Hacker News Reader

As an open-source extension developer, I wish there was a way to prove that the extension uploaded is generated from a specific git commit. It wouldn't solve everything, but it would make it easier for anyone to audit the code and know that it actually matches the code I've uploaded.

View on HN

Indeed. I was thinking about this, and would argue this should really not only exist... but be the only way extensions with this level of wide-sweeping access should be permitted to be published.

Chrome team, if they were security-focused, would not permit any closed source extensions which have access to all website data.

People don't seem to understand sometimes that if an extension has this sort of access, you need to be able to trust your browser extensions as much as you trust your browser itself.

I'd add to that "not obfuscated" too since JS minimization and WASM can be as obscure as binary.

Reply on news.ycombinator.com