Chrome users beware: Manifest v3 is deceitful and threatening • Hacker News Board

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#361

Post by wccrawford » Fri, Dec 10, 2021, 4:45 PM UTC

wccrawford wrote: post #323

qiqitori wrote: post #269

Earlier quoted context omitted.

The EFF doesn't need to give "the other side" because the other side is mostly obvious to the target audience (which isn't random people, Google itself is a huge part of the target audience). Note that Google doesn't give the other side either. Also, nothing in politics works like that, if you want to get people to join your cause you don't end everything you say with "But keep in mind that $foo".

So long as they're only interested in preaching to the choir, that's true. If they want to reach other people who are as zealous, they could stand to give a better full of the landscape.

Ugh, typo: Who are not as zealous.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#362

Post by less_less » Fri, Dec 10, 2021, 4:55 PM UTC

blub wrote: post #288

less_less wrote: post #284

Earlier quoted context omitted.

Do you want to call out any particularly malicious ad blockers here? Just in case I happen to have installed one of them.

Since parent tested all of them and they’re not kidding, it follows that yours must be a scam. Unless they didn’t test everything or were exaggerating that is.

Yeah. Also I know that mine blocks ads, but parent alluded to a spectrum of malice and scamminess. If it cost $2 but it's a mediocre fork of ABP and that's all, then I'm already out the $2 and I might as well keep it installed. If parent claims it's outright malware that steals passwords, mines crypto and holds your cat pictures for ransom then I'm at least going to investigate.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#363

Post by rektide » Fri, Dec 10, 2021, 6:10 PM UTC

tentacleuno wrote: post #109

rektide wrote: post #4

Previously extensions could be background pages, with access to DOM & Web Platform apis. MV3 currently reduces them to Service Workers, able to use far far far less capabilities. This is a massive massive downgrade for Extensions, unfathomable really. A Mozillaian proposed a less limited Limited Events Page but Google has snubbed it & not discussed. https://github.com/w3c/webextensions/issues/134 Extensions are force…

> I generally find Google to be quite a good steward for the web & am so happy they advance so many different initiatives & capabilities. I don't. Especially not with FloC[0][1]. [0]: https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-... [1]: https://developer.chrome.com/docs/privacy-sandbox/floc/

What else?

As for FloC, still trying to understand FloC's implications & make a position on it. Hearing it proposed, it sounds enormously stupid, but I'm not convinced it's in fact bad. Part of me even thinks it indeed sounds like a significant privacy win over where we are.

Rather than discuss FloC though I'm wondering what other efforts you would malign.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#364

Post by timbit42 » Fri, Dec 10, 2021, 6:49 PM UTC

marderfarker2 wrote: post #281

The day Chrome (and it’s derivatives) kill my extensions, is the day I switch to Firefox. I cannot live without my adblocking.

That day will be too late. The time to switch is before it happens to discourage it from happening. It's really too late even now.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#365

Post by Lamad123 » Fri, Dec 10, 2021, 7:11 PM UTC

jefftk wrote: post #187

coffeefirst wrote: post #178

Earlier quoted context omitted.

I’m sure you are an honest person working in good faith. But we saw very similar behavior from Google around AMP. They had a very narrow reasonable sounding explanation, and just ignored all criticism and requests from both users and publishers that didn’t fit their narrative. This went on for years. Today we know AMP was also a anticompetitive plot to kill off header bidding. Why should we to believe a word of what…

> Today we know AMP was also a anticompetitive plot to kill off header bidding. I completely disagree, and I think this will become clear as information continues to come out.

Stop astroturfing.. Your company is a scummy monster!!

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#366

Post by jefftk » Fri, Dec 10, 2021, 7:27 PM UTC

Lamad123 wrote: post #365

jefftk wrote: post #187

Earlier quoted context omitted.

> Today we know AMP was also a anticompetitive plot to kill off header bidding. I completely disagree, and I think this will become clear as information continues to come out.

Stop astroturfing.. Your company is a scummy monster!!

Google has not asked me to comment here, now or previously. When I see incorrect claims about something I have background on I point it out.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#367

Post by anticensor » Sat, Dec 11, 2021, 3:47 PM UTC

chii wrote: post #234

dessant wrote: post #165

Earlier quoted context omitted.

This is just an attempt to rehash the same old arguments provided by Google that have been repeatedly debunked by developers and security researchers. > I work on ads at Google, speaking only for myself I'm doubtful about a person's ability to speak for themselves, when they have been consistently defending their employer on HN for years, at every occasion they got.

"It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It"

Also known as Sinclair's law.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#368

Post by raxxorrax » Sat, Dec 11, 2021, 4:16 PM UTC

judge2020 wrote: post #64

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is…

Review by Google is completely worthless for my security considerations. I need my software to work for me, so Chrome will not be part of that anymore.

To say browser extensions pose a risk is true, but it hardly makes it in the top list of threats anymore. Malicious sites however still do and Google just restricted our ability to let third party tools provide essential services. Sure, these could be malicious, but that is generally not a wide spread IT problem of today. That should be also obvious to Chrome developers.

Accidentally they also restrict ad blockers? Come on, you are getting played.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#369

Post by greggh » Sat, Dec 11, 2021, 4:18 PM UTC

cookiengineer wrote: post #277

tptacek wrote: post #258

It's hard to take EFF seriously when they write so hyperbolically. What's clearly also the case is that Chrome extensions are one of the great modern security and privacy challenges --- to the point where multiple tech company security teams have people whose job it is just to screen them. Another detail that EFF doesn't want to share is that ad blockers are some of the worst offenders --- they demand maximal access…

Every time someone mentions this I have to think about the messed up ecosystem of Safari Webextensions. Safari only allows extensions installed via the apple store, but every single adblocker there is a scam. I'm not kidding you, I audited most of them. Chances are it's either a three years outdated list of adblock plus that doesn't catch anything or it's an extension that replaces all google analytics identifiers wi…

I use Wipr and it is great. I don't see ads, which is the reason I use it. So I don't see your point. Other than the fact that you are making a competitor, so you are incentivized to post something like this.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#370

Post by creamytaco » Sat, Dec 11, 2021, 4:19 PM UTC

nickelpro wrote: post #266

LamaOfRuin wrote: post #204

Earlier quoted context omitted.

It does not allow request blocking as that has been understood in the context of extensions until now It is not a question that V3 breaks the gold standard privacy protecting extension.

I quibble with this. Request blocking "as that has been understood", is preventing the request from leaving the browser. That's still demonstrably doable with mv3. What's changed is the mechanism. You can argue about the value of changing the mechanism, about the burden placed on plugin developers, or the efficacy of various APIs, but the functionality is inarguably still there.

You're being disingenuous. With Manifest v3, it is not possible any more to block requests dynamically which has huge implications for the efficacy of ad blocking (example: forget blocking youtube ads). Additionally, you're limited in how many static rules you can have.

Therefore, it's not just about changing the mechanism, the end result is clearly a lot worse. One can say, they crippled ad-blocking which this change. Hopefully, once the millions of people using ublock origin start noticing what's happening, they will move away from Chrome. I already did, ublock origin is worth more to me than any feature Google puts in Chrome.