4 ms·

>The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as

>The only thing I'll say is... Extensions have a scary level of access (they're basically almost as easy to use as a website, but with unlimited powers such as recording every site you visit and stealing passwords), and the average user will never understand that. Probably not going to be all that popular on HN, but this is why I'm very hesitant about using extensions on Firefox (and I suppose Chrome too, but it's been a while since I've used that browser). I'm not going to audit the source code of these extensions, so why should I trust them with privileges to essentially record every website I visit? I wish Chrome and Firefox would adopt a content blocking system similar to Safari, where the author of the ad blocker can essentially tell the browser what content to block, but the ad blocker itself doesn't get any information about user activity. This could exist alongside the existing extension system, in case additional capabilities are needed. Yes this is less powerful than giving the ad blockers content to all the user's browsing history, but I'd happily exchange less effective ad blocking in exchange for enhanced privacy

MrPatan 6y ago
I've stopped using extensions altoghether. And I used quite a few back in the day, even made a couple myself. "Hesitant" doesn't convey the level of fear everyone should feel after reading "Has acess to: All data on all websites". Same applies to apps, of course. By the way, I think a pi-hole is safer than an ad-blocker extension, but I'm not sure. What would I be opening myself to if it gets hacked and my DNS server is now the enemy?
- knome 6y ago
  As long as you don't blithly accept new ssh connection end points or bypass certificate warnings, you should be fine. They could track where you go online via the DNS requests ( the sites at least ), and they could mess with anything unencrypted. Used to be if an HTTPS site loaded an HTTP script resource it provided a dangerous place middlemen could invade your secure session. chrome, IE ( presumably now Edge as well ) and firefox rightfully block mixed content by default, and have for some time https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_... ( the mentioned Firefox 23 came out in 2013, so like I said, a while )
mullingitover 6y ago
> I wish Chrome and Firefox would adopt a content blocking system similar to Safari, where the author of the ad blocker can essentially tell the browser what content to block, but the ad blocker itself doesn't get any information about user activity. Please, no. This is exactly what makes Safari all-around worthless, despite all the hard work they put into it. Chrome will get forked the minute they do this, and the forked version will restore that functionality, and I will immediately install that fork and uninstall Chrome.
- spideymans 6y ago
  >Please, no. This is exactly what makes Safari all-around worthless, despite all the hard work they put into it. Keep in mind that I said that the legacy extension system should remain in place, for people such as yourself that wish to utilize it. That said, I wouldn't characterize Safari's content blockers as worthless. It's not as effective as Firefox's ad blockers, but I still rarely see ads. If I had to guess, I'd say under five ads per month manage to sneak through.
  - hobs 6y ago
    In my mind that just means switching over the big boy browser to that approach just means giving an incentive for more of those types of ads that slip through.
jvolkman 6y ago
Isn't this what Manifest v3 does?
varenc 6y ago
> I wish Chrome and Firefox would adopt a content blocking system similar to Safari... This is exactly what Chrome's Manifest v3 offers. As they put it: "There's a new declarativeNetRequest API which lets extensions modify and block network requests in a privacy-preserving and performant way."[0] MV3 went live earlier this year so you can build on it now, but no word on when extensions will be required to migrate. Manifest v3 has been widely criticized [1] for weakening ad blocking which of course aligns with Google's self-interest. It's a tough balance to strike. [0] https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#network-request-modification https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o... [1] https://news.ycombinator.com/item?id=20044430 https://news.ycombinator.com/item?id=20044430
- Nullabillity 6y ago
  Nope, MV3 weakens ad blocking, but still gives full read access to the requests.
  - dotproto 6y ago
    The CWS developer program policy does not allow extensions to request unnecessary permissions. If an extension doesn't have a good reason to observe network requests in MV3, it will/should be rejected. So yes, it's technically possible to observe network requests but in practice few should be doing it.
deleted 6y ago
[deleted]
matheusmoreira 6y ago
Extensions such as uBlock Origin just happen to be important enough that they should not be subjected to these limitations. They're essential browser features that for some reason haven't been integrated into the browser itself yet.
- MrPatan 6y ago
  AFAIK the author is just one guy. I'm sure he's the best guy there is, but if tomorrow morning he finds his favorite horse's head in his bed, I wouldn't fault him for including some tiny little script in it, you know, practically nothing!

MrPatan 6y ago

I've stopped using extensions altoghether. And I used quite a few back in the day, even made a couple myself. "Hesitant" doesn't convey the level of fear everyone should feel after reading "Has acess to: All data on all websites". Same applies to apps, of course. By the way, I think a pi-hole is safer than an ad-blocker extension, but I'm not sure. What would I be opening myself to if it gets hacked and my DNS server is now the enemy?

knome 6y ago
As long as you don't blithly accept new ssh connection end points or bypass certificate warnings, you should be fine. They could track where you go online via the DNS requests ( the sites at least ), and they could mess with anything unencrypted. Used to be if an HTTPS site loaded an HTTP script resource it provided a dangerous place middlemen could invade your secure session. chrome, IE ( presumably now Edge as well ) and firefox rightfully block mixed content by default, and have for some time https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_... ( the mentioned Firefox 23 came out in 2013, so like I said, a while )

mullingitover 6y ago

> I wish Chrome and Firefox would adopt a content blocking system similar to Safari, where the author of the ad blocker can essentially tell the browser what content to block, but the ad blocker itself doesn't get any information about user activity. Please, no. This is exactly what makes Safari all-around worthless, despite all the hard work they put into it. Chrome will get forked the minute they do this, and the forked version will restore that functionality, and I will immediately install that fork and uninstall Chrome.

spideymans 6y ago
>Please, no. This is exactly what makes Safari all-around worthless, despite all the hard work they put into it. Keep in mind that I said that the legacy extension system should remain in place, for people such as yourself that wish to utilize it. That said, I wouldn't characterize Safari's content blockers as worthless. It's not as effective as Firefox's ad blockers, but I still rarely see ads. If I had to guess, I'd say under five ads per month manage to sneak through.
- hobs 6y ago
  In my mind that just means switching over the big boy browser to that approach just means giving an incentive for more of those types of ads that slip through.

jvolkman 6y ago

Isn't this what Manifest v3 does?

varenc 6y ago

> I wish Chrome and Firefox would adopt a content blocking system similar to Safari... This is exactly what Chrome's Manifest v3 offers. As they put it: "There's a new declarativeNetRequest API which lets extensions modify and block network requests in a privacy-preserving and performant way."[0] MV3 went live earlier this year so you can build on it now, but no word on when extensions will be required to migrate. Manifest v3 has been widely criticized [1] for weakening ad blocking which of course aligns with Google's self-interest. It's a tough balance to strike. [0] https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#network-request-modification https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o... [1] https://news.ycombinator.com/item?id=20044430 https://news.ycombinator.com/item?id=20044430

Nullabillity 6y ago
Nope, MV3 weakens ad blocking, but still gives full read access to the requests.
- dotproto 6y ago
  The CWS developer program policy does not allow extensions to request unnecessary permissions. If an extension doesn't have a good reason to observe network requests in MV3, it will/should be rejected. So yes, it's technically possible to observe network requests but in practice few should be doing it.

deleted 6y ago

[deleted]

matheusmoreira 6y ago

Extensions such as uBlock Origin just happen to be important enough that they should not be subjected to these limitations. They're essential browser features that for some reason haven't been integrated into the browser itself yet.

MrPatan 6y ago
AFAIK the author is just one guy. I'm sure he's the best guy there is, but if tomorrow morning he finds his favorite horse's head in his bed, I wouldn't fault him for including some tiny little script in it, you know, practically nothing!