3 ms·

I think that shows that "just adding declarativeNetRequest" wouldn't really accomplish much? Developers would continue using the old API and users wouldn't hold

I think that shows that "just adding declarativeNetRequest" wouldn't really accomplish much? Developers would continue using the old API and users wouldn't hold them accountable because they wouldn't know the difference or what the tradeoffs hard. Not saying V3 is a perfect or even good solution but just thought the option you suggested doesn't seem like it would work.

Groxx 6y ago
It lets developers opt into a less-sensitive and higher-performance API, losing flexibility as a tradeoff. That seems like a perfectly acceptable reason for an API to exist, and a reasonable tradeoff. Follow up with big angry warnings about extensions that use the less-safe APIs, and let users choose. As opposed to now, where all permissions are quite calmly displayed. "Half of all malicious extensions use this API, we strongly advise you to look for an alternative"[1] is very different than "x wants permission to modify requests". The failings of the current permissions system doesn't mean users are incapable of deciding. It means the current system doesn't work for users. Either it's unsolvable for the majority (unlikely IMO), or it's not matching what users need to know to decide. I thoroughly support making better APIs (declarativeNetRequest is plenty useful, and makes decent tradeoffs), but that doesn't have to be at the cost of other things, nor is some "make everything safe" dream the only option. [1]: https://blog.chromium.org/2019/06/web-request-and-declarative-net-request.html https://blog.chromium.org/2019/06/web-request-and-declarativ...
dessant 6y ago
Extension stores have a policy of only allowing the use of permissions one really needs, which they have been enforcing with automated scans and manual reviews. Why couldn't they require the use of declarativeNetRequest for extensions that only need those features?
shawnz 6y ago
The advantage from the users perspective is less scary permission nag screens, and if Google's word is to be believed, improved performance from manifest v3-based adblockers. That seems to me like it is more than enough opportunity for v3-based blockers to compete with v2-based blockers if they really are better for the user as Google claims. Meanwhile v2-based blockers can continue to compete based on their increased capabilities compared to v3-based blockers, and uses can decide what their own needs are.

Groxx 6y ago

It lets developers opt into a less-sensitive and higher-performance API, losing flexibility as a tradeoff. That seems like a perfectly acceptable reason for an API to exist, and a reasonable tradeoff. Follow up with big angry warnings about extensions that use the less-safe APIs, and let users choose. As opposed to now, where all permissions are quite calmly displayed. "Half of all malicious extensions use this API, we strongly advise you to look for an alternative"[1] is very different than "x wants permission to modify requests". The failings of the current permissions system doesn't mean users are incapable of deciding. It means the current system doesn't work for users. Either it's unsolvable for the majority (unlikely IMO), or it's not matching what users need to know to decide. I thoroughly support making better APIs (declarativeNetRequest is plenty useful, and makes decent tradeoffs), but that doesn't have to be at the cost of other things, nor is some "make everything safe" dream the only option. [1]: https://blog.chromium.org/2019/06/web-request-and-declarative-net-request.html https://blog.chromium.org/2019/06/web-request-and-declarativ...

dessant 6y ago

Extension stores have a policy of only allowing the use of permissions one really needs, which they have been enforcing with automated scans and manual reviews. Why couldn't they require the use of declarativeNetRequest for extensions that only need those features?

shawnz 6y ago

The advantage from the users perspective is less scary permission nag screens, and if Google's word is to be believed, improved performance from manifest v3-based adblockers. That seems to me like it is more than enough opportunity for v3-based blockers to compete with v2-based blockers if they really are better for the user as Google claims. Meanwhile v2-based blockers can continue to compete based on their increased capabilities compared to v3-based blockers, and uses can decide what their own needs are.