4 ms·

You can't just request "that new permission" for all web sites ("hosts"), but only for certain specific hosts, and only with the permission of each host. > The

You can't just request "that new permission" for all web sites ("hosts"), but only for certain specific hosts, and only with the permission of each host. > The Twitter post you link claims that's impossible, I don't see why. Your original post claimed that people understand this issue "perfectly." It turns out there was more to it than you thought.

danShumway 7y ago
Check the spec[0] -- Google isn't getting rid of the ability for users to grant full URL access for extensions, because of course they're not. That permission is absolutely necessary for a wide variety of extensions, including ad blockers. They're just implementing changes to how that permission is going to be granted. With respect, a lot of us have been following these changes for a long time. We know about the permission stuff already. And to be clear, the permission changes are good -- they're just not going to significantly change normal user behavior in most cases. > It turns out there was more to it than you thought. It turns out that a Google advocate on Twitter posted, "we can't do it the other way" with no explanation of why it would be a problem. Again, this exactly is how Google gaslights. They refuse to engage with the wider developer community, ignore proposals and objections, and then when the wider community finally gets mad enough to start complaining in mainstream channels, they start posting on Twitter and blogs that "actually, it's complicated." If developers don't have the full picture, give it to them. The Chrome team can't complain that developers aren't informed about the technical limitations they're facing when they're posting arcane updates to Twitter instead of the official threads that everyone is following. [0]: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.oenw1ekaaubz https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...
- dfabulich 7y ago
  You say that they give "no explanation of why it would be a problem," in reference to Justin Schuh's tweet: > The underlying issue with blocking Web Request is that it is effectively a UXSS, which could not be bound by origin-based host permissions like the rest of the API can. The reasoning here should be obvious. Observing web requests can be useful with the cooperation/permission of the host you're observing, but it makes no sense to have an ad blocker that requires permission from the ad-blocked websites. If you grant the core premise is that we don't want extensions to be allowed to observe all web traffic, because this permission will be abused, then the only logical conclusion is to use a rules engine. That's the only way to design an ad blocker that doesn't/can't observe all web traffic.
  - danShumway 7y ago
    > it makes no sense to have an ad blocker that requires permission from the ad-blocked websites. I don't follow what you mean by this. Under the current V3 specification, as currently proposed, Privacy Badger (assuming they stick it out and keep maintaining a Chrome version) will need to be granted observation permissions on every single website, adblocked or not. The way Privacy Badger works is by determining at runtime based on request observation which domains it should blacklist. This is not going to be a fringe usecase. Are you misunderstanding how the proposed permissions system works by some chance, or am I misunderstanding your argument? It's not the website you request permissions from -- it's the user you request permissions from for domains/domain patterns. Why doesn't it make sense for a user to grant an ad blocker permission to operate on domains where they want it to block ads?

danShumway 7y ago

Check the spec[0] -- Google isn't getting rid of the ability for users to grant full URL access for extensions, because of course they're not. That permission is absolutely necessary for a wide variety of extensions, including ad blockers. They're just implementing changes to how that permission is going to be granted. With respect, a lot of us have been following these changes for a long time. We know about the permission stuff already. And to be clear, the permission changes are good -- they're just not going to significantly change normal user behavior in most cases. > It turns out there was more to it than you thought. It turns out that a Google advocate on Twitter posted, "we can't do it the other way" with no explanation of why it would be a problem. Again, this exactly is how Google gaslights. They refuse to engage with the wider developer community, ignore proposals and objections, and then when the wider community finally gets mad enough to start complaining in mainstream channels, they start posting on Twitter and blogs that "actually, it's complicated." If developers don't have the full picture, give it to them. The Chrome team can't complain that developers aren't informed about the technical limitations they're facing when they're posting arcane updates to Twitter instead of the official threads that everyone is following. [0]: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.oenw1ekaaubz https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...

dfabulich 7y ago
You say that they give "no explanation of why it would be a problem," in reference to Justin Schuh's tweet: > The underlying issue with blocking Web Request is that it is effectively a UXSS, which could not be bound by origin-based host permissions like the rest of the API can. The reasoning here should be obvious. Observing web requests can be useful with the cooperation/permission of the host you're observing, but it makes no sense to have an ad blocker that requires permission from the ad-blocked websites. If you grant the core premise is that we don't want extensions to be allowed to observe all web traffic, because this permission will be abused, then the only logical conclusion is to use a rules engine. That's the only way to design an ad blocker that doesn't/can't observe all web traffic.
- danShumway 7y ago
  > it makes no sense to have an ad blocker that requires permission from the ad-blocked websites. I don't follow what you mean by this. Under the current V3 specification, as currently proposed, Privacy Badger (assuming they stick it out and keep maintaining a Chrome version) will need to be granted observation permissions on every single website, adblocked or not. The way Privacy Badger works is by determining at runtime based on request observation which domains it should blacklist. This is not going to be a fringe usecase. Are you misunderstanding how the proposed permissions system works by some chance, or am I misunderstanding your argument? It's not the website you request permissions from -- it's the user you request permissions from for domains/domain patterns. Why doesn't it make sense for a user to grant an ad blocker permission to operate on domains where they want it to block ads?