Hacker News Reader

Comment by BugWatch | Hacker News Reader

Life's complexity constantly increases, but our available time is fixed... we need a community-run automated-- and user-reported addon analysis and checking service, provided though another addon, which notifies you when one of your installed (or currently page open) addons "goes to the darkside"... sigh

View on HN

All of the "recommended" addons for Firefox (and maybe the most popular ones too?) are regularly reviewed by Mozilla for malicious code. I haven't heard of any problems with those ( probably because most problems are caught before they get pushed to users)

That is actually not a bad idea... but it does go to show the utter failure of Google's extension store that a community-run system would be necessary to police their platform.

The alternatives are either fully open repositories (although a slightly motivated programmer can easily view the source of any extension) or a walled garden a la Apple app stores. Am I missing something here?

I think the silent, automatic updates and wide-reaching permissions that aren't communicated in an understandable way to end users are the real issues.

A good sandbox with suitable access control would help too.

Extensions have sandboxing and permissions but to be able to do anything moderately useful you need access to literally everything.

For something as basic as an ad blocker or a theme loader you need full access to every page.

That's ok, as long as you don't phone home.

Well, this is not really true as the extension can still do a lot of damage in e.g. online banking.

This is not much of an issue on Linux distros where everything is done in the open.

Reply on news.ycombinator.com