5 ms·

Yes, I totally agree that Manifest V3 solves some real problems — in the case of many webextensions, I would welcome the ability to manually control which domai

Yes, I totally agree that Manifest V3 solves some real problems — in the case of many webextensions, I would welcome the ability to manually control which domains the extension can run in. However, the move to Manifest V3 also involves curtailing the power of extensions, including those that I trust as much or more than the browser itself. I want uBlock origin to be able to intercept and filter requests according to the logic that gorhill deems most sensible rather than however Chromium wants it to be done, since I trust gorhill far more than Google (and possibly slightly more than even Mozilla). I don't think that any of the tiny extensions that I've written to scratch my own itch require any of the capabilities removed in Manifest V3, but if they did, I'd also want them to keep having them.

fastest963 6y ago
> However, the move to Manifest V3 also involves curtailing the power of extensions, including those that I trust as much or more than the browser itself. I want uBlock origin to be able to intercept and filter requests according to the logic that gorhill deems most sensible rather than however Chromium wants it to be done, since I trust gorhill far more than Google (and possibly slightly more than even Mozilla). So what happens if gorhill's account is hacked or he gets tired of working on the extension and sells it to the highest bidder? These are not theoretical problems, they've happened multiple times in the past. I'm not saying Manifest V3 is the perfect solution but these are very real problems that cause me to not install any extensions that can access all sites.
- gnomewascool 6y ago
  > So what happens if gorhill's account is hacked or he gets tired of working on the extension and sells it to the highest bidder? Approximately the same as would happen if the developer of a traditional Windows* application were hacked or sold out, except less serious, since they wouldn't have access to the underlying filesystem. It's not a non-existent risk, but it is a trade-off I and many other people want to be able to make. uBlock Origin being FOSS and popular considerably mitigates the risks. (Not to mention that I trust gorhill not to sell out...) * or Linux (except that in Linux most software is distributed via repositories, which lessens the risks, somewhat; OTOH uBlock origin is also available via the repositories, for instance on Debian[0] and Ubuntu[1]). I'm not sure about sandboxing on MacOS. [0] https://packages.debian.org/stretch/webext-ublock-origin https://packages.debian.org/stretch/webext-ublock-origin [1] https://packages.ubuntu.com/search?keywords=webext-ublock-origin https://packages.ubuntu.com/search?keywords=webext-ublock-or...
  - jsnell 6y ago
    > (Not to mention that I trust gorhill not to sell out...) Gorhill has already once given the extension away to a person who turned out to be untrustworthy! That fiasco is why we're all using uBlock Origin rather than uBlock, after all. Granted it wasn't for a financial motive, but the outcome was the same.
    - _qulr 6y ago
      > we're all using uBlock Origin rather than uBlock This says it all. Were any users actually harmed? Where's the harm to justify the destruction of blocking abilities? It's ironic to cite uBlock Origin to try to argue that uBlock Origin should not exist, which is the endgame of Manifest v3. Any software whatsoever can change hands. Salesforce just bought Slack. Is that an argument to hobble or eliminate Slack? No. Oracle acquired Java. Facebook acquired Instagram. The list is endless, and there's nothing special about extensions here that justifies special treatment or punishment.
      - jsnell 6y ago
        I've said nothing about manifest v3, or that uBlock Origin should not exist. The OP said that they trusted gorhill. I pointed out that gorhill already did exactly this once. It is not a hypothetical. That said, it looks like 800k users still have the original uBlock installed. And also, uBlock Origin is blocking ublock.org on the basis of it being malware. Are you saying it's not actually a malware risk, and it's really on Origin's blocklist for some totally unrelated reason?
        _qulr 6y ago
        > uBlock Origin is blocking ublock.org on the basis of it being malware. Are you saying it's not actually a malware risk, and it's really on Origin's blocklist for some totally unrelated reason? We don't have to speculate. The reason is right here, and it's not because of malware. https://github.com/gorhill/uBlock/wiki/uBlock-Origin-is-completely-unrelated-to-the-web-site-ublock.org https://github.com/gorhill/uBlock/wiki/uBlock-Origin-is-comp... If it were malware, then why would it still be in the Chrome Web Store? Google reviews every extension update, and also has the power to remove extensions from the store, regardless of Manifest v3. It's also important to note that Manifest v3 only affects the content blocking capability of extensions. Extensions that are not content blockers still have extremely powerful capabilities that could be abused to capture user data or otherwise do harm. And those extensions can change ownership too. Manifest v3 is not even remotely close to a solution to this general problem.

fastest963 6y ago

> However, the move to Manifest V3 also involves curtailing the power of extensions, including those that I trust as much or more than the browser itself. I want uBlock origin to be able to intercept and filter requests according to the logic that gorhill deems most sensible rather than however Chromium wants it to be done, since I trust gorhill far more than Google (and possibly slightly more than even Mozilla). So what happens if gorhill's account is hacked or he gets tired of working on the extension and sells it to the highest bidder? These are not theoretical problems, they've happened multiple times in the past. I'm not saying Manifest V3 is the perfect solution but these are very real problems that cause me to not install any extensions that can access all sites.

gnomewascool 6y ago
> So what happens if gorhill's account is hacked or he gets tired of working on the extension and sells it to the highest bidder? Approximately the same as would happen if the developer of a traditional Windows* application were hacked or sold out, except less serious, since they wouldn't have access to the underlying filesystem. It's not a non-existent risk, but it is a trade-off I and many other people want to be able to make. uBlock Origin being FOSS and popular considerably mitigates the risks. (Not to mention that I trust gorhill not to sell out...) * or Linux (except that in Linux most software is distributed via repositories, which lessens the risks, somewhat; OTOH uBlock origin is also available via the repositories, for instance on Debian[0] and Ubuntu[1]). I'm not sure about sandboxing on MacOS. [0] https://packages.debian.org/stretch/webext-ublock-origin https://packages.debian.org/stretch/webext-ublock-origin [1] https://packages.ubuntu.com/search?keywords=webext-ublock-origin https://packages.ubuntu.com/search?keywords=webext-ublock-or...
- jsnell 6y ago
  > (Not to mention that I trust gorhill not to sell out...) Gorhill has already once given the extension away to a person who turned out to be untrustworthy! That fiasco is why we're all using uBlock Origin rather than uBlock, after all. Granted it wasn't for a financial motive, but the outcome was the same.
  - _qulr 6y ago
    > we're all using uBlock Origin rather than uBlock This says it all. Were any users actually harmed? Where's the harm to justify the destruction of blocking abilities? It's ironic to cite uBlock Origin to try to argue that uBlock Origin should not exist, which is the endgame of Manifest v3. Any software whatsoever can change hands. Salesforce just bought Slack. Is that an argument to hobble or eliminate Slack? No. Oracle acquired Java. Facebook acquired Instagram. The list is endless, and there's nothing special about extensions here that justifies special treatment or punishment.
    - jsnell 6y ago
      I've said nothing about manifest v3, or that uBlock Origin should not exist. The OP said that they trusted gorhill. I pointed out that gorhill already did exactly this once. It is not a hypothetical. That said, it looks like 800k users still have the original uBlock installed. And also, uBlock Origin is blocking ublock.org on the basis of it being malware. Are you saying it's not actually a malware risk, and it's really on Origin's blocklist for some totally unrelated reason?
      - _qulr 6y ago
        > uBlock Origin is blocking ublock.org on the basis of it being malware. Are you saying it's not actually a malware risk, and it's really on Origin's blocklist for some totally unrelated reason? We don't have to speculate. The reason is right here, and it's not because of malware. https://github.com/gorhill/uBlock/wiki/uBlock-Origin-is-completely-unrelated-to-the-web-site-ublock.org https://github.com/gorhill/uBlock/wiki/uBlock-Origin-is-comp... If it were malware, then why would it still be in the Chrome Web Store? Google reviews every extension update, and also has the power to remove extensions from the store, regardless of Manifest v3. It's also important to note that Manifest v3 only affects the content blocking capability of extensions. Extensions that are not content blockers still have extremely powerful capabilities that could be abused to capture user data or otherwise do harm. And those extensions can change ownership too. Manifest v3 is not even remotely close to a solution to this general problem.