16 ms·

Manifest v3 in Firefox: Recap and Next Steps

206 points by TangerineDream 4y ago

nbp 4y ago
“[…] by virtue of the combined share of Chromium-based browsers, will be a de facto standard for browser […]” — i.e. The web is dead. Please consider switching to a non-Chromium-based browser if you want it back.
- shadowgovt 4y ago
  If "the web" in this case means "several incompatible standards I have to adopt to work on all likely users' browsers," I won't miss that web. If "the web" means "There are a few standards different implementations conform to, and if I adopt those standards I'm compatible with those implementations," I don't see it dead in the adoption of MV3.
- zamadatix 4y ago
  It's not really about whether it's Chromium based or not it's about what the fork does once it's disabled in Chromium.
- deleted 4y ago
  [deleted]
WalterGR 4y ago
Can anyone explain the “Manifest” in the name “Manifest v3”? Sure, extensions have manifests, but clearly the project is about much more. It seems like… an odd choice.
- lapcat 4y ago
  The manifest.json file of an extension has a key "manifest_version" which for many years had the value of 2. You set the value of "manifest_version" to 3 to signify to the browser that your extension adopts the new API. The name is very meaningful to extension developers. To others, perhaps not.
  - WalterGR 4y ago
    Sure. It's just odd synecdoche.
- anaisbetts 4y ago
  In this case, you can think of it as the API surface exposed to Chrome/FF extensions, or akin to the iOS version/Android API Level - it fundamentally affects what an extension can Do
wolpoli 4y ago
> Mozilla will maintain support for blocking WebRequest in MV3. Glad to hear that uBlock Origin will live on in Firefox.
- foepys 4y ago
  I have a slight hope that gorhill will just remove the Chrome extension which might get users back to Firefox. It's next to useless with Manifest v3 and has been quite constricted for a while now when being used in Chrome [1]. 1: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
  - agumonkey 4y ago
    I wonder what the stats are. A lot of people first action on a new setup is to install ublock.. it's almost a political tool.
  - donmcronald 4y ago
    > Ability to uncloak 3rd-party servers disguised as 1st-party through the use of CNAME record. I always thought that would be the evolution of ads, but didn't realize it was already fairly widespread. Maybe it's time for me to look at switching back to Firefox. I ditched them when they pushed so hard for DoH which looks a lot like ad delivery tech to me. I thought Microsoft would give users a good experience with Edge since they should be trying to gain market share, but that was totally wrong. It pushes Microsoft accounts and affiliated products super hard. Does anyone have a recommendation for a plain, un-Googled, Chromium browser on Windows. I'd prefer something digitally signed and without extra features like Brave, etc. have.
    - Gare 4y ago
      > I ditched them when they pushed so hard for DoH which looks a lot like ad delivery tech to me. It looks like privacy-enabling tech to me. I don't want my ISP to snoop which domains I visit or hijack DNS requests.
wolpoli 4y ago
Microsoft Edge will stop running Manifest v2 on January 2023 [1], or 6 months from now. [1]: https://docs.microsoft.com/en-us/microsoft-edge/extensions-chromium/developer-guide/manifest-v3 https://docs.microsoft.com/en-us/microsoft-edge/extensions-c...
- lapcat 4y ago
  As an extension developer, I see a catastrophe coming for extensions in Chromium browsers. I don't think users are going to be prepared for the slaughter. You're going to lose a ton of extensions, and many others will be hobbled by manifest v3. Firefox and Safari should be ok at least in the immediate future. I doubt Apple is going to announce next month at WWDC that v2 extensions will be dead in September 2022, even before Chrome kills them in 2023. v3 is not even ready yet. There are still major bugs and missing features, which Mozilla's blog post alludes to. I'm postponing the migration myself as long as possible.
  - wildrhythms 4y ago
    What's the uBlock Origin equivalent for Safari? Every time I think about switching to 'the better browser on my Mac' I find there is no such replacement.
    - lapcat 4y ago
      There's no equivalent for Safari. There are a number of Safari content blockers, but the API is strictly limited. It's somewhat similar to declarativeNetRequest in Chrome manifest v3.
      - nieve 4y ago
        I know this is probably driven by Apple's opposition to anything that looks like dynamic code execution in extensions, but it seems weird for a company that's not completely dependent on ads the way Google is.
        4y ago
rektide 4y ago
Murdering userscript extensions & dynamic code is such a sad thing to declare a win. There's so much FUD being used to scare the web into accepting so many sad new limits. I detest this technical fearocracy.
- Vinnl 4y ago
  What do you mean when referring to userscript extensions and dynamic code? The latter I think refers to being able to execute code that is fetched at runtime? That certainly makes things a lot easier for developers, but I don't quite see what limits that imposes for users?
  - rektide 4y ago
    There's a range of different ways to author & uses for dynamic code. In terms of use cases, downloaded on the fly code is definitely one example. Userscript engines like Greasemonkey, VioletMonkey, & TamperMonkey are all alao on the chopping block, which also allow user-edited code as well as downloaded code. There's also a huge range of uses for dynamic code in general. Data stores & engines will optimize performance by using the Function constructor[1]. Cant do that anymore: basic, sensible, multi-decade long optimizations are now off the table. Being able to use eval() to dynamically generate a complex expression- no longer allowed. It's bitterly ironic that Apple's prohibition against interpretters (a type of dynamic code) has held their platform back from allowing interesting things to run on iOS. Chrome's real rendering & js engines are blocked there. Because Apple says it's too unsafe to trust programs to do anything not statically defined, that only code that can all be fully read & understand is ok. Now here's Google & then Mozilla, bringing the exact same prohibitions against dynamic code to the web. At it's deepest heart. It's so ugly, so hypocritical, & so menacing & massive a threat to possibility, to extensions that can grow & develop. Long hope, but a deep one: I very much hope one day (far away) a semantic-web like world wide web might emerge, but if this sick knee-capping happens the browser will never be a viable place for user agency- which must be a dynamic & growable organic thingh never be tenable as a place where user agency can grow & flourish. Extensions are amazing, but if they're restricted to single-purpose little timmicks, unflexible static predefined capabilities, Google will have insured that the only thriving systems the world will get will be inside the data center. These restrictions mortally cripple user-agency, that which is most special & most dear about the web & what set it apart from conventional software applications. My open github issue[2] on this. [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... [2] https://github.com/w3c/webextensions/issues/139 https://github.com/w3c/webextensions/issues/139
pictur 4y ago
why are these manifest files a complete mess? I really don't understand how they manage to complicate something so simple
- djbusby 4y ago
  Maybe it's not actually simple?
- freediver 4y ago
  Different tech companies, that are also major browser manufacturers, have a radically different vision of what the web should be and how it should be consumed.
- wonderbore 4y ago
  The file itself is not the issue. It's just that Chrome uses it to introduce breaking changes. That is all. They could have dropped support for APIs at any time like they did before, but decided to group all of these changes together under a single umbrella.
freediver 4y ago
As a developer of a browser supporting WebExtensionsAPI, the move to v3 is going to add so much complexity. For developers, maintaining browser extensions across browsers with different support for WebExtensionsAPI is going to become a major PITA. Even right now one can not submit a new Chrome extension unless it is v3 so that means that extensions codebases have to be branched out for Firefox and Chrome which was not the case before. The hardest will be on the browser side of things. Supporting both v2 and v3 sides of an already extremely complex API (which is what we plan to do) will be causing a lot of issues. The situation is not good. The lack of standard and unity does not help the web.
- prox 4y ago
  The existence of a monopoly does not help the web.
- worble 4y ago
  The fact that Firefox is standing up to Google and their crippling of WebRequest is a good thing, for users at least. The alternative is not "unity", it's Google dictating standards that only ostensibly help them and their ad business.
  - sharken 4y ago
    But what are the options when Google gets to dictate how Chrome and Microsoft Edge behaves. That is 75% of the browser market, so Google could in theory define their standards and not care about other browsers. The Ad-friendliness of Googles implementation of Manifest V3 is a clear example of how Google uses their influence. Somehow the standards commission should have more to say about the process and implementations, i just don't see how. And it all started out so nice. https://www.w3.org/community/webextensions/2021/06/04/forming-the-wecg/ https://www.w3.org/community/webextensions/2021/06/04/formin...
    - chii 4y ago
      > And it all started out so nice. road to hell is paved with good intentions.
Confiks 4y ago
It would aid communication if Mozilla would denote the maintained support for blocking `WebRequest` in the version number. Unfortunately `manifest_version` is a number, not a string, but I guess naming it 4 would clarify things plenty by annoying the standards process just enough.
guelo 4y ago
Here they defend the decision to adopt WebExtensions even though they're now reduced to chasing Chrome's whims. But maybe all the disruption and pain can be justified because there has been a flood of cross-platform plugins that were previously unavailable in Firefox. I don't have any data but my sense is that there are a lot fewer extensions than their used to be. There is definitely less plugin innovation happening since, as with most Google APIs, it is less powerful, less transparent, more locked down. There is also the question of differentiation, what is Firefox's value if it is but another Chrome clone?
- sp332 4y ago
  It's a superset of Chrome's functionality. E.g. https://github.com/w3c/webextensions/issues/134 https://github.com/w3c/webextensions/issues/134. The Web Extension API in Firefox is generally a lot bigger than Chrome's, so there's plenty of differentiation and I wouldn't call it a clone.
zamubafoo 4y ago
Literally just figured out how to get my browsing history piped into Grafana+Loki so that I have a single source of truth regarding my browsing history using a userscript that ignores CORS and just POSTs to Loki's API. Apparently that's going away entirely now and there is no good way to stream browsing history anywhere if it's not tied to a browser maker's services (even if they are selfhosted a la Firefox Sync). You can't even read from the browsers history database because browsers for some reason lock the entire database even while running in WAL mode (my original plan was to do something similar to litestream and just attach to the places.sqlite or History files and push the url to Loki, but that just doesn't work). There are reasonable reasons to do this, but it really seems that it's just to curb user agency with their own data and devices.
- Yaina 4y ago
  Correct me if I'm wrong, but this should still work if you write your own extension, right?
  - zamubafoo 4y ago
    > [...] to improve the isolation of data between different origins, cross-origin requests are no longer possible from content scripts, unless the destination website opts in via CORS. If the server doesn't supply your target domain in the CORS header, the request should fail if my understanding is correct. If it is this would allow a website like YouTube to block SponsorBlock from loading it's data. There might be ways to bypass this but for me it's just a side project, so I haven't really looked too deep into it.
    - ianbicking 4y ago
      You just need to make the request from something that isn't a content script, like a background page
- _boffin_ 4y ago
  I’d love to hear more about your setup. I want to do that…
wolverine876 4y ago
> WebRequest ... provides a level of power and flexibility that is critical to enabling advanced privacy and content blocking features. Unfortunately, that power has also been used to harm users in a variety of ways. What are the risks to users? How does Mozilla mitigate them?
- TingPing 4y ago
  Extensions can inspect and control a lot of network data. You can't mitigate it, it's a permission to be given sparingly.
thayne 4y ago
> string-based code execution has been removed from extension APIs. So will it just be impossible to have extensions like ViolentMonkey, TamperMonkey, GreaseMonkey, Stylus, etc. in Firefox as well as chrome? That wouldn't be as big of a problem if the browser had it's own way to add user scripts, but it doesn't. And making your own extension for little scripts isn't really viable either. Especially since firefox at least requires the extension to be signed to install permanently, and getting it signed is not only a pain, but may be a privacy problem if your userscript has something sensitive in it. If you take away these extensions please at least give us a native way to add user scripts (and by all means put it behind a big scary warning that you shouldn't use untrusted scripts and you should only do it if you really know what you are doing).
- zzo38computer 4y ago
  Would a metacircular interpreter help, or does that not work? What if the entire document is replaced, is that possible? (Replacing the entire document might be necessary to fix some other things too, although I read the documentation for WebRequest, and it seems that security details cannot be modified, and that might make some things difficult, although adding a proxy with your own certificate might do.) Alternatively you could use developer edition if you want to write your own extensions, I think. Still, it is too bad that you will need all of this mess just to get the computer to work.
- franga2000 4y ago
  Stylus likely won't be affected, as CSS isn't actually "code execution" and can be fully reduced to "make a <style> element and inject it into the page". As for userscripts, those could be done in the same way, but this would reduce functionality and security.
- maxloh 4y ago
  Simeon Vincent (from the Chrome team) stated that they are planning to support extensions that inject user-written scripts or styles last year. https://github.com/Tampermonkey/tampermonkey/issues/644#issuecomment-858224952 https://github.com/Tampermonkey/tampermonkey/issues/644#issu...
perryizgr8 4y ago
If ublock origin stops working on Edge and Chrome I will switch to Firefox. Firefox is a horrible browser, but I don't see any choice at this point. Have you tried to browse the internet without ublock??
- BuckRogers 4y ago
  Brave is my 2nd choice to Edge and it's adblocking isn't dependent on manifest versions. I would consider a good adblocker alternative though like AdGuard. I love that one on iOS. They do a great job. I can't say I miss uBlock Origin there.
- julianbuse 4y ago
  What do you find so horrible about Firefox? Genuinely curious.
- franga2000 4y ago
  Is there anything actually wrong with Firefox besides just being kind of sluggish on heavy pages these days? All the web features that matter are available and have been for years...
  - BuckRogers 4y ago
    I used Firefox religiously for 19 years straight until last August. I moved to Edge. I never liked Chrome but did want its speed as you refer to there. If Edge loses uBlock Origin, I'll definitely try alternatives first.. but I wouldn't go back to FF. I did a review of all browsers last summer and came to liking Edge the most, then Brave as my second choice. Part of my ranking methodology was how big of a vendor was supporting each browser, as I've seen some value in that now that browsers are critical. That metric really hurt Vivaldi, Opera etc. Brave only came out on top because it's the only fully open-sourced browser other than Firefox. The built-in adblocking that's not dependent on outside support may win it a lot of new users soon though, including me.
    - franga2000 4y ago
throwaway0x7E6 4y ago
>Unfortunately, that power has also been used to harm users in a variety of ways it's all so tiresome the long term goal for Google, Apple and Microsoft is no extensions at all. it is painfully obvious about the vision these companies have for the future of personal computing. I know full well why does Mozilla do its competitors' bidding, but it does piss me off to no end to read their bullshit rationale for doing it. in 2032, we'll be reading about the removal of the address bar being a doubleplusgood thing. more security! less inequity!
- lapcat 4y ago
  > the long term goal for Google, Apple and Microsoft is no extensions at all. Apple added extensions to Safari iOS last year and added WebExtensions API to Safari Mac the previous year, so that's demonstrably untrue of Apple.
mdoms 4y ago
tentacleuno 4y ago
> Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest. We will continue to work with content blockers and other key consumers of this API to identify current and future alternatives where appropriate. Content blocking is one of the most important use cases for extensions, and we are committed to ensuring that Firefox users have access to the best privacy tools available. This is 100% the right thing to do: let extensions use the more powerful API, while also providing the more neutered version for extensions that may not need to use the legacy version, or are designed around Chrome instead of Firefox. There's been a fair bit of confusion regarding Mozilla and Manifest V3, but I'm glad this (somewhat) clears it up.
Raed667 4y ago
I think this is the key sentence in the article: > Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest. That means uBlock Origin will continue to work on Firefox !
srg0 4y ago
> Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest.

nbp 4y ago

“[…] by virtue of the combined share of Chromium-based browsers, will be a de facto standard for browser […]” — i.e. The web is dead. Please consider switching to a non-Chromium-based browser if you want it back.

shadowgovt 4y ago
If "the web" in this case means "several incompatible standards I have to adopt to work on all likely users' browsers," I won't miss that web. If "the web" means "There are a few standards different implementations conform to, and if I adopt those standards I'm compatible with those implementations," I don't see it dead in the adoption of MV3.
zamadatix 4y ago
It's not really about whether it's Chromium based or not it's about what the fork does once it's disabled in Chromium.
deleted 4y ago
[deleted]

WalterGR 4y ago

Can anyone explain the “Manifest” in the name “Manifest v3”? Sure, extensions have manifests, but clearly the project is about much more. It seems like… an odd choice.

lapcat 4y ago
The manifest.json file of an extension has a key "manifest_version" which for many years had the value of 2. You set the value of "manifest_version" to 3 to signify to the browser that your extension adopts the new API. The name is very meaningful to extension developers. To others, perhaps not.
- WalterGR 4y ago
  Sure. It's just odd synecdoche.
anaisbetts 4y ago
In this case, you can think of it as the API surface exposed to Chrome/FF extensions, or akin to the iOS version/Android API Level - it fundamentally affects what an extension can Do

wolpoli 4y ago

> Mozilla will maintain support for blocking WebRequest in MV3. Glad to hear that uBlock Origin will live on in Firefox.

foepys 4y ago
I have a slight hope that gorhill will just remove the Chrome extension which might get users back to Firefox. It's next to useless with Manifest v3 and has been quite constricted for a while now when being used in Chrome [1]. 1: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
- agumonkey 4y ago
  I wonder what the stats are. A lot of people first action on a new setup is to install ublock.. it's almost a political tool.
- donmcronald 4y ago
  > Ability to uncloak 3rd-party servers disguised as 1st-party through the use of CNAME record. I always thought that would be the evolution of ads, but didn't realize it was already fairly widespread. Maybe it's time for me to look at switching back to Firefox. I ditched them when they pushed so hard for DoH which looks a lot like ad delivery tech to me. I thought Microsoft would give users a good experience with Edge since they should be trying to gain market share, but that was totally wrong. It pushes Microsoft accounts and affiliated products super hard. Does anyone have a recommendation for a plain, un-Googled, Chromium browser on Windows. I'd prefer something digitally signed and without extra features like Brave, etc. have.
  - Gare 4y ago
    > I ditched them when they pushed so hard for DoH which looks a lot like ad delivery tech to me. It looks like privacy-enabling tech to me. I don't want my ISP to snoop which domains I visit or hijack DNS requests.

wolpoli 4y ago

Microsoft Edge will stop running Manifest v2 on January 2023 [1], or 6 months from now. [1]: https://docs.microsoft.com/en-us/microsoft-edge/extensions-chromium/developer-guide/manifest-v3 https://docs.microsoft.com/en-us/microsoft-edge/extensions-c...

lapcat 4y ago
As an extension developer, I see a catastrophe coming for extensions in Chromium browsers. I don't think users are going to be prepared for the slaughter. You're going to lose a ton of extensions, and many others will be hobbled by manifest v3. Firefox and Safari should be ok at least in the immediate future. I doubt Apple is going to announce next month at WWDC that v2 extensions will be dead in September 2022, even before Chrome kills them in 2023. v3 is not even ready yet. There are still major bugs and missing features, which Mozilla's blog post alludes to. I'm postponing the migration myself as long as possible.
- wildrhythms 4y ago
  What's the uBlock Origin equivalent for Safari? Every time I think about switching to 'the better browser on my Mac' I find there is no such replacement.
  - lapcat 4y ago
    There's no equivalent for Safari. There are a number of Safari content blockers, but the API is strictly limited. It's somewhat similar to declarativeNetRequest in Chrome manifest v3.
    - nieve 4y ago
      I know this is probably driven by Apple's opposition to anything that looks like dynamic code execution in extensions, but it seems weird for a company that's not completely dependent on ads the way Google is.
      - 4y ago

rektide 4y ago

Murdering userscript extensions & dynamic code is such a sad thing to declare a win. There's so much FUD being used to scare the web into accepting so many sad new limits. I detest this technical fearocracy.

Vinnl 4y ago
What do you mean when referring to userscript extensions and dynamic code? The latter I think refers to being able to execute code that is fetched at runtime? That certainly makes things a lot easier for developers, but I don't quite see what limits that imposes for users?
- rektide 4y ago
  There's a range of different ways to author & uses for dynamic code. In terms of use cases, downloaded on the fly code is definitely one example. Userscript engines like Greasemonkey, VioletMonkey, & TamperMonkey are all alao on the chopping block, which also allow user-edited code as well as downloaded code. There's also a huge range of uses for dynamic code in general. Data stores & engines will optimize performance by using the Function constructor[1]. Cant do that anymore: basic, sensible, multi-decade long optimizations are now off the table. Being able to use eval() to dynamically generate a complex expression- no longer allowed. It's bitterly ironic that Apple's prohibition against interpretters (a type of dynamic code) has held their platform back from allowing interesting things to run on iOS. Chrome's real rendering & js engines are blocked there. Because Apple says it's too unsafe to trust programs to do anything not statically defined, that only code that can all be fully read & understand is ok. Now here's Google & then Mozilla, bringing the exact same prohibitions against dynamic code to the web. At it's deepest heart. It's so ugly, so hypocritical, & so menacing & massive a threat to possibility, to extensions that can grow & develop. Long hope, but a deep one: I very much hope one day (far away) a semantic-web like world wide web might emerge, but if this sick knee-capping happens the browser will never be a viable place for user agency- which must be a dynamic & growable organic thingh never be tenable as a place where user agency can grow & flourish. Extensions are amazing, but if they're restricted to single-purpose little timmicks, unflexible static predefined capabilities, Google will have insured that the only thriving systems the world will get will be inside the data center. These restrictions mortally cripple user-agency, that which is most special & most dear about the web & what set it apart from conventional software applications. My open github issue[2] on this. [1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... [2] https://github.com/w3c/webextensions/issues/139 https://github.com/w3c/webextensions/issues/139

pictur 4y ago

why are these manifest files a complete mess? I really don't understand how they manage to complicate something so simple

djbusby 4y ago
Maybe it's not actually simple?
freediver 4y ago
Different tech companies, that are also major browser manufacturers, have a radically different vision of what the web should be and how it should be consumed.
wonderbore 4y ago
The file itself is not the issue. It's just that Chrome uses it to introduce breaking changes. That is all. They could have dropped support for APIs at any time like they did before, but decided to group all of these changes together under a single umbrella.

freediver 4y ago

As a developer of a browser supporting WebExtensionsAPI, the move to v3 is going to add so much complexity. For developers, maintaining browser extensions across browsers with different support for WebExtensionsAPI is going to become a major PITA. Even right now one can not submit a new Chrome extension unless it is v3 so that means that extensions codebases have to be branched out for Firefox and Chrome which was not the case before. The hardest will be on the browser side of things. Supporting both v2 and v3 sides of an already extremely complex API (which is what we plan to do) will be causing a lot of issues. The situation is not good. The lack of standard and unity does not help the web.

prox 4y ago
The existence of a monopoly does not help the web.
worble 4y ago
The fact that Firefox is standing up to Google and their crippling of WebRequest is a good thing, for users at least. The alternative is not "unity", it's Google dictating standards that only ostensibly help them and their ad business.
- sharken 4y ago
  But what are the options when Google gets to dictate how Chrome and Microsoft Edge behaves. That is 75% of the browser market, so Google could in theory define their standards and not care about other browsers. The Ad-friendliness of Googles implementation of Manifest V3 is a clear example of how Google uses their influence. Somehow the standards commission should have more to say about the process and implementations, i just don't see how. And it all started out so nice. https://www.w3.org/community/webextensions/2021/06/04/forming-the-wecg/ https://www.w3.org/community/webextensions/2021/06/04/formin...
  - chii 4y ago
    > And it all started out so nice. road to hell is paved with good intentions.

Confiks 4y ago

It would aid communication if Mozilla would denote the maintained support for blocking `WebRequest` in the version number. Unfortunately `manifest_version` is a number, not a string, but I guess naming it 4 would clarify things plenty by annoying the standards process just enough.

guelo 4y ago

Here they defend the decision to adopt WebExtensions even though they're now reduced to chasing Chrome's whims. But maybe all the disruption and pain can be justified because there has been a flood of cross-platform plugins that were previously unavailable in Firefox. I don't have any data but my sense is that there are a lot fewer extensions than their used to be. There is definitely less plugin innovation happening since, as with most Google APIs, it is less powerful, less transparent, more locked down. There is also the question of differentiation, what is Firefox's value if it is but another Chrome clone?

sp332 4y ago
It's a superset of Chrome's functionality. E.g. https://github.com/w3c/webextensions/issues/134 https://github.com/w3c/webextensions/issues/134. The Web Extension API in Firefox is generally a lot bigger than Chrome's, so there's plenty of differentiation and I wouldn't call it a clone.

zamubafoo 4y ago

Literally just figured out how to get my browsing history piped into Grafana+Loki so that I have a single source of truth regarding my browsing history using a userscript that ignores CORS and just POSTs to Loki's API. Apparently that's going away entirely now and there is no good way to stream browsing history anywhere if it's not tied to a browser maker's services (even if they are selfhosted a la Firefox Sync). You can't even read from the browsers history database because browsers for some reason lock the entire database even while running in WAL mode (my original plan was to do something similar to litestream and just attach to the places.sqlite or History files and push the url to Loki, but that just doesn't work). There are reasonable reasons to do this, but it really seems that it's just to curb user agency with their own data and devices.

Yaina 4y ago
Correct me if I'm wrong, but this should still work if you write your own extension, right?
- zamubafoo 4y ago
  > [...] to improve the isolation of data between different origins, cross-origin requests are no longer possible from content scripts, unless the destination website opts in via CORS. If the server doesn't supply your target domain in the CORS header, the request should fail if my understanding is correct. If it is this would allow a website like YouTube to block SponsorBlock from loading it's data. There might be ways to bypass this but for me it's just a side project, so I haven't really looked too deep into it.
  - ianbicking 4y ago
    You just need to make the request from something that isn't a content script, like a background page
_boffin_ 4y ago
I’d love to hear more about your setup. I want to do that…

wolverine876 4y ago

> WebRequest ... provides a level of power and flexibility that is critical to enabling advanced privacy and content blocking features. Unfortunately, that power has also been used to harm users in a variety of ways. What are the risks to users? How does Mozilla mitigate them?

TingPing 4y ago
Extensions can inspect and control a lot of network data. You can't mitigate it, it's a permission to be given sparingly.

thayne 4y ago

> string-based code execution has been removed from extension APIs. So will it just be impossible to have extensions like ViolentMonkey, TamperMonkey, GreaseMonkey, Stylus, etc. in Firefox as well as chrome? That wouldn't be as big of a problem if the browser had it's own way to add user scripts, but it doesn't. And making your own extension for little scripts isn't really viable either. Especially since firefox at least requires the extension to be signed to install permanently, and getting it signed is not only a pain, but may be a privacy problem if your userscript has something sensitive in it. If you take away these extensions please at least give us a native way to add user scripts (and by all means put it behind a big scary warning that you shouldn't use untrusted scripts and you should only do it if you really know what you are doing).

zzo38computer 4y ago
Would a metacircular interpreter help, or does that not work? What if the entire document is replaced, is that possible? (Replacing the entire document might be necessary to fix some other things too, although I read the documentation for WebRequest, and it seems that security details cannot be modified, and that might make some things difficult, although adding a proxy with your own certificate might do.) Alternatively you could use developer edition if you want to write your own extensions, I think. Still, it is too bad that you will need all of this mess just to get the computer to work.
franga2000 4y ago
Stylus likely won't be affected, as CSS isn't actually "code execution" and can be fully reduced to "make a <style> element and inject it into the page". As for userscripts, those could be done in the same way, but this would reduce functionality and security.
maxloh 4y ago
Simeon Vincent (from the Chrome team) stated that they are planning to support extensions that inject user-written scripts or styles last year. https://github.com/Tampermonkey/tampermonkey/issues/644#issuecomment-858224952 https://github.com/Tampermonkey/tampermonkey/issues/644#issu...

perryizgr8 4y ago

If ublock origin stops working on Edge and Chrome I will switch to Firefox. Firefox is a horrible browser, but I don't see any choice at this point. Have you tried to browse the internet without ublock??

BuckRogers 4y ago
Brave is my 2nd choice to Edge and it's adblocking isn't dependent on manifest versions. I would consider a good adblocker alternative though like AdGuard. I love that one on iOS. They do a great job. I can't say I miss uBlock Origin there.
julianbuse 4y ago
What do you find so horrible about Firefox? Genuinely curious.
franga2000 4y ago
Is there anything actually wrong with Firefox besides just being kind of sluggish on heavy pages these days? All the web features that matter are available and have been for years...
- BuckRogers 4y ago
  I used Firefox religiously for 19 years straight until last August. I moved to Edge. I never liked Chrome but did want its speed as you refer to there. If Edge loses uBlock Origin, I'll definitely try alternatives first.. but I wouldn't go back to FF. I did a review of all browsers last summer and came to liking Edge the most, then Brave as my second choice. Part of my ranking methodology was how big of a vendor was supporting each browser, as I've seen some value in that now that browsers are critical. That metric really hurt Vivaldi, Opera etc. Brave only came out on top because it's the only fully open-sourced browser other than Firefox. The built-in adblocking that's not dependent on outside support may win it a lot of new users soon though, including me.
  - franga2000 4y ago

throwaway0x7E6 4y ago

>Unfortunately, that power has also been used to harm users in a variety of ways it's all so tiresome the long term goal for Google, Apple and Microsoft is no extensions at all. it is painfully obvious about the vision these companies have for the future of personal computing. I know full well why does Mozilla do its competitors' bidding, but it does piss me off to no end to read their bullshit rationale for doing it. in 2032, we'll be reading about the removal of the address bar being a doubleplusgood thing. more security! less inequity!

lapcat 4y ago
> the long term goal for Google, Apple and Microsoft is no extensions at all. Apple added extensions to Safari iOS last year and added WebExtensions API to Safari Mac the previous year, so that's demonstrably untrue of Apple.

mdoms 4y ago

tentacleuno 4y ago

> Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest. We will continue to work with content blockers and other key consumers of this API to identify current and future alternatives where appropriate. Content blocking is one of the most important use cases for extensions, and we are committed to ensuring that Firefox users have access to the best privacy tools available. This is 100% the right thing to do: let extensions use the more powerful API, while also providing the more neutered version for extensions that may not need to use the legacy version, or are designed around Chrome instead of Firefox. There's been a fair bit of confusion regarding Mozilla and Manifest V3, but I'm glad this (somewhat) clears it up.

Raed667 4y ago

I think this is the key sentence in the article: > Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest. That means uBlock Origin will continue to work on Firefox !

srg0 4y ago

> Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest.