uBlock Origin Lite: Description

Took us about a quarter heads down to do the conversion which involved quite a bit of rewriting. We had been prepping and planning for the work pretty much since they first teased MV3 in 2018.

Now we are figuring out the right way to flip the switch. You get stuck in the long review queue every time you flip manifest versions, cuz your permissions list has likely changed.

Google's rollout has been the absolute worst; but hey, as you say, everyone who can't eat a bowl of shit and keep on smiling will simply disappear from the competitive landscape.

I believe there's none.

I guess the biggest issue I have with V3 is I don't really "get it".

The idea was initially that extensions have too many privileges and that malware can leverage those privileges for harm. I'd love data here! This is such a good area to share information on, as someone in security I'd really value that.

I'd like to see case studies on malware, or even broad things like "malware uses these permissions X% of the time".

But back to the point, assuming that this is true, how does V3 help? Specifically, what can malware not do with V3 that it could do before? Given the data, how will this impact the threat landscape?

I can think of some obvious things, like that you can't have dynamic scripts - cool, makes sense, I bet malware loves that and removing it seems like it'd be a huge win.

But WebRequests? I'm sure malware was using it, I guess, but what in V3 makes the malware use case for it harder? It seems like we're getting something that can be used maliciously just like before, but it's somewhat weaker in ways that malware won't care about? Again, data here would be great. I'd love to see "X% of malware used it this way, we removed that way".

Communication has seemingly been pretty bad around the motivations, which has led to a lot of people being pretty upset and confused about the changes.

Google, please share the data and reasoning!

edit: With regards to uBlock Lite specifically, I'm looking forward to seeing it evolve. I do like the idea of having a permissionless blocker that works decently and can then have the opt-in approach. I don't honestly consider it a massive security win though.

If no one were building an adblocker for Chrome I'd just build it myself. I'm sure I'd do a worse job than the people doing it today but it'd be better than nothing.