Chrome users beware: Manifest v3 is deceitful and threatening • Hacker News Board

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#111

Post by dane-pgp » Thu, Dec 09, 2021, 10:25 PM UTC

bee_rider wrote: post #75

dessant wrote: post #55

Earlier quoted context omitted.

> Where do people get this sense of entitlement from? Please cite one law you believe Google has broken. Just like Amazon (your employer), Google has also been fined several times in the past decade for illegal business practices. Their illegal activities are extensively documented, and in some cases they were forced to change course due to regulatory intervention. Feel free to look it up, I don't think there is a ne…

No you have to understand, as long as a company doesn't commit enough crimes to be literally run out of business, we have to pretend it is good for some reason.

And if a company does go out of business after committing too many crimes, then the problem is too much regulation holding back innovation.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#112

Post by mkl » Thu, Dec 09, 2021, 10:26 PM UTC

pkulak wrote: post #6

ineptech wrote: post #5

If Chrome can kill uBlock and use its dominance to do user-hostile stuff, and Firefox goes along "in the interest of cross-browser compatibility", then what the hell's the point of Firefox in the first place?

My assumption is that Firefox will be implementing the standard, but not the restrictions. Am I wrong there?

You are pretty much right. There's no need for assumptions though, see https://blog.mozilla.org/addons/2021/05/27/manifest-v3-updat... and https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest....

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#113

Post by eitland » Thu, Dec 09, 2021, 10:26 PM UTC

foxrider wrote: post #107

eitland wrote: post #100

Mentioning again to the entrepreneurical ones here that I want to pay money for something that works like old Firefox but uses the new supposedly more secure code base. I pay for IntelliJ so why not pay for the just as important browser if I can get one that I like? Just don't increase the pricing to Jetbrains level until you have Jetbrains level features.

I'd pay for Vivaldi if I had to at this point, it's the only browser that feels "feature-complete" to me

Is it Chromium based?

It might be great but for now refuse to support anything that further strengthen Googles grip on the market.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#114

Post by jeroenhd » Thu, Dec 09, 2021, 10:27 PM UTC

pkulak wrote: post #11

If Google actually gave a crap about security, they would let you disable extensions. As it is, I have to routinely delete malicious extensions from every family member's Chromebook. Lord knows how they get there, but they always do. Since this new standard still lets extensions observe everything, I don't see what the point is.

You can only signed addons these days, so they must be sourced or at least signed by Google. Especially on Chromebooks which are more restrictive in the software they run.

My guess would be that your family members got social engineered into installing that crap ("this web page only works with X, click here to install"), ort their browsers got exploited and hacked (very unlikely!). You'll probably need full MDM to prevent these websites from getting their users to enable extensions.

The problem with disabling extensions is that whatever has the capability of pushing extensions into your browser also has the ability to change the settings for addons. The only solution I can think of is to create a Chromium build that cannot run extensions at all.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#115

Post by KronisLV » Thu, Dec 09, 2021, 10:29 PM UTC

eitland wrote: post #113

foxrider wrote: post #107

Earlier quoted context omitted.

I'd pay for Vivaldi if I had to at this point, it's the only browser that feels "feature-complete" to me

Is it Chromium based? It might be great but for now refuse to support anything that further strengthen Googles grip on the market.

> It might be great but for now refuse to support anything that further strengthen Googles grip on the market.

The question then becomes: "What else even is out there?"

Because if you're looking for something that's even remotely feature complete for browsing the modern day web, the majority of the current browsers out there are indeed based on Chromium, as expressed in this article, "Firefox is the Only Alternative": https://batsov.com/articles/2021/11/28/firefox-is-the-only-a...

Here's the table from the article in text format:

  Browser  Based on Chromium Open-source  Market Share (desktop + mobile)
  Chrome   Yes               No           64.7%
  Chromium Yes               Yes          -
  Edge     Yes               No           4.0%
  Brave    Yes               Yes          -
  Vivaldi  Yes               No           -
  Opera    Yes               No           2.4%
  Safari   No                No           19.0%
  Firefox  No                Yes          3.7%

To me it seems like Firefox is the only viable alternative and putting all of our hopes on a singular browser and the company behind it, especially given that there has recently been some controversy around it, seems risky. For example: https://itdm.com/mozilla-firefox-usage-down-85-but-why-are-e... and https://arstechnica.com/information-technology/2020/08/firef...

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#116

Post by kevingadd » Thu, Dec 09, 2021, 10:29 PM UTC

judge2020 wrote: post #64

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is…

Anyone who pays attention to the web platform should know by now that any rationale Chrome (or Google in general) developers give for web platform decisions is made up. They repeatedly told us they had specific motives for AMP and it was all a lie, AMP was designed to tighten their grip on the advertising market. It's not the only example - the way their autoplay whitelist works is also transparently manipulative despite lies to the contrary - and I would bet money that MV3 is partially motivated by business incentives in the same way. Googlers' paychecks are signed by Ads and GCP and ad-blockers actively undermine the former.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#117

Post by jeroenhd » Thu, Dec 09, 2021, 10:32 PM UTC

pkulak wrote: post #19

izacus wrote: post #15

Earlier quoted context omitted.

Chrome allows you to disable installation of extensions via Group Policy for a looong time now: https://security.stackexchange.com/questions/66239/how-to-pr...

I'm just not smart enough to figure that out. That first answer references steps that don't exist on any Chromebook I've ever seen. So I assume I have to enroll the machine in a group policy externally? I have no idea. Never been able to figure it out. I usually just end up installing an extension (oh, the irony) that blocks the extensions domain. :/

Chromebooks don't run Windows, so Group Policies won't work for you.

You can get the same (and more) control with an Enterprise subscription from Google which seems to cost about $50 per year, per device.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#118

Post by kevingadd » Thu, Dec 09, 2021, 10:33 PM UTC

gnicholas wrote: post #86

Does anyone know how the Manifest v3 changes will affect extensions that modify pages for accessibility reasons?

Generally speaking it shouldn't impact them, but it may make them more awkward to use. And the developers will have to change a lot of code.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#119

Post by jeroenhd » Thu, Dec 09, 2021, 10:33 PM UTC

oliverulerich wrote: post #39

izacus wrote: post #15

Earlier quoted context omitted.

Chrome allows you to disable installation of extensions via Group Policy for a looong time now: https://security.stackexchange.com/questions/66239/how-to-pr...

but sadly Group Policy is not available on Windows Home edition

In most cases, you can get group policies like these to work if you manually create the registry keys that GPO would create for you. It's more complicated, but it can work.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#120

Post by kevingadd » Thu, Dec 09, 2021, 10:33 PM UTC

power78 wrote: post #59

donatj wrote: post #47

I miss the early days of Firefox extensions (circa 2004) where an extension could in very powerful ways completely change the layout/functionality of your browser; when they had near unlimited access to the XUL and could change anything and everything. I used a ton of very useful extensions then. Nested tabs were one of my favorites. These days I've got a password manager, a bookmark checker, and a tab manager I wrot…

I wish Firefox would have left the old extension abilities. They could have easily added the WebExtensions standard to allow for cross-browser compatibility and not removed the old functionality.

Once multi-process was adopted, old extensions couldn't work anymore. The design simply didn't work.