little-rat VS crxmon

Great idea! We need a lot more visibility into what extensions are doing. I made little-rat [1] last year, to detect network calls coming from other extensions. Love to see more tools like yours!

[1] https://github.com/dnakov/little-rat

It says 1.0 in the extensions manager, but it was downloaded fresh this evening by clicking on the 'ZIP' link in your readme.md on here:

https://github.com/dnakov/little-rat/tree/main

2: https://github.com/dnakov/little-rat

I recently installed the Little Rat chrome extension, which I found here on HackerNews.

https://github.com/dnakov/little-rat

And what I found is that the Midnight Lizard chrome extension is monitoring my browsing-- sending home screenshots.

You can see examples here: https://ibb.co/JQvgt3p

Apparently my browsing data is being ingested by a company called "Mark Monitor Inc." (based on WhoIs search for the domain the data is sent to -- https://www.whois.com/whois/ytimg.com )

Nifty - but please do this more carefully:

https://github.com/dnakov/little-rat/blob/main/popup.js#L36

I do not want to have to worry about whether another extension can inject xss into yours with a crafted request/id/name.

> How is this even possible that Google allows this? Is this really true?

Yes, you only need to upload the key (meaning, include a `key.pem` in your packed zip file) on first upload. [0]

However, I'm not sure if Google will allow you to upload with a _different_ key. Since the extension would change, I'm not sure what would happen, both to the webstore page (does the previous one 301 to the new one?) and to existing extensions (do they stop auto-updating?).

> This weekend Chrome decided to disable all these extensions on just one machine

There is a trick for this, if you are loading an unpacked extension. Simply edit `manifest.json` in the unpacked extension directory, to add a `"key": ""`. You can do this with any extension from the store, since you can extract the public key from a .crx file [1]. When you load an extension this way, the ID will be the same as the "real" extension.

[0] https://groups.google.com/a/chromium.org/g/chromium-extensio...

[1] https://github.com/milesrichardson/crxmon/blob/4dae445b05b76...