Live data from Hacker News

Chrome users beware: Manifest v3 is deceitful and threatening

eff.org

151–160 of 396 posts

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#151
post #22
post #15

Earlier quoted context omitted.

Chrome allows you to disable installation of extensions via Group Policy for a looong time now: https://security.stackexchange.com/questions/66239/how-to-pr...

That's windows-only, right?

I've seen these restrictions enabled on macOS and ChromeOS as well, so there is a way to manage them.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#152

Earlier quoted context omitted.

Is it Chromium based? It might be great but for now refuse to support anything that further strengthen Googles grip on the market.

> It might be great but for now refuse to support anything that further strengthen Googles grip on the market. The question then becomes: "What else even is out there?" Because if you're looking for something that's even remotely feature complete for browsing the modern day web, the majority of the current browsers out there are indeed based on Chromium, as expressed in this article, "Firefox is the Only Alternative"…

Firefox isn't perfect. I'm sure if you go back to the last major browser war, you'll see that Firefox didn't "win" that war. But they did win the fight they were fighting. They proved that you don't have to put up with the monopolistic behavior of Microsoft to browse the internet.

Today, Google and Microsoft and Apple are fighting Browser War 2, and it looks as though Google is winning. However, Firefox is still fighting, but not to win. But to prove that we don't have to put up with the monopolistic behavior of Google to browse the internet.

Firefox has had it's ups and downs. But "winning the war", in my mind, isn't the point of Firefox.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#153

Earlier quoted context omitted.

The article does not mention changes over the last two years because there haven't been any to mention. The new WebRequest API still does not support blocking requests (and still does support _recording_ requests), and the replacement for that functionality is still very limited.

> WebRequest API still does not support blocking requests (and still does support _recording_ requests) The whole point is that there would be no reason to allow any ad blocking extension access to the WebRequest API anymore. The replacement, declarativeNetRequest, does not require the user to give any permissions, so the days of granting ad blocking extensions full access to every page are gone. If you think Google…

> The replacement, declarativeNetRequest, does not require the user to give any permissions, so the days of granting ad blocking extensions full access to every page are gone.

From what I see, it also has some strict limits. My basic uBlock+ install has 82780 network filter rules. Chrome seems to "only" guarantee 30000 rules, and I don't know if these match 1-to-1.

And there don't seem to be dynamic replacements, which might be useful to trick adblock detection. Not sure how far in the cat-and-mouse game we are on that front, but I sure don't like the idea of giving the mice highly limited rulesets while the cats can do and do whatever they like.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#154

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is…

I see a lot of people suggesting Firefox, which is great. But also, considering Chrome is basically Chromium, can't we just fork Chromium and keep using that?

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#155
Because of this, sometime in 2022 I will shut down Sitetruth, my fifteen year old ad blocking and site evaluation system. That offers add-ons for Chrome and Firefox, and puts a tag with company background info on each search result. Some search ads are removed, and some are de-emphasized. Some time next year, Google will probably force that add-on out of Chrome, as they tighten their grip over what browsers are allowed to do.

I did this as a technology demo, to demonstrate automated site background checking. The concept that you have to have a business address to sell online is almost archaic now, even though it's the law in the EU and California. So, today often the system often can't tie a web site to business records.

The concept of "legitimate business" is dead.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#157

Because of this, sometime in 2022 I will shut down Sitetruth, my fifteen year old ad blocking and site evaluation system. That offers add-ons for Chrome and Firefox, and puts a tag with company background info on each search result. Some search ads are removed, and some are de-emphasized. Some time next year, Google will probably force that add-on out of Chrome, as they tighten their grip over what browsers are allow…

Just build an electron browser, you can control whats going on inside in.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#158

Earlier quoted context omitted.

I mean you can, but firefox doesn't treat you any better. We waited 2+ months to get a minor update through review, and getting it through that quickly took emailing several folks (including one from HN). During that whole process they also removed the display of your queue position, making it even more opaque. At some point they disliked something in our extension that had been live for months, and disabled every re…

At this point I am seriously wondering if Mozilla is paid to drive Firefox into the ground.

That may explain the inverse correlation between salary and market share. You'd have to pay a lot to convince a leader to do this deliberately.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#159
post #94

Earlier quoted context omitted.

In the article, Firefox is cited as intending to adopt MV3 for compatibility reasons. If they indeed do so, I'm not sure how much relief running Firefox will offer from the more evil aspects of MV3.

With Firefox's market share, not much. This could massively benefit Firefox adoption, though, because everyone relying on old extensions will have to switch. From that viewpoint, the new restrictions could actually be a good thing.

At the point when Edge (Chromium) no longer supports proper adblockers, I would instantly stop using it and use Firefox for almost everything. It would be a 100% deal-breaker for me. Right now, I have Firefox installed but don't use it much, because I don't see a compelling advantage.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#160
post #131

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is…

Google has not provided any reason to not include "block request" functionality. And that the super bad faith underlying fact that poison their "reasoning".

There is still "block request" functionality, the change is that it's now declarative. This is the same way it works in Safari, and is (a) more efficient because you don't need to execute JS to evaluate each request and (b) more private because an ad/content blocker doesn't need to be given such broad permissions. There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and easily can be used to block Google ads.

Docs: https://developer.chrome.com/docs/extensions/reference/decla...

(Disclosure: I work on ads at Google, speaking only for myself)

Post reply on HN