Except it's way easier to trust a bunch of extensions that the entire community vets, with a code you can inspect, instead of the thousands of ever changing 3rd party code executing in ads every day.
Pardon my ignorance, but not every extension is open source? Recently been a few stories of popular extension maintainers offered money to either include coffee or hand over all control to shady people.
Personally I wouldn't count thousands getting auto-updated malware installed in their browser before the world notices as vetting.
No, but this one is.
Besides ublock origin and noscript I avoid extensions like the plague. Autoupdates mean that any malicious actor could infect many before it gets pulled.
And even the ones that are not are quite easy to read:
- extensions are a just a zip file full of static assets
- they are rarely minified or obfuscaded
- they use a manifest and a set of standard API
- they are distributed through one plateform
So it's still way easier to keep them in check than ads, even if we didn't have to take the number of them in consideration.
And second, you trust them with totally different things. Ads run in the context of a website. Which is heavily sandboxed. Extensions run outside of it and can do anything they want to your browsing.