4 ms·

> This change will give Chrome users increased ads

jrockway 4y ago
MV3 comes from a legitimate concern for user security. Every time I visit my Mom she has some Chrome extension that steals all her traffic and reads every page and reports back to some shady company. It's a huge problem for ordinary users, it's just that ad blockers legitimately do the same thing as far as the browser is concerned, so it's a hard balance to strike. If you do nothing, random people lose key personal information. If you do something, HN complains about how it's a conspiracy to make them see more ads. As always, it's probably a little from column A and a little from column B, but mostly column A with the "unfortunate" side effect of column B. Google has had years to remove ad blockers from the extension marketplace, for example, and they'd need to write a lot less code relative to MV3. Not building uBlock Origin into Chrome was the mistake they made here. Once there is a known-good ad-blocker built in, nobody cares about extensions anymore. (Except for the steal-your-data extensions, whose authors are definitely amongst us on HN.)
- Siira 4y ago
  We can’t pay the price of your old relative X’s laziness. They don’t care about their privacy, their data gets stolen. Their choice, their tradeoff.
- linkgoron 4y ago
  Google could disable extensions completely and your claim would still be true. It's clear that MV3 does not come from a legitimate concern for user security, because Google could solve security issues without destroying a large part of the extension ecosystem. It might also solve issues with security, but Google's complete refusal to work with the community to find common ground shows what they're really after.
- x0x0 4y ago
  It's likely not a sincere concern for user security, or eg google could grant ublock origin and a handful of others permanent mv2 access. And nobody else. Or require stringent whitelisting. etc. There's no rules here except the ones google chooses to impose.
  - staticassertion 4y ago
    > or eg google could grant ublock origin and a handful of others permanent mv2 access You make this sound easy. It isn't.
- lapcat 4y ago
  > Every time I visit my Mom she has some Chrome extension that steals all her traffic and reads every page and reports back to some shady company. Manifest V3 doesn't stop this. Also, Google reviews every extension and update on the Chrome Web Store. The API is irrelevant when Google is asleep at the wheel.
  - laundermaf 4y ago
    > Google reviews every extension and update on the Chrome Web Store Absolutely not true. No one has the manpower to actually review/understand all the code that is being pushed to the store. Extensions are automatically approved after a few minutes. Mozilla tries but it's more of a spot check after the extension is being published.
    - lapcat 4y ago
      > Extensions are automatically approved after a few minutes. This is not true in my experience. In fact I've experienced reviews lasting days or weeks with the Chrome Web Store.
      - laundermaf 4y ago
        It depends on how new the extension is, probably. It does occasionally get stuck in review, but definitely not "every extension and update". Mozilla tried to do that and had to backtrack a few years ago.
        lapcat 4y ago
        Again, this is contrary to my years long experience with the Chrome Web Store.
    - chidg 4y ago
      I work for a company whose primary product is an extension. From my experience it's quite random; sometimes an update will pass 'review' a few hours after submission (never a few minutes, but it's clearly not being reviewed in any depth) and other times it will be held up for a few days, a week, or up to 15 days recently. It seems to be a lottery, where your chances of a manual review are increased by requiring certain permissions and other factors the chrome gods decide are risky. In our case they have rejected updates several times for spurious reasons, like claiming we do not use the notifications permission although we asked for it - even though use of the `.notifications` method on the chrome javascript api was visible in our code. I think GPs point stands - whether or not they actually review every update, they make the claim that extensions are reviewed, and they're reviewed often enough that they should be able to catch genuinely dangerous extensions.
- perryizgr8 4y ago
  These things should be optional. As a user, I'm confident enough that I can download software and run it without any major problems. Even if it turns out to be malicious, I know how to get rid of it. Most users are not like this. They really do benefit from a restricted experience. That's why app store and extension restrictions should exist. The problem is when engineers go all in on the restrictions, and completely abandon the other set of users. This is software, it can have an infinite number of knobs and customisations. It's not a table, which can only have a fixed number of legs.

MV3 comes from a legitimate concern for user security. Every time I visit my Mom she has some Chrome extension that steals all her traffic and reads every page and reports back to some shady company. It's a huge problem for ordinary users, it's just that ad blockers legitimately do the same thing as far as the browser is concerned, so it's a hard balance to strike. If you do nothing, random people lose key personal information. If you do something, HN complains about how it's a conspiracy to make them see more ads. As always, it's probably a little from column A and a little from column B, but mostly column A with the "unfortunate" side effect of column B. Google has had years to remove ad blockers from the extension marketplace, for example, and they'd need to write a lot less code relative to MV3. Not building uBlock Origin into Chrome was the mistake they made here. Once there is a known-good ad-blocker built in, nobody cares about extensions anymore. (Except for the steal-your-data extensions, whose authors are definitely amongst us on HN.)

Siira 4y ago
We can’t pay the price of your old relative X’s laziness. They don’t care about their privacy, their data gets stolen. Their choice, their tradeoff.
linkgoron 4y ago
Google could disable extensions completely and your claim would still be true. It's clear that MV3 does not come from a legitimate concern for user security, because Google could solve security issues without destroying a large part of the extension ecosystem. It might also solve issues with security, but Google's complete refusal to work with the community to find common ground shows what they're really after.
x0x0 4y ago
It's likely not a sincere concern for user security, or eg google could grant ublock origin and a handful of others permanent mv2 access. And nobody else. Or require stringent whitelisting. etc. There's no rules here except the ones google chooses to impose.
- staticassertion 4y ago
  > or eg google could grant ublock origin and a handful of others permanent mv2 access You make this sound easy. It isn't.
lapcat 4y ago
> Every time I visit my Mom she has some Chrome extension that steals all her traffic and reads every page and reports back to some shady company. Manifest V3 doesn't stop this. Also, Google reviews every extension and update on the Chrome Web Store. The API is irrelevant when Google is asleep at the wheel.
- laundermaf 4y ago
  > Google reviews every extension and update on the Chrome Web Store Absolutely not true. No one has the manpower to actually review/understand all the code that is being pushed to the store. Extensions are automatically approved after a few minutes. Mozilla tries but it's more of a spot check after the extension is being published.
  - lapcat 4y ago
    > Extensions are automatically approved after a few minutes. This is not true in my experience. In fact I've experienced reviews lasting days or weeks with the Chrome Web Store.
    - laundermaf 4y ago
      It depends on how new the extension is, probably. It does occasionally get stuck in review, but definitely not "every extension and update". Mozilla tried to do that and had to backtrack a few years ago.
      - lapcat 4y ago
        Again, this is contrary to my years long experience with the Chrome Web Store.
  - chidg 4y ago
    I work for a company whose primary product is an extension. From my experience it's quite random; sometimes an update will pass 'review' a few hours after submission (never a few minutes, but it's clearly not being reviewed in any depth) and other times it will be held up for a few days, a week, or up to 15 days recently. It seems to be a lottery, where your chances of a manual review are increased by requiring certain permissions and other factors the chrome gods decide are risky. In our case they have rejected updates several times for spurious reasons, like claiming we do not use the notifications permission although we asked for it - even though use of the `.notifications` method on the chrome javascript api was visible in our code. I think GPs point stands - whether or not they actually review every update, they make the claim that extensions are reviewed, and they're reviewed often enough that they should be able to catch genuinely dangerous extensions.
perryizgr8 4y ago
These things should be optional. As a user, I'm confident enough that I can download software and run it without any major problems. Even if it turns out to be malicious, I know how to get rid of it. Most users are not like this. They really do benefit from a restricted experience. That's why app store and extension restrictions should exist. The problem is when engineers go all in on the restrictions, and completely abandon the other set of users. This is software, it can have an infinite number of knobs and customisations. It's not a table, which can only have a fixed number of legs.