19 ms·
Manifest V3 now available on M88 Beta
- woofwoofwoof 6y agoEnd of uBlock origin as we know it I guess?
- rasz 6y agoYes. End of uBlock, end of Twitch adblock, end of any blocker requiring in flight header modification to work.
- ComputerGuru 6y agoFYI: Manifest v3 -> new Chrome extension manifest version.
- frongpik 6y agoThe manifest that disables uBO?
- deleted 6y ago[deleted]
- blibble 6y agowow, even stooping as low as to quoting eyeo (the people behind AdBlock Plus), whose business model is to extort money out of you if you don't want to be blocked (their "approved ads" list) the annoucement of manifest v3 moved me to firefox, glad to see I didn't waste my effort
- kgwxd 6y agoI've been having a hard time figuring out what Mozilla is really going to do with this. Best I can find [1] is "no immediate plans" to fundamentally break uBlock Origin. That phrasing makes me feel queasy. [1] https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest-v3-faq/ https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest...
- XzetaU8 6y agoRegarding Manifest v3 in Firefox, watch this recent video from the Ad Blocker Dev Summit 2020 "Rob Wu & Philipp Kewisch - The Future of Content Blockers in Firefox - Adblocker Dev Summit 2020" https://www.youtube.com/watch?v=tpDFS-GUytg https://www.youtube.com/watch?v=tpDFS-GUytg
- Arnavion 6y ago(Relevant part is 04:00 - 07:30 )
- kevin_thibedeau 6y agoIf that happens it will be time to hard fork Firefox and abandon Mozilla. They're already teetering without a direction so I doubt they would take the risk unless their overlord presses the issue.
- nine_k 6y agoI suppose disabling the M3 manifest support in about:config (by default) would be enough, if they are forced to implement its support for any reason. What do they have to lose if they don't support M3, or support it partially?
- apazzolini 6y agoManifest v3 prompted my permanent move to Firefox as well. Good riddance, Chrome.
- fastest963 6y agoI know a lot of people think Manifest V3 is here only to break adblockers but it seems like it's trying to solve a real problem. Adblockers currently only work by having full access to every tab, iframe, page, etc. What happens when an adblocker is sold and the new owner secretly installs spyware to steal all of your passwords and cookies? This has happened multiple times already with extensions in the past. It seems to me like Chrome is trying to limit use-cases that require full access to every single site you visit. How will Firefox solve this problem better than Chrome or Safari? It seems inevitable that the status quo for these extensions is going away.
- sneak 6y ago> Adblockers currently only work by having full access to every tab, iframe, page, etc. What happens when an adblocker is sold and the new owner secretly installs spyware to steal all of your passwords and cookies? Perhaps installing something (A) on Monday should not give the developer/publisher the right or ability to arbitrarily exec B on your machine on Tuesday. No-interaction updates are the problem here. They amount to a remote code exec vulnerability, exploited just as you describe.
- jefftk 6y agoAn ad blocker that did not auto update would quickly go stale. Removing updating support for extensions would be even less popular! (Disclosure: I work for Google, speaking only for myself)
- The_rationalist 6y agoI'm not up to date on the topic but Additionally, we are currently planning to change the rule limit from maximum of 30k rules per extension to a global maximum of 150k rules. The Declarative Net Request API now allows for the registration and removal of dynamic rules - specified at runtime rather than statically in the manifest. We’ve also added the capability to remove common tracking headers, such as Referer, Cookie, and Set-Cookie. The blocking version of the Web Request API remains available for managed extensions because of the deep integrations that enterprises may have between their software suites and Chrome. It seems that the publicized drawbacks have been addressed, which drawbacks remains? What could prevent uBlock Origin support?
- acrispino 6y agoSee rgorhill's comment from 2018: https://bugs.chromium.org/p/chromium/issues/detail?id=896897&desc=2#c23 https://bugs.chromium.org/p/chromium/issues/detail?id=896897... It's not just about the limit.
- The_rationalist 6y agoDidn't gorhill update its view with the change made since to the v3?
- elaus 6y agoThe fact that they indicated to increase the rule limit for over a year but haven't done so yet (the beta still has a limit of 30k) doesn't seem like they really have addressed the drawbacks. I wouldn't think increasing that limit would take that much time if it's a pressing issue but maybe I'm missing something.
- rasz 6y agoThis means every uBO user would have to install as "managed extensions" whatever this means. This pretty much kills uBO.
- kevingadd 6y agoThe limit is still 30k. As is typical with Chrome's devrel (they did the exact same thing with Web Audio multiple times) they tell the web community that they are going to fix problems, and then just don't fix anything and go ahead and ship a bad product. At best shouting about it gets a delay so you have more time to plan for the fact that they're shooting your product or service in the head.
- dsissitka 6y agoThey did stop showing the value at [0] but if [1] is up to date it looks like the limit is still 30,000. What do you all plan to do? At the moment I'm using Brave. I like that their position on Manifest v3 has been clear since day one. Edit: I just tested it and the limit is still 30,000. Here's the error if you're curious: https://imgur.com/a/EmywSUk https://imgur.com/a/EmywSUk [0] https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/#property-MAX_NUMBER_OF_RULES https://developer.chrome.com/docs/extensions/reference/decla... [1] https://github.com/chromium/chromium/blob/987f407f2e293f9737f5c9c30a045308fa0590ae/extensions/common/api/declarative_net_request.idl https://github.com/chromium/chromium/blob/987f407f2e293f9737...
- The_rationalist 6y agoI read that we are currently planning to change the rule limit from maximum of 30k rules per extension to a global maximum of 150k rules.
- dsissitka 6y agoMy concern is they said that 18 months ago and the limit still appears to be 30,000. I think I'm going to check out the beta and see if that's the case. Edit: I just tested it and the limit is still 30,000. Here's the error if you're curious: https://imgur.com/a/EmywSUk https://imgur.com/a/EmywSUk
- rasz 6y agoThat limit is just a red herring, they will bump it up at some point as a gesture of good will to drown out voices of valid opposition against the removal of blocking webRequest API. Its the classic Magicians look at my right hand move, while the left one is crushing little bird and pocketing its remains.
- timdorr 6y agoGoogle has claimed they will bump it to 300K for Chrome 89: https://9to5google.com/2020/12/09/chrome-88-beta-extension-manifest-v3/ https://9to5google.com/2020/12/09/chrome-88-beta-extension-m...
- rasz 6y agoRight now (as of ~81) Chrome will load first website from previously saved session without waiting for extensions to initialize - all privacy/blocker extensions are ignored on first page load, "run_at": "document_start" is not obeyed, because loading first website 200ms faster once per daily session is more important than loading adblocker! https://github.com/Tampermonkey/tampermonkey/issues/1083 https://github.com/Tampermonkey/tampermonkey/issues/1083 The 'making extensions safer for everyone' Manifest V3 keeps the ability to spy on all traffic, but removes ability to modify headers/block requests. Killing Blocking (blocking = synchronous meaning wont complete until extension decides what to do with it) webRequest API means no more: -intelligent/dynamic blockers -User Agent modifications -modifying CSP rules to disable javascript/web fonts etc Google is removing control from users hands, from the code users want to run. This is one of the steps in a battle against general computing. https://boingboing.net/2012/01/10/lockdown.html https://boingboing.net/2012/01/10/lockdown.html You no longer own a computer, you own a Google Web Appliance.
- moritonal 6y agoYou still own the computer, you just download Chrome (rather than any of the alts) and give them power. It's Google that are breaking the internet for people, and getting away with it because of their market share. I've not used Chrome for ages and use Edge only where things don't work (like Google Photos).
- rhencke 6y agoWhat about users who own Chromebooks?
- spijdar 6y agoIt's ironically pretty straightforward to install Firefox on most chromebooks, through the Debian container/VM, with opengl + audio passthrough.
- lldbg 6y agoOnly on HackerNews is that considered pretty straightforward. I barely understand what a container is, and I know the BIOS mbr magic number off the top of my head. We should not all have to be Andy Dufresne to escape privacyhell. A bit of a tangent coming here, if you will indulge me. The battle for privacy is lost on so many fronts; I do not believe it can be won, any longer. Even the language used by proponents for privacy shows this. What Google and others represent is not the opposite of privacy, that would be transparency. I've never heard Google's (nor Facebook's) practices designated as transparency friendly. Perhaps there is a good word for it, but as an ESL person, I've at least never heard of it. As programmers we should know all about the benefit that proper naming provides. And things should be called by their proper name. I am not for privacy, I have nothing to hide. Rather, I am against the exploitation of data I generate. So this comment can be taken as either a call to arms and naming the enemy, or as a statement of my ignorance of the queen's own english :p
- zamadatix 6y agoThere is a clear and obvious path to implementing Manifest V3 in a way that best serves users overall and this path involves working with the uBlock Origin team/gorhill and the concerns they've brought up with the change. Until that happens I refuse to believe any train of thought that this is a user focused change and not a ad revenue focused change. To be clear that it has some benefit to users that can be pointed out does not make the change user focused in the same way putting a solar cellphone charger on a cargo ship doesn't make it environmentally friendly. It'd be a different discussion if this was presented as an ad revenue focused change but it's presented as if it's user focus and the community is driving the direction of how it's implemented. Clearly this is not the case, in a conveniently true way, and it'd be such a simple thing to clear up. Even if the uBlock Origin team ends up saying "hmm, we really all got together and thought about it and there was nothing else to change that couldn't impact user privacy significantly" at least it removes the divide and controversy. Throwing references from companies with shady practices that exclude Google ads from their blocking does nothing to show a willingness to work with developers on what's best for users, in fact it makes the situation look even more shady. I don't know if gorhill reads HN but on the off chance he does thank you for your work.
- Groxx 6y agoThere's also the option of just adding declarativeNetRequest. Then 1) uBlock Origin and others keep working un-modified, 2) they could adopt declarativeNetRequest for cases where they're able (say as a pre-filter or if you only use those rules), and 3) blockers that only use declarativeNetRequest can exist. Let them all compete on performance-vs-features-vs-privacy. There's nothing about introducing a new API that requires removing an older one - this is a political change, not a technical one. It's hard to see it as anything but ad-revenue motivated.
- alooPotato 6y agoDo you think users would understand the difference and the privacy trade-off?
- 6y ago
- speedgoose 6y agoI'm curious to see what Microsoft will do with Edge. That could give them a clear advantage.
- neurobashing 6y agothey've already stated they'll be supporting V3.
- currysausage 6y agoSupporting v3 doesn't necessarily entail disabling v2. Have they stated anything regarding v2?
- qnxub 6y agoIf DNS over HTTPS becomes standard, and Manifest V3 lands in Chromium-based browsers, Safari, and Firefox, how are we supposed to block ads?
- blibble 6y agoI suspect the plan is to make ad blockers impotent by reducing their ability to adapt quickly to new forms of block evasion the ad blockers slowly become more and more useless, people stop using them entirely, and google's the biggest winner
- AgentME 6y agoFirefox has no incentive to prevent people from blocking ads, and DNS over HTTPS isn't a tool to block users from reconfiguring their own machines. All browsers let you configure your DNS settings still. The thing that DNS over HTTPS prevents is letting whoever is supplying your internet (including your ISP, whatever hotspot you're using on the go, etc) manipulate your DNS. It's not about removing control from the person who owns the machine.
- wvenable 6y ago> DNS over HTTPS isn't a tool to block users from reconfiguring their own machines. Yes it is. Effectively it takes the "machine" out of the equation entirely. DNS resolution happens between the app and the server without you have any say over it at all.
- netheril96 6y agoI guess you can run your local DNS server and point the browser to that. The local DNS server can do all the filtering you want, and forward the filtered out requests to the outside DNS server.
- zelly 6y agothe doomsday scenario the top-level comment mentioned is if they disabled that option. it's possible but very unlikely because it would make that browser unusable for many corporate networks.
- celsoazevedo 6y agoTime to move to Firefox or to a Chromium-based browser that will continue to support current extensions.
- pjmlp 6y agoKeep pushing for Electron apps and then don't cry wolf.
- alacombe 6y agoTaking no chance for now... $ dnf install python3-dnf-plugin-versionlock $ dnf versionlock add google-chrome-beta $ dnf versionlock add google-chrome-stable
- zelly 6y agogood way to get pwned
- tyingq 6y agoI don't buy the safety/security line as the reason to disable the webRequest intercept capability is a bit silly. They still allow extensions to inject arbitrary javascript, which has all the same safety/security issues. If you think of an ad blocker like anti-virus, you're basically hobbling any ability to do heuristics, and limiting blocking to a fixed identifier. Getting around this sort of hobbled ad blocker is pretty straightforward, just lots of random domains that change.
- dstaley 6y agoI just wanted to call out the ending of the blog post: > The Chrome Web Store will start accepting Manifest V3 extensions mid-January when Chrome 88 reaches stable. While there is not an exact date for removing support for Manifest V2 extensions, developers can expect the migration period to last at least a year from when Manifest V3 lands in the stable channel. This means that we'll have at least a year where Manifest V2 extensions will still work. Hopefully by the end of that period there will be a good selection of Manifest v3 compatible ad blockers.
- rasz 6y agoYou cant be a good privacy/adblocker extension using V3. Want to strip umt tracking parameters from loaded URLs? cant do it under V3. Want to disable JS on a page? cant do under V3. Want to spoof your own User Agent? you know the drill.
- jsmith45 6y agoWhy can't the RedirectByRegEx declarative action be used to "strip umt tracking parameters"? That sounds very much like something you can do with that declarative action type. User agent spoofing also sounds like the sort of thing one could use the SetRequestHeader declarative action for. As for disabling JavaScript, yeah declarativeWebRequest appears to lack the ability to do that.
- antpls 6y agoDoes anyone recommend a good out-of-the-box local proxy that allows changing user-agents, doing DoH, and managing https connections ?
- zelly 6y ago> changing user-agents $ chromium --user-agent "..." > DoH chrome://flags/#dns-over-https > managing https connections wat this mean? https is meant to be opaque
- user749391 6y agoThe fact that most users don't understand this changes and can not make and informed decision and the fact that the ones who can make a informed decision are so tiny that their voice can easily be dismissed by chromium developers is what is really concerning. I would expect that from Apple or Microsoft, but now I have to expect that from Google too
- user749264 6y agodon't use chrome won't scale. Stop saying that. The only thing that could make Google change would be a YouTube 2.0 that breaks Chrome in a dally basis using dark patterns