News for hackers. Stuff that matters.

A comment on Show HN: Little Rat – Chrome extension monitors network calls of all extensions. Parent comment

Re:Show HN: Little Rat – Chrome extension monitors network c... by meesles on Monday August 14, 2023 @12:15PM (#37122783)
Verifying Github source code is not sufficient, since you don't know the release contains that source code (when downloading fro the store). You'd have to verify signatures

Also, plenty of these extensions have been acquired by data firms or other sketchy places to then add your browser to botnets. If these are absolutely necessary for you, I highly recommend downloading the source and dumping it into Chrome/Edge via developer mode. At least then you know they can't update it in the background and you know what you're running.

[ Parent | on HN ]
Re:Show HN: Little Rat – Chrome extension monitors network c... by SoKamil on Monday August 14, 2023 @12:18PM (#37122824)
.crx is just a .zip underneath. You can unzip it and inspect the code.
[ Parent | on HN ]
Re:Show HN: Little Rat – Chrome extension monitors network c... by throwaway290 on Monday August 14, 2023 @12:39PM (#37123093)
I thought it's just installed and that's it, cool...
[ Parent | on HN ]
Re:Show HN: Little Rat – Chrome extension monitors network c... by Exuma on Monday August 14, 2023 @04:05PM (#37126117)
It's not in the store, you download it
[ Parent | on HN ]
Re:Show HN: Little Rat – Chrome extension monitors network c... by snowycat on Monday August 14, 2023 @11:54PM (#37129975)
You could always download it from github, turn on developer mode in chrome (there's a little switch in the top right corner of the chrome://extensions ui), and then load it as an unpacked extension from source without ever touching the chrome web store.
[ Parent | on HN ]