Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome users beware: Manifest v3 is deceitful and threatening

eff.org

Post reply on HN
Print view View original

241–250 of 396 posts

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#241

Post by amluto »

jefftk wrote: post #160
yonixw wrote: post #131

Earlier quoted context omitted.

Google has not provided any reason to not include "block request" functionality. And that the super bad faith underlying fact that poison their "reasoning".

There is still "block request" functionality, the change is that it's now declarative. This is the same way it works in Safari, and is (a) more efficient because you don't need to execute JS to evaluate each request and (b) more private because an ad/content blocker doesn't need to be given such broad permissions. There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and…

I would believe this more if Mv3 didn’t allow extensions to inspect all web requests programmatically, just not block them. Want to exfiltrate your users’ data to attack or track them? Fine. Want to block ads. No way!

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#242

Post by ineedasername »

gerash wrote: post #221
ineedasername wrote: post #189

Earlier quoted context omitted.

I think the fact that it will significantly limit privacy and ad blockers is sufficient reason for a high level of criticism, which I took as the main point. I didn't see dissecting the security details as the point they were trying to make. Instead it was to partially undermine the reasons Google said they were doing this. Basically "here's why it's bad for privacy, and here are why Google's stated reasons for the u…

"significantly limit privacy"? You either don't know what this change does or find it "significantly more private" when an extension developer has full read / write access to your web requests

I was referring to the much higher level of difficulty adblockers and the like will have in filling their intended purpose.

It seems like this is the clear interpretation of what I wrote and that you may be purposely misconstruing my comment in order to level a soft insult and condescending language at me over an opinion you don't agree with.

To give you a little benefit of the doubt though and assume you may just be passionate about the issue and don't intend to be insulting I will address your other point: Users giving away access to their web requests without realizing it is a problem. It is also one that can be addressed without making it much harder for privacy-minded users and the providers of those extensions to get what they want as well.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#243

Post by donkarma »

mappu wrote: post #123
bambax wrote: post #56

Earlier quoted context omitted.

> Adblockers are probably the most common kind of extension, and are currently granted effectively unlimited access to read and modify every single web page you use. That's fucking scary. How is that scary? The browser by definition has unlimited access to read and modify (and monitor) anything I do in it. And I trust gorhill a million times more than any Google employee, past, present or future.

The scary part is gorhill is able to sell or hand over the extension - as he has done in the past - to someone with looser morals and/or goals. How much do you think NSO Group would pay for this kind of access? If you ran uBlock Origin, would you like to retire early? Jbk from the VLC project has a lot of stories about turning down 6, 7 figure payments to bundle malware in VLC. Not everyone has the strong morals and…

has gorhill really sold an extension to someone in the past?

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#244

Post by imbnwa »

jefftk wrote: post #188
Qub3d wrote: post #163

Earlier quoted context omitted.

The safari change absolutely kneecapped content blockers. Ublock dropped it[0], and the remaining few providers, like AdGuard, have to do all sorts of trickery[1] to get even close to the same performance. If you're going to argue this is better, don't point us to such a clearly worse result. [0]: https://github.com/el1t/uBlock-Safari/issues/158 [1]: https://adguard.com/en/blog/safari-adblock-extensions.html

I'm not arguing that V3 is better -- I think that's a complicated question, and I was trying to describe some of the tradeoffs. What I am arguing is that V3 does, contra my parent, support request blocking.

I just hate that rhetorical game of "well, prima facie I meet your standard so what's the problem?" You met the standard before too, obviously that's not the problem

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#245

Post by Karunamon »

winternett wrote: post #233
AnonC wrote: post #229

A lot of comments here are wondering what Firefox will do and if uBlock Origin would be made useless in Firefox like it would be in Chrome (once Mv3 is implemented). Short answer: Firefox is adopting various parts of Mv3, but will continue to support blocking webrequest, which is used by extensions like uBlock Origin. So uBlock Origin would become useless in Chrome, possibly Edge and a few other browsers, but not on…

Chrome has just been getting worse and worse over time, but if you can recall, Firefox was also a slug when it was at a peak of market dominance and before that MSIE... The problem is that orgs and companies stop caring once they gain the primary market share. They also start dictating standards to everyone and ignoring user feedback. It's symptomatic of our current software development driven economy. I recall when…

Mozilla never seemed to get out of that "the user is an idiot, best ignored" mindset even as their market share falls lower than a vendor-specific mobile browser. It's mind-boggling how just about everyone except the people calling the shots in that org can point out the problem.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#247

Post by Eelongate »

fabrice_d wrote: post #162
dheera wrote: post #154

Earlier quoted context omitted.

I see a lot of people suggesting Firefox, which is great. But also, considering Chrome is basically Chromium, can't we just fork Chromium and keep using that?

Brave said they will keep the v2 capability in their Chromium fork "as long as it's possible" (paraphrasing, I can't find the exact tweet to quote).

Does Brave have their own extension repository yet, or are they still leaving that all up to Google? I don't see much value in Brave supporting a feature dropped from Chrome if it only has Chrome extensions and they all drop support for it anyway.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#248

Post by jacquesm »

judge2020 wrote: post #64

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is…

Sure, just like AMP was to make the web faster.

What Google says vs what's going on aren't necessarily the same thing, they have a long history of selling us the 'for your convenience' line while removing functionality that people depended on but that ultimately hurt Google's business interests: to be able to force feed you more ads.

They have long outlived their credit in the bank of the benefit of the doubt.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#249

Post by Eelongate »

AnonC wrote: post #223
trissylegs wrote: post #168

Earlier quoted context omitted.

It's for Browser extensions. Chrome extensions (and also Firefox and Safari). a fail called the "Manifest" that tells Chrome and the extension about the extension and contains all it's permission requests. Eg: "This extensions wants to modify all webpages", which is what ad blockers need to do. Going forward extensions in the Chrome Web store will have to use Manifest v3. Which has less capabilities than previous ver…

> tl;dr. Ad blockers will not longer be possible in Chrome. This is not completely true. Ad blockers like uBlock Origin that allow specific elements to be picked and blocked wouldn’t be allowed. All the requests (like ads) to be blocked would have to be declared in a list (like Safari Content Blockers, and presumably have a limit on the number of rules). The actual blocking will be done by the browser without the ext…

So, useful adblockers that actually work well won't be allowed.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#250

Post by mappu »

donkarma wrote: post #243
mappu wrote: post #123

Earlier quoted context omitted.

The scary part is gorhill is able to sell or hand over the extension - as he has done in the past - to someone with looser morals and/or goals. How much do you think NSO Group would pay for this kind of access? If you ran uBlock Origin, would you like to retire early? Jbk from the VLC project has a lot of stories about turning down 6, 7 figure payments to bundle malware in VLC. Not everyone has the strong morals and…

has gorhill really sold an extension to someone in the past?

"sell or hand over the extension", he handed over the original uBlock to someone who immediately tried to monetize it.
Post reply on HN