thegreatsuspender VS io-ts

Happened in (2021)[https://github.com/greatsuspender/thegreatsuspender/issues/1...], and then a few others have forked the extension and tried to revive it, only to eventually sell to nefarious owners or sell user data themselves

I went to github and downloaded the last known "good version, installed it manually."

You want someone to die for disabling a potentially malicious extension that is unmantained since 2020?

Also if you want to read up on the removal of the app and the malware issues this post goes over it as well as other recovery options

Similar code projects have had issues like this before, like the open source Great Suspender.

What can happen after a project changes hands - https://github.com/greatsuspender/thegreatsuspender/issues/1263

Better link https://github.com/greatsuspender/thegreatsuspender/issues/1...

> TLDR: The old maintainer appears to have sold the extension to parties unknown, who have malicious intent to exploit the users of this extension in advertising fraud, tracking, and more. In v7.1.8 of the extension (published to the web store but NOT to GitHub), arbitrary code was executed from a remote server, which appeared to be used to commit a variety of tracking and fraud actions. After Microsoft removed it from Edge for malware, v7.1.9 was created without this code: that has been the code distributed by the web store since November, and it does not appear to load the compromised script. However, the malicious maintainer remains in control, however, and can introduce an update at any time. It further appears that, while v7.1.9 was what was listed on the store, those who had the hostile v7.1.8 installed did NOT automatically receive the malware-removing update, and continued running the hostile code until Google force-disabled the extension.

For what it is worth, you may have heard of the Great Suspender incident (https://github.com/greatsuspender/thegreatsuspender/issues/1263). It was used by millions, and was also open source on GitHub, but it could still end up becoming malicious.

Long ass comment: That is not true for the most part. While the increased amount of individuals working of an OSS project may lead to better vulnerability detection according to both parties of the closed-source/proprietary debate, it doesn't lead to a massively more secure software overall. Not all reviewers have the similar experience or expertise and, because of it, not everyone will be able to review, identify or patch any flaws or vulnerability of a specific software since it may require other skills beyond just basic programming skills such as network or cryptographic skills. [1] Some even suggested that the large number of users contributing to the project can lead people "into a false sense of security." [2] Overall, some papers conclude that being an open source software or a proprietary software isn't an important factor for security and suggest considering other factors, such as the particular vendor/maintainer that controls the entire process. [3] After all, what if the maintainer decides to sabotage their own code? What if the project was sold to another maintainer for its own shaddy needs?

If you're referring to The Great Suspender, that extension was bought by an advertising company earlier this year. I'm using the last good version (github) though.

Qué rico. Si tenés chance meté un proceso de code review fuerte, y para el tema de I/O probá a usar https://github.com/Effect-TS/schema ó https://github.com/gcanti/io-ts que les da una solución obvia al tema de "tipos para lo que devuelva el backend", aunque es en realidad mucho más capaz que eso.

My fave is still io-ts (https://github.com/gcanti/io-ts/blob/master/docs/index.md) as I find it more flexible than zod at the ingress. The author is also working on the Effect ecosystem which also looks interesting.

I’ve been using io-ts for this and been very happy with it. [1] It’s similar to Swift’s Coding protocol in case you’re familiar.

[1] https://gcanti.github.io/io-ts/

Yeah, there are a few new concepts and it's not the easiest to pick up right away. The best introduction is here on the main documentation page.

We use https://github.com/gcanti/io-ts/blob/master/Decoder.md which has a very similar interface. It can even be used to mutate the data using https://github.com/gcanti/io-ts/blob/master/Decoder.md#the-parse-combinator.

A good way to significantly improve the reliability of your app is via improving type-safety by moving away from using any to unknown. One relevant example could be when you type your backend responses and when stringifying JSON to using unknown combined with some sort of runtime type checking. It can be done either by using built-in functionality like type guards or using an external library like io-ts, zod or yup.

Usage of TypeBox is similar with io-ts and zod, but it is much powerful and faster than them. Also, TypeBox can generate JSON schema very easily. Therefore, if you're looking for a validator library for new project and not suffering from legacy codes, I think TypeBox would be much better choice than io-ts and zod. TypeBox can totally replace them.

This check can be done with different libraries like: io-ts, typebox, or zod. These libraries allow you to create objects that represent your typescript definitions. Then, these objects can be used at runtime to validate the received data, in addition, you can also convert this object to a Typescript definition to have all the benefits of using typescript. These objects can be called schema validations because they are responsible for the data validation.