Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome users beware: Manifest v3 is deceitful and threatening

eff.org

Post reply on HN
Print view View original

331–340 of 396 posts

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#331

Post by raxxorrax »

judge2020 wrote: post #64

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is…

The security improvement is negible compared to the danger of data extraction which ad blockers pretty effectively prevent in many cases. No, the security advantages just plainly aren't there and I think this is more driven by Google business interests.

Installing random plugins is a security issue. But web tracking is by far the more significant threat.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#332

Post by cookiengineer »

1_player wrote: post #311
cookiengineer wrote: post #277

Earlier quoted context omitted.

Every time someone mentions this I have to think about the messed up ecosystem of Safari Webextensions. Safari only allows extensions installed via the apple store, but every single adblocker there is a scam. I'm not kidding you, I audited most of them. Chances are it's either a three years outdated list of adblock plus that doesn't catch anything or it's an extension that replaces all google analytics identifiers wi…

You can't list these apps, say they're scam or they don't work with no proof whatsoever except your word, especially when there's counter arguments they actually work. Explain yourself, or are we supposed to take your word for gospel?

> Explain yourself, or are we supposed to take your word for gospel?

Not gonna waste more time on this tbh, as I'm building a competition to those products. If you don't believe me, stay in your walled garden. I've given you hints, start checking them for yourself or don't.

If I would post screenshots of MITMProxy, Little Snitch or something else, people would try to discredit them as fake anyways.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#333

Post by belorn »

tptacek wrote: post #258

It's hard to take EFF seriously when they write so hyperbolically. What's clearly also the case is that Chrome extensions are one of the great modern security and privacy challenges --- to the point where multiple tech company security teams have people whose job it is just to screen them. Another detail that EFF doesn't want to share is that ad blockers are some of the worst offenders --- they demand maximal access…

Google could add a simple button in Chrome if they wanted to trust users to make their own decision about displaying Google advertisement on Chrome. Instead they went with a decision that results in more google advertisements reaching users, which means that it is EFF that doesn't trust users?

Technology changes means nothing without outcomes, or else it is just changes to electrical potential of positive and negative state. If extensions like uBlock Origin are crippled or forced to leave than the outcome is crap, which is what occurred when safari did a similar "step in the direction of privacy, security, and performance". I wonder if google was aware of this when making the decision.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#334

Post by knob »

amelius wrote: post #317
veeti wrote: post #292

Earlier quoted context omitted.

There is no decision left to make once this change goes through. You can talk about improved security all you want, but the fact remains that uBlock Origin will be permanently crippled. This by far negates any security or privacy gain that Manifest v3 could possibly make. Switch to Firefox.

> Switch to Firefox. And if you're a webmaster, add some crippling/inconveniencing logic if user agent equals chrome.

I despise Chrome.

Yet I oppose your suggestion. Lets be above that.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#335

Post by skinkestek »

vorticalbox wrote: post #148
skinkestek wrote: post #84

Earlier quoted context omitted.

At this point I am seriously wondering if Mozilla is paid to drive Firefox into the ground.

This does feel like it is the case doesn't it? I really want to like firefox but I hate it more with every release.

It is still the best browser for me even when I don't consider my dislike for Google.

It is just - for me at least - not lovable anymore.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#336

Post by Vinnl »

piokoch wrote: post #309
hyperman1 wrote: post #305

Earlier quoted context omitted.

This is in fact one of the best arguments pro to do the change: * Chrome destroys ad blocking * Advanced users now suffer the same internet as everyone else * Advanced users will find a solution, and that solution can't be chrome anymore * This starts an exodus of advanced users . * Advanced users configure the browsers for everybody else, hence everybody else also joins the exodus The end result is less of a monopol…

Looking in the internet I see that "94% of Mozilla revenues came through royalties received by search engines to be featured on its Mozilla Firefox browser" I am afraid that at some point Mozilla can be forced to comply and cripple ad blockers too. Hopefully someone will decide to come up with a totally new browser. I remember times when BitKeeper told Linus that they will somehow try to charge for using their tool t…

Alternative sources of income are growing - the share of search engine deals was down to 86% last year, apparently: https://www.reddit.com/r/firefox/comments/rcc7m6/mozilla_aga...

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#337

Post by ilaksh »

tux1968 wrote: post #133
ilaksh wrote: post #76

One option is to just move away from browsers entirely. We can take some of the good things. Like maybe a small subset of HTML and web assembly. Add some minimal IO to web assembly.

A website being rendered by opaque, per-site web-assembly code, is not going to be amenable to uBlock, Greasemonkey or any other user-empowering extensions.

In this theoretical world you would generally not authorize any code (nor could any run by default) if you were just trying to view a web page. The HTML subset would be used for displaying information.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#338

Post by iggldiggl »

readflaggedcomm wrote: post #73
power78 wrote: post #59

Earlier quoted context omitted.

I wish Firefox would have left the old extension abilities. They could have easily added the WebExtensions standard to allow for cross-browser compatibility and not removed the old functionality.

They basically did, until the underlying browser became incompatible. That was the point: to have a stable API instead of extensions relying on implementation details, which includes multiple processes.

They didn't just broke them by necessity of rewriting the browser, though – they then actively blocked them on regular browser versions (non-Nightly/Developer Edition/etc.).

Case in point: With some limited maintenance and a compatibility shim for loading them, a number of old add-ons are still working on current Firefox versions: https://github.com/xiaoxiaoflood/firefox-scripts/tree/master...

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#339

Post by pastacacioepepe »

Tempest1981 wrote: post #219

It's also a major problem for many extensions, since ServiceWorkers (can) get killed every 5 minutes. No talk of a solution, just people trying hacks. https://bugs.chromium.org/p/chromium/issues/detail?id=115225... Example of breaking long-runnng classroom extensions used in education: (comment 63) https://bugs.chromium.org/p/chromium/issues/detail?id=115225... And breaking a simple image picker: (comment 36) https:/…

Yes this is the craziest part of the transition from V2 to V3. V3 is still bugged.

I crashed chrome by setting the incognito key to "split", and turns out there's no way to be sure that when you open an incognito page, your extension will be awake. What a mess.

I will postpone the "upgrade" the most I can, then I suppose I'll be forced to write a desktop app and pay hefty licenses to Microsoft/Apple. Google is just ignoring the complaints and the bug reports.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#340

Post by arepublicadoceu »

jefftk wrote: post #160
yonixw wrote: post #131

Earlier quoted context omitted.

Google has not provided any reason to not include "block request" functionality. And that the super bad faith underlying fact that poison their "reasoning".

There is still "block request" functionality, the change is that it's now declarative. This is the same way it works in Safari, and is (a) more efficient because you don't need to execute JS to evaluate each request and (b) more private because an ad/content blocker doesn't need to be given such broad permissions. There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and…

> There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and easily can be used to block Google ads.

Those serious "serious tradeoffs" made me completely stop using the web on my iPhone. Yeah, Safari content block can block roughly 80% of web ads, but those extra 20% are extremely annoying.

Web owners use all sorts of trickery to bypass adblockers and serve malware filled ads. Handicapping our current best defense tech against this is a sure as hell way to make me never open chrome again and completely purging it from any friends and family computer.

Post reply on HN