Live data from Hacker News

Chrome users beware: Manifest v3 is deceitful and threatening

eff.org

381–390 of 396 posts

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#381
TIL that there is this whole Degoogle movement.

I luv muh privacy as much as the next guy. But the posters to the Reddit sub of that movement come off sounding "emotion-driven" at best. Conspiracy theory "extremists" at worst.

The impression I get from the Reddit discussion of the eff.org article is that the majority of posters there are not "Hackers". That can be a good thing in a way.

One not-so-good thing, on the other hand, is degoogle posters' apparent unfamiliarity with the nuances sometimes involved in software maintainability decisions.

That plus the confirmation bias that is inevitable in any subreddit.

I'm far from a Google fanboy. Trust me! But being somebody who does code reviews on the regular, I can understand why Google played the "Single purpose" policy constraint card as their rationale for pulling that AdNauseum extension. [0]

From a quick review of the AdNauseum code [1] I can see why Google would say that it does more than one thing.

Case in point: It could be argued that my word processor provides a "Single purpose". Namely: Process words.

But my word processor actually has several discreet functions that I use it for: Mail merges, PDF generation, script and manage macros, etc.

So in that sense, my word processor does not provide a "Single purpose". I could see how Google could apply that to AdNauseum.

***************

[0] https://web.archive.org/web/20211209223531/https://adnauseam...

[1] https://github.com/dhowe/AdNauseam/

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#382

Earlier quoted context omitted.

Brave said they will keep the v2 capability in their Chromium fork "as long as it's possible" (paraphrasing, I can't find the exact tweet to quote).

Does Brave have their own extension repository yet, or are they still leaving that all up to Google? I don't see much value in Brave supporting a feature dropped from Chrome if it only has Chrome extensions and they all drop support for it anyway.

Microsoft does, and it has just about everything that I use. Huge opportunity for them. None of the smaller vendors have their own extension store.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#383

Earlier quoted context omitted.

How do you mean? I use both browsers and, while I certainly wasn't happy with the changes that accompanied their move to WebExtensions back around version 57, I don't find FF these days to be any worse overall than Chrome. Not trying to be argumentative, just not clear on your meaning.

I rely on Firefox for everything a browser does, and praise its many unique features and conveniences; I don't want to imagine using a garbage flavor of Chromium. But the folks at Mozilla keep hitting my morale. Examples- 1. History of installing and running arbitrary code on clients in the name of "Experiments" without user permission. 2. Full telemetry on by default. 3. Shoving their products like Pocket (added to…

They also removed live bookmarks, a feature I loved since 2002. There is a browser extension now, but I just moved to Inoreader (and Edge).

Final straw was the dedicated search bar not working with keyword shortcuts for other search engines. While the settings page claims those are supposed to work in the address bar and the search bar, they only work in the address ("omni") bar.

Too many features removed. I'd rather just go to my native browser and all the inherent advantages to it at that point, which as mentioned is MS Edge. I love it. In fact, their unnecessary additions (MS Shopping) actually opened my eyes to things I didn't know existed, like the Honey extension. I have no complaints about Microsoft Edge on Windows 11 or iOS. After 19 years of Firefox.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#384

Because of this, sometime in 2022 I will shut down Sitetruth, my fifteen year old ad blocking and site evaluation system. That offers add-ons for Chrome and Firefox, and puts a tag with company background info on each search result. Some search ads are removed, and some are de-emphasized. Some time next year, Google will probably force that add-on out of Chrome, as they tighten their grip over what browsers are allow…

Can't you run a proxy that intercepts and rewrites the HTML in the network level to remove the ads? Would that workaround the issue?

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#385

Earlier quoted context omitted.

Tons of people said this. They were all right. So, what's the alternative here? What can people actually do to improve on things?

Use Firefox, Opera, Brave, or DuckDuckGo browser.

What's DuckDuckGo browser? - That looks like a fake to me.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#386
post #229

A lot of comments here are wondering what Firefox will do and if uBlock Origin would be made useless in Firefox like it would be in Chrome (once Mv3 is implemented). Short answer: Firefox is adopting various parts of Mv3, but will continue to support blocking webrequest, which is used by extensions like uBlock Origin. So uBlock Origin would become useless in Chrome, possibly Edge and a few other browsers, but not on…

Get a DNS Sink (such as pfblockerNG-devel). Works without Add-Ons or client config and in any browser. uBlock Origin is really only used on my computer for when I am not at home.

Would love to hear how you block Youtube ads like this :)

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#387

Earlier quoted context omitted.

Is it Chromium based? It might be great but for now refuse to support anything that further strengthen Googles grip on the market.

> It might be great but for now refuse to support anything that further strengthen Googles grip on the market. The question then becomes: "What else even is out there?" Because if you're looking for something that's even remotely feature complete for browsing the modern day web, the majority of the current browsers out there are indeed based on Chromium, as expressed in this article, "Firefox is the Only Alternative"…

While I may be the only one around here to not know this, but I didn't realize Brave was OSS all the way through. That's great. I used FF for 19 years and switched to Edge fulltime in August ('21), and never looked back as each browser has its strengths and weaknesses. In the end, other than me being upset with feature removal in FF, I found Edge objectively comes out on top for me.

Vivaldi always seemed to hold the most promise but was buggy for me and still missing strong iOS integration that the competition has in place. Having used FF for so long, I was ready to go to a larger provider. So mainly, MS, Apple, or Google. Native browsers have big advantages so resisting those no longer made sense if I'm making a switch.

But Brave in my testing, did not completely convince me. Reviewing my testing notes-

Brave- no dedicated search bar option (important for privacy / prefetching and not having to continually retype your search query). Didn't get to mobile support and crossplatform sync. No dedicated extension store.

Of course, I had to give up on my dedicated search bar requirement, because FF's has been gimped by Mozilla, and Vivaldi had other unrelated usability flaws. So Edge it has been, and being completely honest, I've been thrilled with it. There's plenty other good here to overlook that and I haven't missed it as much as I thought I would.

All that said, I'm now going to keep Brave in mind, moving it up a notch. I always liked Eich which doesn't hurt. I don't fear a Chromium world, and never used FF because it wasn't, in fact I mostly resented it. I just don't see eye to eye with the anti-Blink crowd.

I think Firefox should've morphed into Brave, rather than be a separate project. A Brave that has Vivaldi's feature set would be perfect. Only thing missing then is major vendor support, and it'll always be non-native on all platforms, but at that point it could be overlooked.

For Firefox to fight its way back will require more than anti-Blink monoculture advocates supporting it. Blink has become the same as the USD, and isn't to be feared. For me, that's like saying you're resisting using the US Dollar because you don't want monoculture. Yet look at how much you can do with the USD. It enables quite a bit, embracing it just enables you to get other things done with less resistance. Users benefit. More important missions are at play. Like perhaps privacy, transparency, both things that Brave clearly focuses on. Or whatever one's chosen priorities are.

I legitimately love MS Edge, and I always keep Tor installed for the best privacy, but Brave is now my #2 pick for a daily driver and will be advocating for it for those that don't want to use their native browser.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#388
post #160
post #131

Earlier quoted context omitted.

Google has not provided any reason to not include "block request" functionality. And that the super bad faith underlying fact that poison their "reasoning".

There is still "block request" functionality, the change is that it's now declarative. This is the same way it works in Safari, and is (a) more efficient because you don't need to execute JS to evaluate each request and (b) more private because an ad/content blocker doesn't need to be given such broad permissions. There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and…

> (a) more efficient because you don't need to execute JS to evaluate each request

This is true, but I think overly performance-focused. It doesn't feel like that much time, so I think there's a valid complaint that it doesn't make sense to kneecap flexibility for speed.

> more private because an ad/content blocker doesn't need to be given such broad permissions

Sure, but this doesn't seem like the only possible solution for the people that own the browser. Why not only allow a restricted subset of JS that lacks any form of IO? Or if that's impossible/risky, why not something like Starlark or Lua?

I think this is based on a fundamental misreading of the problem. The privacy concern is that your data will leak, not merely that it's accessible to a third party. The cat binary can read my data, and I'm not at all concerned about that. So can my shell, and likewise on the concern.

Privacy doesn't necessitate this solution. It is one of the possible solutions, but I think is hard to sell as the best solution to the problem. It is likely the easiest.

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#389

Earlier quoted context omitted.

> WebRequest API still does not support blocking requests (and still does support _recording_ requests) The whole point is that there would be no reason to allow any ad blocking extension access to the WebRequest API anymore. The replacement, declarativeNetRequest, does not require the user to give any permissions, so the days of granting ad blocking extensions full access to every page are gone. If you think Google…

> The replacement, declarativeNetRequest, does not require the user to give any permissions, so the days of granting ad blocking extensions full access to every page are gone. From what I see, it also has some strict limits. My basic uBlock+ install has 82780 network filter rules. Chrome seems to "only" guarantee 30000 rules, and I don't know if these match 1-to-1. And there don't seem to be dynamic replacements, whi…

The current global rule limit is 300k rules per profile. This is shared between all extensions, which is shared amongst all extensions. This limit comes after the 30k per extension minimum, so if your extension uses 40k rules only 10k count against the global limit.

So if we assume rules are 1-to-1 (and in fact fewer rules should be present in declarativeNetRequest because certain rules like element hiding do not factor into declarativeNetRequest, and would be handled directly by the extension), you could fit ~5 adblocking extensions the size of your basic ublock install, and most of a 6th.

Now there are some advanced capabilities of some adblockers that have no equivalent available, but for common multi-plugin rulesets like EasyList, declaritiveNetRequest will support pretty much everything contained therein, (except cosmetic rules, which the plugin must apply separately, since they are not blocking requests, but modifying the page, which is quite different).

Re: Chrome users beware: Manifest v3 is deceitful and threatening

#390

Earlier quoted context omitted.

> WebRequest API still does not support blocking requests (and still does support _recording_ requests) The whole point is that there would be no reason to allow any ad blocking extension access to the WebRequest API anymore. The replacement, declarativeNetRequest, does not require the user to give any permissions, so the days of granting ad blocking extensions full access to every page are gone. If you think Google…

> The replacement, declarativeNetRequest, does not require the user to give any permissions, so the days of granting ad blocking extensions full access to every page are gone. Great, but I want to give my add blocker access to every web page. That's kind of it's purpose. Sure it could be abused, but not if you used one of the community recommended blockers. > If you think Google is doing this for their own gain, I gu…

> Sure it could be abused, but not if you used one of the community recommended blockers.

Why not? What stops someone from buying (or stealing or co-opting) uBlock Origin and using the fact that it has access to every user's web browsing to do some serious damage?

Post reply on HN