5 ms·
Hqng on, MV3 still lets extensions read web traffic, right? It just can't block it.
by sebzim4500 3y ago
Hqng on, MV3 still lets extensions read web traffic, right? It just can't block it.
- minedwiz 3y agodeclarativeNetRequest (https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/ https://developer.chrome.com/docs/extensions/reference/decla...) involves loading a ruleset into the browser, which then does the blocking itself inside the network process.
- FiloSottile 3y agoFirefox's implementation of MV3 allows both async permission-less blocking (declarativeNetRequest API) and permissioned synchronous blocking (webRequest API). uBO Lite uses the former to provide an ad-blocker without read/write permissions. You can still write a unsandboxed extension with MV3 (and in Firefox it will still be able to intercept requests, while in Chrome it will not be on the network hot path) but the point is that you can also write a permission-less ad-blocker now, which is what I want.
- npace12 3y agoYou need the webRequest API (that uBO Full is using) from manifest v2 to be able to read the traffic. Without it, you can just block/allow based on rules. Chrome is deprecating it with v3, Firefox supposedly no.
- sebzim4500 3y agoUnless I'm misunderstanding the docs, the webRequest permission isn't going anywhere, just the webRequestBlocking one. So it doesn't sound like there has been any security win here.
- npace12 3y agoYeah, I think you're correct. The security win is that you can block without needing the permissions for webRequest which are "can read and modify everything you do"