3 ms·
That's not really true. Block lists can be updated via the store. The security hole is that the app might maliciously modify the content of the pages you are
by hgsgm 4y ago
That's not really true. Block lists can be updated via the store. The security hole is that the app might maliciously modify the content of the pages you are viewing. It doesn't need to make requests if can tell your page to send your requests to a different server.
The declarative API solves that by not allowing page modification outside of safety boundaries like deleting elements.
- tadfisher 4y agoAnother way to solve it would have been to define a "blocking" webRequestFilter function of the form "Request -> Bool", because ad blockers only care about preventing requests, not actually executing requests or modifying results.
- amluto 4y agoCome again? Here’s an example with declarativeNetRequest that modifies requests: https://stackoverflow.com/questions/3274144/can-i-modify-outgoing-request-headers-with-a-chrome-extension https://stackoverflow.com/questions/3274144/can-i-modify-out... Saying that manifest v3 is about security is really not credible. Maybe the changes look like security, but the details are simply not consistent with security being the primary goal.