I've developed a few browser extensions, and every week I receive numerous emails with "revenue offer". Some experienced developers know that offers like these will inject malware into the browsers of your users, but scammers who make these offers will not tell you about it. They offer "integrations" that don't look so suspicious. Imagine how many developers have accepted these offers. Then look at the number of extensions in your browser and think about how much risk there is that you have an extension with malware.
    • Coolcoder360@lemmy.worldEnglish
      5·
      1 year ago

      I love the offer of almost $15k to then say they can bargain if the users are active, like if it’s worth that much without active users then that’s definitely shady.

  • Dariusmiles2123@sh.itjust.worksEnglish
    8·
    1 year ago

    It’s interesting to read as I never thought about the vulnerability these extensions are.

    I guess you should limit the number of extensions you have.

  • djsaskdja@reddthat.comEnglish
    8·
    1 year ago

    Exactly why most enterprise organizations disable them. You should too if you’re doing anything sensitive data.

    • munderzi@feddit.chEnglish
      3·
      1 year ago

      That’s why on my work PC I use a completely vanilla Firefox, gotta live with the ads. But I’m not risking giving full access to website content to any extension

  • No Face@sh.itjust.worksEnglish
    91·
    1 year ago

    To add to the blog post, if you use user scripts, utilize your manager’s blacklist and learn REGEX.

    If needed, use Group Policy, Regedit or .plists on macOS to blacklist domains to prevent an extension from running on them. As an example, I use Shutup.css to block comments online, but on something like Lemmy, I want to see comments as that’s primarily how content is created and adding it to my extension domain blacklist prevents the extension from running on the website or any lemmy domains.

  • Franzia@lemmy.blahaj.zoneEnglish
    4·
    1 year ago

    I thought my ISP already had this data and is selling it. Should I go make sure all my extensions are 100% kosher?