redditReallySucks@lemmy.dbzer0.com
on 02 Sep 2023 14:23
nextcollapse
Or maybe only install extensions from trusted sources developers.
2Xtreme21@lemmy.world
on 02 Sep 2023 15:19
nextcollapse
I think the point is that even if an extension comes from a trusted source, the developer could fairly easily push out an update that turns the extension into malware. Check the GitHub link in another comment below where the developer posts the solicitation emails he gets on a regular basis offering to monetize his extension. He isn’t selling out, but maybe not every dev is as willing as he is to forgo a potentially lucrative offer.
RdVortex@lemmy.world
on 02 Sep 2023 16:35
collapse
TheEntity@kbin.social
on 02 Sep 2023 17:50
collapse
To be specific: from trusted developers. Installing them only from the official repository (is it still possible to reasonably install them any other way?) won't help if a dev sells such an addon. On the other hand I cannot imagine someone like Raymond Hill (the uBlock Origin dev) doing it, considering his track record.
redditReallySucks@lemmy.dbzer0.com
on 02 Sep 2023 19:38
collapse
That’s why on my work PC I use a completely vanilla Firefox, gotta live with the ads. But I’m not risking giving full access to website content to any extension
Your ISP cannot read https data in transit. Extensions can because the page is now rendered on your local browser.
Franzia@lemmy.blahaj.zone
on 03 Sep 2023 04:12
collapse
Thank you!
NullaFacies@sh.itjust.works
on 02 Sep 2023 23:21
collapse
To add to the blog post, if you use user scripts, utilize your manager’s blacklist and learn REGEX.
If needed, use Group Policy, Regedit or .plists on macOS to blacklist domains to prevent an extension from running on them. As an example, I use Shutup.css to block comments online, but on something like Lemmy, I want to see comments as that’s primarily how content is created and adding it to my extension domain blacklist prevents the extension from running on the website or any lemmy domains.
threaded - newest
Or maybe only install extensions from trusted
sourcesdevelopers.I think the point is that even if an extension comes from a trusted source, the developer could fairly easily push out an update that turns the extension into malware. Check the GitHub link in another comment below where the developer posts the solicitation emails he gets on a regular basis offering to monetize his extension. He isn’t selling out, but maybe not every dev is as willing as he is to forgo a potentially lucrative offer.
And there are cases where this has already happened: bleepingcomputer.com/…/-particle-chrome-extension… There are probably more recent cases too, but this was the first one I could find.
To be specific: from trusted developers. Installing them only from the official repository (is it still possible to reasonably install them any other way?) won't help if a dev sells such an addon. On the other hand I cannot imagine someone like Raymond Hill (the uBlock Origin dev) doing it, considering his track record.
Yeah, that’s what I meant.
.
Exactly why most enterprise organizations disable them. You should too if you’re doing anything sensitive data.
That’s why on my work PC I use a completely vanilla Firefox, gotta live with the ads. But I’m not risking giving full access to website content to any extension
.
Firefox will disable extensions in private mode if you want to
It’s interesting to read as I never thought about the vulnerability these extensions are.
I guess you should limit the number of extensions you have.
.
I thought my ISP already had this data and is selling it. Should I go make sure all my extensions are 100% kosher?
Your ISP cannot read https data in transit. Extensions can because the page is now rendered on your local browser.
Thank you!
To add to the blog post, if you use user scripts, utilize your manager’s blacklist and learn REGEX.
If needed, use Group Policy, Regedit or .plists on macOS to blacklist domains to prevent an extension from running on them. As an example, I use Shutup.css to block comments online, but on something like Lemmy, I want to see comments as that’s primarily how content is created and adding it to my extension domain blacklist prevents the extension from running on the website or any lemmy domains.