7 ms·

Apple is trying to thread the needle. They want to allow content blocking, but they do not want to allow content blocking plugins to see and potentially report

Apple is trying to thread the needle. They want to allow content blocking, but they do not want to allow content blocking plugins to see and potentially report on what sites you visit. Personally, I’m totally cool with the trade-off of having less capable ad blocking functionality, if I can be sure my web plugins aren’t a security or privacy risk.

deftturtle 7y ago
I don’t see why Safari can’t block extensions from sending data to remote servers. Seems like a pretty basic thing, so we have more powerful tools and not the privacy risks
- om2 7y ago
  Preventing exfiltration by a tool that's by definition allowed to affect outgoing network traffic via blocking is an impossible problem.
commoner 7y ago
uBlock Origin is completely free and open source. https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/ It's a very popular project on GitHub with many developers scrutinizing any changes to the codebase. Fears of uBlock Origin being a "security or privacy risk" based on code in the extension are unfounded.
- Wowfunhappy 7y ago
  It's not whether uBlock Origin is a security risk, it's whether the APIs it's using are a security risk, lest they fall into the hands of a less benign actor. (I also wish they'd kept the APIs open, just stating the other case.)
  - PostOnce 7y ago
    You're complaining that a general purpose computer can be used for... general purposes. Computers should do what their users tell them to. I wouldn't appreciate a smartknife with a blade that only extended when something I was authorized to cut was in range. "Unrecognized cultivar". Tools do the work their possessors wish. Why would you let someone limit your tools? It's everywhere now. It's in the coffee pods. Why does everyone else know better than the user what the user should be doing?
    - lotsofpulp 7y ago
      >Why does everyone else know better than the user what the user should be doing? See windows and the malware infested ecosystem. People obviously don’t know what they’re doing, and/or don’t have the time vet every little action they do on their computer.
      - danShumway 7y ago
        But uBlock Origin keeps me safe online. I'm sympathetic to concerns about people who don't know what they're doing, but if I'm a Safari user, I have to value keeping myself safe first. This change makes ordinary users safer, but makes power users less safe. I understand why Apple is doing it. But I'm still going to advise responsible owners to ditch Safari and pick a browser that will do a better job of blocking trackers.
        acdha 7y ago
        > But uBlock Origin keeps me safe online. The problem is that all of the spyware says exactly the same thing. If the API exists, ordinary users are going to be asked to make huge security decisions with no effective way to tell whether the vendor (or the new owner who just bought it) is being honest.
        danShumway 7y ago
        Sure, but: > I'm sympathetic to concerns about people who don't know what they're doing, but if I'm a Safari user, I have to value keeping myself safe first. This change still means that Firefox will have better adblocking and privacy tools than Safari. It's a tradeoff -- and if I'm a user that's already conservative about granting extensions permissions, I don't see how I get any benefits from this. I only get the downsides in the form of less effective blockers.
- falcolas 7y ago
  So long as it’s not sold. It’s happened before - a popular ad blocker is bought up for millions of dollars by an ad agency, and turned into an already installed vehicle for new ads. I see nothing about “free and open source” which prevents this.
  - somebehemoth 7y ago
    It can be forked?
    - saagarjha 7y ago
      The last fork of uBlock Origin didn’t do so well: https://ublock.org/ https://ublock.org/
      - pwinnski 7y ago
        Didn't do so well how? It's very popular, used by many people who don't realize how terrible it is!
        saagarjha 7y ago
        Ok, let's say it didn't do good :)
    - jtbayly 7y ago
      So what? How does that protect the end user?
  - 0x0 7y ago
    In fact, isn't that why uBlock is not uBO?
- wstuartcl 7y ago
  ... One malicious push/release effectively enables every user on browsers that have not transitioned to the passive list/filter model of blocking to be completely owned. It is not about intent, it is about the many many extensions out there that use this feature set for good intent, but inherently open the risk of a full on traffic funnel should they be exploited * the number of users for each of them.
tyingq 7y ago
They are already familiar with how to run a comprehensive review of apps. They could just replicate that for extensions.
- ChrisLTD 7y ago
  Apple is doing reviews for extensions, and also tightening up the APIs at the same time. At least on the Mac you've got alternatives if you're willing to make a different trade off. iPhone users and ChromeOS users are stuck.
- pwinnski 7y ago
  They can do that for apps because apps are compiled and submitted. The expressly do not allow for dynamic code execution within apps to keep functionality from changing after their review. That cannot be "just replicate"d for javascript extensions.
  - rwiggum 7y ago
    > The expressly do not allow for dynamic code execution within apps to keep functionality from changing after their review. This is false. You can deploy a react native app with dynamic code downloading and execution to the apple app store.
  - wmp56 7y ago
    > That cannot be "just replicate"d for javascript extensions. This is false too. If extensions aren't allowed to communicate with the internet and can't auto-update themselves, then they also can't run arbitrary code without the user's consent.
  - deleted 7y ago
    [deleted]

deftturtle 7y ago

I don’t see why Safari can’t block extensions from sending data to remote servers. Seems like a pretty basic thing, so we have more powerful tools and not the privacy risks

om2 7y ago
Preventing exfiltration by a tool that's by definition allowed to affect outgoing network traffic via blocking is an impossible problem.

commoner 7y ago

uBlock Origin is completely free and open source. https://github.com/gorhill/uBlock/ https://github.com/gorhill/uBlock/ It's a very popular project on GitHub with many developers scrutinizing any changes to the codebase. Fears of uBlock Origin being a "security or privacy risk" based on code in the extension are unfounded.

Wowfunhappy 7y ago
It's not whether uBlock Origin is a security risk, it's whether the APIs it's using are a security risk, lest they fall into the hands of a less benign actor. (I also wish they'd kept the APIs open, just stating the other case.)
- PostOnce 7y ago
  You're complaining that a general purpose computer can be used for... general purposes. Computers should do what their users tell them to. I wouldn't appreciate a smartknife with a blade that only extended when something I was authorized to cut was in range. "Unrecognized cultivar". Tools do the work their possessors wish. Why would you let someone limit your tools? It's everywhere now. It's in the coffee pods. Why does everyone else know better than the user what the user should be doing?
  - lotsofpulp 7y ago
    >Why does everyone else know better than the user what the user should be doing? See windows and the malware infested ecosystem. People obviously don’t know what they’re doing, and/or don’t have the time vet every little action they do on their computer.
    - danShumway 7y ago
      But uBlock Origin keeps me safe online. I'm sympathetic to concerns about people who don't know what they're doing, but if I'm a Safari user, I have to value keeping myself safe first. This change makes ordinary users safer, but makes power users less safe. I understand why Apple is doing it. But I'm still going to advise responsible owners to ditch Safari and pick a browser that will do a better job of blocking trackers.
      - acdha 7y ago
        > But uBlock Origin keeps me safe online. The problem is that all of the spyware says exactly the same thing. If the API exists, ordinary users are going to be asked to make huge security decisions with no effective way to tell whether the vendor (or the new owner who just bought it) is being honest.
        danShumway 7y ago
        Sure, but: > I'm sympathetic to concerns about people who don't know what they're doing, but if I'm a Safari user, I have to value keeping myself safe first. This change still means that Firefox will have better adblocking and privacy tools than Safari. It's a tradeoff -- and if I'm a user that's already conservative about granting extensions permissions, I don't see how I get any benefits from this. I only get the downsides in the form of less effective blockers.
falcolas 7y ago
So long as it’s not sold. It’s happened before - a popular ad blocker is bought up for millions of dollars by an ad agency, and turned into an already installed vehicle for new ads. I see nothing about “free and open source” which prevents this.
- somebehemoth 7y ago
  It can be forked?
  - saagarjha 7y ago
    The last fork of uBlock Origin didn’t do so well: https://ublock.org/ https://ublock.org/
    - pwinnski 7y ago
      Didn't do so well how? It's very popular, used by many people who don't realize how terrible it is!
      - saagarjha 7y ago
        Ok, let's say it didn't do good :)
  - jtbayly 7y ago
    So what? How does that protect the end user?
- 0x0 7y ago
  In fact, isn't that why uBlock is not uBO?
wstuartcl 7y ago
... One malicious push/release effectively enables every user on browsers that have not transitioned to the passive list/filter model of blocking to be completely owned. It is not about intent, it is about the many many extensions out there that use this feature set for good intent, but inherently open the risk of a full on traffic funnel should they be exploited * the number of users for each of them.

tyingq 7y ago

They are already familiar with how to run a comprehensive review of apps. They could just replicate that for extensions.

ChrisLTD 7y ago
Apple is doing reviews for extensions, and also tightening up the APIs at the same time. At least on the Mac you've got alternatives if you're willing to make a different trade off. iPhone users and ChromeOS users are stuck.
pwinnski 7y ago
They can do that for apps because apps are compiled and submitted. The expressly do not allow for dynamic code execution within apps to keep functionality from changing after their review. That cannot be "just replicate"d for javascript extensions.
- rwiggum 7y ago
  > The expressly do not allow for dynamic code execution within apps to keep functionality from changing after their review. This is false. You can deploy a react native app with dynamic code downloading and execution to the apple app store.
- wmp56 7y ago
  > That cannot be "just replicate"d for javascript extensions. This is false too. If extensions aren't allowed to communicate with the internet and can't auto-update themselves, then they also can't run arbitrary code without the user's consent.
- deleted 7y ago
  [deleted]