remember this happening when an extension got sold and then stole my Instagram cookies. Absolutely tonnes of likes of weird shit.
Re: I built a platform for discovering and sharing Chrome extension collections
#67Earlier quoted context omitted.
I think the asymmetry in payoffs explains this, since a bad actor who baits and switches their extension could do massive damage to users. So google try to catch this behaviour and inevitably have some false positives (extensions labelled malware that actually aren't). The cost of a false positive is annoyance. The cost of real malware getting through could be your bank balance.
Automatic extension updates is a stupid practice. The attack surface for a legit extension is minimal, while being huge for a malware update. I'm against almost all automatic software updates in general, but browser extensions take the cake for having an obscene cost/benefit ratio. Chrome won't even let you turn it off. Personally I extract and load all my extensions in developer mode.
the alternative is leaving software eternally insecure as people will not update them. and of those that will, 99.99% (probably not an exaggeration) will not have the interest, time, or ability to review code changes before updating.
Re: I built a platform for discovering and sharing Chrome extension collections
#68Earlier quoted context omitted.
Automatic extension updates is a stupid practice. The attack surface for a legit extension is minimal, while being huge for a malware update. I'm against almost all automatic software updates in general, but browser extensions take the cake for having an obscene cost/benefit ratio. Chrome won't even let you turn it off. Personally I extract and load all my extensions in developer mode.
the alternative is leaving software eternally insecure as people will not update them. and of those that will, 99.99% (probably not an exaggeration) will not have the interest, time, or ability to review code changes before updating.
There are some core technologies that should be updated automatically as the cost/benefit is well in favor of updates (by default, but with an option to turn it off). But the fact that we're at the point of all software updating automatically with zero acknowledgement that there is even a cost associated with it is a huge problem. Ostensibly a security practice but now serves as a means for software distributors to extract the maximum value from their users. The pendulum is well overdue for a swing back towards the middle.