Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
We get pwned when Chrome plugin devs sell out. A look at malicious auto updates (keydiscussions.com)
2 points by spenvo on June 25, 2021 | hide | past | favorite | 3 comments


Plug-ins and extensions to GUI applications tend to end in tears. If you add enough extensions to your web browser or IDE it will be FUBAR.

The reason?

One reason is that any code that uses CPU and blocks rendering can freeze the app. Browsers avoid this more than anything but at severe cost (asynchronous everything, limited content filtering, …). No individual memory allocation is bad but make enough of them and you have a problem. Malware is a big problem but is down the list.

I tell people to (1) not install extensions, (2) only install a few trusted extensions that save resources (ad blockers, anti tracking)

Installing some extension because it is going to make it ‘easier’ to use a feature on some website is like buying stuff on the dark web and being amazed when you get a visit from the FBI.


Autoupdates are like not locking your door so that the burglar can rob you without breaking in.


Precisely! Especially for your average Chrome extension from a developer you don't trust.

(Also, author here: I submitted the link with a shorter title that works best with HN's character constraints)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: