News for hackers. Stuff that matters.

A comment on Automa: A Chrome extension for automating the browser. Parent comment

Re:Automa: A Chrome extension for automating the browser by randunel on Sunday November 21, 2021 @04:00PM (#29299676)
How can you verify that your extension actually runs the code that's in the open source repository? Extensions' integrity can be signed and verified against something that was also authored by the creator, but what verifies that the code in the linked repository is the same one, not a different one?
[ Parent | on HN ]
Re:Automa: A Chrome extension for automating the browser by robbedpeter on Monday November 22, 2021 @01:35AM (#29303491)
Checksums are super useful, too - if you build the project yourself, you can get the checksum, and if it's different than the one in the store, you can ask questions.

A web of trust style checksum confirmation network would be invaluable for browser extensions. Building that into a browser's security model would be great - an extension has to be validated with a minimum score or it's disabled unless manually activated.

[ Parent | on HN ]
Re:Automa: A Chrome extension for automating the browser by forgotmypw17 on Sunday November 21, 2021 @05:18PM (#29300317)
I think you can build it yourself and install that?
[ Parent | on HN ]