6 ms·

While the controversy centers around ad blockers, the most important aspect of the Chrome extension API changes seems to have been missing from the discussions

While the controversy centers around ad blockers, the most important aspect of the Chrome extension API changes seems to have been missing from the discussions of the past few months. You will not be able to fully control every aspect of a request in your own browser, despite installing extensions that run priviledged code that you trust. HTTP headers can no longer be freely edited, unless they are part of a limited whitelist blessed by the Chrome team. This kills innovation in the browser extension space in its tracks, and ad blockers are just a subset of use cases that will be impacted. The changes will inevitably find their way into Chromium forks which do not have the resources to maintain the deprecated API while merging upstream changes, further limiting choice and hindering innovation.

dictum 7y ago
I understand the challenges at scale, but there's definitely a decade-long trend towards locking down devices and software from user changes, because any API or configuration that's accessible to knowledgeable users is also accessible to malware and social engineering. This coincidentally aligns with business goals (watch our ads, replace your phone every 2 years, sync everything to our cloud because anything else is risky and cumbersome, do not integrate our devices with a non-blessed solution etc.) but for some reason discussing these goals is frowned upon. Correlation does not imply causation, but an event can have multiple causes at once, and only some are allowed in polite discussion, and not everything should be attributed to only malice or only stupidity.
- deleted 7y ago
  [deleted]
- _jal 7y ago
  > but for some reason discussing these goals is frowned upon Well, the reasons are obvious - execs don't like having their motives questioned by the little people, especially when those motives are self-serving and bad. How dare you question your betters? One reason of many I banned Google.
derefr 7y ago
Mind you, another way to say that is “malicious extension authors can no longer snoop on all network traffic.” As someone who was, at one point, pitched a project proposal for a browser extension our company could make which would “make users think they’re getting one useful effect, while secretly using their browser as a node in a distributed web-scraping farm to social-network sites they’re logged into” — I’m sure this is more common than people think, and very wary of extensions saying they do one thing while doing quite another (which happens to fit into the same permissions set as the explicit purpose of the extension, making users none the wiser.)
- CodeCube 7y ago
  I'm curious if you wouldn't mind sharing what was the context around that pitch, and your subsequent response. It sounds like you didn't go forward with implementing that ... was it your decision to not move forward, or were you in a team and that's just what ended up happening?
  - derefr 7y ago
    The startup that I was working at, that came up with the pitch, fell apart before we ever had to make the call to implement it. Which I’m somewhat glad of; I don’t really like the idea of being forced to choose between ethics and helping a few friends survive. (And don’t get me wrong, building this extension would have been a matter of survival for the startup—we were depending heavily on piecing together a unified social-network graph to do Dynamic Network Analysis to, and social-network services actively resist having this data pulled from them.) If you’re curious, the point of the startup was to path-find between you and people you want to be connected to but aren’t (investors, say), telling you which friends-of-friends to prioritize getting to know in order to later leverage them as intermediate links in the chain to meet the people you really want to meet, that are three or four or five steps removed from you, and so entirely invisible to your local part of the network. (And yes, that’s a really darn cynical play. But the data that we did have showed that the intermediate “links” in your chain would almost always be business-people, “growth hackers”, etc. for whom getting to know you was valuable in its own right—they would value any chance to grow their Rolodex. So it at least seemed like a positive-sum interaction on the surface.)
jolmg 7y ago
> This kills innovation in the browser extension space in its tracks, I was under the impression that innovation in the browser extension space had long been killed since the transition of extension APIs to WebExtensions in the major browsers.
- FiveSquared 7y ago
  Compatibility and removing of old cruft though.
- gnomewascool 7y ago
  Not quite — if you run Firefox nightly you can develop and use "webextension experiments", which have the same power as the old pre-webextension Firefox addons. If you wish, you can also apply to have your experiment be turned into an official webextension API for Firefox. This is considerably more cumbersome than previously, but still far better than having to fork the whole browser. (On the topic of forks, if running a bleeding edge browser — nightly — is not for you, you can use Waterfox, which is approximately Firefox ESR + the ability to run full-powered extensions.)
  - JohnFen 7y ago
    > you can use Waterfox, which is approximately Firefox ESR + the ability to run full-powered extensions. But if you're going to use Waterfox (as I do), and you want to use the most recent version, be sure to check if the extensions you want to use will work. 68 introduced changes that do prevent some older extensions from working.
- roca 7y ago
  There's plenty of room for innovation in extensions just using the existing WebExtension APIs. When the existing APIs run out of steam, you can work with Mozilla developers to design and implement new APIs and submit them to Mozilla as a contribution to Firefox. No guarantee they'll be accepted --- performance, security, maintainability must be maintained --- but people have done this successfully to enable their extensions (e.g. NoScript). Mozilla needed to clear out the unmaintainable mess of letting any extension poke the browser's internals in any way. They've done that, without "killing innovation".
skybrian 7y ago
Forks can be patched. Otherwise, what's the point of maintaining a fork? Although a small team of occasional volunteers might not have the resources to maintain this, you can be sure that Microsoft does. It's also considerably easier than doing it all yourself like Firefox.
3xblah 7y ago
"HTTP headers can no longer be freely edited, unless they are part of a limited whitelist blessed by the Chrome team." Are you suggesting that Chrome/Chromium users will not be able to control the headers that the client sends? (short of editing the Chromium source and recompiling)
- deleted 7y ago
  [deleted]

dictum 7y ago

I understand the challenges at scale, but there's definitely a decade-long trend towards locking down devices and software from user changes, because any API or configuration that's accessible to knowledgeable users is also accessible to malware and social engineering. This coincidentally aligns with business goals (watch our ads, replace your phone every 2 years, sync everything to our cloud because anything else is risky and cumbersome, do not integrate our devices with a non-blessed solution etc.) but for some reason discussing these goals is frowned upon. Correlation does not imply causation, but an event can have multiple causes at once, and only some are allowed in polite discussion, and not everything should be attributed to only malice or only stupidity.

deleted 7y ago
[deleted]
_jal 7y ago
> but for some reason discussing these goals is frowned upon Well, the reasons are obvious - execs don't like having their motives questioned by the little people, especially when those motives are self-serving and bad. How dare you question your betters? One reason of many I banned Google.

derefr 7y ago

Mind you, another way to say that is “malicious extension authors can no longer snoop on all network traffic.” As someone who was, at one point, pitched a project proposal for a browser extension our company could make which would “make users think they’re getting one useful effect, while secretly using their browser as a node in a distributed web-scraping farm to social-network sites they’re logged into” — I’m sure this is more common than people think, and very wary of extensions saying they do one thing while doing quite another (which happens to fit into the same permissions set as the explicit purpose of the extension, making users none the wiser.)

CodeCube 7y ago
I'm curious if you wouldn't mind sharing what was the context around that pitch, and your subsequent response. It sounds like you didn't go forward with implementing that ... was it your decision to not move forward, or were you in a team and that's just what ended up happening?
- derefr 7y ago
  The startup that I was working at, that came up with the pitch, fell apart before we ever had to make the call to implement it. Which I’m somewhat glad of; I don’t really like the idea of being forced to choose between ethics and helping a few friends survive. (And don’t get me wrong, building this extension would have been a matter of survival for the startup—we were depending heavily on piecing together a unified social-network graph to do Dynamic Network Analysis to, and social-network services actively resist having this data pulled from them.) If you’re curious, the point of the startup was to path-find between you and people you want to be connected to but aren’t (investors, say), telling you which friends-of-friends to prioritize getting to know in order to later leverage them as intermediate links in the chain to meet the people you really want to meet, that are three or four or five steps removed from you, and so entirely invisible to your local part of the network. (And yes, that’s a really darn cynical play. But the data that we did have showed that the intermediate “links” in your chain would almost always be business-people, “growth hackers”, etc. for whom getting to know you was valuable in its own right—they would value any chance to grow their Rolodex. So it at least seemed like a positive-sum interaction on the surface.)

jolmg 7y ago

> This kills innovation in the browser extension space in its tracks, I was under the impression that innovation in the browser extension space had long been killed since the transition of extension APIs to WebExtensions in the major browsers.

FiveSquared 7y ago
Compatibility and removing of old cruft though.
gnomewascool 7y ago
Not quite — if you run Firefox nightly you can develop and use "webextension experiments", which have the same power as the old pre-webextension Firefox addons. If you wish, you can also apply to have your experiment be turned into an official webextension API for Firefox. This is considerably more cumbersome than previously, but still far better than having to fork the whole browser. (On the topic of forks, if running a bleeding edge browser — nightly — is not for you, you can use Waterfox, which is approximately Firefox ESR + the ability to run full-powered extensions.)
- JohnFen 7y ago
  > you can use Waterfox, which is approximately Firefox ESR + the ability to run full-powered extensions. But if you're going to use Waterfox (as I do), and you want to use the most recent version, be sure to check if the extensions you want to use will work. 68 introduced changes that do prevent some older extensions from working.
roca 7y ago
There's plenty of room for innovation in extensions just using the existing WebExtension APIs. When the existing APIs run out of steam, you can work with Mozilla developers to design and implement new APIs and submit them to Mozilla as a contribution to Firefox. No guarantee they'll be accepted --- performance, security, maintainability must be maintained --- but people have done this successfully to enable their extensions (e.g. NoScript). Mozilla needed to clear out the unmaintainable mess of letting any extension poke the browser's internals in any way. They've done that, without "killing innovation".

skybrian 7y ago

Forks can be patched. Otherwise, what's the point of maintaining a fork? Although a small team of occasional volunteers might not have the resources to maintain this, you can be sure that Microsoft does. It's also considerably easier than doing it all yourself like Firefox.

3xblah 7y ago

"HTTP headers can no longer be freely edited, unless they are part of a limited whitelist blessed by the Chrome team." Are you suggesting that Chrome/Chromium users will not be able to control the headers that the client sends? (short of editing the Chromium source and recompiling)

deleted 7y ago
[deleted]