Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I found a GNOME extension through a Google search (using Chromium), and was very surprised that I could simply toggle the On/Off switch to have the website install a full GNOME extension on my computer without any other manual steps involved. (tested, this works with Firefox as well.) Granted, it does pop up a dialog box asking me to confirm installation, but ...

  1. While this is great for ease of use and usability, aren't there security vulnerabilities with this? I would be interested in knowing how exactly this feature works, and whether I should be concerned about any "backdoors" that this might allow for hackers to easily install executables on my machine.

  2. Are the extensions on the GNOME site vetted? Is there a way to tell whether extensions are safe or not?

  3. Are the Chromium and Firefox browsers modified by GNOME in order to allow for this feature? Are there any other custom GNOME Chromium/Firefox changes that users should know about?

UPDATE: Having understood how this works, I now believe this is a really great feature especially for non-technical users, but it did alarm me a little when I first encountered it.

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Yes, and no.

First the link you clicked on to install an extension was coded in, specifically (I think) to gnome 3.2 as a method for instillation. So in that sense it is a "trusted" site.

Second, gnome extensions are user scripts, stored only for your user. They don't have access to any information that the user does not have access to. So for example there can't be a shell extensions to write files to /.

Third, Browsers were not modified, but gnome shell was.

Basically the install method is no less safe then providing you a tar.gz file and telling you to manually extract it in your home directory. Rather or not the individual extensions are safe is a decision you need to make on a case by case basis. However gnome.org is a legit site, as is the extensions sub domain.

share|improve this answer
    
Got it, thanks a lot for the detailed explanation. But to allow the automated install, wouldn't the browser have to be modified to allow this? I did some more reading, sounds like this is done through a Firefox/Chromium plugin? –  Suman Dec 1 '12 at 18:38
    
Yes "Gnome Shell Integration" plugin in firefox and chrome based. –  coteyr Dec 1 '12 at 18:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.