Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Begin disabling installed extensions still using Manifest V2 in Chrome stable"

developer.chrome.com

Post reply on HN
Print view View original

171–180 of 490 posts

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#171

Post by SAI_Peregrinus »

cma wrote: post #120
foxandmouse wrote: post #32

Earlier quoted context omitted.

I love Mozilla, but I’m concerned about its future. Since 80% of its income reportedly comes from the Google search deal, do they have a plan to replace it after the recent ruling? And can they maintain their current level of autonomy while doing so?

The Android version of Firefox still doesn't have working keyboard shortcuts after 13 years or a way to delete individual history items to prevent broken auto complete. The money is going into lots of other things than the browser.

I'm not sure keyboard shortcuts for a version designed to run on an OS for devices without keyboards will ever be a priority. You can use a keyboard on an Android device, but the vast, vast majority of Android devices are phones that never get used with keyboards. I don't expect there's much priority to adding that feature.

I agree that a lot of money is going to things other than the browser though.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#172

Post by kccqzy »

yjftsjthsd-h wrote: post #159
drivebycomment wrote: post #112

Earlier quoted context omitted.

One of the most common API malware extensions use is what MV3 blocks, and adblock extension is one of the common malware vectors: https://helpcenter.getadblock.com/hc/en-us/articles/97384768... https://www.wired.com/story/fake-chrome-extensions-malware/ This has been never ending.

Okay, if you absolutely must then make that specific API require extra audit approval from the extension store, but breaking it outright is throwing out the baby with the bathwater; in a world where the FBI outright recommends an adblocker because ads are such a strong malware vector ( https://techcrunch.com/2022/12/22/fbi-ad-blocker/ ), it's irresponsible to undermine uBo.

Nobody likes extra audit approvals. The platform doesn't want to spend resources doing the audit. The developers don't want to be audited.

The Firefox version of uBlock Origin Lite was pulled due to unsatisfactory audit process: https://news.ycombinator.com/item?id=41707418

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#173

Post by kuhsaft »

yjftsjthsd-h wrote: post #158
kuhsaft wrote: post #114

Earlier quoted context omitted.

> The only way this is an improvement if you think the blockers are malicious Extensions and in turn MV2 blockers can easily be malicious. https://usa.kaspersky.com/blog/dangerous-chrome-extensions-8... Look at how many in Kaspersky’s list are advertised as ad blockers. The majority of users aren’t tech savvy like HN.

> Look at how many in Kaspersky’s list are advertised as ad blockers By my count 5, 6 if we include "Autoskip for Youtube", out of 34. That might be an argument for dropping extensions, but I don't think it's an argument for breaking ad blockers.

> That might be an argument for dropping extensions

Those extensions used the same API that ad blockers used, but for malicious purposes.

So, you would support removing that API? Well, that’s what they did for MV3 and implemented an API just for ad blocking.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#174

Post by kuhsaft »

jauntywundrkind wrote: post #170
kuhsaft wrote: post #166

Earlier quoted context omitted.

> To all the engineers working on this stuff, I hope you're happy that your work is essentially destroying the world that you and I grew up in. That was a world where the user base was much more limited and devices were less capable. Now we have children, grandparents, educated, and uneducated users with access to web connected devices. These devices now contain everything about you. Compromise of a device can destro…

Still a shit poor pathetic excuse to screw over the userscript/grease monkey users. The browser is called a user agent, but this shift to absolute security no matter what, no say about it is a shift to native apps, is a shift to the developer is in control, is a shift to this being Google and the sites browser, not ours, and that being done unilaterally with nearly no opt outs is the sort of mega tectonic shift that…

> Still a shit poor pathetic excuse to screw over the userscript/grease monkey users.

Tampermonkey still works fine with MV3

> We cannot pander to imagined ever worsening users forever.

The most popular software/hardware will always pander to the most users. That’s why they’re the most popular.

You can’t complain about the most popular option pandering to the most users. Well, you can complain, but you might be in the minority of the users.

> It feels like the things being done in the name of security are really building an immense prison.

I get that, but we are running so much untrusted code on our machines now. Applications that use thousands of dependencies with the hope that someone spots a bad actor.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#176

Post by GeoAtreides »

kuhsaft wrote: post #162
eikenberry wrote: post #144

Earlier quoted context omitted.

If I remember right then the difference is more about ad-tracking/privacy than blocking. V2 allowed UBO to find and intercept the calls to the ad servers before the calls were made. Where V3+UBL still makes the calls it just doesn't display the results. So while you might not see the ads, the ads see you.

On the contrary, MV2 used onBeforeRequest which let extensions see what requests you were making. They could then take that data and use it for malicious purposes. MV3 doesn’t allow extensions to know what requests are being made, so extensions can’t use your data maliciously. Requests to ads that are blocked are blocked. I think you’re thinking of Privacy-preserving ad measurement which is an option in Firefox and S…

but op wasn't talking about what extensions are seeing, but what the ad servers do. You haven't address their point at all

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#177

Post by throwaway48476 »

sho wrote: post #25

Hopefully this is the inflection point for Chrome. Despite all their made-up "security" reasons, everyone knows this is solely about making adblock less effective. For many users, adblock is what makes chrome bearable - and if they make it unbearable, then those users will leave. Slowly but surely. Google seems much too sure of itself making this change. I hope their arrogance pays off just the same as Microsoft's di…

So, are you going to leave chrome then?

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#178

Post by [deleted] »

kuhsaft wrote: post #174
jauntywundrkind wrote: post #170

Earlier quoted context omitted.

Still a shit poor pathetic excuse to screw over the userscript/grease monkey users. The browser is called a user agent, but this shift to absolute security no matter what, no say about it is a shift to native apps, is a shift to the developer is in control, is a shift to this being Google and the sites browser, not ours, and that being done unilaterally with nearly no opt outs is the sort of mega tectonic shift that…

> Still a shit poor pathetic excuse to screw over the userscript/grease monkey users. Tampermonkey still works fine with MV3 > We cannot pander to imagined ever worsening users forever. The most popular software/hardware will always pander to the most users. That’s why they’re the most popular. You can’t complain about the most popular option pandering to the most users. Well, you can complain, but you might be in th…

[deleted]

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#179

Post by echoangle »

EasyMark wrote: post #139
freedomben wrote: post #17

Notably, Firefox is not removing v2 support (at least for now as of March 2024) > Firefox, however, has no plans to deprecate MV2 and will continue to support MV2 extensions for the foreseeable future. And even if we re-evaluate this decision at some point down the road, we anticipate providing a notice of at least 12 months for developers to adjust accordingly and not feel rushed. [1] [1]: https://blog.mozilla.org/a…

To my knowledge the “big” chrome engine alternatives aren’t either. I know that Vivaldi and Brave plan on keeping around v2 as long as it is economically feasible

This sounds like Android phone manufacturers making fun of apple for removing the headphone jack and then doing it themselves a year later. Are they seriously going to maintain V2 support for a relatively small percentage of Powerusers which probably are mostly already using Firefox anyways? The point of being economically infeasible is probably in a month or so.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#180

Post by dang »

lapcat wrote: post #84

This submission title does not appear to be accurate. Here's what was actually said: > October 9th 2024: an update on Manifest V2 phase-out. > Over the last few months, we have continued with the Manifest V2 phase-out. Currently the chrome://extensions page displays a warning banner for all users of Manifest V2 extensions. Additionally, we have started disabling Manifest V2 extensions on pre-stable channels. > We wil…

Ok, I've replaced the title with that language from the article (shortened a bit to fit HN's 80 char title limit). Thanks!

Submitted title was "Manifest v2 is now removed from Chrome canary"

Post reply on HN