21 ms·

Google resumes transition to Manifest V3 for Chrome extensions

171 points by ghostwords 3y ago

gary_0 3y ago
Anyone remember "DOS ain't done until Lotus won't run"? Now it's "Chrome ain't done until uBlock won't run". If it's not Manifest V3 that makes the Internet safe for advertising, it'll be a "browser integrity" token or some other kind of DRM-by-another-name. Google has made it clear with YouTube that the arms race is on, and sooner or later they'll go nuclear.
- ronsor 3y ago
  And they'll kill all of us, including themselves, in the process.
  - clouddrover 3y ago
    No. Use Firefox and you will survive. uBlock Origin works best in Firefox: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
    - anonymousab 3y ago
      The nuclear option will eventually be to just ban Google accounts for using any ad blocking. The question is whether that atmosphere would simply cause people to quit Google services vs. turn off Adblock altogether to continue using them. I would wager that the latter would be far more likely and common for the average person.
      - mcronce 3y ago
        I agree with your intuition on the latter being more likely. And Google won't care about the minority of power users they lose. They've been outwardly hostile toward power users with Android for years.
        shiroiuma 3y ago
        Apple is even worse...
        I_Am_Nous 3y ago
        True, but getting an iPhone to tinker with is kind of like buying a book to rearrange the words into your own story. They crafted a beautiful walled garden for you, and the walls are a feature - which is definitely not for everyone. That said, I have fond memories of installing Linux on my iPod Mini so I understand the joy of making devices do things they were never intended to do.
      - xur17 3y ago
        > The nuclear option will eventually be to just ban Google accounts for using any ad blocking. Or they just keep making it harder and harder to use alternative browsers that support ad blocking.
      - Tommstein 3y ago
        > The nuclear option will eventually be to just ban Google accounts for using any ad blocking. The collateral damage from that would probably lead to the mother and father of all class-action lawsuits, literal Acts of Congress, and EU fines that Google would have to get a second job in order to pay if they don't try to break them up outright.
      - maxloh 3y ago
        IMO both will happen. People are going to continue using other Google services, but quit YouTube.
      - dun44 3y ago
        That’s one reason why we need a YouTube archive that’s outside of Google’s control.
    - Analemma_ 3y ago
      Firefox only survives because Google props it up. I don’t think Google can stop completely without incurring antitrust wrath, but they could probably start attaching strings and conditions to the funding.
      - clouddrover 3y ago
        So you're saying the more users Firefox has, the stronger Mozilla's bargaining position. You make a good case to use Firefox.
        lcnPylGDnU4H9OF 3y ago
        Alternatively, the more users Firefox has, the more incentive Google has to twist Mozilla's arm. I doubt that ultimately defeats forks that are maintained by volunteers (https://librewolf.net/ https://librewolf.net/), and I don't want to discourage Firefox adoption, but it's not quite so cut-and-dry as "use Firefox". There will likely come a time that it's "use this community fork of old-Firefox-before-it-got-Googled". Still not a case against Firefox; just pointing out there's more to the picture.
        leotravis10 3y ago
        In other words, if Firefox becomes popular enough, there's a chance that Google will deliver a nail to Mozilla's coffin in pulling their search deal and other funding which is the backbone of their business in a financial level. Another example is that Mozilla has a LOT to lose if the DOJ wins in the US v. Google antitrust trial just for those deals.
        toyg 3y ago
        In the past, when FF was stronger, they took search deals with other engines (yahoo, bing). If their numbers go back up, it could be a viable strategy again. Maybe I'm old, but doing the right thing on the internet has always been harder than just going with the flow. Using Linux in 2000 was very hard, using Firefox in 2001 was no walk in the park - but one gotta do what one gotta do, if one has some principles.
    - saurik 3y ago
      > If it's not Manifest V3 that makes the Internet safe for advertising, it'll be a "browser integrity" token or some other kind of DRM-by-another-name. So, no: Firefox will NOT save you.
      - clouddrover 3y ago
        Not on its own it won't. It needs more people using it. It needs to support extensions like uBlock Origin, which it does. Chrome is built to serve Google's interests, which is exactly as you'd expect. Use Firefox for a web which better balances the competing interests of corporations and end users.
        gary_0 3y ago
        There are already plenty of banking sites and such that will turn you away for not having a standard-issue Chrome user agent header. Also, crank your browser's privacy settings too high, and any website with twitchy Cloudflare settings will give you the sisyphean "I'm not a bot" check box until you give up and go away (or come back with a Chrome that's hungry for cookies). So no, on our present course, Firefox will not save us. And even if every HN reader used it, that wouldn't even come close to pushing its usage share out of the single digits.
        clouddrover 3y ago
        > There are already plenty of banking sites and such that will turn you away for not having a standard-issue Chrome user agent header. Don't use that bank. > Also, crank your browser's privacy settings too high, and any website with twitchy Cloudflare settings will give you the sisyphean "I'm not a bot" check box Don't use that website. It's certainly true that you have no agency or self respect if you embrace a defeatist and submissive outlook. So don't do that.
        shiroiuma 3y ago
        >There are already plenty of banking sites and such that will turn you away for not having a standard-issue Chrome user agent header There are countless banks out there. I have bank accounts with several different institutions in two different countries and they all work fine with Firefox + uBO. If yours doesn't, why are you supporting them? >Also, crank your browser's privacy settings too high, and any website with twitchy Cloudflare settings will give you the sisyphean "I'm not a bot" check box until you give up and go away (or come back with a Chrome that's hungry for cookies). I haven't seen this. If a website is too much of a PITA to use, I just won't use it, and I suggest you do the same.
    - narinxas 3y ago
      firefox and being able to compile it on you machine may do the trick for a little while but policy decisions aren't like technical ones.... principles are at play at every layer above the strictly-technical discussion
      - clouddrover 3y ago
        Right. So make the principled choice and use Firefox now.
    - 1vuio0pswjnm7 3y ago
      But today Firefox, i.e., Mozilla, is wholly dependent, financially, on Google. One could argue that Google can "kill" Mozilla easier than it can "kill" uBlock.
  - narinxas 3y ago
    to them who find this comment exagerated (hyperbollic?) there are things that through symbolism come to signify life-or-death scenario across different contexts (i.e. life or dead of what-exactly?) these "ad-tech" wars aren't about technology as much as they (really) are about (the future?) of user freedom. freedom is the key word (symbol) which links this difficult real world contest into the nuclear leagues
  - PoignardAzur 3y ago
    I really don't like advertising, but it's a non-lethal nuisance.
- krackers 3y ago
  > This lets extensions modify network requests without intercepting them and viewing their content, thus providing more privacy. Doesn't uBlock currently block youtube ads by blocking requests based on XHR content? This will kill that.
  - moffkalast 3y ago
    For each 10 ft wall youtube builds uBlock will eventually find a 11 ft ladder.
    - krackers 3y ago
      Actually looking a bit more at how the xhr filtering is implemented, uBO seems to do it not at the webRequest level but instead by shimming the javascript fetch() method itself. So maybe this approach would still work in a MV3 world, I don't know what restrictions are imposed on content scripts.
      - maxloh 3y ago
        How does the actual code look like?
  - mortallywounded 3y ago
    No. People that care will simply stop using Chrome.
    - archerx 3y ago
      I already have firefox installed on all my machines slowly transitioning over. Chromes new UI updates are really pushing me over to firefox faster. Now when I set up nee computers for friends I install firefox for them, when they ask me why not chrome I tell them chrome is old news and not to be trusted which they happily accept and use firefox. Slowly the tide is turning.
      - lta 3y ago
- pjmlp 3y ago
  Everyone that has helped Chrome (alongside its Electron shell) take over the Web can now thank Google.
  - chii 3y ago
    Fork chrome, or switch to firefox.
    - pjmlp 3y ago
      Fork Chrome is usually easier said than done, as proven by the "success" of most FOSS forks, besides many key features aren't even in Chromium. I am mostly a Firefox user, at least until it stays around.
      - maxloh 3y ago
        Brave and Vivaldi is quite success IMO.
        pjmlp 3y ago
        Yet another two re-inforcing Chrome dominance on the Web.
        firecall 3y ago
        Brave is ~0.05% market share. It’s probably successful in that it’s a well known project within the tech community. And 0.05% of the global browser market is a lot of users and probably a decent business. (Are they profitable?) But outside of HN type audiences, no one has heard of it.
        maxloh 3y ago
        It seems that they became profitable, weirdly enough, by having users opt-in to their own ads... in their ad-blocking browser [0]. [0]: https://brave.com/2021-recap/ https://brave.com/2021-recap/
    - 3y ago
account-5 3y ago
I don't use chrome but if I did why is this a good or bad thing? Is this just a part of Google's push to force users to give up all their data under the pretense of security?
- jsnell 3y ago
  It's making content blocking extensions work the way they do in Safari. The benefit is security, as it allows for a massive reduction in the amount of extensions with unlimited powers to steal authentication cookies, MITM ostensibly secure connections, etc. The downside is a loss of flexibility in what ad blockers can do (though Safari ad blockers seem to get by well enough). It's unclear whether it's an improvement or reduction in power efficiency. In typical internet mob fashion Apple doing this is considered doubleplusgood, Google doing it is them being evil and trying to kill the Internet.
  - ceejayoz 3y ago
    > In typical internet mob fashion Apple doing this is considered doubleplusgood, Google doing it is them being evil and trying to kill the Internet. Apple has neither Chrome's market share nor Google's advertising network. Context matters.
    - jsnell 3y ago
      Thanks for the example, that's a great demonstration! The context is that an entity that does not give a crap about making ad blocking hard (Apple) believes that this is the best design for content blocking extensions. They have no ulterior motive, it's just obviously the right technical design.
      - lapcat 3y ago
        > They have no ulterior motive "Alphabet pays Apple 36% of Safari search revenue, Sundar Pichai confirms" https://www.cnbc.com/2023/11/14/google-pays-apple-36percent-of-safari-search-revenue-sundar-pichai.html https://www.cnbc.com/2023/11/14/google-pays-apple-36percent-... > it's just obviously the right technical design. Setting aside the question of motives, Safari engineers designed their content blocking system (1) without any actual experience in developing ad blocking extensions and (2) without consulting the developers who do have such experience. Moreover, ad blocking extension developers are practically unanimous in saying that Safari content blockers are inferior and not obviously the right technical design.
bloppe 3y ago
So, does this still cripple ad blocking? It's pretty hard to parse from the post. I don't really care anyway. Chrome is not the internet. Just use Firefox.
- cookies23 3y ago
  Not really. You can read AdGuard opinion on MV3 https://adguard.com/en/blog/chrome-manifest-v3-where-we-stand.html https://adguard.com/en/blog/chrome-manifest-v3-where-we-stan...
  - anonymousab 3y ago
    > Despite losing a small part of their functionality, ad blockers will still be able to offer nearly the same quality of filtering that they demonstrated with Manifest V2. If some mechanism or capability is no longer possible or is made infeasible for adblockers to control, then ads will simply switch to using that mechanism. It's a pretty obvious outcome. You cannot simply give just an inch with adtech.
    - e2le 3y ago
      I would be interested to see a list of capabilities and features lost in MV3. For example, do we lose CNAME filtering or strict-blocking? It's not clear what we are losing.
      - ghostwords 3y ago
        We lose the ability to innovate. The browser (Google) becomes the gatekeeper. And yes, we lose CNAME filtering.[1] https://github.com/w3c/webextensions/issues/151#issuecomment-1018778881 https://github.com/w3c/webextensions/issues/151#issuecomment... Google is an advertising company. Chrome extensions already experienced a lost decade, where nothing much happened until the Manifest V3 "proposal". It's not a good idea to let Google hold the keys to anti-tracking tech. [1] I stand corrected, DNS lookups are not part of webRequest in MV2 Chrome either. This doesn't change my larger point.
DiabloD3 3y ago
[flagged]
redder23 3y ago
You should not be using Chrome anyway but if you still do, its time to switch and advocate for different browsers. Brave has a uBlock Origin based adblocker build in, written in Rust. Firefox is the best browser for uBlock Origin.
- jnrk 3y ago
  Manifest V3 applies to all Chromium based browsers, including Brave.
  - redder23 3y ago
    Why make claims you have no clue about? As someone said above Brave is NOT affected, their adblocker is a the very core of the browser and a basic chromium extension.
  - Moldoteck 3y ago
    Couldn't they modify the fork in a way to not implement v3?
    - redder23 3y ago
      I am also wondering if there is or will be a Chromium fork that just keeps the old code and not enforces v3 but just support both v2 and v3 and then also default to accept some alternative extension store that also has v2 extensions.
  - antonok 3y ago
    Brave's adblocker is written in Rust [0] and compiled to native code; it's not affected by the Mv3 transition because it doesn't use extension APIs. Brave also publicly committed [1] to continuing support for Mv2 through patches. [0] https://github.com/brave/adblock-rust https://github.com/brave/adblock-rust [1] https://twitter.com/brave/status/1574822799700541446 https://twitter.com/brave/status/1574822799700541446
- deleted 3y ago
  [deleted]
red_admiral 3y ago
Some, but not all of the problem, can be mitigated by pointing your DNS to mullvad (the no-ads one; DNS doesn't need a subscription unlike the full VPN product). Ironically, this might be a market opportunity for MS to get a few users back to chrome's poor cousin Edge, if they allow proper extensions again.
- lcnPylGDnU4H9OF 3y ago
  > DNS doesn't need a subscription They also give detailed steps on how to configure the DNS settings for a given browser or device. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#how-to-use https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#...
tholman 3y ago
I've got maybe 4 extensions that are manifest V2 that just purely don't seem worth upgrading/fixing up (my largest with 5-10k installs) due to the time/5+ year old code that has been working fine on the old apis... Has chrome done some outreach to the popular extensions, or maybe just gone past a point where they're happy to kill off the old and move onto the new? Or is this purely about ublock etc?
- kuchenbecker 3y ago
  Not even about Ublock. Do you control your browser? Manifest V2 you can write a plugin to modify the page in pretty much any way. This is used by adblockers but philisophically important because this is no longer possible in V3 in the name of security. Instead chrome mitigated the adblock concern in-particular. But manifest v2 isn't actually disappearing, it's a chrome web store policy. You can still manually install the crx.
  - lapcat 3y ago
    > But manifest v2 isn't actually disappearing, it's a chrome web store policy. You can still manually install the crx. It is actually disappearing. Re-read the announcement. Google Chrome will be disabling MV2 extensions. It's not just a Web Store policy.
    - kuchenbecker 3y ago
      I may be wrong, but my read is they can be enabled and installed manually. Disabling them is not good though and removing from web store is a death sentence for commercial apps.
      - lapcat 3y ago
        > I may be wrong, but my read is they can be enabled and installed manually. You are wrong. Disabling them means that they won't work, end of story. Dead. Gone.
    - gnicholas 3y ago
PoignardAzur 3y ago
Title seems to be editorialized? That's against HN rules, IIUC.
- lapcat 3y ago
  It's not exactly the original title, but to me the edit seems both neutral and more informative than the original title.
siproprio 3y ago
so, adguard sold out?
- spartanatreyu 3y ago
  Every adblocker that contains the letters: "ad" has. Ublock Origin has been the best for almost a decade running and is most powerful when running on Firefox. Raymond "Gorhill" Hill is the BDFL of Ublock Origin and has never accepted any money from ad companies and has never added/removed any feature that weakens the adblocking.
jauntywundrkind 3y ago
How's the situation with debugging tools & userscripting extensions (grease monkey, violetmonkey, tamper monkey)? Outlawing dynamic code (use of eval for example) is a huge locking down of the system, one I have some sympathy for but also think deeply narrows the type of extensions that can be built, in a chilling way.
- ghostwords 3y ago
  There is a new userScripts API: https://github.com/Tampermonkey/tampermonkey/issues/644#issuecomment-1789533494 https://github.com/Tampermonkey/tampermonkey/issues/644#issu...
  - jauntywundrkind 3y ago
    Which evidently you need to be in some "developer mode" to have work?? I use this all the time just to improve websites I visit, change colors or adjust workflows to make them less jank. My work jira is reskinned with violet monkey. They're called userscripts. Making folks have to enter a dev mode to use them feels abominable. Also seems like this narrowly targets just userscripting cases, while ignoring any other use cases where we might want to have dynamic behavior. It still doesn't allow me to write an extension that lets me ship up code & run it. I get this is by design, to improve security, but it feels so much less like my user agent when I'm outlawed from running whole categories of code in the browser. My best hope is that many of the dynamic code practices are enforced chiefly by the web store. And that we can sideload whatever we want.
    - deleted 3y ago
      [deleted]
PoignardAzur 3y ago
> Improving content filtering support by providing more generous limits in the declarativeNetRequest API for static rulesets and dynamic rules Anyone here know more about this? From the article linked in that quote: > We determined that some filter rules, such as those with an action of block or allow, are much safer and are less likely to be abused. They also happen to make up the large majority of ad block filter rules. Based on this, I drafted and shared a proposal in the Web Extensions Community Group to define a set of rules that we consider lower risk and allow up to 30,000 of these. From what I remember of the discourse at the time Manifest v3 was first announced, the most major complaint from developers who were otherwise open to the idea of static filters was that the number of filters allowed was way too small for the modern web. Google's proposed changes seem to address that, maybe? I don't know how effective they are in practice.
- ghostwords 3y ago
  DNR is better than at launch, but still full of feature gaps. How do you match a redirect response? How do you robustly rewrite URLs based on query parameters?[1] The fundamental problem is that DNR is not an adequate replacement for webRequest. From something I wrote[2] a couple of years ago: > [R]emoving blocking webRequest won’t stop abusive extensions, but will harm privacy and security extensions. If Manifest V3 is merely a step on the way towards a more "safe" (i.e., limited) extensions experience, what will Manifest V4 look like? If the answer is fewer, less-powerful APIs in service of “safety”, users will ultimately suffer. The universe of possible extensions will be limited to what Google explicitly chooses to allow, and creative developers will find they lack the tools to innovate. Meanwhile, extensions that defend user privacy and safety against various threats on the Web will be stuck in the past, unable to adapt as the threats evolve. [1] https://github.com/w3c/webextensions/issues/302 https://github.com/w3c/webextensions/issues/302 [2] https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st...
  - ameshkov 3y ago
    For the most part I agree with your quote save for the “stuck in the past, unable to adapt” part, I’d replace with “lag behind”. If the things continue to develop the way they are now, the new features will be eventually incorporated into DNR (in somewhat different form, but anyways). Basically, the “innovation” should be requested via the W3C group from the browsers and only then (after quite some time) it can be used as a part of DNR. Is it worse than what we had before? Absolutely, adding anything to DNR is now a many-months process. Do we get anything in return? We actually do, the changes and improvements that are being made to the extensions platform are significant. I’d say that the situation changed from “MV3 is bad, DNR is unusable” to “MV3 is good, DNR is useable-but-limited”.
PikachuEXE 3y ago
Is Chromium based browsers affect in any way? I throw away Chrome years ago but still using Chromium based browsers.
- soundnote 3y ago
  Yes. The change is to the extension APIs used by Chromium, and thus Chrome, Edge etc. Browser makers like Brave build the adblocker directly into the browser, so they don't have to care what extensions are and are not allowed to do on Chromium.

171 points by ghostwords 3y ago

Anyone remember "DOS ain't done until Lotus won't run"? Now it's "Chrome ain't done until uBlock won't run". If it's not Manifest V3 that makes the Internet safe for advertising, it'll be a "browser integrity" token or some other kind of DRM-by-another-name. Google has made it clear with YouTube that the arms race is on, and sooner or later they'll go nuclear.

ronsor 3y ago
And they'll kill all of us, including themselves, in the process.
- clouddrover 3y ago
  No. Use Firefox and you will survive. uBlock Origin works best in Firefox: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
  - anonymousab 3y ago
    The nuclear option will eventually be to just ban Google accounts for using any ad blocking. The question is whether that atmosphere would simply cause people to quit Google services vs. turn off Adblock altogether to continue using them. I would wager that the latter would be far more likely and common for the average person.
    - mcronce 3y ago
      I agree with your intuition on the latter being more likely. And Google won't care about the minority of power users they lose. They've been outwardly hostile toward power users with Android for years.
      - shiroiuma 3y ago
        Apple is even worse...
        I_Am_Nous 3y ago
        True, but getting an iPhone to tinker with is kind of like buying a book to rearrange the words into your own story. They crafted a beautiful walled garden for you, and the walls are a feature - which is definitely not for everyone. That said, I have fond memories of installing Linux on my iPod Mini so I understand the joy of making devices do things they were never intended to do.
    - xur17 3y ago
      > The nuclear option will eventually be to just ban Google accounts for using any ad blocking. Or they just keep making it harder and harder to use alternative browsers that support ad blocking.
    - Tommstein 3y ago
      > The nuclear option will eventually be to just ban Google accounts for using any ad blocking. The collateral damage from that would probably lead to the mother and father of all class-action lawsuits, literal Acts of Congress, and EU fines that Google would have to get a second job in order to pay if they don't try to break them up outright.
    - maxloh 3y ago
      IMO both will happen. People are going to continue using other Google services, but quit YouTube.
    - dun44 3y ago
      That’s one reason why we need a YouTube archive that’s outside of Google’s control.
  - Analemma_ 3y ago
    Firefox only survives because Google props it up. I don’t think Google can stop completely without incurring antitrust wrath, but they could probably start attaching strings and conditions to the funding.
    - clouddrover 3y ago
      So you're saying the more users Firefox has, the stronger Mozilla's bargaining position. You make a good case to use Firefox.
      - lcnPylGDnU4H9OF 3y ago
        Alternatively, the more users Firefox has, the more incentive Google has to twist Mozilla's arm. I doubt that ultimately defeats forks that are maintained by volunteers (https://librewolf.net/ https://librewolf.net/), and I don't want to discourage Firefox adoption, but it's not quite so cut-and-dry as "use Firefox". There will likely come a time that it's "use this community fork of old-Firefox-before-it-got-Googled". Still not a case against Firefox; just pointing out there's more to the picture.
        leotravis10 3y ago
        In other words, if Firefox becomes popular enough, there's a chance that Google will deliver a nail to Mozilla's coffin in pulling their search deal and other funding which is the backbone of their business in a financial level. Another example is that Mozilla has a LOT to lose if the DOJ wins in the US v. Google antitrust trial just for those deals.
        toyg 3y ago
        In the past, when FF was stronger, they took search deals with other engines (yahoo, bing). If their numbers go back up, it could be a viable strategy again. Maybe I'm old, but doing the right thing on the internet has always been harder than just going with the flow. Using Linux in 2000 was very hard, using Firefox in 2001 was no walk in the park - but one gotta do what one gotta do, if one has some principles.
  - saurik 3y ago
    > If it's not Manifest V3 that makes the Internet safe for advertising, it'll be a "browser integrity" token or some other kind of DRM-by-another-name. So, no: Firefox will NOT save you.
    - clouddrover 3y ago
      Not on its own it won't. It needs more people using it. It needs to support extensions like uBlock Origin, which it does. Chrome is built to serve Google's interests, which is exactly as you'd expect. Use Firefox for a web which better balances the competing interests of corporations and end users.
      - gary_0 3y ago
        There are already plenty of banking sites and such that will turn you away for not having a standard-issue Chrome user agent header. Also, crank your browser's privacy settings too high, and any website with twitchy Cloudflare settings will give you the sisyphean "I'm not a bot" check box until you give up and go away (or come back with a Chrome that's hungry for cookies). So no, on our present course, Firefox will not save us. And even if every HN reader used it, that wouldn't even come close to pushing its usage share out of the single digits.
        clouddrover 3y ago
        > There are already plenty of banking sites and such that will turn you away for not having a standard-issue Chrome user agent header. Don't use that bank. > Also, crank your browser's privacy settings too high, and any website with twitchy Cloudflare settings will give you the sisyphean "I'm not a bot" check box Don't use that website. It's certainly true that you have no agency or self respect if you embrace a defeatist and submissive outlook. So don't do that.
        shiroiuma 3y ago
        >There are already plenty of banking sites and such that will turn you away for not having a standard-issue Chrome user agent header There are countless banks out there. I have bank accounts with several different institutions in two different countries and they all work fine with Firefox + uBO. If yours doesn't, why are you supporting them? >Also, crank your browser's privacy settings too high, and any website with twitchy Cloudflare settings will give you the sisyphean "I'm not a bot" check box until you give up and go away (or come back with a Chrome that's hungry for cookies). I haven't seen this. If a website is too much of a PITA to use, I just won't use it, and I suggest you do the same.
  - narinxas 3y ago
    firefox and being able to compile it on you machine may do the trick for a little while but policy decisions aren't like technical ones.... principles are at play at every layer above the strictly-technical discussion
    - clouddrover 3y ago
      Right. So make the principled choice and use Firefox now.
  - 1vuio0pswjnm7 3y ago
    But today Firefox, i.e., Mozilla, is wholly dependent, financially, on Google. One could argue that Google can "kill" Mozilla easier than it can "kill" uBlock.
- narinxas 3y ago
  to them who find this comment exagerated (hyperbollic?) there are things that through symbolism come to signify life-or-death scenario across different contexts (i.e. life or dead of what-exactly?) these "ad-tech" wars aren't about technology as much as they (really) are about (the future?) of user freedom. freedom is the key word (symbol) which links this difficult real world contest into the nuclear leagues
- PoignardAzur 3y ago
  I really don't like advertising, but it's a non-lethal nuisance.
krackers 3y ago
> This lets extensions modify network requests without intercepting them and viewing their content, thus providing more privacy. Doesn't uBlock currently block youtube ads by blocking requests based on XHR content? This will kill that.
- moffkalast 3y ago
  For each 10 ft wall youtube builds uBlock will eventually find a 11 ft ladder.
  - krackers 3y ago
    Actually looking a bit more at how the xhr filtering is implemented, uBO seems to do it not at the webRequest level but instead by shimming the javascript fetch() method itself. So maybe this approach would still work in a MV3 world, I don't know what restrictions are imposed on content scripts.
    - maxloh 3y ago
      How does the actual code look like?
- mortallywounded 3y ago
  No. People that care will simply stop using Chrome.
  - archerx 3y ago
    I already have firefox installed on all my machines slowly transitioning over. Chromes new UI updates are really pushing me over to firefox faster. Now when I set up nee computers for friends I install firefox for them, when they ask me why not chrome I tell them chrome is old news and not to be trusted which they happily accept and use firefox. Slowly the tide is turning.
    - lta 3y ago
pjmlp 3y ago
Everyone that has helped Chrome (alongside its Electron shell) take over the Web can now thank Google.
- chii 3y ago
  Fork chrome, or switch to firefox.
  - pjmlp 3y ago
    Fork Chrome is usually easier said than done, as proven by the "success" of most FOSS forks, besides many key features aren't even in Chromium. I am mostly a Firefox user, at least until it stays around.
    - maxloh 3y ago
      Brave and Vivaldi is quite success IMO.
      - pjmlp 3y ago
        Yet another two re-inforcing Chrome dominance on the Web.
      - firecall 3y ago
        Brave is ~0.05% market share. It’s probably successful in that it’s a well known project within the tech community. And 0.05% of the global browser market is a lot of users and probably a decent business. (Are they profitable?) But outside of HN type audiences, no one has heard of it.
        maxloh 3y ago
        It seems that they became profitable, weirdly enough, by having users opt-in to their own ads... in their ad-blocking browser [0]. [0]: https://brave.com/2021-recap/ https://brave.com/2021-recap/
  - 3y ago

account-5 3y ago

I don't use chrome but if I did why is this a good or bad thing? Is this just a part of Google's push to force users to give up all their data under the pretense of security?

jsnell 3y ago
It's making content blocking extensions work the way they do in Safari. The benefit is security, as it allows for a massive reduction in the amount of extensions with unlimited powers to steal authentication cookies, MITM ostensibly secure connections, etc. The downside is a loss of flexibility in what ad blockers can do (though Safari ad blockers seem to get by well enough). It's unclear whether it's an improvement or reduction in power efficiency. In typical internet mob fashion Apple doing this is considered doubleplusgood, Google doing it is them being evil and trying to kill the Internet.
- ceejayoz 3y ago
  > In typical internet mob fashion Apple doing this is considered doubleplusgood, Google doing it is them being evil and trying to kill the Internet. Apple has neither Chrome's market share nor Google's advertising network. Context matters.
  - jsnell 3y ago
    Thanks for the example, that's a great demonstration! The context is that an entity that does not give a crap about making ad blocking hard (Apple) believes that this is the best design for content blocking extensions. They have no ulterior motive, it's just obviously the right technical design.
    - lapcat 3y ago
      > They have no ulterior motive "Alphabet pays Apple 36% of Safari search revenue, Sundar Pichai confirms" https://www.cnbc.com/2023/11/14/google-pays-apple-36percent-of-safari-search-revenue-sundar-pichai.html https://www.cnbc.com/2023/11/14/google-pays-apple-36percent-... > it's just obviously the right technical design. Setting aside the question of motives, Safari engineers designed their content blocking system (1) without any actual experience in developing ad blocking extensions and (2) without consulting the developers who do have such experience. Moreover, ad blocking extension developers are practically unanimous in saying that Safari content blockers are inferior and not obviously the right technical design.

bloppe 3y ago

So, does this still cripple ad blocking? It's pretty hard to parse from the post. I don't really care anyway. Chrome is not the internet. Just use Firefox.

cookies23 3y ago
Not really. You can read AdGuard opinion on MV3 https://adguard.com/en/blog/chrome-manifest-v3-where-we-stand.html https://adguard.com/en/blog/chrome-manifest-v3-where-we-stan...
- anonymousab 3y ago
  > Despite losing a small part of their functionality, ad blockers will still be able to offer nearly the same quality of filtering that they demonstrated with Manifest V2. If some mechanism or capability is no longer possible or is made infeasible for adblockers to control, then ads will simply switch to using that mechanism. It's a pretty obvious outcome. You cannot simply give just an inch with adtech.
  - e2le 3y ago
    I would be interested to see a list of capabilities and features lost in MV3. For example, do we lose CNAME filtering or strict-blocking? It's not clear what we are losing.
    - ghostwords 3y ago
      We lose the ability to innovate. The browser (Google) becomes the gatekeeper. And yes, we lose CNAME filtering.[1] https://github.com/w3c/webextensions/issues/151#issuecomment-1018778881 https://github.com/w3c/webextensions/issues/151#issuecomment... Google is an advertising company. Chrome extensions already experienced a lost decade, where nothing much happened until the Manifest V3 "proposal". It's not a good idea to let Google hold the keys to anti-tracking tech. [1] I stand corrected, DNS lookups are not part of webRequest in MV2 Chrome either. This doesn't change my larger point.

DiabloD3 3y ago

[flagged]

redder23 3y ago

You should not be using Chrome anyway but if you still do, its time to switch and advocate for different browsers. Brave has a uBlock Origin based adblocker build in, written in Rust. Firefox is the best browser for uBlock Origin.

jnrk 3y ago
Manifest V3 applies to all Chromium based browsers, including Brave.
- redder23 3y ago
  Why make claims you have no clue about? As someone said above Brave is NOT affected, their adblocker is a the very core of the browser and a basic chromium extension.
- Moldoteck 3y ago
  Couldn't they modify the fork in a way to not implement v3?
  - redder23 3y ago
    I am also wondering if there is or will be a Chromium fork that just keeps the old code and not enforces v3 but just support both v2 and v3 and then also default to accept some alternative extension store that also has v2 extensions.
- antonok 3y ago
  Brave's adblocker is written in Rust [0] and compiled to native code; it's not affected by the Mv3 transition because it doesn't use extension APIs. Brave also publicly committed [1] to continuing support for Mv2 through patches. [0] https://github.com/brave/adblock-rust https://github.com/brave/adblock-rust [1] https://twitter.com/brave/status/1574822799700541446 https://twitter.com/brave/status/1574822799700541446
deleted 3y ago
[deleted]

red_admiral 3y ago

Some, but not all of the problem, can be mitigated by pointing your DNS to mullvad (the no-ads one; DNS doesn't need a subscription unlike the full VPN product). Ironically, this might be a market opportunity for MS to get a few users back to chrome's poor cousin Edge, if they allow proper extensions again.

lcnPylGDnU4H9OF 3y ago
> DNS doesn't need a subscription They also give detailed steps on how to configure the DNS settings for a given browser or device. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#how-to-use https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#...

tholman 3y ago

I've got maybe 4 extensions that are manifest V2 that just purely don't seem worth upgrading/fixing up (my largest with 5-10k installs) due to the time/5+ year old code that has been working fine on the old apis... Has chrome done some outreach to the popular extensions, or maybe just gone past a point where they're happy to kill off the old and move onto the new? Or is this purely about ublock etc?

kuchenbecker 3y ago
Not even about Ublock. Do you control your browser? Manifest V2 you can write a plugin to modify the page in pretty much any way. This is used by adblockers but philisophically important because this is no longer possible in V3 in the name of security. Instead chrome mitigated the adblock concern in-particular. But manifest v2 isn't actually disappearing, it's a chrome web store policy. You can still manually install the crx.
- lapcat 3y ago
  > But manifest v2 isn't actually disappearing, it's a chrome web store policy. You can still manually install the crx. It is actually disappearing. Re-read the announcement. Google Chrome will be disabling MV2 extensions. It's not just a Web Store policy.
  - kuchenbecker 3y ago
    I may be wrong, but my read is they can be enabled and installed manually. Disabling them is not good though and removing from web store is a death sentence for commercial apps.
    - lapcat 3y ago
      > I may be wrong, but my read is they can be enabled and installed manually. You are wrong. Disabling them means that they won't work, end of story. Dead. Gone.
  - gnicholas 3y ago

PoignardAzur 3y ago

Title seems to be editorialized? That's against HN rules, IIUC.

lapcat 3y ago
It's not exactly the original title, but to me the edit seems both neutral and more informative than the original title.

siproprio 3y ago

so, adguard sold out?

spartanatreyu 3y ago
Every adblocker that contains the letters: "ad" has. Ublock Origin has been the best for almost a decade running and is most powerful when running on Firefox. Raymond "Gorhill" Hill is the BDFL of Ublock Origin and has never accepted any money from ad companies and has never added/removed any feature that weakens the adblocking.

jauntywundrkind 3y ago

How's the situation with debugging tools & userscripting extensions (grease monkey, violetmonkey, tamper monkey)? Outlawing dynamic code (use of eval for example) is a huge locking down of the system, one I have some sympathy for but also think deeply narrows the type of extensions that can be built, in a chilling way.

ghostwords 3y ago
There is a new userScripts API: https://github.com/Tampermonkey/tampermonkey/issues/644#issuecomment-1789533494 https://github.com/Tampermonkey/tampermonkey/issues/644#issu...
- jauntywundrkind 3y ago
  Which evidently you need to be in some "developer mode" to have work?? I use this all the time just to improve websites I visit, change colors or adjust workflows to make them less jank. My work jira is reskinned with violet monkey. They're called userscripts. Making folks have to enter a dev mode to use them feels abominable. Also seems like this narrowly targets just userscripting cases, while ignoring any other use cases where we might want to have dynamic behavior. It still doesn't allow me to write an extension that lets me ship up code & run it. I get this is by design, to improve security, but it feels so much less like my user agent when I'm outlawed from running whole categories of code in the browser. My best hope is that many of the dynamic code practices are enforced chiefly by the web store. And that we can sideload whatever we want.
  - deleted 3y ago
    [deleted]

PoignardAzur 3y ago

> Improving content filtering support by providing more generous limits in the declarativeNetRequest API for static rulesets and dynamic rules Anyone here know more about this? From the article linked in that quote: > We determined that some filter rules, such as those with an action of block or allow, are much safer and are less likely to be abused. They also happen to make up the large majority of ad block filter rules. Based on this, I drafted and shared a proposal in the Web Extensions Community Group to define a set of rules that we consider lower risk and allow up to 30,000 of these. From what I remember of the discourse at the time Manifest v3 was first announced, the most major complaint from developers who were otherwise open to the idea of static filters was that the number of filters allowed was way too small for the modern web. Google's proposed changes seem to address that, maybe? I don't know how effective they are in practice.

ghostwords 3y ago
DNR is better than at launch, but still full of feature gaps. How do you match a redirect response? How do you robustly rewrite URLs based on query parameters?[1] The fundamental problem is that DNR is not an adequate replacement for webRequest. From something I wrote[2] a couple of years ago: > [R]emoving blocking webRequest won’t stop abusive extensions, but will harm privacy and security extensions. If Manifest V3 is merely a step on the way towards a more "safe" (i.e., limited) extensions experience, what will Manifest V4 look like? If the answer is fewer, less-powerful APIs in service of “safety”, users will ultimately suffer. The universe of possible extensions will be limited to what Google explicitly chooses to allow, and creative developers will find they lack the tools to innovate. Meanwhile, extensions that defend user privacy and safety against various threats on the Web will be stuck in the past, unable to adapt as the threats evolve. [1] https://github.com/w3c/webextensions/issues/302 https://github.com/w3c/webextensions/issues/302 [2] https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st...
- ameshkov 3y ago
  For the most part I agree with your quote save for the “stuck in the past, unable to adapt” part, I’d replace with “lag behind”. If the things continue to develop the way they are now, the new features will be eventually incorporated into DNR (in somewhat different form, but anyways). Basically, the “innovation” should be requested via the W3C group from the browsers and only then (after quite some time) it can be used as a part of DNR. Is it worse than what we had before? Absolutely, adding anything to DNR is now a many-months process. Do we get anything in return? We actually do, the changes and improvements that are being made to the extensions platform are significant. I’d say that the situation changed from “MV3 is bad, DNR is unusable” to “MV3 is good, DNR is useable-but-limited”.

PikachuEXE 3y ago

Is Chromium based browsers affect in any way? I throw away Chrome years ago but still using Chromium based browsers.

soundnote 3y ago
Yes. The change is to the extension APIs used by Chromium, and thus Chrome, Edge etc. Browser makers like Brave build the adblocker directly into the browser, so they don't have to care what extensions are and are not allowed to do on Chromium.