Show HN: Little Rat – Chrome extension monitors network calls of all extensions (github.com)

  1) Go to Releases, right click the crx file and save.
  2) In Chrome, go to Extensions then drag and drop the crx file
  3) Profit

0: https://github.com/dnakov/little-rat/blob/f0b9b6be39af9fe7f4...

You will be amazed at the obvious extension policy violations Mozilla is letting many of their "recommended" extensions get away with.

[1]: https://firefox-source-docs.mozilla.org/devtools-user/browse...

[2]: https://firefox-source-docs.mozilla.org/networking/http/logg...

[3]: https://firefox-source-docs.mozilla.org/devtools-user/about_...

  chrome.declarativeNetRequest.onRuleMatchedDebug.addListener((e) => {
    if (e.request.initiator?.startsWith('chrome-extension://')) {

Here the actual code of the extension is basically 2 files, one of 114 lines and the other 66. Plain js, easy to digest. Looks pretty safe.

Also, plenty of these extensions have been acquired by data firms or other sketchy places to then add your browser to botnets. If these are absolutely necessary for you, I highly recommend downloading the source and dumping it into Chrome/Edge via developer mode. At least then you know they can't update it in the background and you know what you're running.

Next, back in the normal browser-- Click the puzzle piece icon where your extensions icons are to the right side of the URL address bar. Click the little thumbtack next to Little Rat extension. Now it's installed and shows in the list of extension icons

A well made extension will only pop up an occasional toast. One that needs the server to work will show the toast when the user expects it to be talking to the server. One sending keypresses or other suspicious data will be really obvious.

The process is roughly the same as inspecting the UI, you basically enable remote debugging and then launch the Browser Toolbox: https://superuser.com/questions/1608096/how-to-inspect-firef...

(this is also a great way to figure out what you need to do for a user-chrome CSS file, e.g. if you want to change how tabs appear beyond just theming. though using a user-chrome CSS file is unfortunately a minor pain in the ass.)

I had to switch it to "multi-process mode" to get network requests from extensions to show up, but that broadly makes sense.

e.g. here's ublock pulling a random block list that I clicked on to test: https://i.imgur.com/wBYbBM2.png

and here's Firefox itself updating the safe-browsing list in the background: https://i.imgur.com/JYxWwjW.png

For example, even if the extension itself can't make requests, there are plenty of ways to 'trick' a webpage into making a request on your behalf when you have permissions to modify the Dom of the web page.

* the content security policy does not allow unsafe-inline

* extension ids are autogenerated by chrome

There are several clones that are trying to piggyback on that name though. You have to go for the original one - the one from Raymond Hill (or gorhill)!

Repeated clicking results in loop of 1) muting second to the last extension 2) muting the extension I'm actually clicking 3) unmuting second to the last and 4) unmuting the one I'm clicking :-D

It is quite hard to describe, I may create a video and upload it somewhere later.