14 ms·

uBlock Origin Lite: Description

373 points by bertman 4y ago

bertman 4y ago
I know there have been some threads about the mv3 uBO version recently, but this is a new, consise and imho good description by gorhill himself.
deleted 4y ago
[deleted]
kristofferR 4y ago
"Lite" is such a bad name, it's often a positive signifier that describes low resource usage/costs. It should have a more negative name, like uBlock Origin Reduced.
- zinekeller 4y ago
  It was indeed named "uBO Minus", but what do you expect from Google? Accept that name?
  - some_furry 4y ago
    Why not name it uBO Neutrino? It has the connotation of being "Lite" since they're low-mass particles. And it sounds vaguely like "neutered", which is what MV3 attempts to do to ad-blockers. (That being said, this description from gorhill looks great.)
  - postalrat 4y ago
    Why would they reject it? Is it offensive?
  - novok 4y ago
    I would call it "uBO Reduced". Reduced resources, reduced permissions, reduced capabilities, reduced effectiveness in actually blocking ads, trackers and content.
- FiloSottile 4y ago
  The page itself mentions how it consumes less resources, and requires less permissions.
- jjulius 4y ago
  >... it's often a positive signifier that describes low resource usage/costs Third sentence: >This means that uBOL itself does not consume CPU/memory resources while content blocking is ongoing -- uBOL's service worker process is required only when you interact with the popup panel or the option pages.
  - hombre_fatal 4y ago
    Sounds like a plus for manifest v3 then. Fewer resources, fewer permissions, to do most of the same task.
    - deathanatos 4y ago
      Adding support for a less-resource intensive API to filter is fine. The problem people have is the destruction of the more powerful APIs to permit the fine control that UBO requires, to do the job proper. There was no need for that, there was no trade-off¹ being made. ¹of technical concerns.
    - HWR_14 4y ago
      It's not doing the same task though. It's being assigned the same task and doing a worse job at it. Because a better solution is unavailable.
- MichaelCollins 4y ago
  I agree, uBlock Origin Minus was a better name. "Lite" is carrying water for Google.
  - flatiron 4y ago
    People in HN get a chuckle about the name. 99% of people would see it and just download something else that isn’t “minus” for some reason.
    - MichaelCollins 4y ago
      A chuckle? I don't see the humor in it.
- AdmiralAsshat 4y ago
  The problem is that something pejorative on the surface is only meaningful to an end-user that is intimately familiar with the limitations of ManifestV3. If you titled an adblocker "uBlock Crippled Edition", you might be protesting Google, but the unfamiliar end-user is just going to see it and think, "Well I certainly don't want a crippled adblocker! Let me just grab one of these numerous others from the appstore that claims it's 100% effective."
  - MichaelCollins 4y ago
    > The problem is that something pejorative on the surface is only meaningful to an end-user that is intimately familiar with the limitations of ManifestV3. You don't need to be "intimately familiar" with the limitations of ManifestV3, a casual understanding, from perhaps an explanatory note in the description of the extension, is sufficient to understand such a name.
    - melony 4y ago
      Your average user has no interest in Google politics, nor would they bother to read through the explanation. Most people install an adblock to block ads. The politics of internet browsers and privacy only matter to power users.
      - deleted 4y ago
        [deleted]
- deleted 4y ago
  [deleted]
vntok 4y ago
Can't wait for the Chromium team to land the new permissions GUI so that all that whining around how MV3 is the end of uBlock Origin can stop. Many here will look silly overnight when that happens. See here: https://bugs.chromium.org/p/chromium/issues/detail?id=1135492 https://bugs.chromium.org/p/chromium/issues/detail?id=113549... > We have always intended to provide support for this functionality in Manifest V3 (for both user-installed and force-installed extensions), and have been iterating on different possible approaches. Our tentative plan (which is not yet finalized) is that the Manifest V3 version of this capability will require extensions to request a new permission scoped to intercepting authentication requests, but will otherwise allow extensions to handle these requests in a similar manner to how they do in Manifest V2. > The permission string and end user facing warning string have not been finalized yet. Also, we have not yet finalized how this new permission will interact with other permission grants, but extensions that currently have the webRequest permission and broad host permissions will likely not require an additional grant for this permission.
- Semaphor 4y ago
  Isn’t that unrelated as it’s about the proxy issue and not the adblocking issue?
- mirashii 4y ago
  The MV3/UBO issues are not really at all related to this ticket or GUI. The thing people take issue with is the removal of a number of mechanisms for intercepting and blocking traffic that uBlock Origin uses. https://github.com/uBlockOrigin/uBlock-issues/issues/338 https://github.com/uBlockOrigin/uBlock-issues/issues/338 has a more detailed list of issues.
  - vntok 4y ago
    If you have a look at the bottom of the discussion in that link: > The redirect-rule= filter option is also not compatible with DNR redirect action due to differing matching algorithm. In uBO, redirect filters do not compete with block/allow filters, as the redirect directives are looked up only after a network request has been matched to a block filter, whichever that is. This works differently in the DNR matching algorithm, redirect rules compete with other block and allow rules. > The no-large-media-elements feature can't be implemented as this requires to inspect response headers on the fly. > There is no concept of exception modifier filters in DNR, i.e. csp=/removeparam= exceptions cannot be accurately translated to DNR rules. For a specific example, all the removeparam= filter exceptions from AdGuard URL Tracking Protection, meant to override the main $removeparam=utm_source filter, can't be converted to DNR. At best, those exception filters maybe could be less accurately be excepted using the excludedRequestDomains property of the main $removeparam=utm_source filter. These issues are all fixable by acting as proxy and inspecting/modifying/replacing requests on the fly (in sync/blocking mode).
aendruk 4y ago
What happened to the name “uBO Minus”?
- tech234a 4y ago
  https://github.com/gorhill/uBlock/commit/93e5133783301c0329b3ce8f9e6079badd06d62d https://github.com/gorhill/uBlock/commit/93e5133783301c0329b...
  - return_to_monke 4y ago
    Why was it controversial, tho?
    - enlyth 4y ago
      Quoting gorhill from a GitHub conversation: "Side note about the experimental uBO Minus MV3 extension: I did not pick the Minus part out of spite, it's to make clear that this is not uBO proper and I want to be sure there is no expectation that this will be the case. I picked Minus for the same reason that the Plus in Adblock Plus was to highlight that this was an improvement over the previous Adblock version. Now the fact that uBO Minus does not require broad read/modify data on all websites can be seen as an improvement over uBO proper by many people who are uncomfortable with granting such broad permissions to an extension. In that case, if you have a better qualifier than Minus, I welcome suggestions."
Ligma123 4y ago
Gorhill should have a statue somewhere for making the web browseable.
- morsch 4y ago
  He really should. I'd pitch in 50 EUR for that.
  - throwaway64643 4y ago
    Haha. This reminds me of a Redditor's story. Despite having no money to afford professional hardware, he still managed to take good astronomy photos using his phone. In one of his posts, his photos impressed a "kind stranger" so much that they gifted him one of the most expensive Reddit awards, whose value can buy him a third of his desired gear.
    - Firmwarrior 4y ago
      haha, oh man (For context: Reddit awards don't give the recipient anything except the ability to browse Reddit without any banner ads, and access to a special forum. If you make a big Reddit donation to someone, you're actually donating to Conde Nast, Spez, etc)
    - LegitShady 4y ago
      pretty sure the most expensive reddit award is worth $120, which isn't a down-payment on an equatorial drive. It might pay for 1/3 of an IR conversion on an existing DSLR camera, maybe. professional astronomy photos is an activity where the low end starts very expensive. Basic setups are in the thousands of dollars.
      - thayne 4y ago
        If you are imaging bright objects like planets or the moon, you don't need an equatorial drive. Especially if you are using a "fast" telescope.
- 4y ago
ck2 4y ago
Isn't the biggest problem with MV3 the 5000 rule limit? Or are there ways around that by compiling it into something internal? This is how adguard did it: https://adguard.com/en/blog/adguard-mv3.html https://adguard.com/en/blog/adguard-mv3.html I'd suggest stop trying to support chrome and let it die? It won't work on mobile anyway, only Firefox supports ublock origin on mobile?
- SquareWheel 4y ago
  The current limit is 30,000 rules, but they've talked about raising it further beyond that point.
  - hombre_fatal 4y ago
    Trivia: 1Blocker convinced apple to raise the limit from 50k to 150k per list for Safari content blockers.
    - novok 4y ago
      My question is why have limits
      - hombre_fatal 4y ago
        Unbounded lists rarely seems like a thoughtful way to start out. But there are probably some DX and UX improvements over unbounded lists. e.g. recompilation takes time, so you set up developers for better UX when their dynamic lists are shorter and separate from their static lists, and they can compile multiple lists at once. (A 50k rule list took seconds on my old Macbook Air). Also encourages breaking lists into logical sublists which is better UX (e.g. regional lists) Also might discourage append-only accumulation where there’s no real incentive to prune the list (i.e. see EasyList). Some limit can help here. Kind of like deciding on a queue size vs unbounded: makes sense to set a limit, see who hits it, and cross that bridge as needed. In Apples case, they 3x’d the limit after a real world product made a real world case. Just some thoughts having built my own Safari content blocker.
concinds 4y ago
A chance for the return of the Safari extension perhaps?
- viktorcode 4y ago
  MV3 version should be directly portable.
  - Nextgrid 4y ago
    You just need build infrastructure. As far as I know, you need XCode to generate the "app" that contains the extension (all extensions need to be provided by an "app" even if it doesn't have any logic in it), then code sign and upload to the App Store. There are open, third-party implementations of the code signing tools so it can be done without a Mac but it just requires effort.
    - phlyingpenguin 4y ago
      I did this earlier today. The background stuff (I forget the name of what crashed at present) crashes on a vanilla conversion. It did block some ads, but wasn't full-featured.
      - syntaxing 4y ago
        Any possibility to get a blog post about how to do this or a gist? I would love to learn how to do this but I sadly don’t know where to start.
        phlyingpenguin 4y ago
        Sorry, didn't see your reply. `xcrun safari-web-extension-converter <extracted chrome extension directory>` It'll create an xcode project and you can run the mac app from there. Safari will need the "Allow Unsigned Extensions" from the Develop menu set before it'll show up in the prefs page. No idea how it all works if you want it on iOS.
syntaxing 4y ago
If this works, is there any reason this won’t work as a content blocker for safari?
- viktorcode 4y ago
  I believe there's none.
- novok 4y ago
  It just won't work that well. Recently in the past few months I've been noticing more and more ads with safari style content blockers, while ublock style continue to work fine. I fear this style of 'adblock' will have similar issues.
  - webmobdev 4y ago
    Switch to Orion browser - https://browser.kagi.com/ https://browser.kagi.com/ - it's a Safari / webkit clone with built-in uBlock Origin.
    - FabHK 4y ago
      Thanks for the suggestion, I've been looking for something like that. Will give it a shot. brew install orion
    - novok 4y ago
      Yeah i use brave which does something similar.
      - webmobdev 4y ago
        Brave is a Chromium clone with their own built-in adblocker. Orion is a Safari / Webkit clone re-engineered to work with Ublock Origin (which is currently the best ad blocker). So on a mac or ios, Orion will be slightly better.
SquareWheel 4y ago
The ability to opt-sites in to cosmetic filtering seems like a big upgrade. I'm now looking forward to seeing this version used in practice.
mrieck 4y ago
How is everyone else's MV3 upgrade going? I have 3 extensions and each one has multiple feature-breaking changes that will take hundreds of hours to implement less than ideal work arounds. I guess I'll focus on SnipCSS (https://www.snipcss.com https://www.snipcss.com) because that's the only one I have paying customers. For people who do manage the upgrade, at least we can look forward to less competition in the Chrome Web Store?
- somehnacct3757 4y ago
  Took us about a quarter heads down to do the conversion which involved quite a bit of rewriting. We had been prepping and planning for the work pretty much since they first teased MV3 in 2018. Now we are figuring out the right way to flip the switch. You get stuck in the long review queue every time you flip manifest versions, cuz your permissions list has likely changed. Google's rollout has been the absolute worst; but hey, as you say, everyone who can't eat a bowl of shit and keep on smiling will simply disappear from the competitive landscape.
- gnicholas 4y ago
  Partly cloud with a chance of thunder. I have 2 extensions and we've gotten one in sight of the finish line (after months of work), and the other appears to be dependent upon some as-yet unfixed third-party code. We are really hoping Google doesn't force this through on their originally-announced timeline. This is the third massive Google-induced change that we've stomached in the last couple years. We spend more time keeping our head above water than we do adding new features...
- ehsankia 4y ago
  Yeah, I find it funny that most of the conversations were always focused on ad-blockers, but honestly it seems like for 99% of people who don't use the power user features, it'll be a no-op on that end. It's other extensions that are much more in trouble.
deleted 4y ago
[deleted]
staticassertion 4y ago
I guess the biggest issue I have with V3 is I don't really "get it". The idea was initially that extensions have too many privileges and that malware can leverage those privileges for harm. I'd love data here! This is such a good area to share information on, as someone in security I'd really value that. I'd like to see case studies on malware, or even broad things like "malware uses these permissions X% of the time". But back to the point, assuming that this is true, how does V3 help? Specifically, what can malware not do with V3 that it could do before? Given the data, how will this impact the threat landscape? I can think of some obvious things, like that you can't have dynamic scripts - cool, makes sense, I bet malware loves that and removing it seems like it'd be a huge win. But WebRequests? I'm sure malware was using it, I guess, but what in V3 makes the malware use case for it harder? It seems like we're getting something that can be used maliciously just like before, but it's somewhat weaker in ways that malware won't care about? Again, data here would be great. I'd love to see "X% of malware used it this way, we removed that way". Communication has seemingly been pretty bad around the motivations, which has led to a lot of people being pretty upset and confused about the changes. Google, please share the data and reasoning! edit: With regards to uBlock Lite specifically, I'm looking forward to seeing it evolve. I do like the idea of having a permissionless blocker that works decently and can then have the opt-in approach. I don't honestly consider it a massive security win though.
- BrianGragg 4y ago
  Maybe I'm out of touch but I think the 'malware' they are worried about are ad blockers.
  - staticassertion 4y ago
    I don't think so. That gets repeated a lot but I think people are just unaware of the fact that Google ads are particularly uninvasive and easy to block. If ad blockers are less capable that will only help Google's competitors, not Google. Another comment the other day confirmed that Google's ads continue to be blockable with V3. This could change - AdSense ads could start implementing bypasses. I think that's unlikely because Google would likely end up with a few lawsuits, questions about browser monopolies, and a congressional hearing. Certainly the EU would be on their asses. One day that may change, but I don't see this move as being part of any specific plans to improve AdSense revenue.
e40 4y ago
What I don't get from this is how uBOL (MV3) compares to uBO (MV2). Anyone?
- skyfalldev 4y ago
  Since MV3 adds quite a lot of limits on what uBO can do, you have to grant permission for each site to have cosmetic filtering.
  - nottorp 4y ago
    So we need to build something external to the browser that will detect uBlock Origin asking for permissions and automatically grant them :) Edit: doesn't this mean that any site you visit will get a chance to track you the first time, until you manage to click to grant permission?
    - forgotusername6 4y ago
      From the blog post on how adguard built their v3 extension the ads themselves are blocked but aren't removed from the page if the cosmetic filters aren't run
  - SquareWheel 4y ago
    That limitation has nothing to do with MV3. Adguard does not suffer from this problem. Making it opt-in is a specific design consideration that gorhill took with this version of uBlock to reduce its permission scope. I wish people were not so quick to share misinformation like this.
    - chlorion 4y ago
      The amount of misinformation in these comments is absolutely wild. For some reason people are just itching to spread FUD about this topic and Google in general. I don't understand where it comes from or why it happens but it's really annoying.
- zamalek 4y ago
dang 4y ago
Related: uBlock Origin Lite - https://news.ycombinator.com/item?id=32904591 https://news.ycombinator.com/item?id=32904591 - Sept 2022 (13 comments) Proxy Chrome extensions are not going to be usable in MV3 - https://news.ycombinator.com/item?id=32899846 https://news.ycombinator.com/item?id=32899846 - Sept 2022 (199 comments) “UBO Minus (MV3)” – An Experimental uBlock Origin Build for Manifest V3 - https://news.ycombinator.com/item?id=32754274 https://news.ycombinator.com/item?id=32754274 - Sept 2022 (255 comments)
bornfreddy 4y ago
I'm really really really hoping that the non-crippled version, which works in Firefox, doesn't die the way uMatrix did (loved it, still miss it). That said, huge thanks to gorhill and all the others working on this project!
- saxonww 4y ago
  Note: uMatrix is not dead, it's just no longer updated. It's still available from the Chrome web store and Firefox add-ons sites. I am using it in Firefox right now, it still works as well as it always has.
  - propogandist 4y ago
    it’s not dead and works well, but wont survive the Manifest V3 changeover. It’s the most important extension out there for the savvy web explorer
    - karottenreibe 4y ago
      So switch to Firefox and continue enjoying it after Mv3
      - propogandist 4y ago
        Firefox still seems to be quite bloated, although there has been improvements in performance. We need more competition vs a company that’s entirely reliant on Google’s $ to stay in business
nightpool 4y ago
I'm really happy that Gorhill has listened to feedback on the branding and explanation of this, and added back in the ability to "opt in" to extended permissions on individual sites. Thank you for your work, and I'm sorry if my comments in the preview HN thread came off as overly hostile, because given the original comments you made about MV3, I couldn't imagine this sort of outcome. I hope that you or someone else still works to release an MV3-compatible "Full site permissions" version of uBlock as well, since I think there are a lot of potential options for improvement by using declarativeNetRequestFeedback, and it's certainly more convenient to not have to opt-in. And I'm still worried that without an MV3-compatible version of full uBlock Origin, users are still going to assume that "MV3 means that ad blockers are broken".
- tyingq 4y ago
  "And I'm still worried that without an MV3-compatible version of full uBlock Origin, users are still going to assume that "MV3 means that ad blockers are broken" I mean, they are hobbled. If you think of it like a malware scanner, it's the equivalent of taking away all heuristics and relying solely on big lists of payload checksums or "bad words".
  - thayne 4y ago
    But even worse than that, because you have a limit on how big that list can be. Otoh, with full permissions it can still do things like hide ads that aren't blocked by the declaritive rules. But, to continue the analogy, that's like killing a process after it's doing malicious stuff instead of preventing it from running in the first place.
- gorhill 4y ago
  > I'm still worried that without an MV3-compatible version of full uBlock Origin, users are still going to assume that "MV3 means that ad blockers are broken". They currently are when compared to their MV2 counterpart. The AdGuard MV3 version which came out earlier this month[1] shows this. Though it does its best to deal with the technical challenges which comes with MV3, the end result is poor efficiency- and reliability-wise compared to its MV2 counterpart. This is easy for anyone to see: open the browser's own Task Manager (Esc-Shift works) and notice how the service worker associated to AdGuard MV3 is regularly (every few seconds) evicted and respawn. When it re-spawns, the process's CPU and memory usage peaks, with memory usage shooting up to between 100-200MB. This happens repeatedly every few seconds or whenever you navigate to a new webpage. CPU/memory efficiency has always been a primary feature of uBO, and I can't release an MV3 version suffering such efficiency setback (this on top of matching algorithm not being fully compatible with that of uBO). However I am willing to work on an MV3 version which does not suffer no CPU/memory efficiency issues, hence uBO Lite, which takes advantage of new possibilities in MV3 to be fully declarative, at the cost of sacrificing some capabilities. --- [1] https://news.ycombinator.com/item?id=32648131 https://news.ycombinator.com/item?id=32648131
joshxyz 4y ago
Gorhill is a god amongst developers and power users at this point. Great guy.
unethical_ban 4y ago
Why does MV3 matter? Fuck Chrome, for a moment. It sounds, to a layman, like an arbitrarily established API for web engines to expose to extension developers. In other words, it isn't HTML5 or HTTP4. Each browser chooses whether to use it. If it is such shit, why is Firefox doing it?
- foepys 4y ago
  Because Firefox needs extensions and considering their 5% market share if they make their own API they will soon have next to no extensions. Firefox has always extended the manifest API and will deliver more functionality than required by the spec to give extensions more flexibility.
ztcfegzgf 4y ago
i love the idea of uBlock Origin Lite. i am willing to trade some efficiency if i don't have to give it the "has access to everything i do in the browser" permissions.

373 points by bertman 4y ago

I know there have been some threads about the mv3 uBO version recently, but this is a new, consise and imho good description by gorhill himself.

deleted 4y ago

[deleted]

kristofferR 4y ago

"Lite" is such a bad name, it's often a positive signifier that describes low resource usage/costs. It should have a more negative name, like uBlock Origin Reduced.

zinekeller 4y ago
It was indeed named "uBO Minus", but what do you expect from Google? Accept that name?
- some_furry 4y ago
  Why not name it uBO Neutrino? It has the connotation of being "Lite" since they're low-mass particles. And it sounds vaguely like "neutered", which is what MV3 attempts to do to ad-blockers. (That being said, this description from gorhill looks great.)
- postalrat 4y ago
  Why would they reject it? Is it offensive?
- novok 4y ago
  I would call it "uBO Reduced". Reduced resources, reduced permissions, reduced capabilities, reduced effectiveness in actually blocking ads, trackers and content.
FiloSottile 4y ago
The page itself mentions how it consumes less resources, and requires less permissions.
jjulius 4y ago
>... it's often a positive signifier that describes low resource usage/costs Third sentence: >This means that uBOL itself does not consume CPU/memory resources while content blocking is ongoing -- uBOL's service worker process is required only when you interact with the popup panel or the option pages.
- hombre_fatal 4y ago
  Sounds like a plus for manifest v3 then. Fewer resources, fewer permissions, to do most of the same task.
  - deathanatos 4y ago
    Adding support for a less-resource intensive API to filter is fine. The problem people have is the destruction of the more powerful APIs to permit the fine control that UBO requires, to do the job proper. There was no need for that, there was no trade-off¹ being made. ¹of technical concerns.
  - HWR_14 4y ago
    It's not doing the same task though. It's being assigned the same task and doing a worse job at it. Because a better solution is unavailable.
MichaelCollins 4y ago
I agree, uBlock Origin Minus was a better name. "Lite" is carrying water for Google.
- flatiron 4y ago
  People in HN get a chuckle about the name. 99% of people would see it and just download something else that isn’t “minus” for some reason.
  - MichaelCollins 4y ago
    A chuckle? I don't see the humor in it.
AdmiralAsshat 4y ago
The problem is that something pejorative on the surface is only meaningful to an end-user that is intimately familiar with the limitations of ManifestV3. If you titled an adblocker "uBlock Crippled Edition", you might be protesting Google, but the unfamiliar end-user is just going to see it and think, "Well I certainly don't want a crippled adblocker! Let me just grab one of these numerous others from the appstore that claims it's 100% effective."
- MichaelCollins 4y ago
  > The problem is that something pejorative on the surface is only meaningful to an end-user that is intimately familiar with the limitations of ManifestV3. You don't need to be "intimately familiar" with the limitations of ManifestV3, a casual understanding, from perhaps an explanatory note in the description of the extension, is sufficient to understand such a name.
  - melony 4y ago
    Your average user has no interest in Google politics, nor would they bother to read through the explanation. Most people install an adblock to block ads. The politics of internet browsers and privacy only matter to power users.
    - deleted 4y ago
      [deleted]
deleted 4y ago
[deleted]

vntok 4y ago

Can't wait for the Chromium team to land the new permissions GUI so that all that whining around how MV3 is the end of uBlock Origin can stop. Many here will look silly overnight when that happens. See here: https://bugs.chromium.org/p/chromium/issues/detail?id=1135492 https://bugs.chromium.org/p/chromium/issues/detail?id=113549... > We have always intended to provide support for this functionality in Manifest V3 (for both user-installed and force-installed extensions), and have been iterating on different possible approaches. Our tentative plan (which is not yet finalized) is that the Manifest V3 version of this capability will require extensions to request a new permission scoped to intercepting authentication requests, but will otherwise allow extensions to handle these requests in a similar manner to how they do in Manifest V2. > The permission string and end user facing warning string have not been finalized yet. Also, we have not yet finalized how this new permission will interact with other permission grants, but extensions that currently have the webRequest permission and broad host permissions will likely not require an additional grant for this permission.

Semaphor 4y ago
Isn’t that unrelated as it’s about the proxy issue and not the adblocking issue?
mirashii 4y ago
The MV3/UBO issues are not really at all related to this ticket or GUI. The thing people take issue with is the removal of a number of mechanisms for intercepting and blocking traffic that uBlock Origin uses. https://github.com/uBlockOrigin/uBlock-issues/issues/338 https://github.com/uBlockOrigin/uBlock-issues/issues/338 has a more detailed list of issues.
- vntok 4y ago
  If you have a look at the bottom of the discussion in that link: > The redirect-rule= filter option is also not compatible with DNR redirect action due to differing matching algorithm. In uBO, redirect filters do not compete with block/allow filters, as the redirect directives are looked up only after a network request has been matched to a block filter, whichever that is. This works differently in the DNR matching algorithm, redirect rules compete with other block and allow rules. > The no-large-media-elements feature can't be implemented as this requires to inspect response headers on the fly. > There is no concept of exception modifier filters in DNR, i.e. csp=/removeparam= exceptions cannot be accurately translated to DNR rules. For a specific example, all the removeparam= filter exceptions from AdGuard URL Tracking Protection, meant to override the main $removeparam=utm_source filter, can't be converted to DNR. At best, those exception filters maybe could be less accurately be excepted using the excludedRequestDomains property of the main $removeparam=utm_source filter. These issues are all fixable by acting as proxy and inspecting/modifying/replacing requests on the fly (in sync/blocking mode).

aendruk 4y ago

What happened to the name “uBO Minus”?

tech234a 4y ago
https://github.com/gorhill/uBlock/commit/93e5133783301c0329b3ce8f9e6079badd06d62d https://github.com/gorhill/uBlock/commit/93e5133783301c0329b...
- return_to_monke 4y ago
  Why was it controversial, tho?
  - enlyth 4y ago
    Quoting gorhill from a GitHub conversation: "Side note about the experimental uBO Minus MV3 extension: I did not pick the Minus part out of spite, it's to make clear that this is not uBO proper and I want to be sure there is no expectation that this will be the case. I picked Minus for the same reason that the Plus in Adblock Plus was to highlight that this was an improvement over the previous Adblock version. Now the fact that uBO Minus does not require broad read/modify data on all websites can be seen as an improvement over uBO proper by many people who are uncomfortable with granting such broad permissions to an extension. In that case, if you have a better qualifier than Minus, I welcome suggestions."

Ligma123 4y ago

Gorhill should have a statue somewhere for making the web browseable.

morsch 4y ago
He really should. I'd pitch in 50 EUR for that.
- throwaway64643 4y ago
  Haha. This reminds me of a Redditor's story. Despite having no money to afford professional hardware, he still managed to take good astronomy photos using his phone. In one of his posts, his photos impressed a "kind stranger" so much that they gifted him one of the most expensive Reddit awards, whose value can buy him a third of his desired gear.
  - Firmwarrior 4y ago
    haha, oh man (For context: Reddit awards don't give the recipient anything except the ability to browse Reddit without any banner ads, and access to a special forum. If you make a big Reddit donation to someone, you're actually donating to Conde Nast, Spez, etc)
  - LegitShady 4y ago
    pretty sure the most expensive reddit award is worth $120, which isn't a down-payment on an equatorial drive. It might pay for 1/3 of an IR conversion on an existing DSLR camera, maybe. professional astronomy photos is an activity where the low end starts very expensive. Basic setups are in the thousands of dollars.
    - thayne 4y ago
      If you are imaging bright objects like planets or the moon, you don't need an equatorial drive. Especially if you are using a "fast" telescope.
4y ago

ck2 4y ago

Isn't the biggest problem with MV3 the 5000 rule limit? Or are there ways around that by compiling it into something internal? This is how adguard did it: https://adguard.com/en/blog/adguard-mv3.html https://adguard.com/en/blog/adguard-mv3.html I'd suggest stop trying to support chrome and let it die? It won't work on mobile anyway, only Firefox supports ublock origin on mobile?

SquareWheel 4y ago
The current limit is 30,000 rules, but they've talked about raising it further beyond that point.
- hombre_fatal 4y ago
  Trivia: 1Blocker convinced apple to raise the limit from 50k to 150k per list for Safari content blockers.
  - novok 4y ago
    My question is why have limits
    - hombre_fatal 4y ago
      Unbounded lists rarely seems like a thoughtful way to start out. But there are probably some DX and UX improvements over unbounded lists. e.g. recompilation takes time, so you set up developers for better UX when their dynamic lists are shorter and separate from their static lists, and they can compile multiple lists at once. (A 50k rule list took seconds on my old Macbook Air). Also encourages breaking lists into logical sublists which is better UX (e.g. regional lists) Also might discourage append-only accumulation where there’s no real incentive to prune the list (i.e. see EasyList). Some limit can help here. Kind of like deciding on a queue size vs unbounded: makes sense to set a limit, see who hits it, and cross that bridge as needed. In Apples case, they 3x’d the limit after a real world product made a real world case. Just some thoughts having built my own Safari content blocker.

concinds 4y ago

A chance for the return of the Safari extension perhaps?

viktorcode 4y ago
MV3 version should be directly portable.
- Nextgrid 4y ago
  You just need build infrastructure. As far as I know, you need XCode to generate the "app" that contains the extension (all extensions need to be provided by an "app" even if it doesn't have any logic in it), then code sign and upload to the App Store. There are open, third-party implementations of the code signing tools so it can be done without a Mac but it just requires effort.
  - phlyingpenguin 4y ago
    I did this earlier today. The background stuff (I forget the name of what crashed at present) crashes on a vanilla conversion. It did block some ads, but wasn't full-featured.
    - syntaxing 4y ago
      Any possibility to get a blog post about how to do this or a gist? I would love to learn how to do this but I sadly don’t know where to start.
      - phlyingpenguin 4y ago
        Sorry, didn't see your reply. `xcrun safari-web-extension-converter <extracted chrome extension directory>` It'll create an xcode project and you can run the mac app from there. Safari will need the "Allow Unsigned Extensions" from the Develop menu set before it'll show up in the prefs page. No idea how it all works if you want it on iOS.

syntaxing 4y ago

If this works, is there any reason this won’t work as a content blocker for safari?

viktorcode 4y ago
I believe there's none.
novok 4y ago
It just won't work that well. Recently in the past few months I've been noticing more and more ads with safari style content blockers, while ublock style continue to work fine. I fear this style of 'adblock' will have similar issues.
- webmobdev 4y ago
  Switch to Orion browser - https://browser.kagi.com/ https://browser.kagi.com/ - it's a Safari / webkit clone with built-in uBlock Origin.
  - FabHK 4y ago
    Thanks for the suggestion, I've been looking for something like that. Will give it a shot. brew install orion
  - novok 4y ago
    Yeah i use brave which does something similar.
    - webmobdev 4y ago
      Brave is a Chromium clone with their own built-in adblocker. Orion is a Safari / Webkit clone re-engineered to work with Ublock Origin (which is currently the best ad blocker). So on a mac or ios, Orion will be slightly better.

SquareWheel 4y ago

The ability to opt-sites in to cosmetic filtering seems like a big upgrade. I'm now looking forward to seeing this version used in practice.

mrieck 4y ago

How is everyone else's MV3 upgrade going? I have 3 extensions and each one has multiple feature-breaking changes that will take hundreds of hours to implement less than ideal work arounds. I guess I'll focus on SnipCSS (https://www.snipcss.com https://www.snipcss.com) because that's the only one I have paying customers. For people who do manage the upgrade, at least we can look forward to less competition in the Chrome Web Store?

somehnacct3757 4y ago
Took us about a quarter heads down to do the conversion which involved quite a bit of rewriting. We had been prepping and planning for the work pretty much since they first teased MV3 in 2018. Now we are figuring out the right way to flip the switch. You get stuck in the long review queue every time you flip manifest versions, cuz your permissions list has likely changed. Google's rollout has been the absolute worst; but hey, as you say, everyone who can't eat a bowl of shit and keep on smiling will simply disappear from the competitive landscape.
gnicholas 4y ago
Partly cloud with a chance of thunder. I have 2 extensions and we've gotten one in sight of the finish line (after months of work), and the other appears to be dependent upon some as-yet unfixed third-party code. We are really hoping Google doesn't force this through on their originally-announced timeline. This is the third massive Google-induced change that we've stomached in the last couple years. We spend more time keeping our head above water than we do adding new features...
ehsankia 4y ago
Yeah, I find it funny that most of the conversations were always focused on ad-blockers, but honestly it seems like for 99% of people who don't use the power user features, it'll be a no-op on that end. It's other extensions that are much more in trouble.

deleted 4y ago

[deleted]

staticassertion 4y ago

I guess the biggest issue I have with V3 is I don't really "get it". The idea was initially that extensions have too many privileges and that malware can leverage those privileges for harm. I'd love data here! This is such a good area to share information on, as someone in security I'd really value that. I'd like to see case studies on malware, or even broad things like "malware uses these permissions X% of the time". But back to the point, assuming that this is true, how does V3 help? Specifically, what can malware not do with V3 that it could do before? Given the data, how will this impact the threat landscape? I can think of some obvious things, like that you can't have dynamic scripts - cool, makes sense, I bet malware loves that and removing it seems like it'd be a huge win. But WebRequests? I'm sure malware was using it, I guess, but what in V3 makes the malware use case for it harder? It seems like we're getting something that can be used maliciously just like before, but it's somewhat weaker in ways that malware won't care about? Again, data here would be great. I'd love to see "X% of malware used it this way, we removed that way". Communication has seemingly been pretty bad around the motivations, which has led to a lot of people being pretty upset and confused about the changes. Google, please share the data and reasoning! edit: With regards to uBlock Lite specifically, I'm looking forward to seeing it evolve. I do like the idea of having a permissionless blocker that works decently and can then have the opt-in approach. I don't honestly consider it a massive security win though.

BrianGragg 4y ago
Maybe I'm out of touch but I think the 'malware' they are worried about are ad blockers.
- staticassertion 4y ago
  I don't think so. That gets repeated a lot but I think people are just unaware of the fact that Google ads are particularly uninvasive and easy to block. If ad blockers are less capable that will only help Google's competitors, not Google. Another comment the other day confirmed that Google's ads continue to be blockable with V3. This could change - AdSense ads could start implementing bypasses. I think that's unlikely because Google would likely end up with a few lawsuits, questions about browser monopolies, and a congressional hearing. Certainly the EU would be on their asses. One day that may change, but I don't see this move as being part of any specific plans to improve AdSense revenue.

e40 4y ago

What I don't get from this is how uBOL (MV3) compares to uBO (MV2). Anyone?

skyfalldev 4y ago
Since MV3 adds quite a lot of limits on what uBO can do, you have to grant permission for each site to have cosmetic filtering.
- nottorp 4y ago
  So we need to build something external to the browser that will detect uBlock Origin asking for permissions and automatically grant them :) Edit: doesn't this mean that any site you visit will get a chance to track you the first time, until you manage to click to grant permission?
  - forgotusername6 4y ago
    From the blog post on how adguard built their v3 extension the ads themselves are blocked but aren't removed from the page if the cosmetic filters aren't run
- SquareWheel 4y ago
  That limitation has nothing to do with MV3. Adguard does not suffer from this problem. Making it opt-in is a specific design consideration that gorhill took with this version of uBlock to reduce its permission scope. I wish people were not so quick to share misinformation like this.
  - chlorion 4y ago
    The amount of misinformation in these comments is absolutely wild. For some reason people are just itching to spread FUD about this topic and Google in general. I don't understand where it comes from or why it happens but it's really annoying.
zamalek 4y ago

dang 4y ago

Related: uBlock Origin Lite - https://news.ycombinator.com/item?id=32904591 https://news.ycombinator.com/item?id=32904591 - Sept 2022 (13 comments) Proxy Chrome extensions are not going to be usable in MV3 - https://news.ycombinator.com/item?id=32899846 https://news.ycombinator.com/item?id=32899846 - Sept 2022 (199 comments) “UBO Minus (MV3)” – An Experimental uBlock Origin Build for Manifest V3 - https://news.ycombinator.com/item?id=32754274 https://news.ycombinator.com/item?id=32754274 - Sept 2022 (255 comments)

bornfreddy 4y ago

I'm really really really hoping that the non-crippled version, which works in Firefox, doesn't die the way uMatrix did (loved it, still miss it). That said, huge thanks to gorhill and all the others working on this project!

saxonww 4y ago
Note: uMatrix is not dead, it's just no longer updated. It's still available from the Chrome web store and Firefox add-ons sites. I am using it in Firefox right now, it still works as well as it always has.
- propogandist 4y ago
  it’s not dead and works well, but wont survive the Manifest V3 changeover. It’s the most important extension out there for the savvy web explorer
  - karottenreibe 4y ago
    So switch to Firefox and continue enjoying it after Mv3
    - propogandist 4y ago
      Firefox still seems to be quite bloated, although there has been improvements in performance. We need more competition vs a company that’s entirely reliant on Google’s $ to stay in business

nightpool 4y ago

I'm really happy that Gorhill has listened to feedback on the branding and explanation of this, and added back in the ability to "opt in" to extended permissions on individual sites. Thank you for your work, and I'm sorry if my comments in the preview HN thread came off as overly hostile, because given the original comments you made about MV3, I couldn't imagine this sort of outcome. I hope that you or someone else still works to release an MV3-compatible "Full site permissions" version of uBlock as well, since I think there are a lot of potential options for improvement by using declarativeNetRequestFeedback, and it's certainly more convenient to not have to opt-in. And I'm still worried that without an MV3-compatible version of full uBlock Origin, users are still going to assume that "MV3 means that ad blockers are broken".

tyingq 4y ago
"And I'm still worried that without an MV3-compatible version of full uBlock Origin, users are still going to assume that "MV3 means that ad blockers are broken" I mean, they are hobbled. If you think of it like a malware scanner, it's the equivalent of taking away all heuristics and relying solely on big lists of payload checksums or "bad words".
- thayne 4y ago
  But even worse than that, because you have a limit on how big that list can be. Otoh, with full permissions it can still do things like hide ads that aren't blocked by the declaritive rules. But, to continue the analogy, that's like killing a process after it's doing malicious stuff instead of preventing it from running in the first place.
gorhill 4y ago
> I'm still worried that without an MV3-compatible version of full uBlock Origin, users are still going to assume that "MV3 means that ad blockers are broken". They currently are when compared to their MV2 counterpart. The AdGuard MV3 version which came out earlier this month[1] shows this. Though it does its best to deal with the technical challenges which comes with MV3, the end result is poor efficiency- and reliability-wise compared to its MV2 counterpart. This is easy for anyone to see: open the browser's own Task Manager (Esc-Shift works) and notice how the service worker associated to AdGuard MV3 is regularly (every few seconds) evicted and respawn. When it re-spawns, the process's CPU and memory usage peaks, with memory usage shooting up to between 100-200MB. This happens repeatedly every few seconds or whenever you navigate to a new webpage. CPU/memory efficiency has always been a primary feature of uBO, and I can't release an MV3 version suffering such efficiency setback (this on top of matching algorithm not being fully compatible with that of uBO). However I am willing to work on an MV3 version which does not suffer no CPU/memory efficiency issues, hence uBO Lite, which takes advantage of new possibilities in MV3 to be fully declarative, at the cost of sacrificing some capabilities. --- [1] https://news.ycombinator.com/item?id=32648131 https://news.ycombinator.com/item?id=32648131

joshxyz 4y ago

Gorhill is a god amongst developers and power users at this point. Great guy.

unethical_ban 4y ago

Why does MV3 matter? Fuck Chrome, for a moment. It sounds, to a layman, like an arbitrarily established API for web engines to expose to extension developers. In other words, it isn't HTML5 or HTTP4. Each browser chooses whether to use it. If it is such shit, why is Firefox doing it?

foepys 4y ago
Because Firefox needs extensions and considering their 5% market share if they make their own API they will soon have next to no extensions. Firefox has always extended the manifest API and will deliver more functionality than required by the spec to give extensions more flexibility.

ztcfegzgf 4y ago

i love the idea of uBlock Origin Lite. i am willing to trade some efficiency if i don't have to give it the "has access to everything i do in the browser" permissions.