News for hackers. Stuff that matters.
Re:Show HN: How many miles do you think you've scrolled today? by mceachen on Tuesday May 05, 2020 @04:14PM (#23084452)
The problem with any chrome extension is that there's no guarantee that the git repo matches the bag of bits that you're installing. No-prompt auto-updates exacerbate the issue.

Installation of software will always require a leap of faith that the publisher doesn't have ill intent.

Re:Show HN: How many miles do you think you've scrolled today? by chapplap on Tuesday May 05, 2020 @04:37PM (#23084745)
You can install the extension directly from a cloned copy of the Github repo (basically as if you were the extension developer). No auto-updates or anything since it's just loaded from some files on your disk. Chrome will nag you about it from time to time though since getting people to install unsigned extensions is a common attack vector.
Re:Show HN: How many miles do you think you've scrolled today? by revicon on Tuesday May 05, 2020 @04:18PM (#23084491)
Try this: https://chrome.google.com/webstore/detail/chrome-extension-s...

Views the source code straight from the google store

Re:Show HN: How many miles do you think you've scrolled today? by mceachen on Tuesday May 05, 2020 @06:17PM (#23085774)
Thanks for sharing, but that's yet another publisher I have to trust with "read and change your data on clients2.google.com, read your browsing history, manage your downloads."

It'd be great if chrome and firefox allowed open source chrome extensions to be compared with their git source tree, possibly with diffs between releases.

Still, though, how many people will go through that effort?