Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome users beware: Manifest v3 is deceitful and threatening

eff.org

Post reply on HN
Print view View original

221–230 of 396 posts

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#221

Post by gerash »

ineedasername wrote: post #189
judge2020 wrote: post #64

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is…

I think the fact that it will significantly limit privacy and ad blockers is sufficient reason for a high level of criticism, which I took as the main point. I didn't see dissecting the security details as the point they were trying to make. Instead it was to partially undermine the reasons Google said they were doing this. Basically "here's why it's bad for privacy, and here are why Google's stated reasons for the u…

"significantly limit privacy"? You either don't know what this change does or find it "significantly more private" when an extension developer has full read / write access to your web requests

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#222

Post by tyingq »

notinty wrote: post #196
tyingq wrote: post #136

Earlier quoted context omitted.

Blocked under the supposed reason of privacy, but extensions can still see every request, and inject whatever javascript they want, exfiltrate your data, etc. Meaning the reason is pretty clearly not privacy.

Can you back this up? Seems like a pretty clear case of being two-faced, and a small page laying out the details would be super helpful.

That Google said it was about privacy? There's some quotes in this article: https://whotracks.me/blog/manifest_v3_privacy.html

Or that extensions can still inject javascript, observe and log requests, exfiltrate data? I mean the api docs will tell you that. Extensions can do all that because they couldn't do a whole lot without those capabilities...normally used for legit purposes, but the apis can't really glean intent.

See things like onBeforeRequest for observe. Injecting javascript is called a "content script" in chrome extension terms. Exfiltrating data could be done in many ways, given that you can inject a "content script".

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#223

Post by AnonC »

trissylegs wrote: post #168
throw7 wrote: post #166

The article is not exactly well written. I don't really follow web developments anymore because the web, well, sucks; So, after reading, I'm still not even sure what "manifest v3" is about and why I should care. I know websites track me. I know I get tons of ads. I know websites popup questions about cookies. I know they play videos that follow me around when I scroll. I know sometime in the past that shit would've b…

It's for Browser extensions. Chrome extensions (and also Firefox and Safari). a fail called the "Manifest" that tells Chrome and the extension about the extension and contains all it's permission requests. Eg: "This extensions wants to modify all webpages", which is what ad blockers need to do. Going forward extensions in the Chrome Web store will have to use Manifest v3. Which has less capabilities than previous ver…

> tl;dr. Ad blockers will not longer be possible in Chrome.

This is not completely true. Ad blockers like uBlock Origin that allow specific elements to be picked and blocked wouldn’t be allowed. All the requests (like ads) to be blocked would have to be declared in a list (like Safari Content Blockers, and presumably have a limit on the number of rules). The actual blocking will be done by the browser without the extension knowing which rules were applied to which pages.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#224

Post by kevin_thibedeau »

jefftk wrote: post #194
ineedasername wrote: post #191

Earlier quoted context omitted.

It's been years since AMP went live. Disagreeing while pointing to information that's been withheld for years and does not (to my knowledge) have a timeline for release... that does not make a very compelling argument. It amounts to "trust us". But we don't-- that's kind of the point.

I interpreted coffeefirst as referring to the current antitrust action against Google, and saying that I expect more information will come out as it progresses.

There will never be a smoking gun because the people cooking up these dark pattern schemes are generally smart enough to not document them. The problem they want solved gets broken up into pieces that are given credible cover stories and then when it is all integrated together the intended outcome happens without it ever being explicitly written down in an incriminating email.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#225

Post by AnonC »

chihuahua wrote: post #159
jeroenhd wrote: post #104

Earlier quoted context omitted.

With Firefox's market share, not much. This could massively benefit Firefox adoption, though, because everyone relying on old extensions will have to switch. From that viewpoint, the new restrictions could actually be a good thing.

At the point when Edge (Chromium) no longer supports proper adblockers, I would instantly stop using it and use Firefox for almost everything. It would be a 100% deal-breaker for me. Right now, I have Firefox installed but don't use it much, because I don't see a compelling advantage.

If you start using Firefox now, you may probably better appreciate it (especially if you also look at other features and extensions like Containers).

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#227

Post by AnonC »

throwawaycuriou wrote: post #172
mappu wrote: post #123

Earlier quoted context omitted.

The scary part is gorhill is able to sell or hand over the extension - as he has done in the past - to someone with looser morals and/or goals. How much do you think NSO Group would pay for this kind of access? If you ran uBlock Origin, would you like to retire early? Jbk from the VLC project has a lot of stories about turning down 6, 7 figure payments to bundle malware in VLC. Not everyone has the strong morals and…

wait, Stylish went rogue?

Yes. See https://robertheaton.com/2018/08/16/stylish-is-back-and-you-...

Use Stylus (https://addons.mozilla.org/en-US/firefox/addon/styl-us/) instead.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#228

Post by gerash »

The article is hollow but from what I understand the gist of the issue is:

Google is cutting down on the extensions ability to read and modify your web requests on the fly. As a side effect adblocker type extensions need to pass their blacklist patterns to chrome which will enforce it on their behalf. Chrome cites improved privacy because users won't need to give random extensions full read write access to pretty much all their online activities and performance gains because arbitrary adblocking code cannot run anymore and it needs to be in form of a blacklist patterns. Lastly Apple Safari has been doing the same all along.

The opponent arguments (expressed in the article and by many people leaving comments here) are that this kneecaps some AdBlock extensions because they need to run arbitrary code as the declarative API is not flexible enough for them and this is part of Google covert plan to kill adblocking.

I personally agree with the Chrome team's argument here

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#229

Post by AnonC »

A lot of comments here are wondering what Firefox will do and if uBlock Origin would be made useless in Firefox like it would be in Chrome (once Mv3 is implemented). Short answer: Firefox is adopting various parts of Mv3, but will continue to support blocking webrequest, which is used by extensions like uBlock Origin. So uBlock Origin would become useless in Chrome, possibly Edge and a few other browsers, but not on Firefox.

Quoting from this update [1] from Mozilla:

> Google has introduced declarativeNetRequest (DNR) to replace the blocking webRequest API. This impacts the capabilities of extensions that process network requests (including but not limited to content blockers) by limiting the number of rules an extension can use, as well as available filters and actions.

> After discussing this with several content blocking extension developers, we have decided to implement DNR and continue maintaining support for blocking webRequest. Our initial goal for implementing DNR is to provide compatibility with Chrome so developers do not have to support multiple code bases if they do not want to. With both APIs supported in Firefox, developers can choose the approach that works best for them and their users.

> We will support blocking webRequest until there’s a better solution which covers all use cases we consider important, since DNR as currently implemented by Chrome does not yet meet the needs of extension developers.

[1]: https://blog.mozilla.org/addons/2021/05/27/manifest-v3-updat...

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#230

Post by pabs3 »

I'd like to see the Firefox DevTools turned into an official user-controlled adblock system for Firefox. It has pretty much all the things you would need; control over the requests, control over the responses, control over presentation, control over JavaScript flow etc.
Post reply on HN