Live data from Hacker News

Firefox is now the last major browser that still supports uBlock Origin

pcworld.com

751–752 of 752 posts

Re: Firefox is now the last major browser that still supports uBlock Origin

#751

Earlier quoted context omitted.

Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versions, etc. maintained backwards compatibility for a window then closed it... just like we have seen here with manifest v2 -> v3. "Please stop looking at all network requests, especially when you don't need to." doesn't result in action... while: "You can no long…

New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together. It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions. Th…

You're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption.

Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.

Re: Firefox is now the last major browser that still supports uBlock Origin

#752

Earlier quoted context omitted.

New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together. It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions. Th…

You're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption. Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.

Well yes, SNI will be removed, when ESNI reaches far enough adoption. That's my point! ESNI does what SNI does, but securely.

You fix an insecure implementation by replacing it with a secure implementation, not removing the feature completely.

Post reply on HN