News for hackers. Stuff that matters.

A comment on The Most Dangerous Code in the Web Browser. Parent comment

Re:The Most Dangerous Code in the Web Browser by fyarebox on Monday August 03, 2015 @11:06PM (#10001408)
The issue with this is updates. In most of these cases with malicious addons, the addon was safe initially, then the author slips in some tracking code / spyware etc. at a later date.

While I might inspect a source for a single sketchy looking addon at installation, inspecting every addon every time it's updated (sometimes weekly or more often) is absurd, and that's why you get cases of adware slipping by for months before anyone notices.

[ Parent | on HN ]
Re:The Most Dangerous Code in the Web Browser by userbinator on Monday August 03, 2015 @11:13PM (#10001434)
You're very correct about updates, but on the other hand I wonder what type of addon needs to be updated at such a high frequency?

Although making a way to easily see the changes made with each new version, something diff-like, would alleviate the problem.

[ Parent | on HN ]
Re:The Most Dangerous Code in the Web Browser by nallerooth on Tuesday August 04, 2015 @02:16AM (#10001942)
One part of the problem is that most of the extensions are updated silently in the background. Some extensions fire up a new tab with a page displaying new features and such, but this is not a requirement in any way.
[ Parent | on HN ]
Re:The Most Dangerous Code in the Web Browser by deian on Tuesday August 04, 2015 @02:33AM (#10001973)
Even worse, they only update if they don't need any additional permissions. Thus incentivizing developers to ask for more permissions up front.
[ Parent | on HN ]
Re:The Most Dangerous Code in the Web Browser by DonHopkins on Tuesday August 04, 2015 @04:50AM (#10002278)
That's exactly what I wonder about Adobe Acrobat so often.
[ Parent | on HN ]