9 ms·

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire ar

by judge2020 5y ago

While a good message that does have actual merit if you know what's happening already, I don't see how this is a legitimate consideration of MV3. The entire argument regarding security doesn't mention any of the reasons Chrome developers cite its security improvement, instead it brings up that Firefox "does good enough already" and that malicious extensions can still get past the review process. the review process is by itself improved with V3 as extensions that pull in code remotely can no longer get past the review process[0], especially with how many current extensions implement RCE C&C intentionally. They also say extensions are "usually interested in simply observing the conversation between your browser and whatever websites you visit" - that's 'usually', though; malicious extensions intercepting and modifying requests for their own benefit isn't unheard of. Instead of only stating 'this is bad', it would be beneficial to include both (A) what they say (B) their basis for the decision, if any (C) why that line of reason is incorrect/deceiving. 0: https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#remotely-hosted-code https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o...

syrrim 5y ago
Beneficial in what sense? If manifest v3 is still bad on net, then including chrome's counter arguments makes for bad rhetoric and thus does a poor job of advancing a valiant goal.
kevingadd 5y ago
Anyone who pays attention to the web platform should know by now that any rationale Chrome (or Google in general) developers give for web platform decisions is made up. They repeatedly told us they had specific motives for AMP and it was all a lie, AMP was designed to tighten their grip on the advertising market. It's not the only example - the way their autoplay whitelist works is also transparently manipulative despite lies to the contrary - and I would bet money that MV3 is partially motivated by business incentives in the same way. Googlers' paychecks are signed by Ads and GCP and ad-blockers actively undermine the former.
yonixw 5y ago
Google has not provided any reason to not include "block request" functionality. And that the super bad faith underlying fact that poison their "reasoning".
- jefftk 5y ago
  There is still "block request" functionality, the change is that it's now declarative. This is the same way it works in Safari, and is (a) more efficient because you don't need to execute JS to evaluate each request and (b) more private because an ad/content blocker doesn't need to be given such broad permissions. There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and easily can be used to block Google ads. Docs: https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/ https://developer.chrome.com/docs/extensions/reference/decla... (Disclosure: I work on ads at Google, speaking only for myself)
  - everforward 5y ago
    > (a) more efficient because you don't need to execute JS to evaluate each request This is true, but I think overly performance-focused. It doesn't feel like that much time, so I think there's a valid complaint that it doesn't make sense to kneecap flexibility for speed. > more private because an ad/content blocker doesn't need to be given such broad permissions Sure, but this doesn't seem like the only possible solution for the people that own the browser. Why not only allow a restricted subset of JS that lacks any form of IO? Or if that's impossible/risky, why not something like Starlark or Lua? I think this is based on a fundamental misreading of the problem. The privacy concern is that your data will leak, not merely that it's accessible to a third party. The cat binary can read my data, and I'm not at all concerned about that. So can my shell, and likewise on the concern. Privacy doesn't necessitate this solution. It is one of the possible solutions, but I think is hard to sell as the best solution to the problem. It is likely the easiest.
  - Qub3d 5y ago
    The safari change absolutely kneecapped content blockers. Ublock dropped it[0], and the remaining few providers, like AdGuard, have to do all sorts of trickery[1] to get even close to the same performance. If you're going to argue this is better, don't point us to such a clearly worse result. [0]:https://github.com/el1t/uBlock-Safari/issues/158 https://github.com/el1t/uBlock-Safari/issues/158 [1]:https://adguard.com/en/blog/safari-adblock-extensions.html https://adguard.com/en/blog/safari-adblock-extensions.html
dheera 5y ago
I see a lot of people suggesting Firefox, which is great. But also, considering Chrome is basically Chromium, can't we just fork Chromium and keep using that?
- fabrice_d 5y ago
  Brave said they will keep the v2 capability in their Chromium fork "as long as it's possible" (paraphrasing, I can't find the exact tweet to quote).
  - Eelongate 5y ago
    Does Brave have their own extension repository yet, or are they still leaving that all up to Google? I don't see much value in Brave supporting a feature dropped from Chrome if it only has Chrome extensions and they all drop support for it anyway.
    - asddubs 5y ago
      this kind of thing is why we need firefox, not chromium fork X.
      - ddalex 5y ago
        firefox said that they will move to V3 as an effort to maximize browser compatibility
        einr 5y ago
        Firefox has said they will implement V3, but "we will diverge from Chrome’s implementation where we think it matters and our values point to a different solution." Specifically, "we have decided to implement DNR and continue maintaining support for blocking webRequest. Our initial goal for implementing DNR is to provide compatibility with Chrome so developers do not have to support multiple code bases if they do not want to. With both APIs supported in Firefox, developers can choose the approach that works best for them and their users." https://blog.mozilla.org/addons/2021/05/27/manifest-v3-update/ https://blog.mozilla.org/addons/2021/05/27/manifest-v3-updat...
userbinator 5y ago
IMHO it's really about "those who give up freedom for security deserve neither", as that classic saying goes[1]. The excuse of "security" has been used throughout time to take away personal freedoms, and with Google (and some of the other authoritarian parts of the industry) pushing very hard in one direction especially within the past few years, it's about time we started pushing much harder in the other. Indeed, good enough is good enough. [1] I am well aware that was not the original context of the quote, but it's a nice rallying cry of the sentiment behind the movement.
ineedasername 5y ago
I think the fact that it will significantly limit privacy and ad blockers is sufficient reason for a high level of criticism, which I took as the main point. I didn't see dissecting the security details as the point they were trying to make. Instead it was to partially undermine the reasons Google said they were doing this. Basically "here's why it's bad for privacy, and here are why Google's stated reasons for the update are insufficient to justify that"
- gerash 5y ago
  "significantly limit privacy"? You either don't know what this change does or find it "significantly more private" when an extension developer has full read / write access to your web requests
  - ineedasername 5y ago
    I was referring to the much higher level of difficulty adblockers and the like will have in filling their intended purpose. It seems like this is the clear interpretation of what I wrote and that you may be purposely misconstruing my comment in order to level a soft insult and condescending language at me over an opinion you don't agree with. To give you a little benefit of the doubt though and assume you may just be passionate about the issue and don't intend to be insulting I will address your other point: Users giving away access to their web requests without realizing it is a problem. It is also one that can be addressed without making it much harder for privacy-minded users and the providers of those extensions to get what they want as well.
  - unionpivo 5y ago
    The only extensin I use (and a lot of people i know) is uBlockOrigin. After manifest v3 it will be worse off. Ublock origin provides a lot of privacy benefits, so people like me are 100% worse off. Well I switched to Firefox, only really use chrome for testing nowdays.
jacquesm 5y ago
Sure, just like AMP was to make the web faster. What Google says vs what's going on aren't necessarily the same thing, they have a long history of selling us the 'for your convenience' line while removing functionality that people depended on but that ultimately hurt Google's business interests: to be able to force feed you more ads. They have long outlived their credit in the bank of the benefit of the doubt.
rob74 5y ago
Yeah, for an article that claims in the title to be adressing Chrome users, it does a very poor job of actually telling these users what this "Manifest v3" thing is and why exactly it's a "raw deal" for them. Provided they even know what a "raw deal" is - for me it's a rarely-used US-specific expression, and I am only aware of it because of an R.E.M. song (https://genius.com/Rem-monty-got-a-raw-deal-lyrics https://genius.com/Rem-monty-got-a-raw-deal-lyrics).
raxxorrax 5y ago
The security improvement is negible compared to the danger of data extraction which ad blockers pretty effectively prevent in many cases. No, the security advantages just plainly aren't there and I think this is more driven by Google business interests. Installing random plugins is a security issue. But web tracking is by far the more significant threat.
rasz 5y ago
"extensions that pull in code remotely can no longer get past the review process" When Google says "pull in code remotely" they dont mean from a remote server. Instead its 'code remote to Google' aka code you wrote yourself sitting on your hard drive. This kills greasemonkey/tampermonkey and all the other UserScript extensions. Google saw how great Apple is doing and fell in love with the concept of walled garden. Its their browser and they wont let you execute any code that wasnt approved by them. User Agent no more, Its Google Agent now.
raxxorrax 5y ago
Review by Google is completely worthless for my security considerations. I need my software to work for me, so Chrome will not be part of that anymore. To say browser extensions pose a risk is true, but it hardly makes it in the top list of threats anymore. Malicious sites however still do and Google just restricted our ability to let third party tools provide essential services. Sure, these could be malicious, but that is generally not a wide spread IT problem of today. That should be also obvious to Chrome developers. Accidentally they also restrict ad blockers? Come on, you are getting played.

syrrim 5y ago

Beneficial in what sense? If manifest v3 is still bad on net, then including chrome's counter arguments makes for bad rhetoric and thus does a poor job of advancing a valiant goal.

kevingadd 5y ago

Anyone who pays attention to the web platform should know by now that any rationale Chrome (or Google in general) developers give for web platform decisions is made up. They repeatedly told us they had specific motives for AMP and it was all a lie, AMP was designed to tighten their grip on the advertising market. It's not the only example - the way their autoplay whitelist works is also transparently manipulative despite lies to the contrary - and I would bet money that MV3 is partially motivated by business incentives in the same way. Googlers' paychecks are signed by Ads and GCP and ad-blockers actively undermine the former.

yonixw 5y ago

Google has not provided any reason to not include "block request" functionality. And that the super bad faith underlying fact that poison their "reasoning".

jefftk 5y ago
There is still "block request" functionality, the change is that it's now declarative. This is the same way it works in Safari, and is (a) more efficient because you don't need to execute JS to evaluate each request and (b) more private because an ad/content blocker doesn't need to be given such broad permissions. There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and easily can be used to block Google ads. Docs: https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/ https://developer.chrome.com/docs/extensions/reference/decla... (Disclosure: I work on ads at Google, speaking only for myself)
- everforward 5y ago
  > (a) more efficient because you don't need to execute JS to evaluate each request This is true, but I think overly performance-focused. It doesn't feel like that much time, so I think there's a valid complaint that it doesn't make sense to kneecap flexibility for speed. > more private because an ad/content blocker doesn't need to be given such broad permissions Sure, but this doesn't seem like the only possible solution for the people that own the browser. Why not only allow a restricted subset of JS that lacks any form of IO? Or if that's impossible/risky, why not something like Starlark or Lua? I think this is based on a fundamental misreading of the problem. The privacy concern is that your data will leak, not merely that it's accessible to a third party. The cat binary can read my data, and I'm not at all concerned about that. So can my shell, and likewise on the concern. Privacy doesn't necessitate this solution. It is one of the possible solutions, but I think is hard to sell as the best solution to the problem. It is likely the easiest.
- Qub3d 5y ago
  The safari change absolutely kneecapped content blockers. Ublock dropped it[0], and the remaining few providers, like AdGuard, have to do all sorts of trickery[1] to get even close to the same performance. If you're going to argue this is better, don't point us to such a clearly worse result. [0]:https://github.com/el1t/uBlock-Safari/issues/158 https://github.com/el1t/uBlock-Safari/issues/158 [1]:https://adguard.com/en/blog/safari-adblock-extensions.html https://adguard.com/en/blog/safari-adblock-extensions.html

dheera 5y ago

I see a lot of people suggesting Firefox, which is great. But also, considering Chrome is basically Chromium, can't we just fork Chromium and keep using that?

fabrice_d 5y ago
Brave said they will keep the v2 capability in their Chromium fork "as long as it's possible" (paraphrasing, I can't find the exact tweet to quote).
- Eelongate 5y ago
  Does Brave have their own extension repository yet, or are they still leaving that all up to Google? I don't see much value in Brave supporting a feature dropped from Chrome if it only has Chrome extensions and they all drop support for it anyway.
  - asddubs 5y ago
    this kind of thing is why we need firefox, not chromium fork X.
    - ddalex 5y ago
      firefox said that they will move to V3 as an effort to maximize browser compatibility
      - einr 5y ago
        Firefox has said they will implement V3, but "we will diverge from Chrome’s implementation where we think it matters and our values point to a different solution." Specifically, "we have decided to implement DNR and continue maintaining support for blocking webRequest. Our initial goal for implementing DNR is to provide compatibility with Chrome so developers do not have to support multiple code bases if they do not want to. With both APIs supported in Firefox, developers can choose the approach that works best for them and their users." https://blog.mozilla.org/addons/2021/05/27/manifest-v3-update/ https://blog.mozilla.org/addons/2021/05/27/manifest-v3-updat...

userbinator 5y ago

IMHO it's really about "those who give up freedom for security deserve neither", as that classic saying goes[1]. The excuse of "security" has been used throughout time to take away personal freedoms, and with Google (and some of the other authoritarian parts of the industry) pushing very hard in one direction especially within the past few years, it's about time we started pushing much harder in the other. Indeed, good enough is good enough. [1] I am well aware that was not the original context of the quote, but it's a nice rallying cry of the sentiment behind the movement.

ineedasername 5y ago

I think the fact that it will significantly limit privacy and ad blockers is sufficient reason for a high level of criticism, which I took as the main point. I didn't see dissecting the security details as the point they were trying to make. Instead it was to partially undermine the reasons Google said they were doing this. Basically "here's why it's bad for privacy, and here are why Google's stated reasons for the update are insufficient to justify that"

gerash 5y ago
"significantly limit privacy"? You either don't know what this change does or find it "significantly more private" when an extension developer has full read / write access to your web requests
- ineedasername 5y ago
  I was referring to the much higher level of difficulty adblockers and the like will have in filling their intended purpose. It seems like this is the clear interpretation of what I wrote and that you may be purposely misconstruing my comment in order to level a soft insult and condescending language at me over an opinion you don't agree with. To give you a little benefit of the doubt though and assume you may just be passionate about the issue and don't intend to be insulting I will address your other point: Users giving away access to their web requests without realizing it is a problem. It is also one that can be addressed without making it much harder for privacy-minded users and the providers of those extensions to get what they want as well.
- unionpivo 5y ago
  The only extensin I use (and a lot of people i know) is uBlockOrigin. After manifest v3 it will be worse off. Ublock origin provides a lot of privacy benefits, so people like me are 100% worse off. Well I switched to Firefox, only really use chrome for testing nowdays.

jacquesm 5y ago

Sure, just like AMP was to make the web faster. What Google says vs what's going on aren't necessarily the same thing, they have a long history of selling us the 'for your convenience' line while removing functionality that people depended on but that ultimately hurt Google's business interests: to be able to force feed you more ads. They have long outlived their credit in the bank of the benefit of the doubt.

rob74 5y ago

Yeah, for an article that claims in the title to be adressing Chrome users, it does a very poor job of actually telling these users what this "Manifest v3" thing is and why exactly it's a "raw deal" for them. Provided they even know what a "raw deal" is - for me it's a rarely-used US-specific expression, and I am only aware of it because of an R.E.M. song (https://genius.com/Rem-monty-got-a-raw-deal-lyrics https://genius.com/Rem-monty-got-a-raw-deal-lyrics).

raxxorrax 5y ago

The security improvement is negible compared to the danger of data extraction which ad blockers pretty effectively prevent in many cases. No, the security advantages just plainly aren't there and I think this is more driven by Google business interests. Installing random plugins is a security issue. But web tracking is by far the more significant threat.

rasz 5y ago

"extensions that pull in code remotely can no longer get past the review process" When Google says "pull in code remotely" they dont mean from a remote server. Instead its 'code remote to Google' aka code you wrote yourself sitting on your hard drive. This kills greasemonkey/tampermonkey and all the other UserScript extensions. Google saw how great Apple is doing and fell in love with the concept of walled garden. Its their browser and they wont let you execute any code that wasnt approved by them. User Agent no more, Its Google Agent now.

raxxorrax 5y ago

Review by Google is completely worthless for my security considerations. I need my software to work for me, so Chrome will not be part of that anymore. To say browser extensions pose a risk is true, but it hardly makes it in the top list of threats anymore. Malicious sites however still do and Google just restricted our ability to let third party tools provide essential services. Sure, these could be malicious, but that is generally not a wide spread IT problem of today. That should be also obvious to Chrome developers. Accidentally they also restrict ad blockers? Come on, you are getting played.