4 ms·

The Chrome folks working on the largest mitigation to Spectre-class bugs -- Site Isolation -- are the same folks who were behind the controversial proposal that

by cbhl 8y ago

The Chrome folks working on the largest mitigation to Spectre-class bugs -- Site Isolation -- are the same folks who were behind the controversial proposal that would have broken certain third-party ad-blocker extensions. Their experience, literally, was, "we tried to fix it and the whole Internet yelled at us". I believe a practical (if oversimplified) model of the trade-offs is more like "secure, useful, fast: pick two".

devwastaken 8y ago
I'm not sure how the two things are connected. The ad blocker thing I don't believe was connected to Spectre or isolation.
- creato 8y ago
  I think he was just pointing out that that team appears to mostly be working on security, and it wasn't just some ad team behind that proposal. FWIW, it's not surprising. I don't install extensions because I don't see how you can possibly trust arbitrary code published by a pseudo-anonymous screen-name to have unlimited access to all browsing activity. That proposal sounded great to me, it would have been nice to be able to use an ad blocker.
  - tedivm 8y ago
    The proposal, as it was initially, would have prevented ad blockers from working. I think extending the proposal so people could give that full access to extensions they trusted (such as ublock origin, which is open source and you can build for yourself if you'd like) is the best way forward on that.
    - creato 8y ago
      > The proposal, as it was initially, would have prevented ad blockers from working. Is that true? I thought the proposal was to allow extensions to provide rules to be run on requests being made, but not to see the requests themselves. The same way Safari extensions apparently work?
      - simcop2387 8y ago
        Yes, but the limits on what kind of rules and how many left it unable to do a lot of what current ad blockers do, like block certain media types and other things like that. I believe it also prevented them from blocking ad serving web sockets and such but i'm not positive on that one.
      - danShumway 8y ago
        > but not to see the requests themselves No, the observation API is untouched[0]. It affected the ability of extensions to arbitrarily intercept and redirect requests, which (to be fair) is a potential MITM risk. IF an extension relied on the declarative model and ignored the webRequest API, you would get a reasonable increase in privacy, because extensions wouldn't be able to monitor what requests had been made or whether or not they were really blocked. But there were no plans to discourage developers from using the non-blocking parts of the webRequest API, so those advantages were pure speculation. > The same way Safari extensions apparently work? Yep. It's worth noting though that: A) Safari hasn't removed the ability for extensions to use the non-declarative model. B) Safari's approach does have documented downsides that make adblockers using their new strategy objectively less powerful. Adblock has a decent page up describing their take on the tradeoffs between the two approaches[1], and you can find similar conversations surrounding other Safari blockers if you poke around long enough. [0]: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.t5tc5efl7rfz https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz... [1]: https://help.getadblock.com/support/solutions/articles/6000099239-what-is-safari-content-blocking- https://help.getadblock.com/support/solutions/articles/60000...
skybrian 8y ago
I think you might have a distorted view of the ad-blocker thing from reading Hacker News? Most of the Internet probably never even heard about it.
- sesutton 8y ago
  It managed to get picked up by mainstream outlets like the BBC.

by cbhl 8y ago

devwastaken 8y ago

I'm not sure how the two things are connected. The ad blocker thing I don't believe was connected to Spectre or isolation.

creato 8y ago
I think he was just pointing out that that team appears to mostly be working on security, and it wasn't just some ad team behind that proposal. FWIW, it's not surprising. I don't install extensions because I don't see how you can possibly trust arbitrary code published by a pseudo-anonymous screen-name to have unlimited access to all browsing activity. That proposal sounded great to me, it would have been nice to be able to use an ad blocker.
- tedivm 8y ago
  The proposal, as it was initially, would have prevented ad blockers from working. I think extending the proposal so people could give that full access to extensions they trusted (such as ublock origin, which is open source and you can build for yourself if you'd like) is the best way forward on that.
  - creato 8y ago
    > The proposal, as it was initially, would have prevented ad blockers from working. Is that true? I thought the proposal was to allow extensions to provide rules to be run on requests being made, but not to see the requests themselves. The same way Safari extensions apparently work?
    - simcop2387 8y ago
      Yes, but the limits on what kind of rules and how many left it unable to do a lot of what current ad blockers do, like block certain media types and other things like that. I believe it also prevented them from blocking ad serving web sockets and such but i'm not positive on that one.
    - danShumway 8y ago
      > but not to see the requests themselves No, the observation API is untouched[0]. It affected the ability of extensions to arbitrarily intercept and redirect requests, which (to be fair) is a potential MITM risk. IF an extension relied on the declarative model and ignored the webRequest API, you would get a reasonable increase in privacy, because extensions wouldn't be able to monitor what requests had been made or whether or not they were really blocked. But there were no plans to discourage developers from using the non-blocking parts of the webRequest API, so those advantages were pure speculation. > The same way Safari extensions apparently work? Yep. It's worth noting though that: A) Safari hasn't removed the ability for extensions to use the non-declarative model. B) Safari's approach does have documented downsides that make adblockers using their new strategy objectively less powerful. Adblock has a decent page up describing their take on the tradeoffs between the two approaches[1], and you can find similar conversations surrounding other Safari blockers if you poke around long enough. [0]: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.t5tc5efl7rfz https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz... [1]: https://help.getadblock.com/support/solutions/articles/6000099239-what-is-safari-content-blocking- https://help.getadblock.com/support/solutions/articles/60000...

skybrian 8y ago

I think you might have a distorted view of the ad-blocker thing from reading Hacker News? Most of the Internet probably never even heard about it.

sesutton 8y ago
It managed to get picked up by mainstream outlets like the BBC.