News for hackers. Stuff that matters.

A comment on Clarifications regarding arrest of climate activist. Parent comment

Re:Clarifications regarding arrest of climate activist by wizzwizz4 on Monday September 06, 2021 @11:28AM (#28434635)
There's no design of browser add-on that could check for that. They update it every so often as it is, and they could serve the modified version to everybody, but it only does the modified behaviour for some people.
[ Parent | on HN ]
Re:Clarifications regarding arrest of climate activist by dane-pgp on Monday September 06, 2021 @01:57PM (#28436271)
The browser add-on that comes closest is Signed Page[0], and in theory it could provide TOFU level security by requiring the user to opt in to new versions. For unclear reasons, though, the devs seem to be against implementing that.[1]

Any system for protecting against backdoors assumes that someone is auditing the code to check for user-specific code paths, so the only extra layer of security to add is some sort of Binary Transparency. A good example of that is Sigstore, which is being experimentally integrated with the Arch Linux package ecosystem.[2]

[0] https://github.com/tasn/webext-signed-pages

[1] https://github.com/tasn/webext-signed-pages/issues/13

[2] https://github.com/kpcyrd/pacman-bintrans

[ Parent | on HN ]