17 ms·

As a proxy extension developer, this is absolutely maddening. We're forced to choose between auth-less open proxies (bad), or baking in a wacky authentication s

by yegor 4y ago

As a proxy extension developer, this is absolutely maddening. We're forced to choose between auth-less open proxies (bad), or baking in a wacky authentication scheme through a side channel (also bad). MV3 drops in 2.5 months, and will leave tens of millions of proxy extension users unable to use products they paid money for. This is all on top of the many other issues with MV3 that Google is pushing under the guise of "improving performance".

rasz 4y ago
V3 will improve performance of ads division.
- yegor 4y ago
  Where is EU when you need them with their anti-trust litigation. Google is pulling a 2000s Microsoft.
  - eastendguy 4y ago
    There is an easy alternative: Use Firefox
    - naikrovek 4y ago
      that doesn't fix the problem, though.
      - erklik 4y ago
        Doesn't it? Product A is bad, thus use Product B. That's how most of my problems with different products are solved.
        esperent 4y ago
        What if product B is also bad? And there's also a product C, D, E but when you check them out you realize they are essentially clones of product A?
        erklik 4y ago
        Firefox is a legitimate alternative, it works for >99% of the world's websites and is an actual alternative i.e. not a clone of Chrome. I've been using it for nearly the last 5 years full-time and have never needed to open Chrome. I am not sure how one can pretend otherwise, so no, I don't think just saying it's "bad" and ignoring it as an alternative is viable. Do some Google websites perform worse on Firefox? Sure, but the entire reason that's because people don't use Firefox enough i.e. some websites are worse on Firefox. You just go around and around. If the audience of HN is not able to make that sacrifice (not use some of the GOOG's website) then we deserve the monopoly of Chrome. Other than that, I also think we need a third alternative for Browsers. Ladybird is in the news these days, and if you're a dev and care about this issue, we should all be contributing to it. I agree about your clone comment ala Brave, and so on.
        esperent 4y ago
        > If the audience of HN is not able to make that sacrifice (not use some of the GOOG's website) then we deserve the monopoly of Chrome. The audience of HN is unlikely to make a difference here. Besides, we are not some political party who all need to vote in one way together. Each person individually here makes their own choices. Personally I think making my life harder with pointless sacrifices is not useful. I ask myself, am I making this sacrifice to make myself feel good, or because I actually think it can make a change? In this case, I don't think it would make any difference and it wouldn't make me feel good so there's no utility in using Firefox, for me. This subject - browser monopoly, and related things like OS or app store monopoly - needs to be tackled with regulation, not personal sacrifices.
        erklik 4y ago
        > The audience of HN is unlikely to make a difference here. The audience of HN and devs in large, are the ones who've contributed to the monopoly of Chrome. Us only testing and creating applications for Chrome led to this. I never said that people don't make their own choice. Of course they do. My point was that if we are going to complain about Chrome, then Firefox is a perfectly fine alternative and is currently the best way to change GOOG's ways is by voting with our feet. Would regulation be nice? Sure. I doubt it's coming though so for the moment, our only alternative to not living in a ad-infested hellscape is to use Firefox.
        fungi 4y ago
        no bc they are leveraging monopoly in search to advantage their other products and undermine competition. im a relatively happy firefox user, but at this point to say mozilla significantly mitigates googles monopoly is as plausible as when microsoft claimed that BeOS somehow mitigated theirs.
    - cute_boi 4y ago
      these days many website don't work in firefox. And the worst thing is you never know it was firefox that was causing problem. Last time I tried to login verizon it didn't work. Same with many website I can't remember on top of my head. I still can't leave firefox due to multi containers tho :(
      - jogu 4y ago
        I've found that many times when a site doesn't work in Firefox it's actually extensions causing issues rather than Firefox itself. That being said, there are still compatibility issues from time to time!
      - Smar 4y ago
        I've also seen sites that do not work in Chrome.
  - naikrovek 4y ago
    Google have been doing this for 10+ years and people are only now starting to see it, it seems. the Microsoft antitrust trial original verdict was reached in 1999 by the way (appeals kept it alive a bit longer, though, into 2001). you are probably referring to the 1990s Microsoft, I imagine.
- staticassertion 4y ago
  Doubtful. I suspect that Google Adsense ads will continue to be blocked post-V3.
  - rasz 4y ago
    Blocking is detectable. uB doesnt block, it shims its own version of js.
    - staticassertion 4y ago
      I'm not sure what you mean.
      - CodesInChaos 4y ago
        If you block third party javascript files (e.g. google analytics) other code required for the website to function correctly might fail, since it relies on that third party javascript. So uBlock doesn't block certain javascript files, and instead replaces them by its own version which contains dummy functions that avoid those errors.
        staticassertion 4y ago
        OK that doesn't have to do with blocking Google AdSense ads nor does it have to do with proxying so I'm kind of confused.
        flutas 4y ago
        >OK that doesn't have to do with blocking Google AdSense ads nor does it have to do with proxying so I'm kind of confused. When a website wants to load an ad, it uses javascript[0]. The website can call a function in the included javascript file and tell AdSense "hey load an ad". If you simply block the JS file the website can break due to trying to call functions that don't exist. uBlock (supposedly, I haven't verified this) instead of blocking the JS instead replaces it with it's own version. That version just basically says "yeah sure cool" whenever the website tries to display an ad, but doesn't actually do anything. [0]: https://support.google.com/adsense/answer/9274516 https://support.google.com/adsense/answer/9274516
iLoveOncall 4y ago
If there is one group of people I will never feel bad for, it's the VPN / proxy vendors. They've been doing false advertising for years on every channel, making consumers pay for absolutely useless products.
- _aizw 4y ago
  There are many legitimate use cases of VPN's. Also there are many VPN companies that don't do false advertising such as Windscribe, mullvad or iVPN.
  - iLoveOncall 4y ago
    > There are many legitimate use cases of VPN's Yes of course, but that probably represents less than 10% of the customers (I'm being extremely generous on purpose, it's probably 0.1%) of your usual NordVPN and co. > don't do false advertising such as Windscribe "Stop tracking and browse privately" and "block annoying advertisers from stalking you online" proves you wrong. VPNs don't stop trackers. > don't do false advertising such as Mullvad "Evade hackers and trackers". Sure. > don't do false advertising such as iVPN Hey looks good actually, they indeed don't claim to block trackers or anything else, just change your IP / geolocation.
    - _aizw 4y ago
      > Yes of course, but that probably represents less than 10% of the customers. Lol how did you come up with 10%? Did you just make it up? > VPNs don't stop trackers. Windscribe (and other VPN's) can block trackers. https://blog.windscribe.com/how-r-o-b-e-r-t-works-76d627446083/ https://blog.windscribe.com/how-r-o-b-e-r-t-works-76d6274460...
    - sebzim4500 4y ago
      A huge portion of VPN users do it to get around geo-blocking, which has not been falsely advertised.
    - TedDoesntTalk 4y ago
      > Hey looks good actually, they indeed don't claim to block trackers or anything else, just change your IP / geolocation Add FoxyProxy to that list of no false advertising, please
aftbit 4y ago
Have any of the Chromium forks committed to maintain MV2 into the future? Having functioning extensions while maintaining the other features that people like from the browser could help pull some marketshare from Google Chrome. Probably just dreaming though...
- Caspy7 4y ago
  None that I'm aware of but Firefox has committed to maintaining the more powerful MV2 content blocking APIs that Google is removing.
  - TedDoesntTalk 4y ago
    Brave has committed to MV2 but they will need their own store first because the chrome web store is kicking out MV2 extensions. So far, they don’t have their own store.
    - yoasif_ 4y ago
      They have explicitly not committed: https://twitter.com/BrendanEich/status/1534905779630661633 https://twitter.com/BrendanEich/status/1534905779630661633 > We could fork them back in at higher maintenance cost. No point in speculating — I don’t write checks of unknown amount and sign them, and Google looks likely to keep V2 support for a year (thanks be to “enterprise”).
- cyber_kinetist 4y ago
  Vivaldi has previously promised to find an alternative for v3, but they left it in vague words and haven’t announced an update for this yet. https://vivaldi.com/blog/chromium-ad-blockers-choice/ https://vivaldi.com/blog/chromium-ad-blockers-choice/
altdataseller 4y ago
Why will auth-less open proxies be bad?
- _aizw 4y ago
  VPN providers won't be able to verify if a user paid for the service.
  - TedDoesntTalk 4y ago
    Not just VPN providers or other paid services. Open proxies on the internet are bad for everyone.
    - _aizw 4y ago
      What are the other issues with open proxies?
      - TedDoesntTalk 4y ago
        They are usually hosted by malware installed on a vulnerable system. And if they are SOCKS proxies (vs http proxies), then they can send send spam using the IP address of the infected device.
      - miohtama 4y ago
        Cyberattacks use open proxies to amplify the attack/hide their source.
    - ajross 4y ago
      Authorization and access control are different problems. You can use ssh to create a auth-free SOCKS5 pipe, for example (lots of us do this every day), but that's not an "open proxy" because it's e.g. listening on ::1 or on the internal network interface, etc...
londons_explore 4y ago
Is there really nowhere else to store Auth information in a synchronous datastore? For example it looks like you could use a lambda function with the Auth info pre-bound...
- oefrha 4y ago
  One big thing about MV3 is that background script, persistent or not, is no more. You have a web worker that can start afresh at any point, outside your control. So variables assigned asynchronously outside your event handler (which must be registered synchronously at the top level) scope don’t work reliably.
progval 4y ago
Does your extension work on Firefox? If yes, have you considered explaining the situation to your users to encourage them to move to Firefox?
- lmm 4y ago
  Firefox has a much worse history than Chrome when it comes to breaking extensions.
  - _aizw 4y ago
    Like what? I can't imagine firefox has done anything worse then MV3.
    - roblabla 4y ago
      Oh, I don't know, maybe breaking literally all of their extension with the deprecation of XUL? I'm a happy firefox user, and I'm pretty sure it was the right choice IMO, as firefox is certainly much more stable and fast now than it was before. But it was certainly a very, very rough process and left some very popular extensions broken without alternatives for months and even years before the necessary APIs were added to webextensions to bring them back.
      - reciprocity 4y ago
        "Breaking all of their extensions with the depreciation of XUL" is one interpretation, another one is that it was needed (of course it was the correct choice!) and there wasn't going to be an easier approach than just ripping the band-aid off. It needed to be done, it's done, and now instead of discussing the larger picture, we're talking about XUL depreciation from Firefox which happened in 2018. So what's your point?
  - Caspy7 4y ago
    They also have a much longer history than Chrome. Kinda glad they disallowed the extensions that had near unfettered access to browser internals.
djfobbz 4y ago
I checked out both of your sites Windscribe.com and ControlD.com...I will be signing up as a paid customer! Thank you for you this.
- TedDoesntTalk 4y ago
  This also breaks proxy authentication in very popular extensions like FoxyProxy.
- yegor 4y ago
  Nice, thanks! If you have any question you can always email me at my HN username @ either domain.
quotemstr 4y ago
Could you run an auth-free proxy on localhost that in turn forwards traffic to a remote proxy that does require auth? You could have your intermediate proxy expose a local interface for configuration.
- olso 4y ago
  This is one of possible solutions, but requires a native app to be installed. Extension would no longer be standalone.
deleted 4y ago
[deleted]
samuelmelo 4y ago
samuelmelo 4y ago
samuelmelo 4y ago
samuelmelo 4y ago
fomine3 4y ago
Good old user:pass@ won't work?
dotproto 4y ago
A couple hours ago I added a comment to the bug to describe our current plans[1]. TL:DR; you'll be able to use webRequest.onAuthRequired in MV3. [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=1135492#c92 https://bugs.chromium.org/p/chromium/issues/detail?id=113549...

by yegor 4y ago

rasz 4y ago

V3 will improve performance of ads division.

yegor 4y ago
Where is EU when you need them with their anti-trust litigation. Google is pulling a 2000s Microsoft.
- eastendguy 4y ago
  There is an easy alternative: Use Firefox
  - naikrovek 4y ago
    that doesn't fix the problem, though.
    - erklik 4y ago
      Doesn't it? Product A is bad, thus use Product B. That's how most of my problems with different products are solved.
      - esperent 4y ago
        What if product B is also bad? And there's also a product C, D, E but when you check them out you realize they are essentially clones of product A?
        erklik 4y ago
        Firefox is a legitimate alternative, it works for >99% of the world's websites and is an actual alternative i.e. not a clone of Chrome. I've been using it for nearly the last 5 years full-time and have never needed to open Chrome. I am not sure how one can pretend otherwise, so no, I don't think just saying it's "bad" and ignoring it as an alternative is viable. Do some Google websites perform worse on Firefox? Sure, but the entire reason that's because people don't use Firefox enough i.e. some websites are worse on Firefox. You just go around and around. If the audience of HN is not able to make that sacrifice (not use some of the GOOG's website) then we deserve the monopoly of Chrome. Other than that, I also think we need a third alternative for Browsers. Ladybird is in the news these days, and if you're a dev and care about this issue, we should all be contributing to it. I agree about your clone comment ala Brave, and so on.
        esperent 4y ago
        > If the audience of HN is not able to make that sacrifice (not use some of the GOOG's website) then we deserve the monopoly of Chrome. The audience of HN is unlikely to make a difference here. Besides, we are not some political party who all need to vote in one way together. Each person individually here makes their own choices. Personally I think making my life harder with pointless sacrifices is not useful. I ask myself, am I making this sacrifice to make myself feel good, or because I actually think it can make a change? In this case, I don't think it would make any difference and it wouldn't make me feel good so there's no utility in using Firefox, for me. This subject - browser monopoly, and related things like OS or app store monopoly - needs to be tackled with regulation, not personal sacrifices.
        erklik 4y ago
        > The audience of HN is unlikely to make a difference here. The audience of HN and devs in large, are the ones who've contributed to the monopoly of Chrome. Us only testing and creating applications for Chrome led to this. I never said that people don't make their own choice. Of course they do. My point was that if we are going to complain about Chrome, then Firefox is a perfectly fine alternative and is currently the best way to change GOOG's ways is by voting with our feet. Would regulation be nice? Sure. I doubt it's coming though so for the moment, our only alternative to not living in a ad-infested hellscape is to use Firefox.
      - fungi 4y ago
        no bc they are leveraging monopoly in search to advantage their other products and undermine competition. im a relatively happy firefox user, but at this point to say mozilla significantly mitigates googles monopoly is as plausible as when microsoft claimed that BeOS somehow mitigated theirs.
  - cute_boi 4y ago
    these days many website don't work in firefox. And the worst thing is you never know it was firefox that was causing problem. Last time I tried to login verizon it didn't work. Same with many website I can't remember on top of my head. I still can't leave firefox due to multi containers tho :(
    - jogu 4y ago
      I've found that many times when a site doesn't work in Firefox it's actually extensions causing issues rather than Firefox itself. That being said, there are still compatibility issues from time to time!
    - Smar 4y ago
      I've also seen sites that do not work in Chrome.
- naikrovek 4y ago
  Google have been doing this for 10+ years and people are only now starting to see it, it seems. the Microsoft antitrust trial original verdict was reached in 1999 by the way (appeals kept it alive a bit longer, though, into 2001). you are probably referring to the 1990s Microsoft, I imagine.
staticassertion 4y ago
Doubtful. I suspect that Google Adsense ads will continue to be blocked post-V3.
- rasz 4y ago
  Blocking is detectable. uB doesnt block, it shims its own version of js.
  - staticassertion 4y ago
    I'm not sure what you mean.
    - CodesInChaos 4y ago
      If you block third party javascript files (e.g. google analytics) other code required for the website to function correctly might fail, since it relies on that third party javascript. So uBlock doesn't block certain javascript files, and instead replaces them by its own version which contains dummy functions that avoid those errors.
      - staticassertion 4y ago
        OK that doesn't have to do with blocking Google AdSense ads nor does it have to do with proxying so I'm kind of confused.
        flutas 4y ago
        >OK that doesn't have to do with blocking Google AdSense ads nor does it have to do with proxying so I'm kind of confused. When a website wants to load an ad, it uses javascript[0]. The website can call a function in the included javascript file and tell AdSense "hey load an ad". If you simply block the JS file the website can break due to trying to call functions that don't exist. uBlock (supposedly, I haven't verified this) instead of blocking the JS instead replaces it with it's own version. That version just basically says "yeah sure cool" whenever the website tries to display an ad, but doesn't actually do anything. [0]: https://support.google.com/adsense/answer/9274516 https://support.google.com/adsense/answer/9274516

iLoveOncall 4y ago

If there is one group of people I will never feel bad for, it's the VPN / proxy vendors. They've been doing false advertising for years on every channel, making consumers pay for absolutely useless products.

_aizw 4y ago
There are many legitimate use cases of VPN's. Also there are many VPN companies that don't do false advertising such as Windscribe, mullvad or iVPN.
- iLoveOncall 4y ago
  > There are many legitimate use cases of VPN's Yes of course, but that probably represents less than 10% of the customers (I'm being extremely generous on purpose, it's probably 0.1%) of your usual NordVPN and co. > don't do false advertising such as Windscribe "Stop tracking and browse privately" and "block annoying advertisers from stalking you online" proves you wrong. VPNs don't stop trackers. > don't do false advertising such as Mullvad "Evade hackers and trackers". Sure. > don't do false advertising such as iVPN Hey looks good actually, they indeed don't claim to block trackers or anything else, just change your IP / geolocation.
  - _aizw 4y ago
    > Yes of course, but that probably represents less than 10% of the customers. Lol how did you come up with 10%? Did you just make it up? > VPNs don't stop trackers. Windscribe (and other VPN's) can block trackers. https://blog.windscribe.com/how-r-o-b-e-r-t-works-76d627446083/ https://blog.windscribe.com/how-r-o-b-e-r-t-works-76d6274460...
  - sebzim4500 4y ago
    A huge portion of VPN users do it to get around geo-blocking, which has not been falsely advertised.
  - TedDoesntTalk 4y ago
    > Hey looks good actually, they indeed don't claim to block trackers or anything else, just change your IP / geolocation Add FoxyProxy to that list of no false advertising, please

aftbit 4y ago

Have any of the Chromium forks committed to maintain MV2 into the future? Having functioning extensions while maintaining the other features that people like from the browser could help pull some marketshare from Google Chrome. Probably just dreaming though...

Caspy7 4y ago
None that I'm aware of but Firefox has committed to maintaining the more powerful MV2 content blocking APIs that Google is removing.
- TedDoesntTalk 4y ago
  Brave has committed to MV2 but they will need their own store first because the chrome web store is kicking out MV2 extensions. So far, they don’t have their own store.
  - yoasif_ 4y ago
    They have explicitly not committed: https://twitter.com/BrendanEich/status/1534905779630661633 https://twitter.com/BrendanEich/status/1534905779630661633 > We could fork them back in at higher maintenance cost. No point in speculating — I don’t write checks of unknown amount and sign them, and Google looks likely to keep V2 support for a year (thanks be to “enterprise”).
cyber_kinetist 4y ago
Vivaldi has previously promised to find an alternative for v3, but they left it in vague words and haven’t announced an update for this yet. https://vivaldi.com/blog/chromium-ad-blockers-choice/ https://vivaldi.com/blog/chromium-ad-blockers-choice/

altdataseller 4y ago

Why will auth-less open proxies be bad?

_aizw 4y ago
VPN providers won't be able to verify if a user paid for the service.
- TedDoesntTalk 4y ago
  Not just VPN providers or other paid services. Open proxies on the internet are bad for everyone.
  - _aizw 4y ago
    What are the other issues with open proxies?
    - TedDoesntTalk 4y ago
      They are usually hosted by malware installed on a vulnerable system. And if they are SOCKS proxies (vs http proxies), then they can send send spam using the IP address of the infected device.
    - miohtama 4y ago
      Cyberattacks use open proxies to amplify the attack/hide their source.
  - ajross 4y ago
    Authorization and access control are different problems. You can use ssh to create a auth-free SOCKS5 pipe, for example (lots of us do this every day), but that's not an "open proxy" because it's e.g. listening on ::1 or on the internal network interface, etc...

londons_explore 4y ago

Is there really nowhere else to store Auth information in a synchronous datastore? For example it looks like you could use a lambda function with the Auth info pre-bound...

oefrha 4y ago
One big thing about MV3 is that background script, persistent or not, is no more. You have a web worker that can start afresh at any point, outside your control. So variables assigned asynchronously outside your event handler (which must be registered synchronously at the top level) scope don’t work reliably.

progval 4y ago

Does your extension work on Firefox? If yes, have you considered explaining the situation to your users to encourage them to move to Firefox?

lmm 4y ago
Firefox has a much worse history than Chrome when it comes to breaking extensions.
- _aizw 4y ago
  Like what? I can't imagine firefox has done anything worse then MV3.
  - roblabla 4y ago
    Oh, I don't know, maybe breaking literally all of their extension with the deprecation of XUL? I'm a happy firefox user, and I'm pretty sure it was the right choice IMO, as firefox is certainly much more stable and fast now than it was before. But it was certainly a very, very rough process and left some very popular extensions broken without alternatives for months and even years before the necessary APIs were added to webextensions to bring them back.
    - reciprocity 4y ago
      "Breaking all of their extensions with the depreciation of XUL" is one interpretation, another one is that it was needed (of course it was the correct choice!) and there wasn't going to be an easier approach than just ripping the band-aid off. It needed to be done, it's done, and now instead of discussing the larger picture, we're talking about XUL depreciation from Firefox which happened in 2018. So what's your point?
- Caspy7 4y ago
  They also have a much longer history than Chrome. Kinda glad they disallowed the extensions that had near unfettered access to browser internals.

djfobbz 4y ago

I checked out both of your sites Windscribe.com and ControlD.com...I will be signing up as a paid customer! Thank you for you this.

TedDoesntTalk 4y ago
This also breaks proxy authentication in very popular extensions like FoxyProxy.
yegor 4y ago
Nice, thanks! If you have any question you can always email me at my HN username @ either domain.

quotemstr 4y ago

Could you run an auth-free proxy on localhost that in turn forwards traffic to a remote proxy that does require auth? You could have your intermediate proxy expose a local interface for configuration.

olso 4y ago
This is one of possible solutions, but requires a native app to be installed. Extension would no longer be standalone.

deleted 4y ago

[deleted]

samuelmelo 4y ago

fomine3 4y ago

Good old user:pass@ won't work?

dotproto 4y ago

A couple hours ago I added a comment to the bug to describe our current plans[1]. TL:DR; you'll be able to use webRequest.onAuthRequired in MV3. [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=1135492#c92 https://bugs.chromium.org/p/chromium/issues/detail?id=113549...