Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Begins Testing Extension Manifest V3 in Chrome Canary

bleepingcomputer.com

Post reply on HN
Print view View original

301–310 of 448 posts

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#301

Post by cletus »

malvosenior wrote: post #171
cletus wrote: post #157

Did anyone actually read the submission? The title is clickbait that doesn't reflect the content. The change here moves modifying content of the webRequest to the browser from the extension. This is fundamentally more secure. Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous. The new declarative API (from the article) limits such extensions to 30,000 rules.…

> So rather than be alarmist and use this to feed into the tired narrative that "Google is killing ad blockers because it's an advertising company" That’s not alarmist, it’s the obvious truth. As a user I should have complete control over what runs on my machine. I don’t need Google “protecting” me (by breaking ad blockers). Google is the single most destructive force in the tech industry today. Very much like Micros…

> it’s the obvious truth.

Only to those who are woefully ignorant of how any large company work and are unable or unwilling to see passed their own desires. But let me ask you this, even if we stipulate it's 100% true, how does that help? What does that accomplish? You've simply stated an opinion that those who agree with you will cheer for (changing nothing) and those who disagree with you won't change (also changing nothing).

People have this overly simplistic view of how large companies work and ascribe malice to Google in particular for what's essentially just chaos. And I say this as a Xoogler.

There are conflicting forces in Google that include, but are not limited to:

1. Protecting the ad revenue business Google is utterly dependent on; and

2. Promoting user privacy and benefits because that's what gets users to keep using your products.

Even (1) comes from a wide variety of motivations such as:

- Making more money;

- The belief that ad-supported models are the only model that works so advertising is an absolute necessity to providing services on the Web.

> I don’t need Google “protecting” me

And again, you seem to be deliberately missing the point here because you say "I" a lot. What about your parents? Or grandparents? Do they need "complete control" over their machines? And consider for a second the scenario where you're not giving them tech support.

This "complete control" is exactly what enables botnets (many of them anyway), fraud, theft, DDoS attacks and so on.

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#302

Post by cletus »

bnegreve wrote: post #222
cletus wrote: post #157

Did anyone actually read the submission? The title is clickbait that doesn't reflect the content. The change here moves modifying content of the webRequest to the browser from the extension. This is fundamentally more secure. Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous. The new declarative API (from the article) limits such extensions to 30,000 rules.…

> So rather than be alarmist [..] we should be pushing for changes that make this workable If, as the author suspects, the intent is to break popular adblockers, I have no interest in trying to make this workable. Personally, I think this is a typical half-legit move: there's a good intention (security) but it's also hard to believe they did not realize that by pushing these changes, they were going to break several…

How hard exactly is it to use Firefox instead of Chrome? It literally takes 2 minutes to switch. This isn't a Microsoft situation where, at the time, there was no alternative to Windows. It is the easiest thing in the world to change browsers. Google knows this too.

Not every surface is a slippery slope.

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#303

Post by cletus »

blep-arsh wrote: post #226
cletus wrote: post #157

Did anyone actually read the submission? The title is clickbait that doesn't reflect the content. The change here moves modifying content of the webRequest to the browser from the extension. This is fundamentally more secure. Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous. The new declarative API (from the article) limits such extensions to 30,000 rules.…

30K is just not enough. Intercepting requests is still possible, just not blocking. Extensions have been already abusing this, of course. It's fiendishly difficult to prevent e.g. corporate users from leaking the whole intranet to SimilarWeb unless you completely disable browser extensions.

> Intercepting requests is still possible, just not blocking

False: https://developer.chrome.com/extensions/declarativeNetReques...

"There are the following kinds of rules:

- Rules that block a network request.

- Rules that prevent a request from getting blocked by negating any matching blocked rules.

- Rules that redirect a network request.

- Rules that remove headers from a network request."

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#304

Post by cletus »

malka wrote: post #254
cletus wrote: post #157

Did anyone actually read the submission? The title is clickbait that doesn't reflect the content. The change here moves modifying content of the webRequest to the browser from the extension. This is fundamentally more secure. Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous. The new declarative API (from the article) limits such extensions to 30,000 rules.…

Google is the worst actor to push for this. I have 0 trust in them that they are doing this for the right reasons, and that I will benefit as a user.

If you have 0 trust in Google, why would you ever use Chrome?

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#305

Post by pen2l »

This is not as terrifying to me as the other news brought to my attention by a post in today's Reddit's r/YSK, that if you use Adblock, your gmail can be closed.

In the new TOS of Youtube [1], it states that if your account is not deemed commercially viable, your Google account (i.e. your Gmail, your Google Photos, your Google Drive, etc.) can be closed down:

    YouTube may terminate your access, or your Google 
    account’s access to all or part of the Service if YouTube
    believes, in its sole discretion, that provision of the 
    Service to you is no longer commercially viable.
Makes sense they would make this decision, as Youtube is a big money-loser for Google and they want to do something about this. Still, this is more of a wake-up call to me than anything else that I need to get off Google.

[1]: https://www.youtube.com/t/terms?preview=20191210#main&

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#306

Post by jefftk »

BurnGpuBurn wrote: post #112

The biggest advertising company in history tries to kill blocking advertisements in their browser? How am I not surprised. I bet this move is also to kill the workings of extensions like DecentralEyes and others that try to protect users from being tracked. The whole changing of the API into a "sure we'll block that URL for ya, sometimes maybe" model reeks of increasing user tracking. They'll work out the kinks to le…

Would anyone like to make a bet on whether ad blocking will still work in Chrome in two years? Something like "if you visit the top ten publishers in the US in Chrome Desktop with the best ad blocker will you see more ads than if you use Firefox Desktop with the best ad blocker"?

(Disclosure: I work at Google, not on Chrome, and don't have any inside information on this)

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#307

Post by cletus »

DaiPlusPlus wrote: post #240
eyegor wrote: post #185

Earlier quoted context omitted.

This isn't just the rule limit, and the most powerful part of extensions imo is to be able to block/modify elements at the dom level. Both for ad blocking and for customizations (reflow pages, modify css, etc). If you don't feel comfortable giving access to blockers, it's not that hard to roll your own. Just read the format of easylist. > extensions can only monitor browser connections, but not modify any of the cont…

And if requests are blocked then content publishers can very easily detect ad-blockers and intentionally degrade the user-experience or add nag screens that aren't part of the usual ad network code. If it's an SPA then it'd be almost impossible to untangle easily when the site's developers can add their "is-adblock-detected?" checks anywhere in their SPA codebase and mess with the UX at-will.

Ok, so of all the replies here, this is the first I've read that's actually raised a really good point. Simply blocking requests will make ad block detection easier for Websites. Then again, this seems to be pretty prevalent already (as in lots of sites I visit already detect this).

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#308

Post by bn7t »

fastball wrote: post #213
mcv wrote: post #170

I'm in the process of switching as much as possible to Firefox. I now use Firefox Mobile on my smartphone, and my new laptop doesn't even get Chrome. And in many ways, it's been a breath of fresh air. Firefox gives my much more control over my privacy, and even recommends some extensions to improve it further. A couple of websites are sadly broken on my Firefox setup, but I can live without them. I want to get back t…

Why not something like Brave which has the performance of Chromium (still better than Firefox imo) because it's a fork but probably won't make similar business decisions to Google?

Regarding brave see: https://news.ycombinator.com/item?id=21323576

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#309

Post by cletus »

tinus_hn wrote: post #256
cletus wrote: post #157

Did anyone actually read the submission? The title is clickbait that doesn't reflect the content. The change here moves modifying content of the webRequest to the browser from the extension. This is fundamentally more secure. Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous. The new declarative API (from the article) limits such extensions to 30,000 rules.…

So, some handwaving and all concerns go away because they are 'tired narratives'. Why not just block all extensions? That's clearly the most secure solution. > I honestly don't like the fact that I have to give a third party developer so much privileged access to run an ad blocker Then don't, install another one that works the way you want. Or don't, because the limited blocking abilities you appear to find sufficien…

> Why not just block all extensions? That's clearly the most secure solution.

That's pretty much what phones do. Both iOS and Android take a white list approach for third-party add ons.

Re: Google Begins Testing Extension Manifest V3 in Chrome Canary

#310

Post by bn7t »

plopz wrote: post #287
AsusFan wrote: post #100

Earlier quoted context omitted.

You won't be laughing for long, I believe. See this FAQ: https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest... Note how they say: "We have no immediate plans to remove blocking webRequest and are working with add-on developers to gain a better understanding of how they use the APIs in question to help determine how to best support them." "No immediate plans" is weasel-speak, as is "[we] are working with add…

You just have to look at how they don't support addons in their new mobile browser to see their true intentions.

Addon support will be available in Firefox Preview. This has been clarified.
Post reply on HN