It seems every now and again some popular Chrome or Firefox extension decides to “go evil” seemingly out of nowhere.
Stylish got caught logging browser history, The Great Suspender turned out to be spyware, and, in the case of “get cookies.txt”, which was endorsed by youtube-dl, apparently the user is not the only one “getting” the cookies.
In most of these cases, it seems that trustworthy extensions get sold off to some shady third parties, or the developers just “turns evil”. This got me wondering: would it be an effective security precaution to simply disable updates for browser extensions? i.e. to download the extension manually from the developer, instead of relying on chrome web store / firefox addon catalogue. It wouldn’t help much if the extension you’re using contains malware now, but it would prevent malware being installed in potential future updates.
So, what do you guys think?
Not really. They don’t put their evil changes in the release notes.
So unless you’re willing to read through the source code changes, you’re just having an outdated version (with potential compatibility/security issues) for no real benefit.