Actually, npm supports "provenance" and as it eliminated long lived access tokens for publishing, it encourages people to use "trusted publishing" which over time should make majority of packages be auto-provenance-vefified.

https://docs.npmjs.com/trusted-publishers#automatic-provenan...

If the RPM/deb comes from a Linux distribution then there is a good chance there is a separate maintainer and the binary package is always built from the source code by the distro.

Also if the upstream developer goes malicious there is a good chance at least one of the distro maintainers will notice and both prevent the bad source code being built for the distro & notify others.

I agree but let me play the devil's advocate. I'll channel Stallman:

Same argument can be applied to all closed source software.

In the end its about who you trust and who needs to be verified and that is relative, subjective, and contextual... always.

So unless you can read the source code and compile yourself on a system you built on an OS you also built from source on a machine built before server management backdoors were built into every server... you are putting your trust somewhere and you cannot really validate it beyond wider public percetptions.

CRX Viewer is handy for quickly checking what's been published:

https://robwu.nl/crxviewer/

The open source one automatically publishes to the Chrome Store from GH actions so that there is no human involvement in the deployment process.

I'm currently in the process of setting that up for the one I'm building, because this transparency is very important to me) and it is a pain in the butt to do so. You have to go through a few verification processes at Google to get the keys approved.

> How do you check that the open sourced code is the same one that you are installing from the extension repository and actually running?

Extensions are local files on disk. After installing it, you can audit it locally.

I don't know about all operating systems but on Linux they are stored as .xpi files which are zip files. You can unzip it.

On my machine they are installed to $HOME/.mozilla/firefox/52xz2p7e.default-release/extensions but I think that string in the middle could be different for everyone.

Diffing it vs what's released in its open source repo would be a quick way to see if anything has been adjusted.

I'm running Uniget on Win11 and this is my worry there. Provenance of installs vs the actually released files.

This kind of nihilistic comment doesn’t do anything for me.

There’s always a possibility of problems along the chain. You are reducing your risk not eliminating it.

I wish we had something like "source hash" available in all repositories.

>Do you also audit every part of every car you buy or medicine you take? Or do you rely on large well-established institutions to do that for you?

Cars are under quite strict laws that software isn't. And there is only a small number of car vendors, while there are several orders of magnitude more extension vendors. Also a car vendor is a big company with many audits and controls, an extension "vendor" could just be some guy in his garage office, who just sold it to scammers, even for popular extensions.

And I still wouldn't trust a modern car using subscriptions and code updated.

There are no established institutions for checking add-ons. The stores claim doing some checks, but seems enough is slipping through their net. It's also common sense to not buy something critical from a random anonymous source on the internet.

“Don’t trust Google” is table stakes for being on the Internet over the past couple decades.

My car can't login to my bank account.

No, Safari is really no different here from Chrome, and indeed there's broad compatibility between the extension API, such that in many cases you can use a Chrome extension unmodified in Safari.

On HN of all places it's not that implausible that someone might be running Linux and Chromium or Firefox, surely?

If they live in California, they're most assuredly borrowing prestige through licenced usage of apple hardware.

Because let's get real, no one ever gets a job in tech if they're not an iPhone user right?