Gnome Tweek Tool 'Get more extension' results in web page opened in gedit

[01011970]

[burdges]

I'm unfamiliar with this specific behavior, but Gnome obtains extensions over the web using a browser plugin. I donno if anyone has audited that extension for security concerns, but there are many concerns, like:

• Are the extensions signed and does the plugin check the signatures?
• Is the plugin invisible to websites besides https://extensions.gnome.org/ because otherwise that leaks information about the user?
• Are the extensions themselves safe enough given how they integrate with Gnome?

A priori, it might be safest to restrict oneself to those Gnome extensions packaged under Debian for now.

[xSmurf]

I'm with @burdges on this, the update mechanism and extensions in general are probably unsafe and we should probably only rely on Debian packaged extensions for now. As such I think we should probably remove this button/feature altogether.

[01011970]

There are four ways how to install Gnome Shell Extensions:

• from the web via browser extension
• from local zip file via file upload button
• from local zip file via extracting to local gnome extension directory
• from the source via git

As primary security concern is about install via browser plugin, I would propose to remove "Get more extensions" link from Tweak Tool > Extension pane and leave all other methods as they are.

[burdges]

It could just pop up a window or web page that explained the situation and/or sent them to their package manager.

[xSmurf]

@pietrearby this is what I was suggesting indeed :) I do like @burdges' idea of a popup with an explanation.

[01011970]

@xSmurf I like the idea, it's the most elegant solution and at least invasive. Just simple dialog box.

[burdges]

Amusingly, sending them to an FAQ question on the subgraph site might be the simplest patch too, just changing a url, well except for the "bug" described here. ;)