Supposedly, Chrome Web Store is hosting more than 200k browser extensions by now and adding 400-500 new ones every day. I wonder how many of these are malicious. 60%? 80? 90?

It’s definitely most them. My research has shown that malicious actors will spam Chrome Web Store with many very similar submissions. Since their goal is to direct attention away from legitimate add-ons offering the same functionality this strategy is unsurprising. The end result is that if Google ever succeeded removing malicious submissions they would be left with far fewer add-ons to manage.

One indicator is: Chrome Web Store only hosts somewhat more than 60k themes. Themes are much simpler to create than extensions, so one would expect there to be considerably more themes than extensions. That was definitely the case on Mozilla Add-ons back when “lightweight themes” were introduced – the number of available themes skyrocketed. Even now Mozilla Add-ons has more themes than extensions. But themes don’t allow extracting user data…

RE: https://infosec.exchange/@WPalant/113232106425106704

There is an interesting back and forth on refoorest, the story I published 18 months ago. In the aftermath of my article they got pulled from Mozilla’s and Google’s add-on stores while Microsoft just didn’t react. Later they were reinstated – no idea what kind of changes they’ve implemented for that, I didn’t notice anything relevant. Now my attention was brought to the fact that Google and Microsoft disabled that extension as malware (Google back in October already, Microsoft a few weeks ago). Yet on a quick glance I still cannot see any problematic behavior beyond what I’ve documented originally. Well, maybe them advertising Polypoly search now (“the first search engine that rewards users with weekly prizes” – yes, totally not a scam).

Side note: Opera just pulled them immediately and never reinstated from what I can tell.

https://palant.info/2024/10/01/lies-damned-lies-and-impact-hero-refoorest-allcolibri/

#refoorest #ColibriHero #ImpactBro

So, where do the cool kids host their code these days? I went to GitLab and saw “Finally, AI for the entire software lifecycle” – ok, I guess this means no GitLab for me. Codeberg then? Or something else?

Note: no, I’m not self-hosting. Yes, I know how to do it, I’ve been doing it for a decade. But I still won’t.

#Github #GithubCopilot #GitLab

Looks like the Karma connection I’ve been writing about is still quite busy, and Google is still far too inconsistent with taking down their extensions: https://www.xda-developers.com/google-featuring-chrome-extension-months-malicious/

And once again this article shows: people expect that “Featured” badge on extensions to mean something. But it really doesn’t.

Gotta love it how the Internet Archive managed to capture the state of the internet so perfectly, here the Netscape Bug Report Form from 1999: https://web.archive.org/web/19990222143253/http://help.netscape.com/forms/bug-client.html

You would put your email address into the form in the ad frame, right?