4 ms·

Quite honestly I'm of the opinion that Google should strictly audit all transfers of ownership of popular extensions. The options for monetizing extensions are

Quite honestly I'm of the opinion that Google should strictly audit all transfers of ownership of popular extensions. The options for monetizing extensions are so limited that the only thing that can motivate someone to buy an extension is nefarious purposes.

saxonww 6y ago
I immediately wondered if the controversial Manifest V3 changes would render this a non-issue. https://github.com/uBlockOrigin/uBlock-issues/issues/338 https://github.com/uBlockOrigin/uBlock-issues/issues/338 https://developer.chrome.com/extensions/migrating_to_manifest_v3 https://developer.chrome.com/extensions/migrating_to_manifes...
- ziml77 6y ago
  I was thinking the same thing. The reason that plugins like this, uBlock, and Stylish are so valuable is that they have access to everything on every site by nature. On one hand it sucks to have functionality taken away but on the other hand it protects against potentially large security issues.
  - yjftsjthsd-h 6y ago
    > On one hand it sucks to have functionality taken away but on the other hand it protects against potentially large security issues. Except that it doesn't actually protect against security issues, because v3 manifests don't break the ability to read data, only modify requests. Also, since ads are a vector for malware[0], having an adblocker is a security benefit, not a loss. [0] ex. https://www.extremetech.com/internet/220696-forbes-forces-readers-to-turn-off-ad-blockers-promptly-serves-malware https://www.extremetech.com/internet/220696-forbes-forces-re...
    - resynth1943 6y ago
      Thanks for the clarification ;-)
- Dylan16807 6y ago
  Unless I missed something, no. Extensions can still have full access to the data stream as long as it's read-only. Maybe it could help a little if you're extremely careful about permissions, but how many people are?
- resynth1943 6y ago
  Yeah, I was wondering the same thing actually...
- plorkyeran 6y ago
  Manifest V3 breaks ad blocking without doing anything about extensions spying on the user. It provides read-only access to everything that previously was available and merely removes the ability to modify or block requests.
gorhill 6y ago
I commented about this in the announcement thread[1]: ==== Though the extension requests the webRequestBlocking permission, that permission is not required to perform the collection of data, including sensitive ones. ==== * * * [1] https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210 https://github.com/NanoAdblocker/NanoCore/issues/362#issueco...
tehlike 6y ago
How can google achieve this, realistically speaking?
eli 6y ago
How would that work? How would you know the new owners are bad until after they’ve pushed an evil update?

saxonww 6y ago

I immediately wondered if the controversial Manifest V3 changes would render this a non-issue. https://github.com/uBlockOrigin/uBlock-issues/issues/338 https://github.com/uBlockOrigin/uBlock-issues/issues/338 https://developer.chrome.com/extensions/migrating_to_manifest_v3 https://developer.chrome.com/extensions/migrating_to_manifes...

ziml77 6y ago
I was thinking the same thing. The reason that plugins like this, uBlock, and Stylish are so valuable is that they have access to everything on every site by nature. On one hand it sucks to have functionality taken away but on the other hand it protects against potentially large security issues.
- yjftsjthsd-h 6y ago
  > On one hand it sucks to have functionality taken away but on the other hand it protects against potentially large security issues. Except that it doesn't actually protect against security issues, because v3 manifests don't break the ability to read data, only modify requests. Also, since ads are a vector for malware[0], having an adblocker is a security benefit, not a loss. [0] ex. https://www.extremetech.com/internet/220696-forbes-forces-readers-to-turn-off-ad-blockers-promptly-serves-malware https://www.extremetech.com/internet/220696-forbes-forces-re...
  - resynth1943 6y ago
    Thanks for the clarification ;-)
Dylan16807 6y ago
Unless I missed something, no. Extensions can still have full access to the data stream as long as it's read-only. Maybe it could help a little if you're extremely careful about permissions, but how many people are?
resynth1943 6y ago
Yeah, I was wondering the same thing actually...
plorkyeran 6y ago
Manifest V3 breaks ad blocking without doing anything about extensions spying on the user. It provides read-only access to everything that previously was available and merely removes the ability to modify or block requests.

gorhill 6y ago

I commented about this in the announcement thread[1]: ==== Though the extension requests the webRequestBlocking permission, that permission is not required to perform the collection of data, including sensitive ones. ==== * * * [1] https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210 https://github.com/NanoAdblocker/NanoCore/issues/362#issueco...

tehlike 6y ago

How can google achieve this, realistically speaking?

eli 6y ago

How would that work? How would you know the new owners are bad until after they’ve pushed an evil update?