Hacker News Reader

Comment by zschuessler | Hacker News Reader

HN users clicking through: take a look at reviews before installing. Appears there may be an issue with adware.

westoque - might want to check your code base, if the adware is unintentional.

I never trust Chrome extensions - too often the business model is to build up a user base and then sell the spot in the store.

The only way to safely install extensions is to pack them yourself from versions you trust, then drag + drop them into the extensions window.

Smart man.

I'm on mobile currently and apparently cannot look at reviews for Chrome extensions. Cookie Inspector is open source[0] according to the extension page, so you could try finding any adware-related code yourself, couldn't you?

[0]: https://github.com/westoque/cookie_inspector

Chrome does nothing to guarantee that an extension is built from the source that it claims.

You can verify that source, enable external sources in Chrome, ('developer mode' or somthing) and then install it - but that says nothing about what's on the Chrome store.

Thankfully, all Chrome extensions can at least have the source viewed.

The .crz file type for Chrome extensions is actually a .zip file, so the code can be inspected. If it's obfuscated this doesn't mean much though.

If it's there, I can't find it. I highly recommend https://chrome.google.com/webstore/detail/chrome-extension-s... to let you download and view the source of extensions.

But how do you know if that extension isn't compromised?

Install it in a VM, unpack it from the filesystem.

Thanks. Yes, it has been an issue and the adware is definitely unintentional.

Will fix immediately :)

Adding to my answer above: users are more likely to install your product too if you provide good customer support.

Post-mortem would be appreciated. As someone who has Chrome extensions in the store, how did you get malware-infected?

How do you accidentally write code to make your extension adware?

Reply on news.ycombinator.com