Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome users beware: Manifest v3 is deceitful and threatening

eff.org

Post reply on HN
Print view View original

61–70 of 396 posts

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#61

Post by breezeTrowel »

plorkyeran wrote: post #48
breezeTrowel wrote: post #43

Earlier quoted context omitted.

I, on the other hand, found the article to be terrible. Consider the following quote: > Manifest V3, or Mv3 for short, is outright harmful to privacy efforts. It will restrict the capabilities of web extensions—especially those that are designed to monitor, modify, and compute alongside the conversation your browser has with the websites you visit. Under the new specifications, extensions like these– like some privac…

The article does not mention changes over the last two years because there haven't been any to mention. The new WebRequest API still does not support blocking requests (and still does support _recording_ requests), and the replacement for that functionality is still very limited.

> The new WebRequest API still does not support blocking requests (and still does support _recording_ requests), and the replacement for that functionality is still very limited.

Thank you. What you wrote is information that needs to be in the article but is not mentioned anywhere. The closest thing is a quote from Mozilla regarding their extensions security review process.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#62

Post by handrous »

danuker wrote: post #34
pkulak wrote: post #18

Earlier quoted context omitted.

I needed them to do that so I could watch Netflix. Debate it all you want, but it made my life measurably better and I'm glad they did it. This would only negatively effect me (and everyone else).

How is your life measurably better, by comparing it with other people's fake and perfect and amazing lives (in Netflix videos)?

> other people's fake and perfect and amazing lives

Uh, if that's what we're supposed to be using movie and TV streaming services for, I've been watching precisely the wrong things.

Seems more like a description of social media & (not unrelatedly) advertising. Or maybe porn.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#63

Post by breezeTrowel »

Shank wrote: post #51
breezeTrowel wrote: post #43

Earlier quoted context omitted.

I, on the other hand, found the article to be terrible. Consider the following quote: > Manifest V3, or Mv3 for short, is outright harmful to privacy efforts. It will restrict the capabilities of web extensions—especially those that are designed to monitor, modify, and compute alongside the conversation your browser has with the websites you visit. Under the new specifications, extensions like these– like some privac…

> There was controversy over changes to the WebRequest API but that was two years ago and, I believe, changes have been made. Are there still changes that break functionality? What changes were made over the past two years? Have things gotten better or worse? The WebRequest API’s blocking functions, which are central to the functionality of uBlock, are still slated to be removed.

Thank you. I hope the author of the article reads this thread and ads a proper summary of the problematic changes that Manifest V3 introduces to the article.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#64

Post by judge2020 »

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3.

The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is by itself improved with V3 as extensions that pull in code remotely can no longer get past the review process[0], especially with how many current extensions implement RCE C&C intentionally. They also say extensions are "usually interested in simply observing the conversation between your browser and whatever websites you visit" - that's 'usually', though; malicious extensions intercepting and modifying requests for their own benefit isn't unheard of.

Instead of only stating 'this is bad', it would be beneficial to include both (A) what they say (B) their basis for the decision, if any (C) why that line of reason is incorrect/deceiving.

0: https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#65

Post by dariusj18 »

danuker wrote: post #23
kreetx wrote: post #17

Earlier quoted context omitted.

I'd guess even if Firefox did keep extensions unrestricted then slowly they would die away - given how much smaller the user base will be. We need some new power to emerge in this space.

I believe they would gain users from Chrome, where you won't be able to block ads anymore.

I would certainly stop using Chrome

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#66

Post by contravariant »

danuker wrote: post #34
pkulak wrote: post #18

Earlier quoted context omitted.

I needed them to do that so I could watch Netflix. Debate it all you want, but it made my life measurably better and I'm glad they did it. This would only negatively effect me (and everyone else).

How is your life measurably better, by comparing it with other people's fake and perfect and amazing lives (in Netflix videos)?

You can tell this argument is flawed because it applies to all forms of video.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#68

Post by tomjen3 »

ineptech wrote: post #5

If Chrome can kill uBlock and use its dominance to do user-hostile stuff, and Firefox goes along "in the interest of cross-browser compatibility", then what the hell's the point of Firefox in the first place?

If they do that, it will be forked.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#69

Post by tomjen3 »

danuker wrote: post #34
pkulak wrote: post #18

Earlier quoted context omitted.

I needed them to do that so I could watch Netflix. Debate it all you want, but it made my life measurably better and I'm glad they did it. This would only negatively effect me (and everyone else).

How is your life measurably better, by comparing it with other people's fake and perfect and amazing lives (in Netflix videos)?

That would be Insta, not Netflix where you are watching interesting/awesome stories.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#70

Post by vehemenz »

jsnell wrote: post #26

The security argument seems pretty simple. The end goal is that legit extensions that people regularly install should not need to ask for dangerous permissions, because a) it teaches the users that it's normal and b) since the extensions can become compromised later and abuse the permissions. Adblockers are probably the most common kind of extension, and are currently granted effectively unlimited access to read and…

Since you casually mentioned it—why would Google implement a safe API after removing the "dangerous" API that increased their ad sales? Given their recent history, and all.
Post reply on HN