<story><title>Don&apos;t fuck with paste</title><url>https://github.com/aaronraimist/DontFuckWithPaste</url></story><parent_chain><item><author>Nifty3929</author><text>This is a bit cynical isn&amp;#x27;t it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control.&lt;p&gt;Of course you&amp;#x27;re right in a technical sense. They could do whatever they want later.&lt;p&gt;But still let&amp;#x27;s celebrate and attitude like this rather than criticizing it.</text></item><item><author>jessriedel</author><text>&amp;gt; In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as &amp;quot;can read and change all your data on websites you visit.&amp;quot; That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read all the code to see how this extension works, and what it&amp;#x27;s [not] doing with your data.&lt;p&gt;The problem is that even if I read the code, or more likely chose to trust that someone has, it&amp;#x27;s not guaranteed to remain true for future updates.  The author&amp;#x27;s scruples may weaken with time, or they might sell the extension, etc.  (I think Chrome&amp;#x27;s extensions auto-update, but even if they didn&amp;#x27;t I&amp;#x27;d still have to remember that this extension is one that I can&amp;#x27;t assume it&amp;#x27;s safe to update.)</text></item></parent_chain><comment><author>Beldin</author><text>This has been used as an attack vector in the past: spot reasonably popular plugin; make author an offer; inject whatever tracking&amp;#x2F;other malwate stuff new owners want (typically after a delay).&lt;p&gt;So now we&amp;#x27;d have to trust the author to do thorough vetting of a potential buyer and also not sell if vetting is inconclusive. And this against an adversary aiming to cheat their way past vetting.&lt;p&gt;Might be a cynical take, but it is not one without reason.&lt;p&gt;As a sibling comment points out, this is due to the permission model. This doesn&amp;#x27;t let the author entirely of the hook though: the permissions model created the situation, the author chose a particular path. The consequences may not have been foreseen by either, but they do exist and affect users.</text></comment>
<story><title>Don&apos;t fuck with paste</title><url>https://github.com/aaronraimist/DontFuckWithPaste</url></story><parent_chain><item><author>Nifty3929</author><text>This is a bit cynical isn&amp;#x27;t it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control.&lt;p&gt;Of course you&amp;#x27;re right in a technical sense. They could do whatever they want later.&lt;p&gt;But still let&amp;#x27;s celebrate and attitude like this rather than criticizing it.</text></item><item><author>jessriedel</author><text>&amp;gt; In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as &amp;quot;can read and change all your data on websites you visit.&amp;quot; That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read all the code to see how this extension works, and what it&amp;#x27;s [not] doing with your data.&lt;p&gt;The problem is that even if I read the code, or more likely chose to trust that someone has, it&amp;#x27;s not guaranteed to remain true for future updates.  The author&amp;#x27;s scruples may weaken with time, or they might sell the extension, etc.  (I think Chrome&amp;#x27;s extensions auto-update, but even if they didn&amp;#x27;t I&amp;#x27;d still have to remember that this extension is one that I can&amp;#x27;t assume it&amp;#x27;s safe to update.)</text></item></parent_chain><comment><author>shakna</author><text>It&amp;#x27;s not cynical - see what happened to ublock. That kind of mess has happened, and will continue to happen, and should be a factor in what you choose to trust.</text></comment>