चर्चा » Greasy Fork Feedback

Popular scripts, security holes

§
पोस्ट केले: 2020-11-14

Hi! I am sort of new here and I am wondering of how many scripts here are outdated and abandoned, but still make a lot fresh installs per day (even if a script was not updated for years) and have a thousands of old active users (assumed by updates checks in the scripts statistics).

Example of the script: https://greasyfork.org/scripts/735

Guys, I really hope you have some premoderation of the big-scripts updates, especially not updated for years. ESPECIALLY marked with @include http*://*/*

Also, just look at that: https://greasyfork.org/scripts/405943

It's a kind of smart, wow. I will make an on screenshot explanation. This guy soon will can kick any of his enemy from that games

https://i.imgur.com/kxpkBLf.png

Guys, this is a 50-lines script that I found literally a minute ago just fast-checking first and second page of the top scripts. This is so bad

https://i.imgur.com/AKGrTpq.png

woxxomनियामक
§
पोस्ट केले: 2020-11-14

There are simple checks against spam bots but there's no human premoderation, of course. For something as big and as frequently updated as GreasyFork you would need like a hundred of full-time reviewers which even Google/Mozilla don't have. You can report those scripts individually, however you would need to present a proof in a fashion that's immediately obvious and verifiable, something I haven't been able to see in your message above.

woxxomनियामक
§
पोस्ट केले: 2020-11-14

An example of an actionable proof would be your first screenshot.

§
पोस्ट केले: 2020-11-14
संपादित केले: 2020-11-14

I just checked a nearby discussion

https://greasyfork.org/discussions/greasyfork/65072-why-does-greasy-fork-moderation-allow-blatant-spam-bots-on-the-site

I don't think you need a hundred full-time reviewers to reject a reports of a scripts that can be useful only for spam and nothing else.

Also, script I have reported here still was not disabled even after the mod answered me, so I think I can't do anything else about here.

At last I just want to say, when the new user that came here for a good script, doesn't matter small one or large, goes to check some another popular script and gets malicious crap, what you think will he do? Answer: he probably will delete both of them, because of no trust. Not a good thing for the good scripts authors, isn't it?

woxxomनियामक
§
पोस्ट केले: 2020-11-14

You need to use the reporting function on a script so the author has a chance to defend themselves. In this case I don't see any urgent need to delete the script as it's not even confirmed that the code you found has been actually ever used.

I don't think you need a hundred full-time reviewers to reject a reports of a scripts that can be useful only for spam and nothing else.

The rules on GreasyFork are simple so it doesn't take more than a second to realize that a report is invalid. Reviewing code to find possible exploits is orders of magnitude more complicated. This is totally incomparable.

At last I just want to say, when the new user that came here for a good script, doesn't matter small one or large, goes to check some another popular script and gets malicious crap, what you think will he do? Answer: he probably will delete both of them, because of no trust. Not a good thing for the good scripts authors, isn't it?

There are no big galleries where users can or should trust the content implicitly. There is exactly zero reason to trust a random extension in Chrome Web Store or an app in Google Play or even a non-recommended extension in Mozilla's addons gallery.

उत्तर पोस्ट करा

उत्तर पोस्ट करण्यासाठी साइन इन करा.