Verifying Github source code is not sufficient, since you don't know the release contains that source code (when downloading fro the store). You'd have to verify signatures

Also, plenty of these extensions have been acquired by data firms or other sketchy places to then add your browser to botnets. If these are absolutely necessary for you, I highly recommend downloading the source and dumping it into Chrome/Edge via developer mode. At least then you know they can't update it in the background and you know what you're running.

.crx is just a .zip underneath. You can unzip it and inspect the code.

I thought it's just installed and that's it, cool...

It's not in the store, you download it

You could always download it from github, turn on developer mode in chrome (there's a little switch in the top right corner of the chrome://extensions ui), and then load it as an unpacked extension from source without ever touching the chrome web store.

I guess the answer is that you must be able to read the code and use your own judgement.

Here the actual code of the extension is basically 2 files, one of 114 lines and the other 66. Plain js, easy to digest. Looks pretty safe.

I'm with you on that one, that's why the code is on github. The best way to install it is to check out the code for any risks, download the repo as a ZIP file and install it.

By reading the source code? No wonder reddit used to go down so often...

I don't pretend to be a security expert in every language.

> No wonder reddit used to go down so often...

That's uncalled for. If this were reddit I'd have a much spicier retort.

just a joke, apologies :(

you leaving is actually part of the reason I left at the time, you were one of the few admins who regularly participated (it seemed)

No worries, I know it was a joke. You can't be a reddit admin for years and not a have a thick skin. :)