4 ms·

There were two parts to the changes. One that stops the current system of ad-blockers requiring them to use a different url-filtering api (specifically one whic

There were two parts to the changes. One that stops the current system of ad-blockers requiring them to use a different url-filtering api (specifically one which denies them the ability to read the urls), and one that puts really tiny limits on that api. I think the first change was in good faith and reasonable. Provided the filtering abilities are reasonable, it is good for privacy and performance (and it would make sense for eg Firefox to support this api too). (I think I would be happiest with an api that lets you write a pure (somehow enforced) js function from url to an action (eg block/allow/upgrade to https) and 4 bits of data). Although obviously it is unfortunate if it stops various good extensions from working well. For the second change, I can’t decide. It could be that they were made deliberately small, or it could be that they didn’t really know what appropriate size limits would be and picked limits which were way too small.

shawnz 7y ago
The limits aren't the only problem -- forcing everyone to use only the declarative API restricts the ability of adblocker vendors to develop new techniques for blocking different kinds of ads or privacy threats.
- deleted 7y ago
  [deleted]
- dan-robertson 7y ago
  I agree that there are good reasons to want something less declarative but I claim that only allowing declarative rules is a reasonable bona fide choice from a security or privacy perspective. In particular if there were no question of motives, I think there would be far fewer complaints about this system being implemented. Indeed Apple’s system for mobile url filtering works like this and though some people complained about the lack of expressivity I didn’t see any complaints that it was some kind of conspiracy to sell ads.
  - tsimionescu 7y ago
    You keep missing the fact that there is no security/privacy advantage to what Google did, since the API for an extension to see every URL being accessed and use it in arbitrary ways still exists. They only removed the part where the extension could block that request from happening.
    - SpicyLemonZest 7y ago
      Selective request blocking has huge security implications. In many ways it's a similar attack surface to arbitrarily rewriting the content. (Imagine making some charges to your credit card, then blocking the request that lists card charges on your bank's website.)
plorkyeran 7y ago
No, they did not deny ad blockers the ability to read the URLs. They removed the ability to modify requests via the webRequest API, but left in the functionality for observing all requests made.
zwaps 7y ago
How long until we find out that Google adservers and tracking can not be blocked in the new API? Who really thinks a whole professional team of developers goes and neuters adblockers for nothing? Let us not be naive.

shawnz 7y ago

The limits aren't the only problem -- forcing everyone to use only the declarative API restricts the ability of adblocker vendors to develop new techniques for blocking different kinds of ads or privacy threats.

deleted 7y ago
[deleted]
dan-robertson 7y ago
I agree that there are good reasons to want something less declarative but I claim that only allowing declarative rules is a reasonable bona fide choice from a security or privacy perspective. In particular if there were no question of motives, I think there would be far fewer complaints about this system being implemented. Indeed Apple’s system for mobile url filtering works like this and though some people complained about the lack of expressivity I didn’t see any complaints that it was some kind of conspiracy to sell ads.
- tsimionescu 7y ago
  You keep missing the fact that there is no security/privacy advantage to what Google did, since the API for an extension to see every URL being accessed and use it in arbitrary ways still exists. They only removed the part where the extension could block that request from happening.
  - SpicyLemonZest 7y ago
    Selective request blocking has huge security implications. In many ways it's a similar attack surface to arbitrarily rewriting the content. (Imagine making some charges to your credit card, then blocking the request that lists card charges on your bank's website.)

plorkyeran 7y ago

No, they did not deny ad blockers the ability to read the URLs. They removed the ability to modify requests via the webRequest API, but left in the functionality for observing all requests made.

zwaps 7y ago

How long until we find out that Google adservers and tracking can not be blocked in the new API? Who really thinks a whole professional team of developers goes and neuters adblockers for nothing? Let us not be naive.