Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome users beware: Manifest v3 is deceitful and threatening

eff.org

Post reply on HN
Print view View original

121–130 of 396 posts

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#121

Post by dathinab »

donatj wrote: post #47

I miss the early days of Firefox extensions (circa 2004) where an extension could in very powerful ways completely change the layout/functionality of your browser; when they had near unlimited access to the XUL and could change anything and everything. I used a ton of very useful extensions then. Nested tabs were one of my favorites. These days I've got a password manager, a bookmark checker, and a tab manager I wrot…

While I also miss some of the capabilities, I also can understand why Firefox removed them.

Extensions systems which don't have very clear cut boundaries like XUL are just add a very hefty maintenance burden and make review extremely hard.

It's not really about "normies".

This doesn't really apply to the current change, as extensions already have clear boundaries and and as the article pointed out problematic apps likely won't be too much affected as they often already do things which bypass the constraints to avoid detection by the reviewer... (assuming I understand the topic correctly)

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#122

Post by kevingadd »

breezeTrowel wrote: post #53
rektide wrote: post #4

Previously extensions could be background pages, with access to DOM & Web Platform apis. MV3 currently reduces them to Service Workers, able to use far far far less capabilities. This is a massive massive downgrade for Extensions, unfathomable really. A Mozillaian proposed a less limited Limited Events Page but Google has snubbed it & not discussed. https://github.com/w3c/webextensions/issues/134 Extensions are force…

Have background pages ever had access to DOM? Usually all interaction with an observed tab is done through content scripts not background pages. Same goes for evaling JS code within the context of the inspected window.

By DOM access I assume they mean that since background pages are pages, you can do things like use IMG and SCRIPT tags to load resources, and perhaps a CANVAS to rasterize images that you then serve to pages via an extension URL or something. I've done stuff like that before so I can imagine there being use cases for it, but it's kind of niche.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#123

Post by mappu »

bambax wrote: post #56
jsnell wrote: post #26

The security argument seems pretty simple. The end goal is that legit extensions that people regularly install should not need to ask for dangerous permissions, because a) it teaches the users that it's normal and b) since the extensions can become compromised later and abuse the permissions. Adblockers are probably the most common kind of extension, and are currently granted effectively unlimited access to read and…

> Adblockers are probably the most common kind of extension, and are currently granted effectively unlimited access to read and modify every single web page you use. That's fucking scary. How is that scary? The browser by definition has unlimited access to read and modify (and monitor) anything I do in it. And I trust gorhill a million times more than any Google employee, past, present or future.

The scary part is gorhill is able to sell or hand over the extension - as he has done in the past - to someone with looser morals and/or goals.

How much do you think NSO Group would pay for this kind of access?

If you ran uBlock Origin, would you like to retire early?

Jbk from the VLC project has a lot of stories about turning down 6, 7 figure payments to bundle malware in VLC. Not everyone has the strong morals and unlimited stamina to withstand that.

Manifest V3 is created to solve a real problem. I have had browser extensions go rogue on me before (Stylish), and i would like it to not happen again. At the same time, uBlock Origin is a hugely important extension for making the web usable for hundreds of millions of people. A compromise must be found that moves their safety out of a single person's hands.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#124

Post by josefx »

matheusmoreira wrote: post #74
ineptech wrote: post #5

If Chrome can kill uBlock and use its dominance to do user-hostile stuff, and Firefox goes along "in the interest of cross-browser compatibility", then what the hell's the point of Firefox in the first place?

They should probably just special case uBlock Origin at this point. It's too important an extension to allow it to be limited.

Are you sure you don't want to hard code the original "uBlock" instead of the "Origin" fork while you are at it? It already had a perfectly fine hostile takeover in the past, no need to wait for a new one.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#125

Post by mortehu »

plorkyeran wrote: post #48
breezeTrowel wrote: post #43

Earlier quoted context omitted.

I, on the other hand, found the article to be terrible. Consider the following quote: > Manifest V3, or Mv3 for short, is outright harmful to privacy efforts. It will restrict the capabilities of web extensions—especially those that are designed to monitor, modify, and compute alongside the conversation your browser has with the websites you visit. Under the new specifications, extensions like these– like some privac…

The article does not mention changes over the last two years because there haven't been any to mention. The new WebRequest API still does not support blocking requests (and still does support _recording_ requests), and the replacement for that functionality is still very limited.

> WebRequest API still does not support blocking requests (and still does support _recording_ requests)

The whole point is that there would be no reason to allow any ad blocking extension access to the WebRequest API anymore.

The replacement, declarativeNetRequest, does not require the user to give any permissions, so the days of granting ad blocking extensions full access to every page are gone.

If you think Google is doing this for their own gain, I guess you can simply ask if declarativeNetRequest will be able to block all Google ads, or if you really need a turing complete language for that.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#126

Post by dathinab »

jeroenhd wrote: post #114
pkulak wrote: post #11

If Google actually gave a crap about security, they would let you disable extensions. As it is, I have to routinely delete malicious extensions from every family member's Chromebook. Lord knows how they get there, but they always do. Since this new standard still lets extensions observe everything, I don't see what the point is.

You can only signed addons these days, so they must be sourced or at least signed by Google. Especially on Chromebooks which are more restrictive in the software they run. My guess would be that your family members got social engineered into installing that crap ("this web page only works with X, click here to install"), ort their browsers got exploited and hacked (very unlikely!). You'll probably need full MDM to pr…

Remindes me one time one time a old person I sometimes help out got social engineered to enable desktop notifications for a website.

And as a non windows user it took me a while to realize that this notifications come from the browser as desktop notifications and disable them. Its still a riddle for me how chrome managed to make it both very obvious and very unclear at the same time that this are websites desktop notifications. (As a counter example I used some sites which used desktop notifications on FF/Andriod instead of making a app just because notifications, that I loved)

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#127

Post by kelnos »

korethr wrote: post #94
polote wrote: post #81

I honestly think that Google underestimated how much they are going to piss off users with MV3. There are thousands of extensions that will stop working and be impossible to build. But also there will be a lot of broken experiences as remote loading is forbidden and fixes will need a new release. Can't wait, but that's a very good opportunity for Firefox as Firefox will become more powerful than Chrome

In the article, Firefox is cited as intending to adopt MV3 for compatibility reasons. If they indeed do so, I'm not sure how much relief running Firefox will offer from the more evil aspects of MV3.

They're not really "adopting" it as the way forward. Firefox will be able to use Mv3-type extensions, but the current extension types will continue to work.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#128

Post by zentiggr »

jsnell wrote: post #26

The security argument seems pretty simple. The end goal is that legit extensions that people regularly install should not need to ask for dangerous permissions, because a) it teaches the users that it's normal and b) since the extensions can become compromised later and abuse the permissions. Adblockers are probably the most common kind of extension, and are currently granted effectively unlimited access to read and…

It sounds like you're happy to hand control of your browser away for free. I've been writing code for a few decades, I don't know everything but I don't need someone to decide for me what's too dangerous for me to have access to.

If I was truly insane I'd go the Steve Gibson route and write a completely different browser from scratch. I'm aware it would take the rest of my life (or longer) at this point but the engine options are so few, and the ability to avoid the owners' restrictive BS limited enough, that I'd be happy as a clam to see a whole new reboot.

I'd jump onto even an alpha of that, just to bump numbers out of hope that ANY group could get together and get out from under the advertising trap.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#129

Post by kelnos »

donatj wrote: post #47

I miss the early days of Firefox extensions (circa 2004) where an extension could in very powerful ways completely change the layout/functionality of your browser; when they had near unlimited access to the XUL and could change anything and everything. I used a ton of very useful extensions then. Nested tabs were one of my favorites. These days I've got a password manager, a bookmark checker, and a tab manager I wrot…

Has nothing to do with "normies". With the old extension system, Mozilla couldn't make any substantial changes to browser internals (like multi-process, among other things) without breaking everything. It makes sense to have clear boundaries between the core and extensions, and keep implementation details out of the extension interface.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#130

Post by heavyset_go »

korethr wrote: post #94
polote wrote: post #81

I honestly think that Google underestimated how much they are going to piss off users with MV3. There are thousands of extensions that will stop working and be impossible to build. But also there will be a lot of broken experiences as remote loading is forbidden and fixes will need a new release. Can't wait, but that's a very good opportunity for Firefox as Firefox will become more powerful than Chrome

In the article, Firefox is cited as intending to adopt MV3 for compatibility reasons. If they indeed do so, I'm not sure how much relief running Firefox will offer from the more evil aspects of MV3.

Firefox devs have confirmed that they'll implement Mv3, but without all of its restrictions and with compatibility for older extensions.
Post reply on HN