How much time on average do you spend on reviewing the source code of a given browser extension before you install it? Also, how do you make sure that the published source code is 1:1 with what you are actually installing?
back
2 comments
You don't need to do a thorough code review to benefit from the source code: the Chrome/Chromium web browser allows the user to load unpacked extensions directly from any folder.
So simply git clone the extension, have a quick look at the recently opened (and closed) issues/PRs for any red flags, git checkout the most recent tag, and load it as unpacked.
Then you are guaranteed to have the source code of exactly the extension you're running, and have done a reasonable amount due diligence for malware.
And if you're interested at any point in the future you can do a code review.
It's a simple strategy. Here's an example: https://github.com/igrigorik/videospeed
Why did this post get downvoted? they are fair enough questions to "given enough eyeballs, all bugs are shallow", especially for browser plugins.
Yeah I'd go as far as to say "How are you sure that open code is what's in the actual package" is the most important question to ask here.