@fastfinge

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@miki @FreakyFwoof So wouldn't having it in core be better, in that case? That way remote access still works without employees having to install addons. Or would it be worse, because remote access now can't be disabled? I don't know enough about the corporate environment to know either way. But I'm starting to wonder if NVAccess does, either. This is my entire point: these decisions are hard, and require deep thought and deep study, both to make the best possible decision (there are no perfect decisions) and to understand how you got there.

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@FreakyFwoof @miki The more remote connections a screen reader makes, and the more possibilities it provides for an outsider to take control of a corporate machine, the harder it is to get corporate security people to let you install it. Jaws tandem had to solve the same problem, though.

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@miki @FreakyFwoof Yes, this is another factor. But once again: jaws tandem is built in. Why is NVDA remote different? Again, I'm not sure what I think here. But I do know that the question is complicated.

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@VE3RWJ No worries! I wish I knew what was up on your machine. You're the only one with these problems LOL

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@FreakyFwoof I completely agree that it's required. But does that mean it should be in core? I dunno. Like I say, reasonable people can disagree. But I notice that Apple has started moving apps (apple sports, apple invites, etc) out of the main OS so they can maintain and update them seperatly.

3

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@VE3RWJ I'm not sure what's up on your machine. I just checked:
stuff.interfree.ca resolves to 207.90.194.199

The certificate should be trusted by all major web browsers (all the correct intermediate certificates are installed).

The certificate will expire in 85 days.

The hostname (stuff.interfree.ca) is correctly listed in the certificate.
Common name: *.interfree.ca
SANs: .interfree.ca, .rblind.com, interfree.ca, rblind.com
Valid from May 15, 2026 to August 13, 2026
Serial Number: 06a09afa07f5130433af0509623757306f2d
Signature Algorithm: sha256WithRSAEncryption
Issuer: R13

Common name: R13
Organization: Let's Encrypt
Location: US
Valid from March 12, 2024 to March 12, 2027
Serial Number: 5a00f212d8d4b480f3924157ea298305
Signature Algorithm: sha256WithRSAEncryption
Issuer: ISRG Root X1
www.sslshopper.com/ssl-checker.html#hostname=stuff.interfree.ca

2

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

NVAccess and the slow Erosion of trust: I still believe that NVDA is the best available screen reader, and I still donate monthly. These are just a chronicle of decisions that have made me go... Huh. What? stuff.interfree.ca/2026/05/20/nvaccess-and-the-slow-erosion-of-trust.html #screenreader #nvda #a11y

12

15

9

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@MostlyBlindGamer @NVAccess Public criticism of the security model is disclosure I guess. Other than complain about inaccuracies I’ve gone out of my way to correct, NVaccess has declined to respond to the actual problem here: virus total scanning is ineffective, and gives users a false sense of security, while being easy for malicious addons to work around. That’s not an exploit! That’s the system working as designed!

1

0

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@NVAccess @tspivey So the answer to a poorly thought out security model is to demand that discussions of it happen in private? That’s an even worse decision than the one I’m upset about.

0

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@tspivey @NVAccess Also, I have two trusted addons, one in the store. Give me $500 per addon and I’ll make sure everyone running my addons never see that your addons have viruses. And when your malicious addon eventually gets removed, mine will probably remain unnoticed in the store so I can sell my result modification to my next customer. This is a joke! Not a real offer! But someone could easily do this. The only practical defence is for users to know and trust the developers of there addons. Not just to be not evil, but also to be skilled. Once you have a single addon installed, you can no longer trust anything NVDA reports unless you trust that addon author. That’s why I think we need pgp keys and author identities front and center. All a virus total scan can do is, at best nothing, and at worst convince a user that an addon is safe when it isn’t.

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@tspivey @NVAccess Right. But what I don’t understand is why they’re spending resources on this. It doesn’t inconvenience any users, sure. But it also doesn’t inconvenience any attackers. And for inexperienced users, a virus total result saying “0 threats sounds the same as saying this addon is safe. What NVDA can do is make assertions about who developed any given addon. Users can then decide if they trust that developer or not. IMHO, that’s where effort should be spent. Not in pretending to play a threat detection game that even the likes of Google and Microsoft can’t win.

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@J3317 @NVAccess Do you mean the text field with unclickable links?

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@NVAccess And I have to push back here, as well. When I go to the addon manager, and brows for and install addons, where do I see this information? There’s no rating like in the chrome or edge addon store. No number of reviews. No number of installs. No easy way to see other addons by the same developer, so I can judge if they’re an active part of the community, or malicious, or what. No contact info for the author. Maybe this is all on a website, or in a group I’m not subscribed to. But for the purposes of helping a user judge if an addon is trustworthy or not, that’s effectively nowhere.

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@tspivey @NVAccess I’ll grant you that I was incorrect about it being delivered in the manifest. But from the perspective of a malicious addon author, I’m not sure how it’s delivered really makes any difference if I can still intercept and modify it at will. It’s still data that the users local copy of NVDA, running on the user’s machine with the user’s addons of unknown providence installed, cannot trust. I admit I’m not the expert either of you are, but I can’t think of a way around this that doesn’t have other awful side effects. It would be safer for everyone for NVAccess to work on developing a trust model for addon developers and a reputation system for addons, rather than pretending it can make any claims at all about the safety of an addon. Again, unless I’m wildly wrong somewhere. And if I am, I’d love to know.

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@tspivey @NVAccess I also think it’s fair to say that any malicious payload delivered via an NVDA Addon is going to be targeted to NVDA users. So you have to assume it knows about NVDA’s security process. So once again, unless I’ve misunderstood a lot more than I think I have, a Virus Total scan is nothing more than a placebo at best. I’d love to be wrong here.

1

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@tspivey @NVAccess I can see the dictionary that contains them in the Python Console. So how they’re delivered really doesn’t matter, if we assume either that I’m malicious or am working for another malicious actor.

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@tspivey @NVAccess My understanding is that NVDA adds them in during its build/test process. They’re then stored on the users machine, fully accessible to addon authors to add our own fake results, or overwrite others, or do whatever we want.

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@NVAccess But you haven’t stopped that from happening. Any addon can still do that. So what threat, exactly is Virus Total defending against? Users who run Windows Defender will already have it intercept known viruses. Unknown viruses aren’t likely to be picked up by defender or Virus Total. Malicious addon authors can just add code into the addon that will download the virus later, and thus never be scanned by Virus Total. I guess maybe you’d catch supply chain attacks? Those of us who distribute outside of the NVDA store can continue doing whatever the heck we want, but now we can also stick fake Virus Total keys into the addon.

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@jaybird110127 @NVAccess I thought that was obvious enough to not need saying. But perhaps it wasn’t, so thank you for saying it. Chrome addons, and even Android and IOS apps, do this constantly. But Google and Apple have to keep fighting the good fight, and ever restricting functions, because there are just so many app developers that expecting users to know who any of them are or who they can trust is impossible. In the much smaller community of addon developers, that’s really not the case.

0

🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca

5mo

@NVAccess As for reaching out privately: the fact that the entire security model here seems completely wrong to me isn’t a vulnerability. It’s endemic to your design. And I have no idea what the store does with it, but I can absolutely put my own virustotal results in a manifest of an addon distributed outside of the store. So NVDA can’t make any assertions based on that data unless it could guarantee the addon was installed from the store. And that would involve…I guess having a local list of the hashes of every single addon? The only way you can secure addons is by restricting the functions available to them, in ways I’m certain I and other users would find unacceptable. So your only workable recourse is to develop a model that strongly relies on author trust, reputation, and audit ability. To be totally honest, this feels like NVDA has not done threat modeling at all, doesn’t understand what threats an “addon security” system is attempting to prevent or what’s realistic, and hasn’t put long and hard thought into balancing the security triangle for users. Instead, from the outside, a virus total scan looks like “we must be seen to be doing something, and this is something.”

1

0

1

0