5 ms·

A bit off topic but, but as a person who develops an extension and browser, another puzzle we need to solve is how to control and transparently log what these e

A bit off topic but, but as a person who develops an extension and browser, another puzzle we need to solve is how to control and transparently log what these extensions are doing with your data. Cookie, storage, exported DOM reads, fetch requests, etc should all be logged in clear text (maybe even pass handlers that pull reduced data) for the user to audit. It blows my mind what any developer can do with extension apis. "This site can access data on this site" warning is not enough.

themerone 4y ago
Malicious extensions will defeat the logging by injecting scripts into the dom.
matheusmoreira 4y ago
The truth is Manifest V3 is a step in the right direction in that regard. It forces extensions to declare what they want done so the browser can do it directly without exposing user data. This is the right choice for 99% of extensions out there. It's just that uBlock Origin is so important and trusted that it should be an exception. There should be no limits on uBlock Origin at all. It's so important that it should just be turned into an actual built-in browser feature, and the only reason it isn't is the massive conflicts of interests involved since all major browsers are backed by adtech profits.
- modzu 4y ago
  isn't that basically what brave did?
  - soulofmischief 4y ago
    And then some. Brave is a polarizing project.
    - WeylandYutani 4y ago
      I refuse anything or anyone involved with crypto.
      - soulofmischief 4y ago
        That's nice, ignorance is bliss after all.
  - alwayslikethis 4y ago
    They are also replacing some with their own ads to promote their tokens iirc. Sounds like a cool concept in theory, but at this point I'm done with internet ads. There will be no third party ads served to me on websites, period. uBlock Origin does this quite well, and having it on Android too is a blessing.
    - freitzkriesler2 4y ago
      'There will be no third party ads served to me on websites, period.' Amen to that. I refuse to be sold to in any form possible. Partly the reason I won't switch to IOS. I'm too married to kiwi browser and it's ability to support ublock.
      - roncesvalles 4y ago
        FYI you can use actual uBlock Origin on Android by using Firefox.
        freitzkriesler2 4y ago
        I have both Firefox and kiwi running. Ff works most of the time.
  - langsoul-com 4y ago
    Brave blocks ads, then introduces their own... There's a conflict of interest, especially as free services rely on ads to be free.
- amluto 4y ago
  Really? Last time I read the spec (which was a while ago), v3 disallowed unrestricted blocking, but it had no corresponding restrictions on sniffing requests and responses and maybe even on modifying requests. So it had no actual security benefit — it just nerfed ad blockers.
  - jimmydorry 4y ago
    The security benefit is preventing unrestricted ability for extensions to modify requests. So much malware is delivered via extension these days, and it's dead simple (and even a relatively common occurence) for a popular extension to get bought by unscrupolous actors that immediately commit changes that would be blocked by v3. GP said "step in the right direction", as this is indeed just a step and not an entire solution.
    - amluto 4y ago
      If a clever malicious extension can’t inject malware using non-blocking webRequest, I’ll eat my hat. For that matter, injecting malware using declarativeNetRequest doesn’t look particularly hard. I find it very hard to believe that the restriction on, specifically, blocking webRequest is genuinely motivated by security. If Chrome really wanted a minimal change here to improve security, they might have restricted webRequest to only permit blocking the request but not modifying it.
      - jimmydorry 4y ago
        If you prevent modifying completely, that would break large swatches of all extensions. I would imagine manifest will eventually move there, but moving straight to the end goal would have created a lot more outrage (rightly so). Again, since you seem to have ignored the main point of GP and my reply, this was the "first step" in the right direction.
- account42 4y ago
  > It's just that uBlock Origin is so important and trusted that it should be an exception. And what about new extensions that are not yet as popular but could reach the same level of importance and trust if it wasn't for restrictions like these making them impossible in the first place. What about extensions that serve a niche but are nevertheless trusted and important within that niche. I don't want my browser to dictate what extensions I choose to install can do anymore than I want my OS to dictate what programs I can install. I'm not even opposed to making a curated experience the default but there MUST be a way to opt out so that technically inclined people can retain their computing freedom.
forty 4y ago
Do you have the same requirements for normal standalone applications?
deleted 4y ago
[deleted]

themerone 4y ago

Malicious extensions will defeat the logging by injecting scripts into the dom.

matheusmoreira 4y ago

The truth is Manifest V3 is a step in the right direction in that regard. It forces extensions to declare what they want done so the browser can do it directly without exposing user data. This is the right choice for 99% of extensions out there. It's just that uBlock Origin is so important and trusted that it should be an exception. There should be no limits on uBlock Origin at all. It's so important that it should just be turned into an actual built-in browser feature, and the only reason it isn't is the massive conflicts of interests involved since all major browsers are backed by adtech profits.

modzu 4y ago
isn't that basically what brave did?
- soulofmischief 4y ago
  And then some. Brave is a polarizing project.
  - WeylandYutani 4y ago
    I refuse anything or anyone involved with crypto.
    - soulofmischief 4y ago
      That's nice, ignorance is bliss after all.
- alwayslikethis 4y ago
  They are also replacing some with their own ads to promote their tokens iirc. Sounds like a cool concept in theory, but at this point I'm done with internet ads. There will be no third party ads served to me on websites, period. uBlock Origin does this quite well, and having it on Android too is a blessing.
  - freitzkriesler2 4y ago
    'There will be no third party ads served to me on websites, period.' Amen to that. I refuse to be sold to in any form possible. Partly the reason I won't switch to IOS. I'm too married to kiwi browser and it's ability to support ublock.
    - roncesvalles 4y ago
      FYI you can use actual uBlock Origin on Android by using Firefox.
      - freitzkriesler2 4y ago
        I have both Firefox and kiwi running. Ff works most of the time.
- langsoul-com 4y ago
  Brave blocks ads, then introduces their own... There's a conflict of interest, especially as free services rely on ads to be free.
amluto 4y ago
Really? Last time I read the spec (which was a while ago), v3 disallowed unrestricted blocking, but it had no corresponding restrictions on sniffing requests and responses and maybe even on modifying requests. So it had no actual security benefit — it just nerfed ad blockers.
- jimmydorry 4y ago
  The security benefit is preventing unrestricted ability for extensions to modify requests. So much malware is delivered via extension these days, and it's dead simple (and even a relatively common occurence) for a popular extension to get bought by unscrupolous actors that immediately commit changes that would be blocked by v3. GP said "step in the right direction", as this is indeed just a step and not an entire solution.
  - amluto 4y ago
    If a clever malicious extension can’t inject malware using non-blocking webRequest, I’ll eat my hat. For that matter, injecting malware using declarativeNetRequest doesn’t look particularly hard. I find it very hard to believe that the restriction on, specifically, blocking webRequest is genuinely motivated by security. If Chrome really wanted a minimal change here to improve security, they might have restricted webRequest to only permit blocking the request but not modifying it.
    - jimmydorry 4y ago
      If you prevent modifying completely, that would break large swatches of all extensions. I would imagine manifest will eventually move there, but moving straight to the end goal would have created a lot more outrage (rightly so). Again, since you seem to have ignored the main point of GP and my reply, this was the "first step" in the right direction.
account42 4y ago
> It's just that uBlock Origin is so important and trusted that it should be an exception. And what about new extensions that are not yet as popular but could reach the same level of importance and trust if it wasn't for restrictions like these making them impossible in the first place. What about extensions that serve a niche but are nevertheless trusted and important within that niche. I don't want my browser to dictate what extensions I choose to install can do anymore than I want my OS to dictate what programs I can install. I'm not even opposed to making a curated experience the default but there MUST be a way to opt out so that technically inclined people can retain their computing freedom.

forty 4y ago

Do you have the same requirements for normal standalone applications?

deleted 4y ago

[deleted]