search

notlmn / copy-as-markdown

🖱 Browser extension to copy hyperlinks, images, and selected text as Markdown with GFM support
MIT License
323 stars 48 forks source link

Chrome extension version 24.6.30 requesting permission to "Read and change all your data on all websites" #49

Open ezzatron opened 3 months ago

ezzatron commented 3 months ago
Screenshot 2024-07-02 at 17 21 16

Seems like a mistake?

tonytamps commented 3 months ago

I'm extremely suspicious about this new permission. I can't see how the recent changes have caused the request for the new permission and it gives me concern that the extension source does not represent the distributed extension.

This is probably just a mistake, and notlmn does a good job of being transparent regarding deployments, but until this is explained I have uninstalled it. The supply chain could be compromised.

notlmn commented 3 months ago

Distribution happens once every week, the source might be different from when the release has happened if you are looking at the main branch of the repo. If you look at the commits for the tag 24.6.24, you'll see what the mistake was.

I have been trying to push for newer release as Firefox releases are almost instant, but Chrome release need manual review from CWS side which is why the releases are still off between these two platforms.

It is fair to suspect and be vigilant of the botched releases until then, you don't have to take my word for it. Meanwhile anyone can download the published extension manually and inspect the code to confirm that's there's nothing malicious in there.

Please wait until 24.7.1 (still under review) to be release onto Chrome Webstore that should not have this problem.

notlmn commented 3 months ago

For anyone following, the fix was already sent out in #47, but waiting for the CWS release.

tonytamps commented 3 months ago

Thanks for the pointer to checkout that tag. That makes sense 🙇 Much appreciated.