There are plenty of reasonably trustworthy extensions. The logic of "it is a cybersecurity and privacy product, therefore it is the only thing I trust" is kind of terrible. That's if anything a category of products that is full of strange software, see "antivirus" software

GP very much did not say to trust security and privacy products in general. They said to trust two such products in particular, which are well-established and trusted. There are prominent examples within the past few months of "privacy" extensions embedding trackers and monetizing user data.

No, GP said to only trust these two extensions and no other extensions. While they are entitled to their opinion, IMO that is such ridiculous. There are many many extensions which provide value which don't do shady things.

Many antivirus products are bordering on malware these days.

And all the other software is bordering on spyware.

I remember a not-so-long time ago that people were worried chrome would drop the extension system as a whole and therefore drop the ability of users to customise how they view web pages.

Now extensions are a "security threat". Here we go...

Yes, if an extension can override CSP directives to allow arbitrary connect-src exceptions, it effectively means that any data in any form on any page is now susceptible of having that data sent to an attacker-owned URL.

The solution doesn't necessitate removing extensions, it just means potentially constraining the API surface of extensions in order to mitigate the attack surface.

Extensions don't need to modify headers to view anything in the dom or make requests with the credentials of the page it's running in. The only thing it can't do is directly interact with the javascript running on the page (and vise versa).

This is misunderstanding. Extensions can read any data even with restrictive CSP. Malicious extension then can use other channel than the currently opened tab to exfiltrate them. There are many.

Extension users do want the extensions to interact with pages, often including cross-origin requests. That is what extensions are for and they won't work with restricting API surface.

both those things are true

Ok and now what?

Is this snark meant to imply that you think that people shouldn't acknowledge a dilemma when one exists, unless they also have a solution to offer for said dilemma?

Google has nigh-on monopoly power over the browser ecosystem. Also, extensions are by-and-large malware. Making people aware that extensions are mostly malware helps Google to consolidate its monopoly; but also (obviously) helps people to avoid malware.

We don't want Google to control the Internet, and we don't want browsers to be full of malware. That's a dilemma. It has no obvious solution. But it's better to be aware of the dilemma — and so realize there is no easy solution — than to ignorantly push for one side or the other to "win."

At this point I'm convinced that there has to be a really strong opposition, or the Internet becomes Google's jail. We are basically seeing the dystopian side of "zero crime policies" acted out online as they slowly but surely evolve the definition of "malware" and erode away at our freedoms.

Google could be educating users to make their own responsible decisions, but it's far more profitable to keep them uninformed and feed them propaganda to maintain the paranoia that lets it monetise and take control away from them. Being ultimately an ad company, it thrives on deception.

and so realize there is no easy solution — than to ignorantly push for one side or the other to "win."

Twenty years ago, what Apple Google Microsoft do today with their software would be widely considered adware/spyware. One side has already won the battle; we can't let it win the war.

"Give me liberty or give me death," as the famous saying goes.

What makes those extensions not "potentially malware"? I am assuming it is because you (or someone you trust) vetted them and decided they were trustworthy.

Why wouldn't this same idea apply to any other extension? You are right, everything is potential malware (the two extensions you mentioned included). There is nothing magical about the two extensions you mentioned.

UBO is good cause like the whole internet trusts Raymond Hill (gorhill).

And 1000s of eyeballs are on those works.

Ublock Origin only exists because gorhill's original Ublock became evil due to a critical management mistake onboarding an untrustworthy parry. Everything is a risk.

I'd argue it's getting counter-intuitive though, similar to the bystander effect. Yes it is popular but if everybody thinks everyone else is verifying the source, then no one is.

When is the last time you checked out the UBO Git?

Sure, but the comment I relied to seemed SO sure that those were the only two legitimate extensions. My point was that there might be others that also have built up that level of trust, and to assume that you know the exact list of trustworthy extensions is putting too much confidence in your knowledge of everything.

Or extension that limit themselves their permissions to specific sites. Like SponsorBlock and Reddit Enhancement Suite.

That's actually the complete list of plugins I have, uBlock Origin, Privacy Badger, SponsorBlock and RES.

So much this. Every extension is an attack vector. They have post-decryption access to all of your web content and largely make the entire benefit of HTTPS moot if you have a bunch of them.

Every extension you install should be carefully vetted and only enabled as long as absolutely necessary. It's the top malware vector I see today.

You could say the same thing about almost anything: browsers, new root certificates, firewall software, antivirus software, anything you install on your own device, etc. Essentially, they're saying "anything you want to execute on your machine is a potential attack vector", and the only way to solve it is: "your browser is now your dumb-terminal into the mainframe (website), and we won't let you the device owner install anything that may potentially tamper with the data coming from our safe mainframe to your screen".

This is not where I want computing to go, and we're all just playing cat-and-mouse games feigning "security" when really "we" just don't trust the "plebs" to administer their own machines and keep themselves safe. This is arguably where Android is already, so one need only look there to see the future of computing and how the browser and "security" is being used as a trojan horse to get there.

This is an absurdist point of view.

If you go to the average non-technical user's Chrome extensions tab, they have 10-12 extensions. 7 of them are actively malicious.

This isn't like a "hey, freedom allows you the freedom to make mistakes" thing. This is a "good practice hasn't even been attempted here, and it's the top vector of all bad things ever" thing.

It's fine for browser extensions to exist, they serve a purpose. However, all existing extension stores should probably delist the entirety of their collection, solely re-accept extensions which an actual software engineer has reviewed, and make it much harder than one click to inadvertently install one when a website asks you to.

Is it more of an attack vector than the hundreds of unvettable third-party scripts the site usually loads itself?

Absolutely. Scripts compromise your activity on the site they're loaded on. Extensions compromise your activity on every single website you go to.

If you're looking at it that way, then we should apply even more scrutiny over native apps we install on our machine and not single out extensions.

Also, not all extensions run on every single site. Also, some extensions actually help in blocking malware, crypto-trackers etc so the potential upsides are also great.

A script loaded by a site needs to escape its sandbox. I assume an extension script is not in its own sandbox so it can read you banking details when you visit a banking website. I imagine they can read key presses so an extension can know your banking passwords.

Which is why extensions also nowadays only served via a web store which has moderation policies and moderators which look for this kind of stuff.

The Chrome Web Store is functionally a malware distribution system. There's no real moderation to speak of, and the vast majority of desktop PC malware is distributed by it.

Decentraleyes is also very helpful on the privacy front. It will cache commonly included libraries like jQuery from various CDNs like Cloudflare, preventing them from tracking you across the internet. ClearURLs is another one that I install on a freshly-opted-out Firefox, to avoid those ubiquitous tracking parameters in various URLs.

You forgot Cookie Autodelete, NoScript, and HTTPS Everywhere.

I think the fact that people are listing different sets of extensions they trust is good evidence that you can't just say "this list is the only list of extensions you can trust"

Frankly this is why I prefer a "maximalist" browser like Vivaldi (and old-school Opera) that focuses on building features into the core browser rather than supporting extensions. There are benefits to having a feature be provided directly by the browser, not the least of which is the trust model. There's a trade-off of fewer features overall and less customization, but it's a trade-off I'm personally fine with.

Different people use different extensions. I have seen quite a few people avoid NoScript, not because they don't trust it, but because they considered manually selecting which scripts could run not worth their time.

Outside of a small list of security extensions numbering a dozen or fewer, you can't really trust much of anything in the extension webstore.

Well, this chain started with "there are exactly two extensions you can trust, no more", and now we are up to a dozen.

0 < n < 12 < CHROME_WEB_STORE_MAX (which is >100k)

So I shouldn't have my bitwarden extension?

LastPass, 1Password, ...