News for hackers. Stuff that matters.
Re:Show HN: A Firefox extension to add latency to distractin... by greenie_beans on Friday February 14, 2020 @02:36PM (#22329552)
I used to have this exact same fear and never downloaded any extensions bc of that, until I started making browser extensions. Pretty much any useful extension needs the access that prompts that generic message about accessing all the data.

Any extension that's listed on the web stores have to be reviewed for malicious code, and they must do what the listing say they do. So if your browser extension has your passwords, then that extension would be considered a password manager.

The extension probably listens to the IPs of well-known time wasting websites like HN or reddit, then adds a latency to the browsing. Same with an ad blocker -- they know every site you visit but only to compare them with their blacklist of advertising IP addresses.

Of course, you have to trust they aren't doing anything else with that info, which you can probably assume you're mostly safe if you don't need an account to use the extension.

Re:Show HN: A Firefox extension to add latency to distractin... by skipants on Friday February 14, 2020 @02:51PM (#22329707)
I believe only "recommended extensions" for Firefox are tech reviewed, which this one is not.

https://support.mozilla.org/en-US/kb/recommended-extensions-...

Re:Show HN: A Firefox extension to add latency to distractin... by pzmarzly on Friday February 14, 2020 @03:16PM (#22329955)
According to [0], Mozilla requires all extensions to have a source in human-readable format and runs a test suite on them. They mention "code review" there, but don't say whether it's manual or automatic. I'd love to hear about it from someone who has some experience with the process.

[0] https://extensionworkshop.com/documentation/publish/submitti...

Re:Show HN: A Firefox extension to add latency to distractin... by Anon1096 on Friday February 14, 2020 @03:43PM (#22330208)
For my extension the review was automatic, and flags things like direct html editing. I only have a few hundred users though, so I'm not sure at what point they decide to do manual reviews.
Re:Show HN: A Firefox extension to add latency to distractin... by dessant on Friday February 14, 2020 @09:49PM (#22332806)
Mozilla runs an automatic check on all extension versions before they get published, and Recommended extensions also go through a manual review before publication.

Listings which do not participate in the Recommended extensions program may also get a manual review after they were published, but immediate human review is not guaranteed.

If you're a developer, I'd recommend disabling automatic extension updates in Firefox, and configuring a script to get notified about updates, even if you only use Recommended extensions.

Extension source viewer is excellent for reviewing updates yourself before installing, and it is maintained by Rob Wu, an engineer at Mozilla.

https://addons.mozilla.org/en-US/firefox/addon/crxviewer/

Re:Show HN: A Firefox extension to add latency to distractin... by chadlavi on Friday February 14, 2020 @05:00PM (#22330825)
There's a link to his github in the extension page. You can read his source code: https://github.com/OskarDamkjaer/FirefoxDelayWebpage

most of the relevant code is in https://github.com/OskarDamkjaer/FirefoxDelayWebpage/blob/ma...

Re:Show HN: A Firefox extension to add latency to distractin... by wizzwizz4 on Saturday February 15, 2020 @05:47AM (#22334505)
It actually matches a regular expression against the URL; I don't think it looks at the IP addresses.