I’m a fan of FOSS and reasonable privacy with data. I also often look for and install software on my computers for random tasks as they come up. Today, when I was looking to install an extension to Firefox called Wikipedia-EN that helps me search Wikipedia by highlighting a word, the Mozilla page for the extension states:
This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.
As someone that is not educated in programming or perpetually current on tech news, what can I do to assess the safety of this and other software? Is there a site that transparently evaluates software and publishes its findings?
Mostly if you find an attached GitHub repository to the software, you can have a bit more trust in it than otherwise, it means that the developer is putting their cards on the table and not trying to hide something nefarious. Of course there are caveats to this but it’s a good start.
As a techie, I can say that’s a hot research area. There isn’t much useful stuff in it.
Is there a site that transparently evaluates software and publishes its findings?
Well, you just found the Mozilla one. It has told you their findings.
Not much you can do other than researching the current consensus. And for the latter you can try to search discussions about its safety. Good query to start with is “is programname malware/spyware”.
Even as a power user… You can’t.
And, in the 21st century, nothing on your computer is safe and private, least of all, browser extensions.
Even if an extension is safe today, with a tiny handful of notable exceptions, it will be”monetized”, or bought and sold to someone that will use it to install adware on your system, train their AI model, or steal your personal information.
There is no feasible defense to this for a layperson, other than absolute transparency in FOSS, and even that is under attack via flaws in the software supply chain.
The best a layperson can hope for is that major vendors care more about exclusivity and locking others out of their ecosystem, such that they are the only ones who have full control of your data (Apple, Google, Microsoft).
