Even worse, even if you know an extension is OK (you can audit the code: iirc the rules say the source has to be readable), it can auto-update after being acquired by a malicious actor (e.g. The Great Suspender).
For TGS I use the last known good version, as an "unpacked" extension.
I think this approach of taking ownership of the code (i.e. running the extension "manually") is the best option, aside from two critical factors: skill and effort.
(Not very much of either is needed, if you know basic JavaScript, but it's a significant "mental hurdle".)
Comments
Even worse, even if you know an extension is OK (you can audit the code: iirc the rules say the source has to be readable), it can auto-update after being acquired by a malicious actor (e.g. The Great Suspender).
For TGS I use the last known good version, as an "unpacked" extension.
I think this approach of taking ownership of the code (i.e. running the extension "manually") is the best option, aside from two critical factors: skill and effort.
(Not very much of either is needed, if you know basic JavaScript, but it's a significant "mental hurdle".)