12 ms·

To defend Google a bit, it looks like the change is being put in place so that users would have more privacy – by stopping extensions accessing all active URLs.

To defend Google a bit, it looks like the change is being put in place so that users would have more privacy – by stopping extensions accessing all active URLs. In essence they are copying what Apple did with Safari and their content blocking APIs. In this model, content blockers provide the browser with a set of blocking rules and the browser executes them against pages during render & load. Ad blocking can occur and privacy of what the user is viewing is retained. Sure it's more restrictive and yes will likely break existing adblockers, but it's probably a better model for the future. There will be arguments that you "can't do what is necessary" to create effective adblockers. That's incorrect.... I've created such an adblocker [1] using the Safari methods and its efficient, effective and high performance – including loading some sites 2x faster. [1] https://www.magiclasso.co/ https://www.magiclasso.co/

omeid2 8y ago
It doesn't actually provide any privacy at all, it simply removes the possiblity to block and leaves the events to be observable. > In Manifest V3, we will strive to limit the blocking version > of webRequest, potentially removing blocking options from most > events (**making them observational only**)
acrispino 8y ago
How do you respond to the comment (#23) from the author of uBlock Origin & uMatrix describing the filtering capabilities that will be lost under the proposed declarativeNetRequest API?
- happybuy 8y ago
  Many similar concerns were raised when the Safari API changed, in this case some of the specific limitations and concerns re the declarativeNetRequest approach may be valid – if so, I'd hope that the Chromium team take them on board and improve. I think the concern re the 30,000 rule limit is misguided. Many of these adblock rule lists are extremely inefficient and should probably be pruned to have less rules. Extremely good and effective adblocking across most websites can be achieved with significantly less rules.
  - notafraudster 8y ago
    I personally use an adblocker not only to block ads, but also to block literally everything I don't like. In most websites, this means the social buttons, the comments section, all search functionality, anything in the header or navigation I won't click, related articles, top articles, other recommended articles, footers, links to privacy policies, parts of bylines that I don't care about, header images when I don't like them, posts in certain categories that I don't like, etc. I use filters to, for instance, block Slack links containing domains I know I'm not going to click. I have over 3,000 rules. I wrote the rules myself to be maximally specific and I am not confident that I could prune the list significantly, although I guess it's possible. It would not surprise me if ad lists are substantially longer, because they have to incorporate the entire internet, not just the 0.001% of it that I visit. I support the goals of efficiency and performance, and think developers should take those goals seriously, but I object when a browser places a hard cap on anything, because the number that cap should be at differs by use case and by user.
    - scarface74 8y ago
      1Blocker for iOS can block everything you mentioned and doesn’t get access to your browsing activity to do it.
      - LamaOfRuin 8y ago
        according to https://1blocker.com/faq/ https://1blocker.com/faq/ to have full functionality it gets access to your browsing activity.
        scarface74 8y ago
        That’s actually not possible on iOS. The content blocking framework only allows a third party ad blocker to submit a JSON file to the system and the rules are processed by Safari. If you are referring to the quote below, that applies to the Mac version. The iOS version uses a share sheet extension that uses an out of process extension where you have to explicitly share the link you want to block. Safari warns me that 1Blocker Menu has access to webpage content, why? We use this permission in order to get information about current tab's domain when you select whitelist option. Sadly, there's no technical way to request just this functionality from the system, so we have to request full access to webpage content (which may include your sensitive information). However, we understand how important this data is and only use the domain. We do not transmit or process your data in any other way. Feel free to disable 1Blocker Menu if you don't like this (you'll still be able to block content).
AznHisoka 8y ago
A question: Would this proposed change mean all Chrome extensions can no longer know what URL I am currently visiting? if so, I guess one company (whose name starts with a S) is gonna be dreading this.
- angott 8y ago
  No, only the blocking API is concerned. Observational capacity will remain.
  - AznHisoka 8y ago
    Damn, that's like tossing out the baby, with the bathwater still in the tub. Throw out the good. Keep the bad..
    - darkpuma 8y ago
      In this case it's clear google doesn't give a damn about the bathwater, it just wants that baby dead. Anybody claiming that google is doing this to protect privacy is either uninformed or deluded.
ltbarcly3 8y ago
So Google is going to help me have more privacy by preventing me from letting extensions I want to run from having access to data I want that extension to have, so it can do a job I want it to do. Meanwhile, Google's software will of course have full access to everything I do online, and most of my data will live on Google servers. And the extension that I want to have access is also downloaded from Google servers. And the extension is open source, so I can totally check it for problems, or believe people I trust who vouch for it. Of course, I can't do that with any of the code on Google's servers, where basically everything I do all day, everything I read, everything I search for, and all my emails and documents are. Got it.
- mooman219 8y ago
  I used to vouch for AdBlockPlus, sometimes extensions change for the worse. They can he hijacked too. HN readers are a small subset of Chrome users. There are many malicious pages out there that attempt to get you to install malicious extensions and the average user will blindly listen. Most people will not check the source, or even reviews.
  - cma 8y ago
    Sometimes browsers change for the worse too.
    - smolder 8y ago
      Yep, when chrome started forcing "logins" to the browser whenever you log in to their services, I knew it was time for me to stop relying on Google's browser.
  - cat199 8y ago
    I used to like 'other thing', and one time 'other thing' changed. It went bad so therefore 'thing you are talking about' could go bad too. Other unrelated grouping is a small part of bigger, more important grouping. There are many bad places that try to do many bad things and bigger, more important grouping will listen. Therefore, existing and functional solution that is currently being broken here is irrelevant. Do you even hear the completely irrelevant cynicism? let's all go jump off a building.
mattigames 8y ago
Your definition of privacy is misplaced, one extension can get more information about an user from having access to facebook.com, google.com, gmail.com and twitter.com than all the other sites combined; and I'm pretty sure Google know this so this change -and whatever Apple is doing- has clearly other goals in mind.
antoinevg 8y ago
A good general rule: If you are planning on providing the functionality in the future please refrain from deprecating the existing mechanism until your replacement is fully complete. Early access may fly on Steam but in the real world your careless management of the refactoring process is wasting the time of your peers.
hiccuphippo 8y ago
What is the limit on the number of rules you can give to Safari? Gorhill mentions a limit of 30K and EasyList alone has more than 40K rules.
- hombre_fatal 8y ago
  50k per content blocker. Though a single app can bundle multiple content blockers.
bad_user 8y ago
The line about privacy is bullshit. This change is clearly targeting aggressive ad-blockers that are too dangerous, too capable to circumvent via anti-adblocking technologies. And Safari's content blocking is a piece of shit that's too limited and that's easily circumvented. It's in fact the weakest adblocking capability around and doesn't pose a threat to publishers.
michaelt 8y ago
How do you explain the fact ad blockers on iOS Safari so much less effective than uBlock Origin?
- threeseed 8y ago
  Because Apple imposed a limit of 50,000 filters. On my Mac I have lists which currently total 140,000 filters. Easy to see the problem.
chopin 8y ago
If I want privacy from an extension, I don't install it. I can't do that realistically with a website as I need to visit it to determine whether it violates my privacy. Running an extension is running code I trust (mostly). Visiting a website is running code I (inherently) don't trust. Many websites even have no idea which code they run on my machine (advertizing networks).
chopin 8y ago
I never would trust Google to increase my privacy.
zwaps 8y ago
Do you need to shill your product every gosh darn time this comes up? NO, your product is not a good replacement. You do not have custom rules, you can not block annoying elements, no it is not faster than Ublock and no, it is not even close to the feature set of Umatrix. And you can not do these things, because your product basically ships an ad-blocking list, and is not a fully featured ad blocker that gives control to the user over what to block. You have just added white lists of websites. As Beta. For Pro subscribers. That doesn't even remotely compare to the permission feature set - in the hand of the USER - of UMatrix or Ublock. Your Adblocker would not even be functional for someone visiting non-English pages. YOUR extension will be caught by anti-adblocking scripts all the time. Please stop. Every time this comes up you post the same thing. Stop deceiving people. You CAN NOT build an equivalent product with the Apple API, and you have certainly not done. No Matter how often you claim this! By the way, Ublock, a product vastly superior to yours, is free.
dexen 8y ago
>Sure it's more restrictive and yes will likely break existing adblockers, but it's probably a better model for the future. A good example why "secure system" is, in a longer run, a system with low usability, and little control by the user/owner. Right now we have ability to block URLs according to any rules, without being limited to whatever the browser author conceived. Perhaps we want to block some URLs based on context, or on content of previous communication, or whatever. Or perhaps pseudo-randomly, to emulate certain problems with the network. Switching to "more secure" approach limits us to "one true way", and precludes any smart hack we may come up in the future. It doesn't help that the change feels like attempt to squeeze out grassroots adblockers, and force people to, at best, use the ABP, which allows ad publishers to buy their way around blocks, and onto users' screens. If uBlock becomes ineffective, I fully expect ABP to be even more aggressive with monetizing access to users' screens.

omeid2 8y ago

It doesn't actually provide any privacy at all, it simply removes the possiblity to block and leaves the events to be observable. > In Manifest V3, we will strive to limit the blocking version > of webRequest, potentially removing blocking options from most > events (**making them observational only**)

acrispino 8y ago

How do you respond to the comment (#23) from the author of uBlock Origin & uMatrix describing the filtering capabilities that will be lost under the proposed declarativeNetRequest API?

happybuy 8y ago
Many similar concerns were raised when the Safari API changed, in this case some of the specific limitations and concerns re the declarativeNetRequest approach may be valid – if so, I'd hope that the Chromium team take them on board and improve. I think the concern re the 30,000 rule limit is misguided. Many of these adblock rule lists are extremely inefficient and should probably be pruned to have less rules. Extremely good and effective adblocking across most websites can be achieved with significantly less rules.
- notafraudster 8y ago
  I personally use an adblocker not only to block ads, but also to block literally everything I don't like. In most websites, this means the social buttons, the comments section, all search functionality, anything in the header or navigation I won't click, related articles, top articles, other recommended articles, footers, links to privacy policies, parts of bylines that I don't care about, header images when I don't like them, posts in certain categories that I don't like, etc. I use filters to, for instance, block Slack links containing domains I know I'm not going to click. I have over 3,000 rules. I wrote the rules myself to be maximally specific and I am not confident that I could prune the list significantly, although I guess it's possible. It would not surprise me if ad lists are substantially longer, because they have to incorporate the entire internet, not just the 0.001% of it that I visit. I support the goals of efficiency and performance, and think developers should take those goals seriously, but I object when a browser places a hard cap on anything, because the number that cap should be at differs by use case and by user.
  - scarface74 8y ago
    1Blocker for iOS can block everything you mentioned and doesn’t get access to your browsing activity to do it.
    - LamaOfRuin 8y ago
      according to https://1blocker.com/faq/ https://1blocker.com/faq/ to have full functionality it gets access to your browsing activity.
      - scarface74 8y ago
        That’s actually not possible on iOS. The content blocking framework only allows a third party ad blocker to submit a JSON file to the system and the rules are processed by Safari. If you are referring to the quote below, that applies to the Mac version. The iOS version uses a share sheet extension that uses an out of process extension where you have to explicitly share the link you want to block. Safari warns me that 1Blocker Menu has access to webpage content, why? We use this permission in order to get information about current tab's domain when you select whitelist option. Sadly, there's no technical way to request just this functionality from the system, so we have to request full access to webpage content (which may include your sensitive information). However, we understand how important this data is and only use the domain. We do not transmit or process your data in any other way. Feel free to disable 1Blocker Menu if you don't like this (you'll still be able to block content).

AznHisoka 8y ago

A question: Would this proposed change mean all Chrome extensions can no longer know what URL I am currently visiting? if so, I guess one company (whose name starts with a S) is gonna be dreading this.

angott 8y ago
No, only the blocking API is concerned. Observational capacity will remain.
- AznHisoka 8y ago
  Damn, that's like tossing out the baby, with the bathwater still in the tub. Throw out the good. Keep the bad..
  - darkpuma 8y ago
    In this case it's clear google doesn't give a damn about the bathwater, it just wants that baby dead. Anybody claiming that google is doing this to protect privacy is either uninformed or deluded.

ltbarcly3 8y ago

So Google is going to help me have more privacy by preventing me from letting extensions I want to run from having access to data I want that extension to have, so it can do a job I want it to do. Meanwhile, Google's software will of course have full access to everything I do online, and most of my data will live on Google servers. And the extension that I want to have access is also downloaded from Google servers. And the extension is open source, so I can totally check it for problems, or believe people I trust who vouch for it. Of course, I can't do that with any of the code on Google's servers, where basically everything I do all day, everything I read, everything I search for, and all my emails and documents are. Got it.

mooman219 8y ago
I used to vouch for AdBlockPlus, sometimes extensions change for the worse. They can he hijacked too. HN readers are a small subset of Chrome users. There are many malicious pages out there that attempt to get you to install malicious extensions and the average user will blindly listen. Most people will not check the source, or even reviews.
- cma 8y ago
  Sometimes browsers change for the worse too.
  - smolder 8y ago
    Yep, when chrome started forcing "logins" to the browser whenever you log in to their services, I knew it was time for me to stop relying on Google's browser.
- cat199 8y ago
  I used to like 'other thing', and one time 'other thing' changed. It went bad so therefore 'thing you are talking about' could go bad too. Other unrelated grouping is a small part of bigger, more important grouping. There are many bad places that try to do many bad things and bigger, more important grouping will listen. Therefore, existing and functional solution that is currently being broken here is irrelevant. Do you even hear the completely irrelevant cynicism? let's all go jump off a building.

mattigames 8y ago

Your definition of privacy is misplaced, one extension can get more information about an user from having access to facebook.com, google.com, gmail.com and twitter.com than all the other sites combined; and I'm pretty sure Google know this so this change -and whatever Apple is doing- has clearly other goals in mind.

antoinevg 8y ago

A good general rule: If you are planning on providing the functionality in the future please refrain from deprecating the existing mechanism until your replacement is fully complete. Early access may fly on Steam but in the real world your careless management of the refactoring process is wasting the time of your peers.

hiccuphippo 8y ago

What is the limit on the number of rules you can give to Safari? Gorhill mentions a limit of 30K and EasyList alone has more than 40K rules.

hombre_fatal 8y ago
50k per content blocker. Though a single app can bundle multiple content blockers.

bad_user 8y ago

The line about privacy is bullshit. This change is clearly targeting aggressive ad-blockers that are too dangerous, too capable to circumvent via anti-adblocking technologies. And Safari's content blocking is a piece of shit that's too limited and that's easily circumvented. It's in fact the weakest adblocking capability around and doesn't pose a threat to publishers.

michaelt 8y ago

How do you explain the fact ad blockers on iOS Safari so much less effective than uBlock Origin?

threeseed 8y ago
Because Apple imposed a limit of 50,000 filters. On my Mac I have lists which currently total 140,000 filters. Easy to see the problem.

chopin 8y ago

If I want privacy from an extension, I don't install it. I can't do that realistically with a website as I need to visit it to determine whether it violates my privacy. Running an extension is running code I trust (mostly). Visiting a website is running code I (inherently) don't trust. Many websites even have no idea which code they run on my machine (advertizing networks).

chopin 8y ago

I never would trust Google to increase my privacy.

zwaps 8y ago

Do you need to shill your product every gosh darn time this comes up? NO, your product is not a good replacement. You do not have custom rules, you can not block annoying elements, no it is not faster than Ublock and no, it is not even close to the feature set of Umatrix. And you can not do these things, because your product basically ships an ad-blocking list, and is not a fully featured ad blocker that gives control to the user over what to block. You have just added white lists of websites. As Beta. For Pro subscribers. That doesn't even remotely compare to the permission feature set - in the hand of the USER - of UMatrix or Ublock. Your Adblocker would not even be functional for someone visiting non-English pages. YOUR extension will be caught by anti-adblocking scripts all the time. Please stop. Every time this comes up you post the same thing. Stop deceiving people. You CAN NOT build an equivalent product with the Apple API, and you have certainly not done. No Matter how often you claim this! By the way, Ublock, a product vastly superior to yours, is free.

dexen 8y ago

>Sure it's more restrictive and yes will likely break existing adblockers, but it's probably a better model for the future. A good example why "secure system" is, in a longer run, a system with low usability, and little control by the user/owner. Right now we have ability to block URLs according to any rules, without being limited to whatever the browser author conceived. Perhaps we want to block some URLs based on context, or on content of previous communication, or whatever. Or perhaps pseudo-randomly, to emulate certain problems with the network. Switching to "more secure" approach limits us to "one true way", and precludes any smart hack we may come up in the future. It doesn't help that the change feels like attempt to squeeze out grassroots adblockers, and force people to, at best, use the ABP, which allows ad publishers to buy their way around blocks, and onto users' screens. If uBlock becomes ineffective, I fully expect ABP to be even more aggressive with monetizing access to users' screens.