This would be really neat, and not that hard to build from what I know about building extensions. Basically just store a hash of file, whenever external files are loaded see if their hash exists in your list, if not block it from loading until it's been reviewed.

As an extra (paid-for?) feature hook into an online system that keeps track of hashes of known-good popular libs, and can mark as untrusted when a vulnerability is found with a version of e.g. jQuery and auto-flag that for users.

But how is it going to know the authentic source?

The source doesn't matter, only the content. If the hash of the file matches the hash you've already approved for jquery-3.3, then the file is (unless someone's found a collision in the hashing algorithm that hasn't been disclosed) jquery-3.3.

I think what they meant is how do you identify the authentic content the first time around?

By manually reviewing the said file or by trusting a central authority of some sort.

And how do you know the browser plugin source code have not changed?

In Firefox you can turn off updates for individual plugins, so you only need to trust Mozilla and the extension author once.

Chrome is currently looking into getting rid of the ability for extension authors to obfuscate code -- minification is the highest level of obfuscation they'll accept now, and (opinion me) minified Javascript code is not that hard to read. Chrome does still need to get on the "let people turn off automatic updates" train though. But I'm not sure what to tell you about that -- you should not be running Chrome as your main browser anyway if you care about security/privacy.

I'm not sure if Mozilla is planning to follow suite on blocking obfuscation. Assuming they are, if you don't trust the extension author even for the initial download, install the extension, read through the source code natively on your own computer, and then set it to not update after that point.

It would be better if you could download the unminified/unbundled source code and install the extension yourself locally, but for whatever reason Firefox and Chrome have decided that's insecure. I feel the opposite, since requiring signed extensions makes it harder for me to audit code or place additional safeguards around that code, but... eh, what do I know?

In any case, the current situation for extensions on Firefox is not all that different from installing something in a standard software repository.

>if you could download the unminified/unbundled source code and install the extension yourself locally

Do you mean for a proprietary extension? AFAIK loading sources locally works fine in chrome.

In Firefox, loading unsigned extensions is severely restricted. It's a separate process to install them, and they'll only last until you restart the browser.

I'm not sure what Chrome's specific rules are; I think they allow loading local sources in dev mode, but warn you about it every time the browser launches? I generally advise people to avoid Chrome if they care about security/privacy anyway, so I've never checked in detail.

But if Chrome does have a way for you to easily load extensions from source, and you're comfortable using it as a main browser, that could be a valid way for you to tackle a problem like this.

Interesting to see Mozilla restricting freedom that given their userbase.