5 ms·

Not "everybody" hates Google for it. People who don't understand the security implications inherent in allowing browser extensions that have nearly-unrestricte

Not "everybody" hates Google for it. People who don't understand the security implications inherent in allowing browser extensions that have nearly-unrestricted access to the user's behavior -- even if well-intended -- may hate the Chrome team for it. But there are those of us who understand why the Chrome team made the decision it did, and are sympathetic. And we're happy that the Chrome team and Apple are of the same mind about this.

dmix 7y ago
Sounds like Google hasn't communicated these technical changes nor their intentions very clearly at all. Just judging how there's multiple people saying different things in this thread for both.
- bduerst 7y ago
  It's clickbait fodder. Construing the manifest privacy changes as Google is blocking ad blockers is better clickbait than saying Apple safari is doing the same thing. It's similar to when the internet blew up about Google's project dragonfly, which was cancelled, while Apple quietly did the same thing by sharing iCloud user data with the Chinese government.
LaGrange 7y ago
> Not "everybody" hates Google for it. People who don't understand the security implications inherent in allowing browser extensions that have nearly-unrestricted access to the user's behavior -- even if well-intended -- may hate the Chrome team for it. ...this is a fantastic argument for disallowing installation of custom browsers. I do hope y'all like IE and/or Safari.
autoexec 7y ago
> People who don't understand the security implications inherent in allowing browser extensions that have nearly-unrestricted access to the user's behavior You can say the exact same thing about any code we run on our devices. We accept that risk or we wouldn't run any software at all. Google isn't worried about our privacy. They take our privacy. They are worried about their profits because that's all any corporation cares about.
- otterley 7y ago
  The question is, whom do you trust, and who bears the greatest consequence of failure? I'll bet my money on Apple over some third-party extension vendor to protect my privacy. Besides, in the end, it's all about minimization of threats. The existence of one threat is better than the existence of two. Don't let perfection be the enemy of the "good enough."
  - autoexec 7y ago
    > The question is, whom do you trust, and who bears the greatest consequence of failure? I'm going to trust uBlock Origin because it is free open source software and I can see everything they are doing with my data. Apple on the other hand forbids reverse engineering safari (trying to understand what it does and how it works). Once you're a part of the apple eco-system apple could theoretically (and to be clear we're talking about purely theoretical privacy risks in all cases) access your browsing history and also tie that directly to your name, address, credit card/bank account, GPS coordinates, etc. Putting your privacy in the hands of a company that has so much of your data already is naturally more risky than compartmentalizing. If hackers somehow compromise my browser extension they get access to my browsing history on one device until I notice and correct the problem. If a hacker somehow compromises Apple they could get access to much much more. For all their care and resources Apple is not immune from attacks either. Safari has had a ton of vulnerabilities exposed just this year so far.
    - otterley 7y ago
      It's not uBlock Origin they're concerned about, though - it's all the other random extensions out there that could use the same capabilities for evil instead of good.
      - autoexec 7y ago
        Ultimately the freedom to decide what code a person runs on their own hardware has to be left up to the user. The users who install every random extension they see are the same ones who download every app and click on every link in the spam they get. You can't protect users from themselves, but you can empower them to better protect themselves. Downloading a sketchy browser extension takes deliberate action on the part of the user. Just loading CNN.com can (and has) caused computers to become infected automatically because of ads. Limiting the ability to block ads is not protecting anyone.
loeg 7y ago
> People who don't understand the security implications inherent in allowing browser extensions that have nearly-unrestricted access to the user's behavior -- even if well-intended -- may hate the Chrome team for it. > But there are those of us who understand why the Chrome team made the decision it did, and are sympathetic. And we're happy that the Chrome team and Apple are of the same mind about this. Hey, you probably didn't mean it this way, but your comment kinda sounds like you're saying everyone who opposes Google's decision is a simpleton who doesn't understand the security implications of browser extensions. That's not true, and more importantly, not especially charitable.
bilbo0s 7y ago
Well, they're not exactly of the same mind. Apple blocks not only the content, but the ability to even monitor as well. So there is a little extra with the Apple way. You'd hope google would follow suit, but given their business model it's understandable if they don't. (Not that I'm a supporter of Google's business model, just that I understand why the ability to monitor is still there.)
- delroth 7y ago
  I can't follow your reasoning. How does Google's business model justify allowing 3rd party Chrome extensions to snoop on user traffic?
  - amluto 7y ago
    Chrome has not proposed any change that would prevent extensions from monitoring all traffic. You are ascribing a good motivation to Google, but Google’s actions are inconsistent with your hypothetical motivation. Specifically, Google proposes to continue allowing extensions to observe all requests, but extensions can’t block requests based on these observations.
    - otterley 7y ago
      > extensions can’t block requests based on these observations The new API is called "declarativeNetRequest" and allows extensions to block requests: https://developer.chrome.com/extensions/declarativeNetRequest https://developer.chrome.com/extensions/declarativeNetReques... "There are the following kinds of rules: * Rules that block a network request. * Rules that prevent a request from getting blocked by negating any matching blocked rules. * Rules that redirect a network request. * Rules that remove headers from a network request." > Google proposes to continue allowing extensions to observe all requests Their expressed intention is to disallow such behavior in the future: "The declarativeNetRequest API is an alternative to the webRequest API. At its core, this API allows extensions to tell Chrome what to do with a given request, rather than have Chrome forward the request to the extension. Thus, instead of the above flow where Chrome receives the request, asks the extension, and then eventually gets the result, the flow is that the extension tells Chrome how to handle a request and Chrome can handle it synchronously. This allows us to ensure efficiency since a) we have control over the algorithm determining the result and b) we can prevent or disable inefficient rules. This is also better for user privacy, as the details of the network request are never exposed to the extension." (Source: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.ypclvihky0p6 https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...)

dmix 7y ago

Sounds like Google hasn't communicated these technical changes nor their intentions very clearly at all. Just judging how there's multiple people saying different things in this thread for both.

bduerst 7y ago
It's clickbait fodder. Construing the manifest privacy changes as Google is blocking ad blockers is better clickbait than saying Apple safari is doing the same thing. It's similar to when the internet blew up about Google's project dragonfly, which was cancelled, while Apple quietly did the same thing by sharing iCloud user data with the Chinese government.

LaGrange 7y ago

> Not "everybody" hates Google for it. People who don't understand the security implications inherent in allowing browser extensions that have nearly-unrestricted access to the user's behavior -- even if well-intended -- may hate the Chrome team for it. ...this is a fantastic argument for disallowing installation of custom browsers. I do hope y'all like IE and/or Safari.

autoexec 7y ago

> People who don't understand the security implications inherent in allowing browser extensions that have nearly-unrestricted access to the user's behavior You can say the exact same thing about any code we run on our devices. We accept that risk or we wouldn't run any software at all. Google isn't worried about our privacy. They take our privacy. They are worried about their profits because that's all any corporation cares about.

otterley 7y ago
The question is, whom do you trust, and who bears the greatest consequence of failure? I'll bet my money on Apple over some third-party extension vendor to protect my privacy. Besides, in the end, it's all about minimization of threats. The existence of one threat is better than the existence of two. Don't let perfection be the enemy of the "good enough."
- autoexec 7y ago
  > The question is, whom do you trust, and who bears the greatest consequence of failure? I'm going to trust uBlock Origin because it is free open source software and I can see everything they are doing with my data. Apple on the other hand forbids reverse engineering safari (trying to understand what it does and how it works). Once you're a part of the apple eco-system apple could theoretically (and to be clear we're talking about purely theoretical privacy risks in all cases) access your browsing history and also tie that directly to your name, address, credit card/bank account, GPS coordinates, etc. Putting your privacy in the hands of a company that has so much of your data already is naturally more risky than compartmentalizing. If hackers somehow compromise my browser extension they get access to my browsing history on one device until I notice and correct the problem. If a hacker somehow compromises Apple they could get access to much much more. For all their care and resources Apple is not immune from attacks either. Safari has had a ton of vulnerabilities exposed just this year so far.
  - otterley 7y ago
    It's not uBlock Origin they're concerned about, though - it's all the other random extensions out there that could use the same capabilities for evil instead of good.
    - autoexec 7y ago
      Ultimately the freedom to decide what code a person runs on their own hardware has to be left up to the user. The users who install every random extension they see are the same ones who download every app and click on every link in the spam they get. You can't protect users from themselves, but you can empower them to better protect themselves. Downloading a sketchy browser extension takes deliberate action on the part of the user. Just loading CNN.com can (and has) caused computers to become infected automatically because of ads. Limiting the ability to block ads is not protecting anyone.

loeg 7y ago

> People who don't understand the security implications inherent in allowing browser extensions that have nearly-unrestricted access to the user's behavior -- even if well-intended -- may hate the Chrome team for it. > But there are those of us who understand why the Chrome team made the decision it did, and are sympathetic. And we're happy that the Chrome team and Apple are of the same mind about this. Hey, you probably didn't mean it this way, but your comment kinda sounds like you're saying everyone who opposes Google's decision is a simpleton who doesn't understand the security implications of browser extensions. That's not true, and more importantly, not especially charitable.

bilbo0s 7y ago

Well, they're not exactly of the same mind. Apple blocks not only the content, but the ability to even monitor as well. So there is a little extra with the Apple way. You'd hope google would follow suit, but given their business model it's understandable if they don't. (Not that I'm a supporter of Google's business model, just that I understand why the ability to monitor is still there.)

delroth 7y ago
I can't follow your reasoning. How does Google's business model justify allowing 3rd party Chrome extensions to snoop on user traffic?
- amluto 7y ago
  Chrome has not proposed any change that would prevent extensions from monitoring all traffic. You are ascribing a good motivation to Google, but Google’s actions are inconsistent with your hypothetical motivation. Specifically, Google proposes to continue allowing extensions to observe all requests, but extensions can’t block requests based on these observations.
  - otterley 7y ago
    > extensions can’t block requests based on these observations The new API is called "declarativeNetRequest" and allows extensions to block requests: https://developer.chrome.com/extensions/declarativeNetRequest https://developer.chrome.com/extensions/declarativeNetReques... "There are the following kinds of rules: * Rules that block a network request. * Rules that prevent a request from getting blocked by negating any matching blocked rules. * Rules that redirect a network request. * Rules that remove headers from a network request." > Google proposes to continue allowing extensions to observe all requests Their expressed intention is to disallow such behavior in the future: "The declarativeNetRequest API is an alternative to the webRequest API. At its core, this API allows extensions to tell Chrome what to do with a given request, rather than have Chrome forward the request to the extension. Thus, instead of the above flow where Chrome receives the request, asks the extension, and then eventually gets the result, the flow is that the extension tells Chrome how to handle a request and Chrome can handle it synchronously. This allows us to ensure efficiency since a) we have control over the algorithm determining the result and b) we can prevent or disable inefficient rules. This is also better for user privacy, as the details of the network request are never exposed to the extension." (Source: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#heading=h.ypclvihky0p6 https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...)