7 ms·

Hey, dislaimer: I worked on this study. Thank you for your comment. To me this reaction from the Chromium devs is missing one of the most fundamental issues. I

by pythux 8y ago

Hey, dislaimer: I worked on this study. Thank you for your comment. To me this reaction from the Chromium devs is missing one of the most fundamental issues. I'm not fundamentally against the declarative API because of technical limitations; I am against it because it is a strong innovation lock. The current extension ecosystem is flexible enough to allow hundreds (maybe thousands) of people to actively work on privacy-enhancing extensions (ad-blockers, anti-tracking, etc.) and the technologies, heuristics, solutions to protect users' privacy on the Web are constantly evolving. The APIs are not used today the same way they were used 2 years ago. If Chrome decides to "freeze" the blocking capabilities of the browser into a declarative API that no one but Chrome devs can improve, they will be preventing people from finding new solutions to tracking and advertising (at least from extensions). It does not matter if they replicate 100% of the capabilities of today's ad-blockers, as long as it does not allow evolution and adaption it will become obsolete. There is precedent in this matter: Safari also has a similar API and it has been a huge pain for ad-blockers developers. The reason is simple: Apple or Google do not have the same strong intensives that we have to continuously improve the blocking capabilities of the user agent. My fear is that this declarative API will be an ok-replacement for today's content blockers, but will not allow the same kind of fast paced development we benefit from today in the space of privacy extensions.

kkm 8y ago
In addition to this, let's also keep in mind the huge cost of maintaining two different code bases of extensions for different browser versions.
saagarjha 8y ago
Speaking as a user (and early developer) of Safari's content blockers; I have almost never run into an issue with them. What kind of development do you fear will be stifled by Apple and Google not having incentives to improve the blocking (which I find somewhat strange in the former case, anyways)?
- pythux 8y ago
  What I'm afraid of is the following: * The blocking engine operated by either Safari or Chrome is a black-box and independent devs will have a harder time understanding it, tweaking it, improving it, debugging it. * Chrome devs are now playing nicely and get feedback and propose some improvements to the APIs but there is no warranty this will happen again, or that they will invest time/energy in the future improving this part of the browser. * It's harder to work with this API than a JavaScript code-base you control. * Chrome seems a bit better here but for Safari the documentation is pretty poor. * You also don't get feedback regarding the rules which matched on a page and this makes it harder to debug or give nice insights to users. That's only a few points from my personal experience but I discussed multiple times with developers of other privacy-enhancing extensions/apps and we shared similar feelings.
  - zaro 8y ago
    > Chrome devs are now playing nicely and get feedback and propose some improvements to the APIs but there is no warranty this will happen again, or that they will invest time/energy in the future improving this part of the browser. I think this is especially true. It is somewhat similar to many other Google products like Maps and Translate. They start as a good free product, but as soon as they gain enough traction the rules change. I think once this declarative Api is the standard for ad blockers in browsers Google will start exercising its control over it for its own benefit.
    - takeda 8y ago
      This is their long game. To me all the push Google did with https, and certificate pinning etc makes much more sense. I was wondering why they were pushing it so hard. I mean after they essentially blocked ways to use proxy to filter the content, next logical step is to restrict API.
      - jefftk 8y ago
        If you want to proxy your HTTPS traffic you add a local CA, and Chrome does not apply certificate pinning. Pinning is only for certs that chain back to the default CAs, specifically so people who need to proxy can do so. (Disclosure: I work for Google, though not on Chrome)
magicalhippo 8y ago
I tried to make my comment rather unbiased, but yeah, it's still a step in the wrong direction IMHO.
gregknicholson 8y ago
I'm hoping that Firefox is once again seen as a viable alternative, that “power users” would consider switching to if Chrome falls behind.
- magicalhippo 8y ago
  I ditched Chrome 8 years ago, first for Opera and then Firefox once Opera became Chrome. It still has memory issues[1], but overall I'm very happy with it. [1]: it's probably not plain old memory leaks anymore, but due to using a few long-lived content processes, pages/scripts that leak is an issue. But usually not a huge deal, once one of the processes start using 2-3GB I just kill it, and refresh the affected tabs (coughSlackcough).
- simon_o 8y ago
  Would love to switch back to Firefox, but the general UX is just too terrible. I also lack the trust that even if they fixed the major issues (or even allowed fixing them yourself) I would be able to rely on things working in the mid-to-long-term. Currently holed up on Vivaldi, where the things you expect out of the box, are in fact working out of the box (vertical tabs, mouse gestures, ...).

by pythux 8y ago

kkm 8y ago

In addition to this, let's also keep in mind the huge cost of maintaining two different code bases of extensions for different browser versions.

saagarjha 8y ago

Speaking as a user (and early developer) of Safari's content blockers; I have almost never run into an issue with them. What kind of development do you fear will be stifled by Apple and Google not having incentives to improve the blocking (which I find somewhat strange in the former case, anyways)?

pythux 8y ago
What I'm afraid of is the following: * The blocking engine operated by either Safari or Chrome is a black-box and independent devs will have a harder time understanding it, tweaking it, improving it, debugging it. * Chrome devs are now playing nicely and get feedback and propose some improvements to the APIs but there is no warranty this will happen again, or that they will invest time/energy in the future improving this part of the browser. * It's harder to work with this API than a JavaScript code-base you control. * Chrome seems a bit better here but for Safari the documentation is pretty poor. * You also don't get feedback regarding the rules which matched on a page and this makes it harder to debug or give nice insights to users. That's only a few points from my personal experience but I discussed multiple times with developers of other privacy-enhancing extensions/apps and we shared similar feelings.
- zaro 8y ago
  > Chrome devs are now playing nicely and get feedback and propose some improvements to the APIs but there is no warranty this will happen again, or that they will invest time/energy in the future improving this part of the browser. I think this is especially true. It is somewhat similar to many other Google products like Maps and Translate. They start as a good free product, but as soon as they gain enough traction the rules change. I think once this declarative Api is the standard for ad blockers in browsers Google will start exercising its control over it for its own benefit.
  - takeda 8y ago
    This is their long game. To me all the push Google did with https, and certificate pinning etc makes much more sense. I was wondering why they were pushing it so hard. I mean after they essentially blocked ways to use proxy to filter the content, next logical step is to restrict API.
    - jefftk 8y ago
      If you want to proxy your HTTPS traffic you add a local CA, and Chrome does not apply certificate pinning. Pinning is only for certs that chain back to the default CAs, specifically so people who need to proxy can do so. (Disclosure: I work for Google, though not on Chrome)

magicalhippo 8y ago

I tried to make my comment rather unbiased, but yeah, it's still a step in the wrong direction IMHO.

gregknicholson 8y ago

I'm hoping that Firefox is once again seen as a viable alternative, that “power users” would consider switching to if Chrome falls behind.

magicalhippo 8y ago
I ditched Chrome 8 years ago, first for Opera and then Firefox once Opera became Chrome. It still has memory issues[1], but overall I'm very happy with it. [1]: it's probably not plain old memory leaks anymore, but due to using a few long-lived content processes, pages/scripts that leak is an issue. But usually not a huge deal, once one of the processes start using 2-3GB I just kill it, and refresh the affected tabs (coughSlackcough).
simon_o 8y ago
Would love to switch back to Firefox, but the general UX is just too terrible. I also lack the trust that even if they fixed the major issues (or even allowed fixing them yourself) I would be able to rely on things working in the mid-to-long-term. Currently holed up on Vivaldi, where the things you expect out of the box, are in fact working out of the box (vertical tabs, mouse gestures, ...).