[HN Gopher] "UBO Minus (MV3)" - An Experimental uBlock Origin Bu...
___________________________________________________________________
"UBO Minus (MV3)" - An Experimental uBlock Origin Build for
Manifest V3
Author : antonok
Score : 210 points
Date : 2022-09-07 18:25 UTC (4 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| krono wrote:
| Tangent but let's stop referring to it as a mere ad blocker, it's
| a content blocker - it's even a very useful and impactful
| accessibility tool in that capacity.
|
| ADHD sucks and I have a lot to thank to these types of tools for
| acting as my "crutches" that allowed me get where I am today.
| jasonhansel wrote:
| 100%. This is an a11y issue, not just about protecting privacy.
| notriddle wrote:
| I'd just like to interject for a moment. What you're refering
| to as an ad blocker, is in fact, a content/ad blocker, or as
| I've recently taken to calling it, a content plus ad blocker.
| Ad blockers are not an extension unto themselves, but rather
| another downloadable block list for a fully functioning user
| agent made useful by the extension, browser chrome, and vital
| web engine components comprising a full user agent content
| customization system, which, in this case, can be customized
| using the ABP blocklist syntax.
|
| Many computer users run a modified version of a content blocker
| every day, without realizing it. Through a peculiar turn of
| events, the version of the content blocker which is widely used
| today is often called an ad blocker, and many of its users are
| not aware that it is basically a generic content blocker with a
| particularly popular block list preloaded.
| LordDragonfang wrote:
| For the uninitiated:
|
| https://wiki.installgentoo.com/index.php/Interjection
| ChemicalScum wrote:
| No.
| [deleted]
| yamazakiwi wrote:
| driverdan wrote:
| If you're still using Chrome now is the time to switch to
| Firefox. This is an interesting experiment but the only solution
| is to stop using Chrome.
| wnevets wrote:
| The moment I need to deicide between installing UBO Minus or
| making Firefox my default browser is the moment I make Firefox
| my default browser. Browsing the internet without a fully
| functioning uBlock Origin is a nightmare.
| [deleted]
| ianlevesque wrote:
| Firefox still isn't a suitable Chrome replacement. Chrome may
| be beaconing half your browsing data back to Mountain View
| quietly in the background, but Firefox shoves its monetization
| strategy right in your face every time you open a new tab
| (Pocket, VPN ads, etc). Firefox is also drastically more
| complex in the UI and menus, and is missing a lot of UX
| niceties in the window and address bar itself (extra clicks to
| search all open tabs comes to mind). Mozilla has no one to
| blame but Mozilla for where Firefox isn't in terms of market
| share.
| sfink wrote:
| Search all open tabs in Firefox: prefix your search with "% "
| (percent followed by a space).
|
| Or don't, and it'll probably be in the list of suggested
| results anyway.
|
| ( _Unless_ you 're using container tabs, in which case it'll
| only search open tabs in the current container, which is
| sometimes good but usually a nuisance.)
|
| I much prefer Firefox's address bar search heuristics over
| Chrome's, but it definitely depends on your usage patterns.
| Firefox is very good at suggesting relevant things from my
| history, to the extent that I will _gasp_ actually close tabs
| now and rely on search to rediscover them, rather than
| forever accumulating open tabs that I might want to get back
| to.
| Melatonic wrote:
| Firefox FTW
| dilap wrote:
| First time in a while running Firefox on Mac, and I'm happy to
| report it finally supports bounce scrolling! In general
| scrolling is very smooth and performance seems excellent.
| jbverschoor wrote:
| Nope, not here. No bouncing, maybe due to 'no animation
| settings' in display. Also, scrolling feels different.
| Different speed, different acceleration.
|
| Still doesn't feel native at all.
| dilap wrote:
| > Nope, not here. No bouncing, maybe due to 'no animation
| settings' in display
|
| Where's that setting?
|
| > Different speed, different acceleration.
|
| Huh, interesting! Are you mouse or trackpad? I'm comparing
| side-by-side on trackpad and I can't detect any difference.
| If I flick the trackpad at the same speed they will both
| land roughly in the same place on the page, and the
| variation, as near as I can tell, is because of variations
| in my flick speed.
|
| In both Safari and Firefox I find it basically effortless
| to scroll exactly where I want to. (This was emphatically
| _not_ true for me in previous versions of Firefox.) Feels
| totally natural. Though maybe there is a difference I 'm
| just not sensitive enough to detect!
|
| FWIW, I'm on Firefox 104.0.2, macOS 12.5.1, MB Pro / M1
| Max.
|
| (Spark, which is a supposedly-native email app, somehow has
| weirder feeling scrolling to me than Firefox.)
| jbverschoor wrote:
| Reduce Motion in display or accessibility settings I
| think it's called.
|
| I'm on M1. Just updated FF from the menu.
|
| I'm using the trackpad, but again, I changed my system
| settings, as I don't like the default speed and
| acceleration.
| dilap wrote:
| Huh, yeah, turning on "Reduce motion" does indeed disable
| bounce scroll in Firefox. Definitely a strange choice on
| their part! (It doesn't affect it in other apps.)
|
| > I changed my system settings, as I don't like the
| default speed and acceleration
|
| I see, that could make sense, if Safari was honoring
| those changes and Firefox wasn't, in some way. I've got
| mostly stock settings (slightly bumped up speed and
| three-finger drag) and it feels spot-on.
| aeharding wrote:
| Something must be wrong on your machine. On my Mac Mini and
| Air (m1) Firefox scrolling is extremely smooth and feels
| much more native than Chrome. Overscrolling has worked
| great since they revamped the engine, even in nested scroll
| views!
|
| Firefox's scrolling engine is so good, CSS scroll snapping
| feel more native than Safari's implementation (with chrome
| feeling the least native - too little friction and takes
| too long to stop moving on large scroll snap areas) [1].
|
| [1] https://ppg.report/41.876,-87.624 for example of CSS
| scroll snapping that performs best on Firefox on Mac
| tapoxi wrote:
| You can also use Brave, which implements its own native
| adblocker and isn't impacted by Manifest v3.
| contravariant wrote:
| Do you mean that particular adblocker is not impacted or is
| Brave going to maintain support for the APIs dropped by
| Manifest v3?
| [deleted]
| therealmarv wrote:
| Brave's adblocker is internal and written in Rust.
|
| https://github.com/brave/adblock-rust
|
| I'm pretty sure it's also faster than any adblock extension
| like uBlock.
| bkallus wrote:
| Both.
|
| "We will continue to support Manifest v2 to the extent that
| we can"
|
| "Brave's adblocker (Brave Shields) is not an extension, and
| is natively implemented. So, it will be totally
| unaffected."
|
| Source: https://www.reddit.com/r/brave_browser/comments/rda
| b12/how_w...
| nightpool wrote:
| Brave has committed to retaining support for all of the
| APIs that were removed by Manifest v3
| https://github.com/brave/brave-
| browser/issues/20059#issuecom... (There are other mentions
| in the wiki and other places)
| antonok wrote:
| Brendan Eich has committed to supporting the Manifest V2
| version of uBlock Origin in Brave [1].
|
| Brave's built-in native adblocker also definitely won't be
| affected, as it doesn't use any webextension APIs at all.
|
| [1]: https://github.com/uBlockOrigin/uAssets/discussions/14
| 544#di...
| prvc wrote:
| Any disadvantages to switching from Chrome or Firefox?
| gapo wrote:
| From the commit msg:
|
| At this point I consider being permission-less the limiting
| factor: if broad "read/modify data" permission is to be used,
| than there is not much point for an MV3 version over MV2, just
| use the MV2 version if you want to benefit all the features which
| can't be implemented without broad "read/modify data" permission.
| Raed667 wrote:
| I think uBlock Origin providing a manifest-v3 compatible
| extension would be a net negative for the community. As it will
| help more people accept the status-quo and accept a mediocre
| state of ad blocking, instead of switching to Firefox
| TheRealPomax wrote:
| What community? "People who use chrome"? Because that community
| couldn't care less about which version of manifest is the
| current version, and what its restrictions are. If they did,
| they'd already not be using Chrome anymore.
| Tenoke wrote:
| If uBlock doesn't provide a compatible extension or if their
| extension is worse than possible I'd likely just switch to the
| best alternative which will pop-up. I imagine most users will
| do the same.
| redox99 wrote:
| Why are you willing to accept an inferior adblocker, instead
| of switching to another browser that maintains support for
| fully featured adblockers?
| comex wrote:
| Until recently, Firefox was an inferior browser, at least
| on macOS where it did a bad job of fitting native UI
| conventions, had a much less secure sandbox than Chrome,
| and was also behind in performance. Seems like things have
| improved on all of those fronts, so perhaps it's time to
| take another look. (That said, I've only ever used Chrome
| as a secondary browser for certain sites - my current
| primary one is Orion - so I have less incentive to
| experiment.)
| Tenoke wrote:
| I've had multiple (typically but not always google) sites
| not work as well with firefox, as well as minor things like
| more captchas. I also don't want to worry and keep checking
| if my subpar performance on a site is because Google, a
| lazy dev or a lib didn't optimize for FF. Further, I just
| have a bunch of settings, extensions, saved password,
| history etc. already setup in Chrome.
| cyber_kinetist wrote:
| A pragmatic reason for me: Firefox has been lagging a lot
| on my Windows machines for months, and I couldn't figure
| out the problem. Tried extensive googling, even tried
| debugging it in the developer profiler to see if anything's
| strange.
|
| I've now given up, and switched to Chrome without regrets.
| I still miss Tree Style Tabs, but the sluggishness isn't
| really worh it.
|
| I'll start using Firefox again until they fix this issue
| and realign their funding towards actual better engineering
| & performance instead spending on vanity "activist"
| projects.
| Dalewyn wrote:
| Because Firefox is shit to use.
|
| Adblocking means little if the actual browser is terrible
| to use. Between proper adblocking and a shitty browser, or
| a shitty adblocker and a shitty-but-still-usable browser I
| will take the latter because ultimately I have shit that
| needs to get done.
|
| Practicality cares not for ideology.
| blibble wrote:
| this is actually a clever way of hurting Google
|
| if gorhill simply refused to release UBO for manifest V3 then
| someone would, and release something similar without the negative
| branding
|
| (plus eyeo crapware "ad blocking" extensions would gain market
| share)
|
| this way the users are being reminded that on Google's platform
| you're getting an inferior blocker
| ryeights wrote:
| Great point! Initially I thought it would be wrong to kowtow to
| Google by releasing a MV3-compliant version, but I think you're
| more correct.
| btown wrote:
| It's also an interesting magnet for traditional media - imagine
| if CNN ran a lede "Ad blockers. You may use them, you may not,
| but Google is on the warpath against them. Here's the developer
| of the popular uBlock Origin Minus describing why his software
| suddenly has that odd name."
|
| Sadly, this is likely not to happen, as every newsroom relies
| on online ad clicks for a revenue stream...
| puffoflogic wrote:
| Wait, are you suggesting that technologies that may be bad
| for news media profits get unfavorable coverage?
| s-video wrote:
| No cosmetic filtering might still tip me over into switching to
| Firefox.
| bot41 wrote:
| What is "Manifest v3"?
| swat535 wrote:
| see this thread: https://news.ycombinator.com/item?id=20050173
| loxias wrote:
| I was wondering the same. I think it's a new standard for how
| Chrome extensions work?
|
| I hope it doesn't affect FF users, and uBlock Origin will
| continue to function same as it always has.
| Havoc wrote:
| That naming convention is an absolute stroke of genius. Not
| enough to get sued, but enough to convey to millions that they
| are using an intentionally crippled product.
| nightpool wrote:
| Just so I understand correctly: This version removes *all* of the
| features that read or modify a user's data, so as to abide by the
| ""stated intent"" of MV3, rather than taking full advantage of
| all of the actual MV3 APIs? For example, this commit removes the
| "scriplet injection" and cosmetic filtering features, which AFAIK
| work perfectly fine on MV3? if broad
| "read/modify data" permission is to be used, than there is not
| much point for an MV3 version over MV2, just use the MV2 version
| if you want to benefit all the features which can't be
| implemented without broad "read/modify data" permission.
|
| Huh? But ... the "read/modify data" permission isn't getting
| removed by MV3? I don't understand how this follows. This is like
| saying "Google implemented all of the same things we could do in
| MV2 in MV3, so we went ahead and removed all of the features
| anyway". I don't see any way to interpret this as anything except
| cutting off your own nose to spite the face of Google. It
| certainly doesn't seem to be a good faith attempt to reproduce
| the features of uBlock within the new technical framework of MV3.
| [deleted]
| ohgodplsno wrote:
| > this commit removes the "scriplet injection"
|
| Considering this is stated in ManifestV3's announcement and
| that no APIs have been made for it:
|
| > Beginning in Manifest V3, we will disallow extensions from
| using remotely-hosted code. This will require that all code
| executed by the extension be present in the extension's package
| uploaded to the webstore. Server communication (potentially
| changing extension behavior) will still be allowed. This will
| help us better review the extensions uploaded, and keep our
| users safe. We will leverage a minimum required CSP to help
| enforce this (though it will not be 100% unpreventable, and we
| will require policy and manual review enforcement as well).
|
| Scriptlet injection is as good as dead.
|
| > and cosmetic filtering features,
|
| Cosmetic filtering can only happen by making a service worker,
| that will turn on five seconds after the page has loaded.
|
| > the "read/modify data" permission isn't getting removed by
| MV3?
|
| No, but Google will heavily restrict any extension using this
| permission, and make the requirements to be published on their
| extension store so draconian that an ad blocking extension
| (which directly threatens their business model) has no chance
| of ever being accepted.
|
| So, no, Google, as usual when they implement a new API, does
| half assed shit, breaks compatibility, forces everyone to
| follow on their bad decisions before deprecating it later.
| Going all in on MV3 is just bringing yourself to the slaughter,
| and MV3 should be laughed off by any serious extension
| developer.
| caladin wrote:
| One interesting consequence of this is that Google's own
| javascript api client will no longer work with MV3 and there
| are apparently no plans to ever make it work.
|
| See https://github.com/google/google-api-javascript-
| client/issue...
|
| Chromium bug marked WONTFIX: https://bugs.chromium.org/p/chro
| mium/issues/detail?id=116445...
|
| Updated readme: https://github.com/google/google-api-
| javascript-client/blob/...
|
| So effectively this means extensions on MV3 can't easily
| access Google apis, which is quite unfortunate since Chrome
| extensions in particular made Google authentication super
| straightforward (piggybacking off of chrome's built-in google
| authentication). If someone knows a better way I'd love to
| hear it.
|
| I believe the reason that the current incarnation of the
| javascript library won't work is because it modifies the dom
| to add script tags to fetch and run the api library (or
| components of it), which is specifically what MV3 will
| disallow AFAIK.
| nightpool wrote:
| > Considering this is stated in ManifestV3's announcement and
| that no APIs have been made for it
|
| I'll admit--when I first made this comment, I assumed (based
| on the initial manifest v3 draft) that this change only
| affected _privileged_ context execution, and did not affect
| execution in the "main world", outside of privileged
| extension contexts. That said, it would still be possible to
| do this using the dynamic addContentScript feature, even
| though I'd imagine it's a very low priority change to
| implement for the uBlock team (how many rules even use
| scriptlets?).
|
| > Cosmetic filtering can only happen by making a service
| worker, that will turn on five seconds after the page has
| loaded.
|
| What? Content scripts still exist. Scriptlets may be harder
| to implement, but there's absolutely no reason cosmetic
| filtering should be.
|
| > No, but Google will heavily restrict any extension using
| this permission, and make the requirements to be published on
| their extension store so draconian that an ad blocking
| extension (which directly threatens their business model) has
| no chance of ever being accepted.
|
| Source? Have they said that they're going to do this to
| uBlock origin? They've said time and time again that making
| sure ad blocking extensions continue to work is one of their
| highest priority goals with MV3.
|
| Also, the DNR changes absolutely _do not_ make a meaningful
| impact on Google 's business model--Google's ads are very,
| very easy to block, and you could do it with a one-line
| chrome extension. The vast majority of complexity in ad
| blockers is required for _other_ ads that live outside of
| Google 's ecosystem. If you really believed that Google was
| making their MV3 changes based on their business goals for
| their ads team (a pretty ludicrous idea when you think about
| how big Google is and how far separated the ads department
| and extensions teams are), then the inescapable conclusion is
| that Google should be _supporting_ ad blockers themselves, to
| hurt the smaller companies that threaten their monopoly by
| trying to work around ad blockers.
| sgc wrote:
| Maybe I am missing something here. But google is a well-known
| pull-the-rug-from-under-you type company, with a long proven
| track record of doing just that. Don't use undocumented, not
| officially supported anything from them. ever. Don't use apis
| that go against their stated goals. They WILL remove them.
| Unless MV3 has officially committed to a changed changed scope
| to allow this, it is irrelevant if it incidentally works.
| nightpool wrote:
| I'm talking about features that the Chrome team has
| explicitly said time and time again will continue to work,
| like content scripts and user styles (cosmetic filters), and
| which MV3 never threatened in the first place. It would be
| ludicrous to consider these "undocumented". It's hard for me
| to see any other reason for gorhill to remove these features
| from the MV3 version of the extension except out of some
| perverse inclination to twist around the meaning of the
| Chrome team's words to support the conclusion that he
| obviously wants to find (that Chrome is trying to kill ad-
| blockers)--when in fact the *stated goals* of the extension
| team have always been the exact opposite (to provide APIs and
| extension points that allow ad blockers to continue to work)
| michaelmrose wrote:
| Google is an ad company. The logical strategy is embrace extend
| extinguish ad blocking. If your extension is getting attacked
| and stripped of functionality minimal investment in keeping it
| working likely to continue to work the longest is logical
| nightpool wrote:
| Many people have said this across many different threads, but
| this is just the exact opposite of true. Google's ads are
| very, very easy to block, and you could do it with a one-line
| chrome extension. The vast majority of complexity in ad
| blockers is required for other ads that live outside of
| Google's ecosystem. If you really believed that Google was
| making their MV3 changes based on their business goals for
| their ads team (a pretty ludicrous idea when you think about
| how big Google is and how far separated the ads department
| and extensions teams are), then the inescapable conclusion is
| that Google should be supporting ad blockers themselves, to
| hurt the smaller companies that threaten their monopoly by
| trying to work around ad blockers.
| stonogo wrote:
| You are conflating a "present/absent" question of this
| permission with Google's stated intent. The key modifier here
| is _broad_ "read/modify data" permission. If an extension
| attempts to assert that permission across a user's entire
| traffic, the extension will not be permitted in the store.
| Google's been very clear on this and it's already caused
| problems for other extensions.
|
| Furthmore the webRequest API has been nerfed to the point that
| it cannot block requests any more, only track them. The
| replacement declarativeNetRequest API is not flexible enough to
| serve uBlock Origin's needs.
| nightpool wrote:
| > If an extension attempts to assert that permission across a
| user's entire traffic, the extension will not be permitted in
| the store. Google's been very clear on this and it's already
| caused problems for other extensions.
|
| Do you have a source for this? Have other ad blocking
| extensions been removed from the store? I find it very hard
| to believe that Google would block uBlock over something so
| clearly and obviously required for its functioning when
| they've said over and over again that making sure ad blocking
| extensions continue to work is a high priority for them.
|
| > The replacement declarativeNetRequest API is not flexible
| enough to serve uBlock Origin's needs.
|
| Well, the stats from the commit in question clearly disagree
| with you--of 22,245 rules, only 145 use unsupported regexes.
| How is DNR "not flexible" enough here?
| fezfight wrote:
| How many people use adblockers? Is there any chance manifest v3
| will lead to enough users abandoning Googles Chrome to build a
| community around an open alternative, like we did when we
| abandoned IE for Firefox all those years ago?
| kibwen wrote:
| Adblockers are an existential threat to Google. If any
| appreciable percentage of the population started using a
| browser that allowed adblockers, Google (and Facebook, and
| Twitter, and Reddit, and...) would do everything within their
| power to block that browser from all the web properties they
| control (this is not an exaggeration: _everything within their
| power_ , because the alternative is the death of their entire
| business model and the end of the company). Even if you can
| play cat-and-mouse games to get around the adblocker-blocking,
| the inconvenience of that alone would be enough to shift most
| non-power-users back onto Chrome.
| causi wrote:
| We've been living in a golden age for some time now. We
| browse the clean, crisp web for free and the ignorant "plebs"
| pay our way by living in an ad-riddled nightmare.
| googlryas wrote:
| Are they? I see ad blocker ads on YouTube all the time.
| Presumably google would block them if they were a real
| threat.
| kibwen wrote:
| If adblockers can afford to pay for ads, that means they
| have a business model, and the one and only adblocker
| business model is "pay to play", where companies pay
| adblockers to allow their ads through.
| tgsovlerkhgsel wrote:
| Nagware/scareware (pushing subscriptions on users,
| possibly with misleading claims) is also a business model
| I've seen used.
|
| I honestly don't mind the "pay to play" model. It's a way
| to establish a healthy ad ecosystem. Ad blockers define
| what they consider acceptable, and collect money. They
| have an incentive to find a reasonable balance: The less
| restrictive they are, the more money they make, but the
| second they go over the line, users will jump to another
| ad blocker that's more restrictive.
|
| I've intentionally and knowingly tolerated the
| "acceptable ads" from ABP until they started allowing the
| Outbrain/Taboola chumboxes. (There even were two versions
| of those, the normal one full of bright colors, tits and
| disgusting disease images, and a slightly toned down one
| for the "acceptable ads" users!)
|
| Since those ads rely on making you psychologically
| uncomfortable (feeling like you're missing out) unless
| you engage with their worthless, misleading and
| unsatisfactory clickbait content, they're 100%
| unacceptable to me, and ABP lost a user.
|
| If uBlock Origin offered an ad whitelist that only allows
| ad networks that a) serve only their own JavaScript, no
| third party crap b) only serve static text and re-encoded
| static, non-animated images c) have some meaningfully
| enforced editorial standards, d) have some privacy
| oversight and follow tracking opt-outs, I would
| definitely give it a chance. I don't mind supporting web
| sites and content creators, and I don't mind seeing
| relevant ads (which can usually be targeted based on the
| content I'm looking at just fine).
|
| I do mind having my fan try to reach escape velocity due
| to crappy JS, getting served malware and exploits, random
| "this site is trying to play DRM protected video" popups
| indicating that something is trying to do fingerprinting,
| 300 different companies getting my browsing data and 20
| of them executing code in my browser (code that they
| haven't written themselves but have been handed by an
| intermediary of an intermediary), and last but not least
| graphic images of diseased body parts. Solve these
| problems, and I won't need to use an ad blocker. Don't
| solve these problems, and I will put protecting myself
| over your revenue.
|
| I also mind having to constantly explain to my parents
| why the new cool product or shop they saw an ad for is an
| utter scam, and how exactly they'll lose money if they
| fall for it. I also mind having to constantly scrape
| crapware and malware from my friends' and relatives'
| computers, _including Chromebooks_. As long as ads lead
| to that, I have no choice but to deploy ad blockers.
| amluto wrote:
| > If uBlock Origin offered an ad whitelist that only
| allows ad networks that a) serve only their own
| JavaScript, no third party crap
|
| Wait, why would an acceptable ad network have JavaScript
| at all? _Maybe_ a minimal, pre-approved bit of JS to help
| the network understand where the ad is being placed, but
| even that is questionable.
|
| Frankly, I consider it somewhere between bizarre and
| obviously wrong for any serious website that needs to
| follow HIPPA, PCI, or any other reasonable security
| standard to allow un-audited third party JS at all.
| staticassertion wrote:
| Adblockers might be an existential threat to Google, but MV3
| won't change anything for Google. Google AdSense ads will
| almost certainly still get blocked, they're not hard to
| block/ obfuscated.
|
| I really doubt this will change anything for Google with
| regards to ads. At most you can argue that this is "step 1"
| in a larger plan to eventually bypass these adblockers or
| something, which I'll totally buy, but V3 has gotten _better_
| at blocking ads over time, not worse.
| antonok wrote:
| > V3 has gotten better at blocking ads over time, not
| worse.
|
| That may be true, but it's still significantly limited
| compared to MV2. And at the current rate, that is unlikely
| to change by the time Manifest V2 support is removed.
|
| What's important is that MV3 adblocker developers no longer
| have full control over _how_ they 're allowed to modify
| pages. Given how adversarial the relationship between
| adblockers and websites is, that lack of control will be
| exploited almost immediately.
| staticassertion wrote:
| Yeah, so I'm against V3 mostly because I think that the
| pros of developers having power outweigh the cons of
| potential malicious extensions. I personally would have
| preferred rethinking a few other areas first:
|
| 1. Auditability - both in terms of the code and the
| behaviors
|
| 2. Improved permissions - could we have split WebRequest
| up?
|
| 3. Improved performance - could we have leveraged new
| APIs, like the declarative API, for improved performance?
| What about compiling to wasm? Or new APIs?
|
| 4. Capabilities/ Sandboxing - Within an extension could
| we slice out capabilities?
|
| 5. Improved UX around permissions. Surfacing the
| permissions and performance implications of extensions
| would be worth exploring and aided by any ability to
| slice up permissions more.
|
| Chrome could even create 'sanctioned' extensions that
| wouldn't trigger scary popups in order to make it that
| much clearer when something is scary - something like "if
| you publish your extension such that it is digitally
| signed, you use 2FA or whatever, you have good standing
| with us, blah blah blah, we will waive that popup". IIRC
| Firefox did this to lower their review burden, NoScript
| was one of the ones on the list _I think_ , but that
| would have been many years ago and I don't know if it has
| changed since.
|
| That said, I don't think V3 is the end of the world. I
| would have _preferred_ the other options, and I bet some
| people at Google explored them too and know much more
| about why they are /aren't viable, but I'm OK with V3. I
| don't really think that Google Adsense is driving this
| decision at all nor do I expect it to benefit them, at
| least not in the short/medium term.
| antonok wrote:
| Great suggestions. The "third party buys popular
| extension and quietly adds malware" approach is also a
| huge attack vector. There really ought to be some way to
| prevent an extension from updating until you've had a
| chance to review and approve that change, especially if
| it requests a lot of sensitive permissions.
| staticassertion wrote:
| Well, even today, if the attacker modifies the
| permissions it will require a re-acknowledgement. Google
| can also do things there, like if the extension is tied
| to a key (as it should be), tell developers that they are
| required to _not_ provide that key to anyone else, even
| if they sell / transfer ownership of the extension.
| Instead, the new owner should register a new key, which
| can trigger review/ scrutiny.
|
| Key + 2FA means the attacker has to have code execution
| on a developer's machine in order to publish an update
| (via the local session token, which you should make short
| lived). And Google could require a FIDO2 token if you
| want to bypass the "alert users that this thing uses lots
| of permissions".
|
| There's a lot of stuff I'd be working on to avoid having
| to remove developer power.
|
| edit: K I've been rate limited by HN so I can no longer
| reply for today, but them's my thoughts.
| blibble wrote:
| if someone offers a typical small extension author
| $500,000 for their extension, I think they're going to
| ignore Google's rules and handover the keys
| dessant wrote:
| Google will be able to use a variety of ad delivery methods
| that are not yet blockable with the filtering API they will
| now also fully control in Chrome.
| staticassertion wrote:
| Google AdSsense has always been able to bypass
| adblockers, as other advertisers have worked to do. At
| least in the "they _could_ if they tried ", they
| obviously have the technical prowess. But they haven't
| because _that_ would be a scandal and invite scrutiny
| that they likely want to avoid - they own a massive part
| of the market without resorting to such things, it 's not
| yet in their interest to do that.
|
| So yes, as I said, maybe this is step 1 in a longer term
| plan to completely remove adblockers. Maybe one day so
| many people will rely on adblockers that Google is forced
| to take a drastic measure.
|
| I personally don't expect that to be the case _any time
| soon_ , but that's really not based on much.
| shadowgovt wrote:
| From Google's point of view, they generally use "How many
| people are running adblockers" as just another quality
| signal on whether the ads are actually working as intended.
| Google doesn't really care if a little under half the users
| on the web block them.
| titaniczero wrote:
| > If any appreciable percentage of the population started
| using a browser that allowed adblockers, Google (and
| Facebook, and Twitter, and Reddit, and...) would do
| everything within their power to block that browser from all
| the web properties they control (this is not an exaggeration:
| everything within their power, because the alternative is the
| death of their entire business model and the end of the
| company)
|
| Even easier, they would just sabotage their own web versions
| (like reddit with mobile.reddit.com) to force people to use
| the app versions where tracking/ads is harder to block.
|
| The web is the best platform for us, the users, and the way
| to go - good sandbox, transparent, customizable. We should
| fight tooth and nail to preserve it.
| bambax wrote:
| They would have to be pretty stealth and smooth to pull this
| off because that kind of behavior would attract even more
| scrutiny from regulators. They don't operate in a vacuum.
| LelouBil wrote:
| Personally,that will be the motivation I needed to switch to
| Firefox on my main computer.
|
| So... thanks Google I guess ?
| redox99 wrote:
| It really depends on the platform and target audience.
|
| For example for a website I manage that targets PC gamers,
| 80-90% desktop users use adblockers. On mobile however the
| majority settles for chrome (which intentionally doesn't
| support extensions to avoid adblockers), therefore most mobile
| users don't have adblockers.
| vbezhenar wrote:
| The question is: how many people will miss manifest v2 options.
|
| I'm using adblocker written by myself. It's pretty primitive,
| it uses declarative blocking by URLs and optionally inserts
| some CSS and JS to selected websites. So far I was able to
| solve all my ads issues with this approach.
| shadowgovt wrote:
| I'm a little surprised Google hasn't seen more pushback from
| enterprise. I'd expect the weirdest uses of broad permissions
| to be on intranets, where the inherent risks of such breadth
| can be mitigated by controlling the accessed data itself. I'm
| comparing the situation to one of the things that kept Flash
| on life support for so long: it had been used to build key
| internal and external tools for fortune-500 companies that
| they needed time to replace.
|
| That Google hasn't seen such pushback suggests to me that
| corps writing their own extensions for internal use never
| caught on like Flash did.
| staticassertion wrote:
| That's an interesting point, but I think it may also speak
| to the fact that v3 isn't _that_ restrictive other than for
| very specific use cases.
| antonok wrote:
| Google actually is allowing MV2 extensions to work under
| enterprise policy for much longer than anyone else: https:/
| /developer.chrome.com/docs/extensions/mv3/mv2-sunset/
| ainar-g wrote:
| > How many people use adblockers?
|
| About 43 %, according to [1].
|
| > Is there any chance manifest v3 will lead to enough users
| abandoning Googles Chrome [...]
|
| No. Google Chrome is pretty much in the same position as
| Internet Explorer used to be. It's the default browser in the
| most popular mobile OS and the first thing people install on
| their PC (or get it installed by someone else). Mozilla can
| barely play catch-up with all the complex web standards pushed
| by Goog&co., to say nothing about adding killer features that
| could bring enough users back from Chrome.
|
| Modern web browsers are rapidly approaching the YouTube
| territory. That is, becoming a technology so complex that only
| a multibillion-dollar conglomerate can really maintain it
| without losing money.
|
| [1]: https://backlinko.com/ad-blockers-users
| tgsovlerkhgsel wrote:
| I'm using Firefox with moderately aggressive ad blocking and
| privacy settings. Almost everything works, and the few
| breakages that I encounter are usually due to the
| blocking/privacy settings (i.e. they'd happen the same on
| Chrome if I configured it similarly).
|
| The only thing I actually have to start Chrome for is
| (ironically) Microsoft Teams.
| josefx wrote:
| > Mozilla can barely play catch-up with all the complex web
| standards pushed by Goog&co.
|
| To be fair they also spend a lot of resources on dreaming up
| their own shit tier solutions. Like the time Google proposed
| federated learning of cohorts, which was universally shot
| down by critics. Mozilla saw that as a sign and jumped into
| bed with Meta to create their own version of it. Because who
| could think about user privacy without immediately thinking
| of Meta?
|
| It is almost as if Mozillas leadership wants to prove that
| Mozilla is a waste of money.
| revlolz wrote:
| The 43% number is huge imo. A large quantity of devices
| either cannot install adblock (or cannot do so easily) such
| as "smart" tvs.
|
| Even to install on Android Firefox it took more effort than I
| expected.
| connicpu wrote:
| It seems the actual number is 43% of those surveyed use an
| ad blocking tool at least once a month, so a lot of those
| may only have their ad blocker installed on their PC, plus
| the bias that comes from only having the answers of those
| who responded to the survey
| hsbauauvhabzb wrote:
| Still that's a fairly overwhelming number of people who
| feel strongly enough about the topic to install a plug-
| in. I'm sure there's a portion of 'no' responses that are
| not aware of what adblockers are or do
| Jaepa wrote:
| 42.7% of internet users worldwide (16-64 years old) use ad
| blocking tools at least once a month.
|
| That framing sets of multiple mental alarm bells.
|
| EDIT: it looks like the source is HootSuite may have a
| conflict of interest, as they seem to focus on social media
| advertising campaigns.
| kelnos wrote:
| What does it even mean to use an ad blocking tool "at least
| once a month"? Like... do people have an ad blocker
| installed, but disabled most of the time, and just enable
| it temporarily when they come across a site with
| particularly egregious ads? That seems... an unlikely use
| model?
| NavinF wrote:
| It means they only use an adblocker on desktop.
| horsawlarway wrote:
| I approve (of both the release and the name).
|
| I see plenty of folks in here lamenting this release at all - in
| the hopes that the lack of it will push folks to Firefox. It
| won't. Those who care about this are already on Firefox, and
| frankly - Firefox isn't going to be the answer here (to be clear,
| this is opinion).
|
| I'm also not thrilled at manifest v3, although for very different
| reasons than the adblocking limitations - I do lots of extension
| development, and I think the service worker approach taken is a
| _bad_ mistake, forcing a distributed consensus model onto
| extensions without understanding the limitations that model
| imposes given how often extensions span multiple js contexts
| (across tabs /frames/content_scripts/windows/etc).
|
| Frankly - the environment is also still riddled with bugs...
| everything from docs that are wrong, to _serious_ issues like a
| service worker not activating on simple, basic, required events
| (like chrome.action.onClicked, which is literally about as basic
| as it gets for extensions).
|
| Overall - my first impression of the manifest v3 upgrade was
| fairly neutral (it's not really solving any of my pain points,
| and it requires a lot of changes to support - but it seemed
| functional). My opinion after porting several large extension
| projects to the space is... bad. It's a bad set of changes as
| implemented in chromium right now.
| clumsysmurf wrote:
| > I do lots of extension development
|
| Off topic, but since you seem experienced at this, do you
| recommend any resources for extension development for someone
| that's beginning from scratch with no experience in this area?
| mfrisbie wrote:
| I was frustrated with the lack of resources, so I'm
| publishing a book on it: "Building Browser Extensions".
| Available later this year.
| https://www.buildingbrowserextensions.com/
|
| And check out the companion extension:
| https://www.buildingbrowserextensions.com/b2x
| horsawlarway wrote:
| I would still recommend the docs from MDN and Google.
|
| If you're relatively familiar with web development in general
| - you can just peruse the APIs that are available for
| extensions
|
| Chromium based:
| https://developer.chrome.com/docs/extensions/reference/
|
| Or for Firefox: https://developer.mozilla.org/en-
| US/docs/Mozilla/Add-ons/Web...
|
| Then hit the MDN "My first extension page" to get a mostly
| functional manifest file: https://developer.mozilla.org/en-
| US/docs/Mozilla/Add-ons/Web...
|
| Get familiar with `about:debugging` in firefox, and
| `chrome://extensions` in chrome - you'll need them to load
| your test extensions.
|
| Finally - It's very worth it to read and understand the "core
| concepts" as outlined here, starting with the
| content_scripts: https://developer.chrome.com/docs/extensions
| /mv3/content_scr...
| svnpenn wrote:
| jasonwatkinspdx wrote:
| Maybe some of us are sick of Firefox fans taking this
| moralizing tone that we're somehow "damaging the cause" by
| simply speaking our mind when we disagree with your
| assessment. That doesn't make me a google shill, nor cynical.
| Just tired of the nonsense.
| kaibee wrote:
| I switched to FF a few months after I started hearing about
| this change coming down the pipe. It was totally fine and
| easy. I haven't had any issues because of it outside of one
| weird old website not working perfectly. And I still have
| Chrome installed so I just used it for a minute in that one
| case in the last year-ish.
| vntok wrote:
| Please don't tell people to refrain from posting their
| analysis here, especially when their point is both clear and
| very logical.
|
| It would be better and much more productive if you would
| explain why you think that Firefox has a bright path ahead
| given all we know about it's management, strategy, corporate
| practices, and frankly raw figures about new installs / usage
| over the past 5 years.
| kaibee wrote:
| Switching browsers is not some herculean task. Its like 15
| minutes of "work" and a day or two of getting used to it.
| And your ad-blocker works.
| Zagill wrote:
| Does Google autofill transfer over to Firefox easily? I'd
| reckon that's a big pain point for a lot of people when
| considering switching browsers
| linza wrote:
| It sounds simple enough but it's not so easy actually. I
| found myself spending some time doing it, and there were
| enough annoyances to abandon switching to firefox.
|
| I really want to like it, it just doesn't click for me.
| There is just no practical incentive at the moment to
| switch (for me), just the more idealistic ones about
| privacy and so on.
| bambax wrote:
| > _Those who care about this are already on Firefox_
|
| I don't think that's true. Many, many more people would care
| immensely if they were suddenly deprived of good adblocking on
| Chrome.
| horsawlarway wrote:
| > if they were suddenly deprived of good adblocking on
| Chrome.
|
| Ok - but that _won 't_ happen (at least not yet, given the m3
| api available, who knows what google will do long term).
|
| The majority of users won't genuinely notice any difference
| between an adblocker running on m3 vs m2, and plenty of
| companies are going to make them.
|
| My point is that despite the push back from the UBO dev (and
| I sort of agree - this does limit some capabilities, although
| not nearly as much as he claims) M3 is absolutely not going
| to kill the adblocker extensions available in chrome.
|
| It just makes them... slightly minus. Which is why I think
| the name is a good call. I don't approve of the direction
| google is going, but this is not the deal breaker for any
| sort of public audience - it's just a talking point among the
| tech literate.
| tyingq wrote:
| _" The majority of users won't genuinely notice any
| difference between an adblocker running on m3 vs m2"_
|
| I think that'll be true for a short time. But once the
| advertisers figure out that ad blockers have been crippled
| on the most popular browser...
|
| They'll figure out how to take advantage of that.
|
| Once Chrome takes away the ability to do live heuristics,
| and leaves you with just a static-ish blacklist, it's
| pretty easy to get around the ad blocker.
| horsawlarway wrote:
| But you can already work around adblockers by just
| serving ads directly from your own servers.
|
| Frankly - you can also move to a service that implements
| adblocking at a different layer (I've seen an explosion
| of dns based adblockers as a service, likely inspired by
| the likes of pi-hole). Those services are using roughly
| the same feature set that's still available in m3.
|
| The big dealbreaker (imo) was the inability to configure
| rules at runtime, and the requirement that they be
| declared in the manifest - and that never actually
| happened (you can dynamically configure them with https:/
| /developer.chrome.com/docs/extensions/reference/decla...)
| tyingq wrote:
| >But you can already work around adblockers by just
| serving ads directly from your own servers
|
| The available heuristics in UBO can block those with many
| different techniques today, especially for a short list
| of very popular sites. I assume many of them stop working
| with MV3.
|
| I'm aware of the DNS based adblockers, what I'm saying is
| that the advertisers might take action on all of them
| once the best option is hobbled. Then it's worth doing
| something that will break almost all the adblockers. One
| effort that puts everything to rest.
| elephanlemon wrote:
| I plan to switch to Firefox if this happens. Some like me are
| just too lazy to do it before we need to!
| rjh29 wrote:
| > I see plenty of folks in here lamenting this release at all -
| in the hopes that the lack of it will push folks to Firefox. It
| won't. Those who care about this are already on Firefox
|
| Huh? I'm going to switch to Firefox the second uBlock Origin
| stops working on Chrome. Otherwise I'll continue to use Chrome
| because it's a better browser (for me). I don't think I'm some
| rare minority here.
| Vinnl wrote:
| I don't think you are either, but like the rest of that group
| , I expect that you'll keep using Chrome anyway. Because it's
| not like uBO will _stop_ working, it 'll just be a bit worse.
| rjh29 wrote:
| I dunno. The new version does not strongly affect end users
| (according to the devs) but there is a psychological
| barrier around switching from the full version to the minus
| version, which I think will cause me to switch to Firefox.
|
| Even if the new version works now, Google are clearly going
| to tighten the vice over the next few years.
| TimTheTinker wrote:
| > Huh? I'm going to switch to Firefox the second uBlock
| Origin stops working on Chrome.
|
| uBlock Origin already blocks a lot better on Firefox than on
| Chrome.
|
| https://github.com/gorhill/uBlock/wiki/uBlock-Origin-
| works-b...
| blibble wrote:
| I was fully in the Google world prior to gorhill's posts on
| manifest v3
|
| as a direct result the only thing I have left is a pixel phone,
| which will be going with the new iPhone
|
| (and in the meantime my entire family has been 'helpfully'
| migrated too)
|
| I may be up the extreme end of the distribution, but this sort
| of grassroots push is what dethroned IE, and the resultant loss
| of control of the web eliminated Microsoft's near total
| influence over the computing industry
| monopoliessuck wrote:
| Just install GrapheneOS on your Pixel and call it a day.
| You'll be better of than anything browser based on iOS, talk
| about software limitations...
| Steltek wrote:
| Can you explain why you'd switch to an iPhone over a web
| browser? iPhone is a huge step back for having an open
| browser with user focused extensions.
|
| https://support.mozilla.org/en-US/kb/add-ons-firefox-ios
| blibble wrote:
| I am hoping the US/EU anti-competitive bills are going to
| go through
|
| (plus my phone is falling apart, and I don't want to give
| Google another penny after their manifest v3 behaviour)
| christophilus wrote:
| I know it's Safari under the hood, but Brave on iOS is
| great.
|
| I do hope that Apple decides to / is forced to allow real
| 3rd party browsers at some point, though. I also hope that
| a decent Linux phone becomes a realistic alternative.
|
| I'll check back in 10 years to see if either of those
| materializes.
| hoten wrote:
| Probably more like one year. The DMA just passed (I
| think? I don't follow too closely)
| anabis wrote:
| Its kind of strange , but there are more options to block
| YouTube ads on Android than iOS.
| johnchristopher wrote:
| I'd bet market share is the explanation ? Though it seems
| it's 50/50 in the US.
| uneekname wrote:
| IMO Firefox on an Android is better than anything you can get
| on iOS. It fully supports uBlock Origin!
|
| I also use a Pixel phone, though I use LineageOS so I feel
| less tied to Google
| carom wrote:
| I came from Android, while I agree with Firefox + ublock
| supremacy, I've been using Sarai with Ad Guard Pro (VPN
| based) and it has been good.
| redox99 wrote:
| I find firefox on android unusable because it has this
| awful, non-native scroll behavior.
|
| On android I use either Brave or Samsung Browser.
| cycomanic wrote:
| What do you mean by non-native scroll behavior? I'm
| asking seriously, never noticed anything.
| easrng wrote:
| Check out https://www.bromite.org/, it's a android
| chromium fork with adblocking built in like brave but
| without the crypto stuff. Also has support for
| userscripts!
| jorvi wrote:
| To be clear: it is a willful choice by Mozilla to fully
| protect Android users but to leave iOS users in the turmoil
| of a constant stream of invasive and malicious ads. I
| specifically took my parents off of Firefox for this
| express reason. Brave has a built-in adblocker, as do many
| other iOS browsers.
|
| And it is not like Mozilla isn't aware, I believe there are
| 2-3 open issues on Bugzilla, years old, that have just been
| left to wither.
| jdmichal wrote:
| Isn't there some rule that any browser on iOS must use
| the native Safari engine? So if iOS Safari doesn't
| support something, there's no way for Firefox to add that
| support. It's basically just a skin.
| jorvi wrote:
| Yes, but like I said, many other 3rd-party browsers have
| perfectly fine built-in adblockers.
|
| Hell, you can install Firefox Focus (which is a 'private
| mode only' browser) and that does have built-in
| adblocking. More perversely, you can use it as a content
| blocker for Safari.
|
| (No, other browsers using Safari's engine do not inherit
| the content blocking)
|
| I repeat: Mozilla is willfully choosing not to protect
| iOS Firefox users from ads. Plain and simple.
| pessimizer wrote:
| I think that what dethroned IE is that using your monopoly to
| maintain a moat of bugs only works for so long. If the
| browser is going to continue to be developed, eventually
| you're going to have to fix the bugs. By then, they were
| competing with Chrome, which was not bug-ridden and also
| backed by a juggernaut.
|
| The grassroots push that dethroned Microsoft's browser was
| Google's browser (aided by Firefox's suicide.)
| ethbr0 wrote:
| The only thing that ever gets mass migration is substantial
| superiority in features they use.
|
| Originally, it was tabbed browsing, which Opera and Mozilla
| had ~5 years before IE. Yes, Microsoft sucked that much in
| those days.
|
| With Chrome, it was an embedded PDF viewer and V8
| performance.
|
| So essentially, mostly people don't switch browsers unless
| there's a _very_ good reason to do so.
| refulgentis wrote:
| Not clear to me why you'd do this, the Manifest v3 changes
| resulted from Apple's adblocker approach using a list and
| trumpeting it as Privacy(tm).
| _V_ wrote:
| I will, for sure, switch to FF the second uBlock stops working
| in Chrome/Chromium.
|
| I switched from the Safari on MacOS for just the same reason
| even though I lost things like ApplePay etc.
|
| I am _not_ giving up on uBlock. The web is too bloated and
| unusable for me without it.
| [deleted]
___________________________________________________________________
(page generated 2022-09-07 23:00 UTC)