Put another way, if the browser manufacturers run an extension store, they are (or ought to, at least) endorse the extensions in that store as reasonable to install. I don't see how they can do that without source. I think they could sort of make that endorsement without proactive auditing if they can remove extensions they discover are malicious, but if they can't even human-audit the source in response to a report of problems, I don't think there's any way they can responsibly offer extensions to their users.
Mozilla does a lot to protect users from malicious extensions, thousands times more than Google.
Right that solved pirating, torrenting and hacking.
None of the above happens on internet any more since cfaa was passed.
Shady people will do shady stuff, no mater what law says. And you will never catch all or even most of them.
So if it's all the same it would be better if we come with solution, that prevents abuse from happening in the first place
If you can buy or take over responsibility for extension foo and automatically exploit thousands of people who automatically get updated to foo 1.1 now with 1000% more malware then it will happen.
If you have me/foo and you want to take over maintaining foo and you have to create you/foo and convince people to remove the working version of me/foo and switch to your you/foo this is a small burden for legitimate users but a higher bar for scummy companies whose accounts will doubtlessly either have a bad history or far more likely none at all to lean on.
Further the time required to convince users to switch will be much longer leading to more time for something to be discovered as malicious before users are effected.
Best this whole process makes exploiting users much less valuable and thus you have less of it to start with.
Unless you think plugins for HTTPS Everywhere, Google Translate, and LastPass should be signed by an individual developer - in which case you'll have to solve the problem of what to do when that developer moves between jobs :)
It's a superficially attractive answer, but the reality is that it's unenforceable.
Nation states get unstuck here on taxation, and bluntly it is unlikely any browser vendor will ever invest as heavily as nation states do on getting revenue.
To be blunt most current software in use in US/Europe already comes from US/Europe.
A buyer company or individual ought to have to create a different name and convince users to install/trust their extension if ownership is transferred instead of merely taking control of the existing name and having the next automatic update install malware.
Extension systems and language specific package managers on the overall have garbage security and are going to be a way bigger problem in the future. They are low hanging fruit.
I suppose you could argue that when Facebook buys Instagram the Instagram app should be uninstalled from users' phones and all their accounts and posts deleted, because they didn't agree to trust Facebook or consent to the data being shared with Facebook. There's a certain logic to that, but it would be a big change to how the current tech ecosystem works.
Also I think it's reasonable for browsers to require complete auditable source (even if there's some obfuscation happening before it gets to users), which would probably have a deterrent effect on weakly-ethical developers - it's harder to ship code you can plainly see is malicious than to just sell the extension and wipe your hands of it. (There are enough stories of founders who care about their companies selling startups to acquirers that don't that I think there is something in human nature that makes it easier to hand off your creation to someone who will do bad things with it than to do the same bad things yourself.)
Holding an individual responsible for the company is simply not plausible in most jurisdictions for anything short of actual criminal actions.