5 ms·

Did anyone actually read the submission? The title is clickbait that doesn't reflect the content. The change here moves modifying content of the webRequest to

by cletus 7y ago

Did anyone actually read the submission? The title is clickbait that doesn't reflect the content. The change here moves modifying content of the webRequest to the browser from the extension. This is fundamentally more secure. Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous. The new declarative API (from the article) limits such extensions to 30,000 rules. I honestly don't know what impact this will have on ad blockers. At worst it seems like ad blockers will become less effective as simple logic tells you that some rules matter more than others and the least used rules will simply be dropped. So rather than be alarmist and use this to feed into the tired narrative that "Google is killing ad blockers because it's an advertising company" (paraphrased) we should be pushing for changes that make this workable, such as: 1. Having a higher limit than 30,000; and 2. Working on ways to condense N rules into <N rules. There must be ways we can be more expressive so that we don't require as many rules, no? I honestly don't like the fact that I have to give a third party developer so much privileged access to run an ad blocker and I'm surprised anyone else is. Extensions can be compromised.

malvosenior 7y ago
> So rather than be alarmist and use this to feed into the tired narrative that "Google is killing ad blockers because it's an advertising company" That’s not alarmist, it’s the obvious truth. As a user I should have complete control over what runs on my machine. I don’t need Google “protecting” me (by breaking ad blockers). Google is the single most destructive force in the tech industry today. Very much like Microsoft in the 90s. We should resist their attempts to embrace, extend, extinguish and we should be insulted that they couch these changes in marketing speak that pretends to be pro-user when it’s the exact opposite.
- cletus 7y ago
  > As a user I should have complete control over what runs on my machine. You do. By running Firefox. This level of control might be useful to you but it's not to most users. As much as power users chafe against things like the App Store, for example, this is clearly a win for most users. Limiting what a malicious extension could do is very much the same because I can guarantee you there are scams to get users to install malicious extensions. How Firefox should respond here is to make ad-blocking a first party solution. In that Firefox itself is responsible for the blocking and all extension writers are responsible for are the rules. At that point you will have a solid story that FF is putting the user first.
  - malvosenior 7y ago
    So it’s safe to say that people are not being alarmist about Google and should switch to Firefox. I don’t think it’s “clear” at all that most users benefit from monopolistic app store practices. I think the giant tech companies do though.
    - cletus 7y ago
      "Should"? I wouldn't go that far. I will say however that people are the uproar is somewhat overblown for three simple reasons: 1. Google wants people to use Chrome. It's clearly of benefit to them (and, for the most part, to users, at least for now); 2. Alternatives exist; and 3. Switching to an alternative is essentially trivial. This just isn't a Microsoft Windows monopoly situation.
  - privateSFacct 7y ago
    Agreed - if you support a user base on chrome folks DO install bogus extensions DESPITE all the guard rails
  - bambax 7y ago
    > How Firefox should respond here is to make ad-blocking a first party solution. Okay, yes -- that would be an interesting move. Not sure they can afford it but it would be great.
  - Endy 7y ago
    Beacon.enabled default is true, and the password manager defaults to sending passwords to a remote server. MozCo is not user friendly. Their main focus is on keeping the Google money flowing.
- cletus 7y ago
  > it’s the obvious truth. Only to those who are woefully ignorant of how any large company work and are unable or unwilling to see passed their own desires. But let me ask you this, even if we stipulate it's 100% true, how does that help? What does that accomplish? You've simply stated an opinion that those who agree with you will cheer for (changing nothing) and those who disagree with you won't change (also changing nothing). People have this overly simplistic view of how large companies work and ascribe malice to Google in particular for what's essentially just chaos. And I say this as a Xoogler. There are conflicting forces in Google that include, but are not limited to: 1. Protecting the ad revenue business Google is utterly dependent on; and 2. Promoting user privacy and benefits because that's what gets users to keep using your products. Even (1) comes from a wide variety of motivations such as: - Making more money; - The belief that ad-supported models are the only model that works so advertising is an absolute necessity to providing services on the Web. > I don’t need Google “protecting” me And again, you seem to be deliberately missing the point here because you say "I" a lot. What about your parents? Or grandparents? Do they need "complete control" over their machines? And consider for a second the scenario where you're not giving them tech support. This "complete control" is exactly what enables botnets (many of them anyway), fraud, theft, DDoS attacks and so on.
sigwinch28 7y ago
> Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous. On the contrary, I think google removing this ability actively removes user choice. A choice that I think users should be able to make. Slippery slope argument: I run a PiHole on my network. Perhaps Google should also absolutely require DNS over HTTPS in Chrome, too, because it's nothing short of dangerous to allow third-party DNS servers to inspect and modify arbitrary DNS requests. > Extensions can be compromised. It's also Google's decision to make extensions auto-update by default.
eyegor 7y ago
This isn't just the rule limit, and the most powerful part of extensions imo is to be able to block/modify elements at the dom level. Both for ad blocking and for customizations (reflow pages, modify css, etc). If you don't feel comfortable giving access to blockers, it's not that hard to roll your own. Just read the format of easylist. > extensions can only monitor browser connections, but not modify any of the content before it's displayed
- DaiPlusPlus 7y ago
  And if requests are blocked then content publishers can very easily detect ad-blockers and intentionally degrade the user-experience or add nag screens that aren't part of the usual ad network code. If it's an SPA then it'd be almost impossible to untangle easily when the site's developers can add their "is-adblock-detected?" checks anywhere in their SPA codebase and mess with the UX at-will.
  - cletus 7y ago
    Ok, so of all the replies here, this is the first I've read that's actually raised a really good point. Simply blocking requests will make ad block detection easier for Websites. Then again, this seems to be pretty prevalent already (as in lots of sites I visit already detect this).
    - DaiPlusPlus 7y ago
      Most adblocking scripts I’ve seen work by detecting if an ad loaded into its ad-placeholder. If you disable JavaScript completely then you don’t get the nag-screen. Some variants use CSS to show the nag screen by default and only removes it if it sees the ad loaded fine. But server-side connection-blocking or request-blocking detection works even when JS is disabled, but it requires a lot of infrastructure and cooperation between publishers, ad-networks, and more - both technical and political/business cooperation. Eventually in the future, web-browsers will render a page twice: one fully-loaded page, hidden from the user, that the ad code will think is what the user sees, while a network-sandboxed version is shown to the user with the already-loaded ad images replaced with white boxes or so. The client scripts can’t tell the ads haven’t loaded and even if they did they can’t phone-home to snitch on the user, while the browser still made those HTTP requests for the ads so the ad-network is satisfied it made an impression. Perhaps we could get fake ad-loading working without wasting downstream bandwidth by spoofing the IP source address field?
tyingq 7y ago
Extensions can still inject arbitrary JavaScript into any page, so this isn't about safety and security. Removing the dynamic capability kills heuristics, so it definitely makes ad blocking worse. There's a reason uBlock Origin is popular. See: https://twitter.com/gorhill/status/1134127701583904770 https://twitter.com/gorhill/status/1134127701583904770
bnegreve 7y ago
> So rather than be alarmist [..] we should be pushing for changes that make this workable If, as the author suspects, the intent is to break popular adblockers, I have no interest in trying to make this workable. Personally, I think this is a typical half-legit move: there's a good intention (security) but it's also hard to believe they did not realize that by pushing these changes, they were going to break several of the most popular extensions available. And, that the direct impact of this would be that for a short moment (at best) many more ads were going to be displayed on Chrome. I think we've seen a lot of these half legit moves recently (apple battery scandal?). So I'm starting to be more and more suspicious.
- chopin 7y ago
  There's no security involved whatsoever: Extensions can still read page content. They're only not allowed to block.
  - rndgermandude 7y ago
    Not just page content. They can read your cookies, they can see all requests (just not modify them on the fly). The extensions tracking you acting as spyware will see no change, the other kind of malicious extensions that want to modify your requests will still do so by modifying the DOM of pages for example. So the "security" reasons google gave have long been debunked as non-sense. The other half is the performance reasons. What's the performance burden of calling a (chain) blocking webRequest listeners? Last time I checked it was single digit milliseconds per request. So a very ad-laden worst-case website with 100 requests will spent maybe 500ms in the webRequest listeners, but will still load faster thanks to all the cruft being blocked away. So what's the win for performance exactly?
- cletus 7y ago
  How hard exactly is it to use Firefox instead of Chrome? It literally takes 2 minutes to switch. This isn't a Microsoft situation where, at the time, there was no alternative to Windows. It is the easiest thing in the world to change browsers. Google knows this too. Not every surface is a slippery slope.
blep-arsh 7y ago
30K is just not enough. Intercepting requests is still possible, just not blocking. Extensions have been already abusing this, of course. It's fiendishly difficult to prevent e.g. corporate users from leaking the whole intranet to SimilarWeb unless you completely disable browser extensions.
- cletus 7y ago
  > Intercepting requests is still possible, just not blocking False: https://developer.chrome.com/extensions/declarativeNetRequest https://developer.chrome.com/extensions/declarativeNetReques... "There are the following kinds of rules: - Rules that block a network request. - Rules that prevent a request from getting blocked by negating any matching blocked rules. - Rules that redirect a network request. - Rules that remove headers from a network request."
  - blep-arsh 7y ago
    I mean the current request inspection API, not the new ruleset-based one.
bambax 7y ago
> I honestly don't know what impact this will have on ad blockers But adblockers authors do know. Instead of accusing people of not reading the article, feel free to read what uBlock origin author has to say about this change.
malka 7y ago
Google is the worst actor to push for this. I have 0 trust in them that they are doing this for the right reasons, and that I will benefit as a user.
- cletus 7y ago
  If you have 0 trust in Google, why would you ever use Chrome?
tinus_hn 7y ago
So, some handwaving and all concerns go away because they are 'tired narratives'. Why not just block all extensions? That's clearly the most secure solution. > I honestly don't like the fact that I have to give a third party developer so much privileged access to run an ad blocker Then don't, install another one that works the way you want. Or don't, because the limited blocking abilities you appear to find sufficient can be gained just as well using an external proxy. > Extensions can be compromised. So can browsers, devices and operating systems.
- cletus 7y ago
  > Why not just block all extensions? That's clearly the most secure solution. That's pretty much what phones do. Both iOS and Android take a white list approach for third-party add ons.

by cletus 7y ago

malvosenior 7y ago

> So rather than be alarmist and use this to feed into the tired narrative that "Google is killing ad blockers because it's an advertising company" That’s not alarmist, it’s the obvious truth. As a user I should have complete control over what runs on my machine. I don’t need Google “protecting” me (by breaking ad blockers). Google is the single most destructive force in the tech industry today. Very much like Microsoft in the 90s. We should resist their attempts to embrace, extend, extinguish and we should be insulted that they couch these changes in marketing speak that pretends to be pro-user when it’s the exact opposite.

cletus 7y ago
> As a user I should have complete control over what runs on my machine. You do. By running Firefox. This level of control might be useful to you but it's not to most users. As much as power users chafe against things like the App Store, for example, this is clearly a win for most users. Limiting what a malicious extension could do is very much the same because I can guarantee you there are scams to get users to install malicious extensions. How Firefox should respond here is to make ad-blocking a first party solution. In that Firefox itself is responsible for the blocking and all extension writers are responsible for are the rules. At that point you will have a solid story that FF is putting the user first.
- malvosenior 7y ago
  So it’s safe to say that people are not being alarmist about Google and should switch to Firefox. I don’t think it’s “clear” at all that most users benefit from monopolistic app store practices. I think the giant tech companies do though.
  - cletus 7y ago
    "Should"? I wouldn't go that far. I will say however that people are the uproar is somewhat overblown for three simple reasons: 1. Google wants people to use Chrome. It's clearly of benefit to them (and, for the most part, to users, at least for now); 2. Alternatives exist; and 3. Switching to an alternative is essentially trivial. This just isn't a Microsoft Windows monopoly situation.
- privateSFacct 7y ago
  Agreed - if you support a user base on chrome folks DO install bogus extensions DESPITE all the guard rails
- bambax 7y ago
  > How Firefox should respond here is to make ad-blocking a first party solution. Okay, yes -- that would be an interesting move. Not sure they can afford it but it would be great.
- Endy 7y ago
  Beacon.enabled default is true, and the password manager defaults to sending passwords to a remote server. MozCo is not user friendly. Their main focus is on keeping the Google money flowing.
cletus 7y ago
> it’s the obvious truth. Only to those who are woefully ignorant of how any large company work and are unable or unwilling to see passed their own desires. But let me ask you this, even if we stipulate it's 100% true, how does that help? What does that accomplish? You've simply stated an opinion that those who agree with you will cheer for (changing nothing) and those who disagree with you won't change (also changing nothing). People have this overly simplistic view of how large companies work and ascribe malice to Google in particular for what's essentially just chaos. And I say this as a Xoogler. There are conflicting forces in Google that include, but are not limited to: 1. Protecting the ad revenue business Google is utterly dependent on; and 2. Promoting user privacy and benefits because that's what gets users to keep using your products. Even (1) comes from a wide variety of motivations such as: - Making more money; - The belief that ad-supported models are the only model that works so advertising is an absolute necessity to providing services on the Web. > I don’t need Google “protecting” me And again, you seem to be deliberately missing the point here because you say "I" a lot. What about your parents? Or grandparents? Do they need "complete control" over their machines? And consider for a second the scenario where you're not giving them tech support. This "complete control" is exactly what enables botnets (many of them anyway), fraud, theft, DDoS attacks and so on.

sigwinch28 7y ago

> Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous. On the contrary, I think google removing this ability actively removes user choice. A choice that I think users should be able to make. Slippery slope argument: I run a PiHole on my network. Perhaps Google should also absolutely require DNS over HTTPS in Chrome, too, because it's nothing short of dangerous to allow third-party DNS servers to inspect and modify arbitrary DNS requests. > Extensions can be compromised. It's also Google's decision to make extensions auto-update by default.

eyegor 7y ago

This isn't just the rule limit, and the most powerful part of extensions imo is to be able to block/modify elements at the dom level. Both for ad blocking and for customizations (reflow pages, modify css, etc). If you don't feel comfortable giving access to blockers, it's not that hard to roll your own. Just read the format of easylist. > extensions can only monitor browser connections, but not modify any of the content before it's displayed

DaiPlusPlus 7y ago
And if requests are blocked then content publishers can very easily detect ad-blockers and intentionally degrade the user-experience or add nag screens that aren't part of the usual ad network code. If it's an SPA then it'd be almost impossible to untangle easily when the site's developers can add their "is-adblock-detected?" checks anywhere in their SPA codebase and mess with the UX at-will.
- cletus 7y ago
  Ok, so of all the replies here, this is the first I've read that's actually raised a really good point. Simply blocking requests will make ad block detection easier for Websites. Then again, this seems to be pretty prevalent already (as in lots of sites I visit already detect this).
  - DaiPlusPlus 7y ago
    Most adblocking scripts I’ve seen work by detecting if an ad loaded into its ad-placeholder. If you disable JavaScript completely then you don’t get the nag-screen. Some variants use CSS to show the nag screen by default and only removes it if it sees the ad loaded fine. But server-side connection-blocking or request-blocking detection works even when JS is disabled, but it requires a lot of infrastructure and cooperation between publishers, ad-networks, and more - both technical and political/business cooperation. Eventually in the future, web-browsers will render a page twice: one fully-loaded page, hidden from the user, that the ad code will think is what the user sees, while a network-sandboxed version is shown to the user with the already-loaded ad images replaced with white boxes or so. The client scripts can’t tell the ads haven’t loaded and even if they did they can’t phone-home to snitch on the user, while the browser still made those HTTP requests for the ads so the ad-network is satisfied it made an impression. Perhaps we could get fake ad-loading working without wasting downstream bandwidth by spoofing the IP source address field?

tyingq 7y ago

Extensions can still inject arbitrary JavaScript into any page, so this isn't about safety and security. Removing the dynamic capability kills heuristics, so it definitely makes ad blocking worse. There's a reason uBlock Origin is popular. See: https://twitter.com/gorhill/status/1134127701583904770 https://twitter.com/gorhill/status/1134127701583904770

bnegreve 7y ago

> So rather than be alarmist [..] we should be pushing for changes that make this workable If, as the author suspects, the intent is to break popular adblockers, I have no interest in trying to make this workable. Personally, I think this is a typical half-legit move: there's a good intention (security) but it's also hard to believe they did not realize that by pushing these changes, they were going to break several of the most popular extensions available. And, that the direct impact of this would be that for a short moment (at best) many more ads were going to be displayed on Chrome. I think we've seen a lot of these half legit moves recently (apple battery scandal?). So I'm starting to be more and more suspicious.

chopin 7y ago
There's no security involved whatsoever: Extensions can still read page content. They're only not allowed to block.
- rndgermandude 7y ago
  Not just page content. They can read your cookies, they can see all requests (just not modify them on the fly). The extensions tracking you acting as spyware will see no change, the other kind of malicious extensions that want to modify your requests will still do so by modifying the DOM of pages for example. So the "security" reasons google gave have long been debunked as non-sense. The other half is the performance reasons. What's the performance burden of calling a (chain) blocking webRequest listeners? Last time I checked it was single digit milliseconds per request. So a very ad-laden worst-case website with 100 requests will spent maybe 500ms in the webRequest listeners, but will still load faster thanks to all the cruft being blocked away. So what's the win for performance exactly?
cletus 7y ago
How hard exactly is it to use Firefox instead of Chrome? It literally takes 2 minutes to switch. This isn't a Microsoft situation where, at the time, there was no alternative to Windows. It is the easiest thing in the world to change browsers. Google knows this too. Not every surface is a slippery slope.

blep-arsh 7y ago

30K is just not enough. Intercepting requests is still possible, just not blocking. Extensions have been already abusing this, of course. It's fiendishly difficult to prevent e.g. corporate users from leaking the whole intranet to SimilarWeb unless you completely disable browser extensions.

cletus 7y ago
> Intercepting requests is still possible, just not blocking False: https://developer.chrome.com/extensions/declarativeNetRequest https://developer.chrome.com/extensions/declarativeNetReques... "There are the following kinds of rules: - Rules that block a network request. - Rules that prevent a request from getting blocked by negating any matching blocked rules. - Rules that redirect a network request. - Rules that remove headers from a network request."
- blep-arsh 7y ago
  I mean the current request inspection API, not the new ruleset-based one.

bambax 7y ago

> I honestly don't know what impact this will have on ad blockers But adblockers authors do know. Instead of accusing people of not reading the article, feel free to read what uBlock origin author has to say about this change.

malka 7y ago

Google is the worst actor to push for this. I have 0 trust in them that they are doing this for the right reasons, and that I will benefit as a user.

cletus 7y ago
If you have 0 trust in Google, why would you ever use Chrome?

tinus_hn 7y ago

So, some handwaving and all concerns go away because they are 'tired narratives'. Why not just block all extensions? That's clearly the most secure solution. > I honestly don't like the fact that I have to give a third party developer so much privileged access to run an ad blocker Then don't, install another one that works the way you want. Or don't, because the limited blocking abilities you appear to find sufficient can be gained just as well using an external proxy. > Extensions can be compromised. So can browsers, devices and operating systems.

cletus 7y ago
> Why not just block all extensions? That's clearly the most secure solution. That's pretty much what phones do. Both iOS and Android take a white list approach for third-party add ons.