15 ms·

Chrome Users Beware: Manifest V3 Is Deceitful and Threatening (2021)

441 points by tambourine_man 3y ago

meepmorp 3y ago
Chrome Users Beware: Chrome is one of the tools that Google uses to maintain and extend its control over the web. You're empowering them to do shady things that aren't to your (or most people's) benefit.
CatWChainsaw 3y ago
Now all firefox has to do is nothing. Keep V2 extensions and chrome will bleed users once their adblockers stop blocking ads. I invite chrome to accelerate their timeline aggressively.
fsflover 3y ago
Previous discussion: https://news.ycombinator.com/item?id=29502439 https://news.ycombinator.com/item?id=29502439
skinkestek 3y ago
At this point, is there still any good reasons to use Chrome? A few years ago some new web apps only supported Chrome, like they only supported IE a few years before, but today I haven't had to use Chrome for months. I might just have been lucky but I don't know. Does anyone else?
- vbeeaz 3y ago
  It's faster than Firefox. Also it integrates better with Google services.
  - Larrikin 3y ago
    How is it faster than Firefox in a meaningful way? Is this even still true for the people who insist on keeping hundreds of tabs open at a time?
    - marginalia_nu 3y ago
      At least on mobile, Firefox is so unresponsive it's a complete nonstarter on a slower phone. Chrome is fine.
      - concordDance 3y ago
        Seems fine on mine. You speaking anecdotally or do you have data?
        marginalia_nu 3y ago
        Yeah, it's slow to the point of being completely unusable on my phone.
        Larrikin 3y ago
        What's the point of even using the web if you don't have an ad blocker in your browser?
        marginalia_nu 3y ago
        I mainly use the parts of the web that doesn't require one.
        leodag 3y ago
        Have you used it recently, or just years ago? It definitely used to be very slow, but since ~2 years ago it's very good, and my go to browser (my phone is not high end, by the way)
        marginalia_nu 3y ago
        I give it a spin every few months. Then I uninstall it because it's still irredeemably unresponsive.
      - flerchin 3y ago
  - Anthony-G 3y ago
    I’d agree that Google Chrome was noticeably faster than Firefox up until around a decade ago. However, I haven’t noticed it to be any faster since then. What makes web browsing faster for me is the use of web extensions that disable the downloading of unnecessary resources and/or the execution of pointless Javascript, e.g., NoScript, uMatrix, uBlock, Privacy Badger, etc – the same extensions that will have their abilities greatly reduced by Manifest v3.
  - kelnos 3y ago
    I haven't noticed any speed differences between Chrome and Firefox for quite some time now (Linux here, so maybe it's different on Windows or macOS). And I haven't found the Google services integration to be all that deep or interesting to matter. In fact, I'd found the opposite to be true: it's gotten in the way. Having the browser log into your Google Account directly has led to some confusing behavior, especially when signing into a second account via some webapp, which sometimes changes how the browser is signed in. Regardless, I think we all would be better off with a bit less integration of Google services in our lives.
- jddj 3y ago
  I need to use chrome for maybe 2 websites per year on mobile which give me infinite loading spinners on Firefox. One website on desktop, which I only use chrome (actually edge but I consider them to be the same thing) for because the developers don't take bug reports seriously unless it's Chromium based
- VPenkov 3y ago
  One that I feel is underappreciated is the inline translation of whatever website you are browsing. I don't speak well the language of the country I currently live in and Chrome really helps. I haven't really found a comparable feature or add-on in other browsers. I'd switch to Firefox in a heartbeat if it offered a decent version of this.
  - bantunes 3y ago
    Firefox has had this since Sep 26 https://www.mozilla.org/en-US/firefox/118.0/releasenotes/ https://www.mozilla.org/en-US/firefox/118.0/releasenotes/
    - kibwen 3y ago
      Note that it supports fewer languages for automatic translation, but all the translation happens client-side, which is super cool.
      - TonyTrapp 3y ago
        And several more languages to be added soon have already been announced: Russian, Farsi, Icelandic, Norwegian, Ukrainian and Dutch. So there's probably much more to come.
  - Semaphor 3y ago
    https://addons.mozilla.org/en-US/firefox/addon/linguist-translator/ https://addons.mozilla.org/en-US/firefox/addon/linguist-tran... Includes offline translation. I very rarely need this, so I can’t speak about the quality, though.
  - BossHogg 3y ago
    I use Translate Web Pages daily. https://github.com/FilipePS/Traduzir-paginas-web https://github.com/FilipePS/Traduzir-paginas-web
  - kelnos 3y ago
    On top of the integrated support for this in Firefox as of recently (that a sibling mentions), Mozilla has offered an extension for this for quite a while now.
- rs_rs_rs_rs_rs 3y ago
  Security. The Chrome security team(and other Google security teams like Project Zero) is top notch. Mozilla can't really compete in this field, unfortunately, Google can afford to and does invest more into browser security.
  - generic92034 3y ago
    But if (! - I am not sure on that, yet) v3 is preventing ad-blockers from working the attack surface is that much larger using Chrome.
    - rs_rs_rs_rs_rs 3y ago
      v3 is no preventing adblockers, it changes the way they'll have to be implemented(they'll be less powerful than before).
      - redserk 3y ago
        Reducing functionality is preventing adblocking, which is overwhelmingly the primary action of adblockers. Thus it is fair to state they are preventing adblockers.
        rs_rs_rs_rs_rs 3y ago
        >Thus it is fair to state they are preventing adblockers No it's not fair to say that. The same way it's not fair to say Apple is preventing adblocking in Safari even if the current state of adblocking there RIGHT NOW is exactly how manifest v3 Chrome will be(using declarativeNetRequest)
        saurik 3y ago
        But, they are, right? They aren't preventing ALL ad blockers, but they aren't even merely preventing theoretical ad blockers: they are blocking concrete ad blockers that people have built and would actively use. If there is a checkpoint at an event which seems to be turning away cars it doesn't matter if other cars are also getting through: the way we use the relevant phrasing allows us to say that "they are turning away cars" as that is a bit ambiguous as to why or how many.
- buro9 3y ago
  > At this point, is there still any good reasons to use Chrome? I use Firefox for everything... except work. At work we have Google Suite, Google Meet, etm and these do not work as well, as consistently, or with the same features in Firefox. A specific example, if you have a 1080p webcam you can use this in Firefox and https://webcamtests.com/ https://webcamtests.com/ will reveal that I have a 1920x1080 FHD webcam @ 50fps ... all good, but Google Meet will only allow 1080p webcams in Chrome. That's a rich feature example, but even things like Docs behaves subtly differently and a little more rich and fluidly in Chrome. What this means is that I segment my life by browser, Firefox is my personal life, and I treat Chrome as my work sandbox.
  - ghusto 3y ago
    We use Google Suite too, and I have no problems with 100% Firefox usage there too. I can't say anything about things like the resolution of your webcam, but I don't know, it all just works here.
  - akjshdfkjhs 3y ago
    Just use the slightly lower resolution. Btw, in 2020 Google was caught red handed shipping broken code to firefox to make it look like broken/slow. Everytime that happens, just open support tickets with your IT dept. That is the only wining move. Otherwise you are just a fool being pushed around :(
  - kelnos 3y ago
    I've come to see this as a feature, not an issue (I accept this as my "punishment" for refusing to install Zoom's app, and instead use it through my browser). Frankly I don't care all that much about what people see on the other side of my webcam. They're universally crap quality anyway. If I really needed decent camera quality for a video call, I'd use my phone, and a dedicated video conferencing app. (Sure, if you've specifically bought an external webcam so you can have high-quality video chats, that's another story. But I don't think all that many people do that.) Outside of the webcam issue, I've never had any problems using any of the GSuite webapss with Firefox.
- baz00 3y ago
  I use Safari and Edge. I haven't noticed anything that doesn't work on those.
  - donatzsky 3y ago
    Edge uses the same engine as Chrome, so that at least is not surprising.
- pingec 3y ago
  I use it to watch youtube, because youtube on FF causes way higher cpu load and battery drain on my windows laptop.
  - Supermancho 3y ago
    Brave is sufficient on phone, smart tv, and desktop for me.
- tambourine_man 3y ago
  I use it for the dev tools only. I remember when Safari used the WebKit dev tools and I had one browser to do everything I needed. Those were the days. Then Apple decided to release some terrible new thing with way less features and much worse interface that’s better at integrating with the iPhone when plugged in, but useless otherwise.
- 50 3y ago
  I've tried different browsers, more so these past few years, and always end up back with Ungoogled Chromium. It seemingly uses half of the memory of Firefox.
- ghusto 3y ago
  I've never had a Chrome based browser installed on my 7 year old Macbook, no problems here.
- deleted 3y ago
  [deleted]
  - deleted 3y ago
    [deleted]
fooker 3y ago
This might be the final straw that motivates me to start deGoogling my online activities.
- deleted 3y ago
  [deleted]
mcpackieh 3y ago
I am upset for the common users of Chrome. This change is awful for them. But any Chrome users here? Any Chrome users reading this comment? You knew, or should have known, that Google is a snake. You willfully chose to use a browser developed by an advertising company. You've known Firefox was an alternative but you willfully chose not to use it because you placed mild convenience ("Ooooh but chrome is milliseconds faster") before your freedom. You get what you fucking deserve.
- stranded22 3y ago
  Firefox is also implementing manifest v3, as per article. I think this should push people towards DNS level blocking (I use nextdns, personally)
  - kome 3y ago
    yes but: "What are we doing differently in Firefox? WebRequest One of the most controversial changes of Chrome’s MV3 approach is the removal of blocking WebRequest, which provides a level of power and flexibility that is critical to enabling advanced privacy and content blocking features. Unfortunately, that power has also been used to harm users in a variety of ways. Chrome’s solution in MV3 was to define a more narrowly scoped API (declarativeNetRequest) as a replacement. However, this will limit the capabilities of certain types of privacy extensions without adequate replacement. Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest. We will continue to work with content blockers and other key consumers of this API to identify current and future alternatives where appropriate. Content blocking is one of the most important use cases for extensions, and we are committed to ensuring that Firefox users have access to the best privacy tools available." https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/ https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi...
    - stranded22 3y ago
      Excellent, thank you
Havoc 3y ago
Google simply can’t be trusted on this point. They’re way to conflicted and financially motivated to do the wrong thing for the user They keep talking about privacy and security threats. Google is the threat here
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
cwales95 3y ago
They'll do anything to weaken user's ability to ensure their privacy and block ads it seems.
- deleted 3y ago
  [deleted]
stareatgoats 3y ago
(2021) EFF had a slew of articles about the evils of MV3 2019 - 2021. Since then, nothing. Has subsequent development proven them wrong - or right? I don't really follow this space closely other than as a user of chrome extensions (in Vivaldi).
- ghostwords 3y ago
  Some thoughts here: https://news.ycombinator.com/item?id=38303956 https://news.ycombinator.com/item?id=38303956
- deleted 3y ago
  [deleted]
_qxjp 3y ago
I found this interesting. On both the Chrome blog and this EFF post, there is a quote from AdGuard CTO Andrey Meshkov. One of the quotes is favorable/neutral toward Google, while the other is more negative. It sounds like Meshkov may have changed his opinion. Google blog ( https://developer.chrome.com/blog/resuming-the-transition-to-mv3/ https://developer.chrome.com/blog/resuming-the-transition-to... ) "As always, migrating to a new platform is a large undertaking, but we're very hopeful..." EFF blog ( https://www.eff.org/deeplinks/2021/12/chrome-users-beware-manifest-v3-deceitful-and-threatening https://www.eff.org/deeplinks/2021/12/chrome-users-beware-ma... ) - sourced from AdGuard blog ( https://adguard.com/en/blog/manifestv3-timeline.html https://adguard.com/en/blog/manifestv3-timeline.html ) "Nearly all browser extensions as you know them today will be affected in some way..."
- ameshkov 3y ago
  It's natural for Google in their public communication to quote positive stuff and not quote anything critical. Recently I tried to explain the current state of MV3 objectively: https://adguard.com/en/blog/chrome-manifest-v3-where-we-stand.html https://adguard.com/en/blog/chrome-manifest-v3-where-we-stan... But yes, my opinion about MV3 did improve with time. Briefly: it is not ideal, DNR is not a full replacement for the blocking webRequest, but their work for the last several years made me hope that they can compensate for what we're losing by other platform improvements. edit: grammar
  - RedShift1 3y ago
    What if, and hear me out, all that effort went into MV2?
    - ameshkov 3y ago
      MV3 is basically MV2 with one tectonic change: replacing persistent background pages with ephemeral service workers. So a large part of this effort actually DID go into MV2. There's a better question: what if instead of investing huge amount of times into DNR they put it somewhere else? For instance, into providing better tools for extensions to persist their state so that we didn't have to rewrite the extensions from scratch to make them work with the new service workers model? I think it would've been much much much better. Unfortunately, that's how hindsight works.
orwin 3y ago
The thing is, not having adblock on chrome would make it unusable for work-related searches. Unless I'm on page 2 or something, I have trouble finding man pages/relevant Api documentation, and all the first results, while useful (especially when I have to do frontend stuff) are absolutely unusable without ublock, even the not terrible websites. That'll mean I'll either drop Google search and directly search SO/reddit and have quicklinks for manpages and other documentation (maybe with GPT help to parse that), or I'll drop chrome at work (i really, really can't work without an ad blocker.).
SpacePortKnight 3y ago
I don't understand the negative comments towards Chrome. Doesn't adblockers on Safari work the same as V3?
- AlexandrB 3y ago
  Yes, and they suck compared to what's possible in Firefox. The history matters too, because Safari extensions were always extremely limited, while this change is an intentional downgrade for what's possible in Chrome.
- kelnos 3y ago
  In addition to what the sibling said, I think at this point we mostly acknowledge (even if we don't accept) that Apple treats their users like children. Apple Always Knows Best, and that means users don't actually get to choose how they use their devices. So this isn't surprising, and it's been the case since forever.
madeofpalk 3y ago
I don't mean to be a google apologist, but the changes basically align with Apple's browser/content APIs that they introduced in like 2016. Web extensions are a massive privacy and security hole that users unwittingly opt themselves into. I mean, the articles explains how dangerous extensions are: > Manifest V3, or Mv3 for short, is outright harmful to privacy efforts. It will restrict the capabilities of web extensions—especially those that are designed to monitor, modify, and compute alongside the conversation your browser has with the websites you visit. Yes. Exactly! That's the point - it restricts the ability for extensions to monitor, snoop, and steal content from every website you browse.
- ComradeMatis 3y ago
  Apologies for the late reply but let's assume we take what you say on face value, there is still a laundry list of limitations that the developer of uBlock Origin have outlined two years ago that the developers of MV3 have flat out refused to address - abritrary limits in terms of the number of filters, talking about regressions, Google flat out refusing to provide extensions for Chrome for Android not to mention when you try the MV3 version of the ad blockers they're a pale shadow of their former self - uBlock Origin Lite block ads but pop up windows still appear but with the message that it has been blocked (telling me after the window open kind of defeats the purpose of it in the first place), then I tried AdGuard which lets through huge numbers of ads etc. basically it is a crippled experience and the only one who benefits is Google's ad division.
- ahartmetz 3y ago
  What if you trust your extensions more than the websites you visit? You will have a few extensions and hundreds or thousands of websites.
  - pvg 3y ago
    It's very difficult for users to make these decisions in an informed way, for either websites or extensions. The browser highly distrusts websites by default and doesn't give users many options to change that. Plus most people have some notion of how trustworthy 'the internet' is and act accordingly. This isn't the case for extensions and I think it's become clear over the years it can't be fixed with various trust knobs so they're left with fiddling with the capabilities/trying to fix the overly permissive design.
jonnycomputer 3y ago
2021. A bit dated. Firefox had adopted Manifest V3 too (or at least is compatible with it)
- AlexandrB 3y ago
  As I understand, Firefox left in the ability to block via the webRequest API, which is one of the biggest points of contention here.
  - jonnycomputer 3y ago
    Helpful info thanks
  - danShumway 3y ago
    Correct. Absent Google's more harmful changes, most of Manifest V3 is actually pretty great and I'm looking forward to broader support rolling out in Firefox. I have a couple of private extensions I maintain that use both Manifest V3 and the blocking webRequest permission in Firefox, and it works great. They wouldn't be possible to build in Chrome.
zztop44 3y ago
If Google does actually force through changes that meaningfully degrade adblocking effectiveness in Chrome, that could ironically be just the thing to motivate a critical mass of users to migrate to Firefox/some other alternative. Firefox won when it was significantly better than IE in ways that lots of people actually cared about (it had tabs). Then Chrome won when it was significantly than Firefox in ways lots of people cared about (it was fast and if a tab crashed the whole browser didn’t crash with it). For a long time, no browser has been significantly better than Chrome in ways lots of people care about. I don’t know if Manifest v3 is as bad as everyone says, but if it is, that might open up a big enough point of difference.
- WarOnPrivacy 3y ago
  > Then Chrome won when it was significantly than Firefox in ways lots of people cared about (it was fast and if a tab crashed the whole browser didn’t crash with it). Firefox shill here. I believe Chrome won because 1) Firefox had long been struggling with RAM consumption and stability 2) Chrome's onboarding was closer to effortless 3) It was relentlessly marketed/placed to saturation. Chrome had it's own RAM issues but #3 outweighed that. Any lock-in Chrome now has is due to A) #3, B) a better sync process that's integrated with Gmail and C) better corporate deployment (Gmail+Chrome). I've had my corp customers on Chrome over Firefox by about 4 to 1. I'm not happy about that but I have to prioritize their experience. However, Firefox has drastically improved in stability (as has Chrome). Chrome is getting less friendly. Where syncing isn't used, I see paths to swap users over the next year or so.
  - FoodWThrow 3y ago
    > I believe Chrome won because 4) Chrome was faster, more responsive, and more stable than Firefox since its inception. Firefox reached parity *9* years later, with Firefox Quantum.
  - zztop44 3y ago
    I agree that Chrome’s lock-in now is around syncing/integration. And, of course, the marketing. Firefox is now totally competitive on speed/stability. But it’s not a significantly better browsing experience, which is what it would need to be in order to overcome inertia and get people to switch. PS: My memory is that Firefox’s RAM issues were pretty awful when Chrome launched (if you had many tabs open it was only a matter of time until the browser crashed). Chrome was a significant improvement in that regard (and Google’s reputation was very good at the time, which probably helped).
rickreynoldssf 3y ago
I have an extension with a few hundred users (Reddit Slideshow) that's going to need to be updated in a way that will reduce privacy. Manifest V3 prevents some of the things I need to do for it to make network requests. The only solution is to deploy a central proxy that can make these requests and funnel all client requests through that proxy. Theoretically I could use that proxy to track my users. At the moment I do no tracking whatsoever. I'm sure its going to cause a bunch of users to uninstall no matter how much I promise I won't track them. A very popular extension, Hoverzoom, does the same things I need to do so its author will need the same solution, or severely limit its functionality. ...and I doubt the author will be able to support a proxy service with the volume it would get.
- Drakim 3y ago
  You don't understand, V3 is very important to enhance user privacy. Details about how it will decrease user privacy must fall to the wayside in favor of the important goal of increasing user privacy. And the secondary effects of it also nerfing adblockers is completely unrelated. It's about user privacy.
  - e40 3y ago
    Newspeak. Bravo.
  - antisthenes 3y ago
    Privacy AND safety. Think of the child safety.
  - true_religion 3y ago
    There is no change in privacy. Under v2 you could intercept and modify requests within the client. Under v3, you can only do that via a proxy. It’s the same lack of privacy. You always had to trust the extension author to not be malicious. V3 only makes it obvious both to users and to the site being requested that there is a man in the middle.
- davidmurdoch 3y ago
  Can you use an iframe in an offscreen document?
ghostwords 3y ago
Hi, Privacy Badger dev and coauthor of a bunch of EFF posts about MV3. Here are some thoughts. We wrote the following call to action a couple of years ago in https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st... > Google needs to cancel moving to service workers, restore blocking webRequest, and halt Manifest V2 deprecation until all regressions in functionality are addressed. To their credit, Google did halt MV2 deprecation. They fixed bugs, filled in functionality gaps (examples: userScripts API, the Offscreen API cludge), and made a number of improvements to DNR, their limited-by-design replacement for the powerful and flexible webRequest API. Google also relaxed their initial, entirely unreasonable service worker lifetime requirements. So where are we now with service workers and DNR? The requirement to base extensions on service workers adds complexity and headaches to developers, but because of various policy changes and workarounds, it is no longer the issue it was two years ago. Google put in a lot of effort to make service workers kind of work for extensions. I think the end result is it's now harder to make a browser extension, but service workers are no longer a deal breaker. However, blocking webRequest is still mostly gone, unavailable outside of a specific proxy authentication use case, and DNR is still not an acceptable replacement. There are still outstanding functionality gaps such as https://github.com/w3c/webextensions/issues/302 https://github.com/w3c/webextensions/issues/302, which is interesting in that much of the tracking that privacy extensions are no longer able to properly handle is by Google! But more importantly, DNR is fundamentally not an adequate replacement for webRequest. As we wrote in https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st... > [R]emoving blocking webRequest won’t stop abusive extensions, but will harm privacy and security extensions. If Manifest V3 is merely a step on the way towards a more "safe" (i.e., limited) extensions experience, what will Manifest V4 look like? If the answer is fewer, less-powerful APIs in service of “safety”, users will ultimately suffer. The universe of possible extensions will be limited to what Google explicitly chooses to allow, and creative developers will find they lack the tools to innovate. Meanwhile, extensions that defend user privacy and safety against various threats on the Web will be stuck in the past, unable to adapt as the threats evolve. The gist is that we now all depend on Google to keep evolving the API to keep up with advertisers and trackers. Google is a massive advertising company. Chrome extensions already had one "lost decade", where nothing much happened until the Manifest V3 proposal. It's just not a good idea to let Google hold the keys to anti-tracking tech.
rlnorthcutt 3y ago
This seems like the same basic tech problem - how to balance uninformed user protections with advanced user capabilities. The problem is browser extensions and the ability for bad actors to use malicious code to harm users. This is a real threat - how do you protect users from their own actions? Putting aside the cynicism about Google's "true" motives and assuming the best intentions on their part... this still seems like an overly broad limitation without a good workaround. Personally, I use as few extensions as possible, and I'm very particular about which ones. I'm sure most readers here are as well. So, for me (us?), this is a problem, especially if we also maintain extensions. But - what about my mom? She doesn't even know how to remove extensions, never mind review them for potential problems. We should not sacrifice the many (and encourage the bad actors) to ensure that the few have the access they want. Why not put in settings that allow the user to allow extensions outside the bounds of MV3? Why not put a warning on the extension page that it "could be risky", or even hide those extensions entirely from the users who don't know to adjust their settings?
- loup-vaillant 3y ago
  > This is a real threat - how do you protect users from their own actions? You fucking educate them. I’m sick and tired of big tech treating people like children. Sure, in the short term perhaps consider putting fences and whatnot, but come on, general purpose computers are mainstream since at least 1995, we ought to have learned what they are by now.
- tyingq 3y ago
  Cynically, because there are motivations behind MV3 that aren't related to privacy or security. I don't think it's tin-foil-hatting to assume Google has an internal plan to deal with ad blockers. There's plenty of security/privacy issues that remain after MV3. It's somewhat telling that onBeforeRequest()'s synchronous blocking was the first thing MV3 went after.
- dcow 3y ago
  > We should not sacrifice the many (and encourage the bad actors) to ensure that the few have the access they want. It's a false dichotomy. We don't need to sacrifice anybody. Require more consent or an advanced toggle to turn on the allegedly dangerous behavior.
DiabloD3 3y ago
I don't know why Google is hard at work adding Chrome to killedbygoogle.com, but I welcome it.
- CivBase 3y ago
  I hate to say it, but there hasn't been a significant change in browser market share since 2018. https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share Chrome continues to have a massive lead over any other browser. The only exception is if we look exclusively at the US mobile market, where Safari has a narrow lead; though I'm sure that's because it's enforced by Apple rather than chosen by users. Worldwide across all devices, Chrome and Chromium based browsers have sat comfortably around 80% market share for the better half of the last decade and there's no sign of that changing.
  - Fatnino 3y ago
    You don't think it will change when your aunt comes to you asking why the adblocking you installed for her isn't working anymore?
    - CivBase 3y ago
      No because most people - my aunt almost certainly included - still don't use ad blockers.
- aqfamnzc 3y ago
  I would welcome it too, but it's never going to happen. The masses just don't care enough to change their habits, especially when there's any friction to switching. It's why tactics like MS's aggressive edge pushing actually work to some degree.
  - wimp 3y ago
    Internet Explorer had 95% market share in 2004, with much of the same sentiment.
jeffwask 3y ago
Remember when Microsoft had to unbundle IE from Windows (the dominate OS of the time) because it gave them too much of a competitive advantage. Google has a dominate position in: - The browser - The search engine - The Ad network - The device operating system - Email communications Plus more money than god to buy dominance where they don't own it. When is it too much control over the primary means of gathering and distributing information in the modern world. It feels like their current power position even dwarfs MS's at the start of the browser wars. Nobody gives a rat's ass about the customer anymore because the customer has nowhere else to go.
- deleted 3y ago
  [deleted]
lima 3y ago
I switched to uBlock Origin Lite as soon as it was available and I haven't seen a single ad. It works fine. And now I have one less thing to worry about - my adblocker extension getting compromised through a supply chain attack.
- luuurker 3y ago
  It works fine on sites that mostly don't do anything to bypass adblockers. It technically can't work fine on sites that do it. Restricting what the adblocker can do will also affect the way they mitigate adblocker avoidance in the future.
- rodlette 3y ago
  +1. I prefer to use uBlock Origin Lite, even on Firefox. The ambient permissions that uBlock Origin requires on all sites is too risky.
  - kelnos 3y ago
    On the other hand, I trust uBlock Origin's developer with my privacy a hell of a lot more than I trust Google. I might even say I trust him more than I trust Mozilla these days.
    - rodlette 3y ago
      I trust the developer too, but the developer isn't the only person you must trust when you accept wide ambient permissions. You must also trust the entire supply chain. I see it as good hygiene to remove wide ambient permissions.
  - zlg_codes 3y ago
    What obvious astroturfing. The Lite version is worse than the original in every way.
    - chlorion 3y ago
      I don't think its astroturfing, but if it is I have used it and I'm pretty sure I'm not an astroturfer! I used the lite version while using chromium for a little while and it worked ok for me. The issue I had with it wasn't that it didn't effectively block ads, it's that you can't block arbitrary elements with the zapper (afaik). I use the element zapper to block non-ad related things sometimes. For me, I'm torn on whether the extra security is worth this limitation or not, and so far I have went back to using the normal ublock, and I have went back to using firefox because chromium crashed fairly often when using the wayland renderer. There is some way you can grant ublock lite more permissions on specific sites, I'm not sure what this does, and I don't think it brings back the element zapper, but it would be cool if it did.
wackget 3y ago
Look, this is the most obvious advice ever but everbody needs to hear it: don't use a web browser made by the world's biggest fucking internet advertising company.
- deleted 3y ago
  [deleted]
hurryer 3y ago
The end game for ad blocking is a neural network inspecting the final rendered webpage frame before it's displayed to the user and painting over it to cover the ads.
- Santosh83 3y ago
  Web integrity DRM will make sure the ads are actually delivered to your display device. You may need to have this NN ad blocker in your smart glasses and paint over the ads there.
  - hurryer 3y ago
    The user will refuse to use such a device. Just like Chrome can't block ad-blockers despite massive financial incentives, because there would be massive user uproar. Your average user doesn't try to copy movies, which is why DRM is accepted in Netflix.
    - DarkCrusader2 3y ago
      We are already there with Android, almost. Can't root it or my bank and work apps stop working. My bank's app once warned me of some app installed on my device which can be "harmful". Won't take long before they deny me access until I uninstall the "harmful" apps.
      - hurryer 3y ago
        Nobody I know wants to root their phone. Me neither. Again, same market pressure, a useful actually used feature will never be removed because people will not buy the device. Most people don't care about replaceable batteries, headphone jacks or rooting. In fact not allowing rooting is net benefit for the vast majority because it prevents spyware being installed on the device by a controlling partner, ...
        guappa 3y ago
        > Again, same market pressure, a useful actually used feature will never be removed because people will not buy the device. When all devices are the same, you have no choice.
zlg_codes 3y ago
Anyone complaining about libre software's ability to pay them is in the wrong part of the culture. Paying someone for labor is a capitalist thing and completely beside the point. Human societies are deliberately designed to disincentivize volunteering or doing anything without getting profiting. These cultures promote the idea that people are only worth what's in their bank account. So why should people start paying money for things when it's the fault of the developers for choosing to give away their time and work? I write that as someone who has FOSS projects. If you want to be paid, don't write code or deliver support until you get the paycheck.
- manonthewall 3y ago
  Humans aren't really built for communism on a large scale either. We are tribal, capitalism gets around that with incentive and greedy individual reward for doing something that generates social improvement at scale (nation-state) level--trade, commerce, interaction, communication. Communism, Marxism will never provide that. You either have to use the carrot (capitalism) or the stick (despotism) at scale to get results. Communism (real communism) fails beyond a few hundred (may only tens) of souls, again we didn't evolve for that,
  - zlg_codes 3y ago
    There are more than two economic systems, and none of them are natural or aligned with humanity's nature. That's something capitalists tell themselves to feel better about the level of exploitation needed to create a 1% class. So, is exploitation and lying and theft part of our nature? Capitalism only rewards sociopathic behavior. It cannot be prosocial.

Chrome Users Beware: Chrome is one of the tools that Google uses to maintain and extend its control over the web. You're empowering them to do shady things that aren't to your (or most people's) benefit.

CatWChainsaw 3y ago

Now all firefox has to do is nothing. Keep V2 extensions and chrome will bleed users once their adblockers stop blocking ads. I invite chrome to accelerate their timeline aggressively.

fsflover 3y ago

Previous discussion: https://news.ycombinator.com/item?id=29502439 https://news.ycombinator.com/item?id=29502439

skinkestek 3y ago

At this point, is there still any good reasons to use Chrome? A few years ago some new web apps only supported Chrome, like they only supported IE a few years before, but today I haven't had to use Chrome for months. I might just have been lucky but I don't know. Does anyone else?

vbeeaz 3y ago
It's faster than Firefox. Also it integrates better with Google services.
- Larrikin 3y ago
  How is it faster than Firefox in a meaningful way? Is this even still true for the people who insist on keeping hundreds of tabs open at a time?
  - marginalia_nu 3y ago
    At least on mobile, Firefox is so unresponsive it's a complete nonstarter on a slower phone. Chrome is fine.
    - concordDance 3y ago
      Seems fine on mine. You speaking anecdotally or do you have data?
      - marginalia_nu 3y ago
        Yeah, it's slow to the point of being completely unusable on my phone.
        Larrikin 3y ago
        What's the point of even using the web if you don't have an ad blocker in your browser?
        marginalia_nu 3y ago
        I mainly use the parts of the web that doesn't require one.
        leodag 3y ago
        Have you used it recently, or just years ago? It definitely used to be very slow, but since ~2 years ago it's very good, and my go to browser (my phone is not high end, by the way)
        marginalia_nu 3y ago
        I give it a spin every few months. Then I uninstall it because it's still irredeemably unresponsive.
    - flerchin 3y ago
- Anthony-G 3y ago
  I’d agree that Google Chrome was noticeably faster than Firefox up until around a decade ago. However, I haven’t noticed it to be any faster since then. What makes web browsing faster for me is the use of web extensions that disable the downloading of unnecessary resources and/or the execution of pointless Javascript, e.g., NoScript, uMatrix, uBlock, Privacy Badger, etc – the same extensions that will have their abilities greatly reduced by Manifest v3.
- kelnos 3y ago
  I haven't noticed any speed differences between Chrome and Firefox for quite some time now (Linux here, so maybe it's different on Windows or macOS). And I haven't found the Google services integration to be all that deep or interesting to matter. In fact, I'd found the opposite to be true: it's gotten in the way. Having the browser log into your Google Account directly has led to some confusing behavior, especially when signing into a second account via some webapp, which sometimes changes how the browser is signed in. Regardless, I think we all would be better off with a bit less integration of Google services in our lives.
jddj 3y ago
I need to use chrome for maybe 2 websites per year on mobile which give me infinite loading spinners on Firefox. One website on desktop, which I only use chrome (actually edge but I consider them to be the same thing) for because the developers don't take bug reports seriously unless it's Chromium based
VPenkov 3y ago
One that I feel is underappreciated is the inline translation of whatever website you are browsing. I don't speak well the language of the country I currently live in and Chrome really helps. I haven't really found a comparable feature or add-on in other browsers. I'd switch to Firefox in a heartbeat if it offered a decent version of this.
- bantunes 3y ago
  Firefox has had this since Sep 26 https://www.mozilla.org/en-US/firefox/118.0/releasenotes/ https://www.mozilla.org/en-US/firefox/118.0/releasenotes/
  - kibwen 3y ago
    Note that it supports fewer languages for automatic translation, but all the translation happens client-side, which is super cool.
    - TonyTrapp 3y ago
      And several more languages to be added soon have already been announced: Russian, Farsi, Icelandic, Norwegian, Ukrainian and Dutch. So there's probably much more to come.
- Semaphor 3y ago
  https://addons.mozilla.org/en-US/firefox/addon/linguist-translator/ https://addons.mozilla.org/en-US/firefox/addon/linguist-tran... Includes offline translation. I very rarely need this, so I can’t speak about the quality, though.
- BossHogg 3y ago
  I use Translate Web Pages daily. https://github.com/FilipePS/Traduzir-paginas-web https://github.com/FilipePS/Traduzir-paginas-web
- kelnos 3y ago
  On top of the integrated support for this in Firefox as of recently (that a sibling mentions), Mozilla has offered an extension for this for quite a while now.
rs_rs_rs_rs_rs 3y ago
Security. The Chrome security team(and other Google security teams like Project Zero) is top notch. Mozilla can't really compete in this field, unfortunately, Google can afford to and does invest more into browser security.
- generic92034 3y ago
  But if (! - I am not sure on that, yet) v3 is preventing ad-blockers from working the attack surface is that much larger using Chrome.
  - rs_rs_rs_rs_rs 3y ago
    v3 is no preventing adblockers, it changes the way they'll have to be implemented(they'll be less powerful than before).
    - redserk 3y ago
      Reducing functionality is preventing adblocking, which is overwhelmingly the primary action of adblockers. Thus it is fair to state they are preventing adblockers.
      - rs_rs_rs_rs_rs 3y ago
        >Thus it is fair to state they are preventing adblockers No it's not fair to say that. The same way it's not fair to say Apple is preventing adblocking in Safari even if the current state of adblocking there RIGHT NOW is exactly how manifest v3 Chrome will be(using declarativeNetRequest)
        saurik 3y ago
        But, they are, right? They aren't preventing ALL ad blockers, but they aren't even merely preventing theoretical ad blockers: they are blocking concrete ad blockers that people have built and would actively use. If there is a checkpoint at an event which seems to be turning away cars it doesn't matter if other cars are also getting through: the way we use the relevant phrasing allows us to say that "they are turning away cars" as that is a bit ambiguous as to why or how many.
buro9 3y ago
> At this point, is there still any good reasons to use Chrome? I use Firefox for everything... except work. At work we have Google Suite, Google Meet, etm and these do not work as well, as consistently, or with the same features in Firefox. A specific example, if you have a 1080p webcam you can use this in Firefox and https://webcamtests.com/ https://webcamtests.com/ will reveal that I have a 1920x1080 FHD webcam @ 50fps ... all good, but Google Meet will only allow 1080p webcams in Chrome. That's a rich feature example, but even things like Docs behaves subtly differently and a little more rich and fluidly in Chrome. What this means is that I segment my life by browser, Firefox is my personal life, and I treat Chrome as my work sandbox.
- ghusto 3y ago
  We use Google Suite too, and I have no problems with 100% Firefox usage there too. I can't say anything about things like the resolution of your webcam, but I don't know, it all just works here.
- akjshdfkjhs 3y ago
  Just use the slightly lower resolution. Btw, in 2020 Google was caught red handed shipping broken code to firefox to make it look like broken/slow. Everytime that happens, just open support tickets with your IT dept. That is the only wining move. Otherwise you are just a fool being pushed around :(
- kelnos 3y ago
  I've come to see this as a feature, not an issue (I accept this as my "punishment" for refusing to install Zoom's app, and instead use it through my browser). Frankly I don't care all that much about what people see on the other side of my webcam. They're universally crap quality anyway. If I really needed decent camera quality for a video call, I'd use my phone, and a dedicated video conferencing app. (Sure, if you've specifically bought an external webcam so you can have high-quality video chats, that's another story. But I don't think all that many people do that.) Outside of the webcam issue, I've never had any problems using any of the GSuite webapss with Firefox.
baz00 3y ago
I use Safari and Edge. I haven't noticed anything that doesn't work on those.
- donatzsky 3y ago
  Edge uses the same engine as Chrome, so that at least is not surprising.
pingec 3y ago
I use it to watch youtube, because youtube on FF causes way higher cpu load and battery drain on my windows laptop.
- Supermancho 3y ago
  Brave is sufficient on phone, smart tv, and desktop for me.
tambourine_man 3y ago
I use it for the dev tools only. I remember when Safari used the WebKit dev tools and I had one browser to do everything I needed. Those were the days. Then Apple decided to release some terrible new thing with way less features and much worse interface that’s better at integrating with the iPhone when plugged in, but useless otherwise.
50 3y ago
I've tried different browsers, more so these past few years, and always end up back with Ungoogled Chromium. It seemingly uses half of the memory of Firefox.
ghusto 3y ago
I've never had a Chrome based browser installed on my 7 year old Macbook, no problems here.
deleted 3y ago
[deleted]
- deleted 3y ago
  [deleted]

fooker 3y ago

This might be the final straw that motivates me to start deGoogling my online activities.

deleted 3y ago
[deleted]

mcpackieh 3y ago

I am upset for the common users of Chrome. This change is awful for them. But any Chrome users here? Any Chrome users reading this comment? You knew, or should have known, that Google is a snake. You willfully chose to use a browser developed by an advertising company. You've known Firefox was an alternative but you willfully chose not to use it because you placed mild convenience ("Ooooh but chrome is milliseconds faster") before your freedom. You get what you fucking deserve.

stranded22 3y ago
Firefox is also implementing manifest v3, as per article. I think this should push people towards DNS level blocking (I use nextdns, personally)
- kome 3y ago
  yes but: "What are we doing differently in Firefox? WebRequest One of the most controversial changes of Chrome’s MV3 approach is the removal of blocking WebRequest, which provides a level of power and flexibility that is critical to enabling advanced privacy and content blocking features. Unfortunately, that power has also been used to harm users in a variety of ways. Chrome’s solution in MV3 was to define a more narrowly scoped API (declarativeNetRequest) as a replacement. However, this will limit the capabilities of certain types of privacy extensions without adequate replacement. Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest. We will continue to work with content blockers and other key consumers of this API to identify current and future alternatives where appropriate. Content blocking is one of the most important use cases for extensions, and we are committed to ensuring that Firefox users have access to the best privacy tools available." https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/ https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi...
  - stranded22 3y ago
    Excellent, thank you

Havoc 3y ago

Google simply can’t be trusted on this point. They’re way to conflicted and financially motivated to do the wrong thing for the user They keep talking about privacy and security threats. Google is the threat here

deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

cwales95 3y ago

They'll do anything to weaken user's ability to ensure their privacy and block ads it seems.

deleted 3y ago
[deleted]

stareatgoats 3y ago

(2021) EFF had a slew of articles about the evils of MV3 2019 - 2021. Since then, nothing. Has subsequent development proven them wrong - or right? I don't really follow this space closely other than as a user of chrome extensions (in Vivaldi).

ghostwords 3y ago
Some thoughts here: https://news.ycombinator.com/item?id=38303956 https://news.ycombinator.com/item?id=38303956
deleted 3y ago
[deleted]

_qxjp 3y ago

I found this interesting. On both the Chrome blog and this EFF post, there is a quote from AdGuard CTO Andrey Meshkov. One of the quotes is favorable/neutral toward Google, while the other is more negative. It sounds like Meshkov may have changed his opinion. Google blog ( https://developer.chrome.com/blog/resuming-the-transition-to-mv3/ https://developer.chrome.com/blog/resuming-the-transition-to... ) "As always, migrating to a new platform is a large undertaking, but we're very hopeful..." EFF blog ( https://www.eff.org/deeplinks/2021/12/chrome-users-beware-manifest-v3-deceitful-and-threatening https://www.eff.org/deeplinks/2021/12/chrome-users-beware-ma... ) - sourced from AdGuard blog ( https://adguard.com/en/blog/manifestv3-timeline.html https://adguard.com/en/blog/manifestv3-timeline.html ) "Nearly all browser extensions as you know them today will be affected in some way..."

ameshkov 3y ago
It's natural for Google in their public communication to quote positive stuff and not quote anything critical. Recently I tried to explain the current state of MV3 objectively: https://adguard.com/en/blog/chrome-manifest-v3-where-we-stand.html https://adguard.com/en/blog/chrome-manifest-v3-where-we-stan... But yes, my opinion about MV3 did improve with time. Briefly: it is not ideal, DNR is not a full replacement for the blocking webRequest, but their work for the last several years made me hope that they can compensate for what we're losing by other platform improvements. edit: grammar
- RedShift1 3y ago
  What if, and hear me out, all that effort went into MV2?
  - ameshkov 3y ago
    MV3 is basically MV2 with one tectonic change: replacing persistent background pages with ephemeral service workers. So a large part of this effort actually DID go into MV2. There's a better question: what if instead of investing huge amount of times into DNR they put it somewhere else? For instance, into providing better tools for extensions to persist their state so that we didn't have to rewrite the extensions from scratch to make them work with the new service workers model? I think it would've been much much much better. Unfortunately, that's how hindsight works.

orwin 3y ago

The thing is, not having adblock on chrome would make it unusable for work-related searches. Unless I'm on page 2 or something, I have trouble finding man pages/relevant Api documentation, and all the first results, while useful (especially when I have to do frontend stuff) are absolutely unusable without ublock, even the not terrible websites. That'll mean I'll either drop Google search and directly search SO/reddit and have quicklinks for manpages and other documentation (maybe with GPT help to parse that), or I'll drop chrome at work (i really, really can't work without an ad blocker.).

SpacePortKnight 3y ago

I don't understand the negative comments towards Chrome. Doesn't adblockers on Safari work the same as V3?

AlexandrB 3y ago
Yes, and they suck compared to what's possible in Firefox. The history matters too, because Safari extensions were always extremely limited, while this change is an intentional downgrade for what's possible in Chrome.
kelnos 3y ago
In addition to what the sibling said, I think at this point we mostly acknowledge (even if we don't accept) that Apple treats their users like children. Apple Always Knows Best, and that means users don't actually get to choose how they use their devices. So this isn't surprising, and it's been the case since forever.

madeofpalk 3y ago

I don't mean to be a google apologist, but the changes basically align with Apple's browser/content APIs that they introduced in like 2016. Web extensions are a massive privacy and security hole that users unwittingly opt themselves into. I mean, the articles explains how dangerous extensions are: > Manifest V3, or Mv3 for short, is outright harmful to privacy efforts. It will restrict the capabilities of web extensions—especially those that are designed to monitor, modify, and compute alongside the conversation your browser has with the websites you visit. Yes. Exactly! That's the point - it restricts the ability for extensions to monitor, snoop, and steal content from every website you browse.

ComradeMatis 3y ago
Apologies for the late reply but let's assume we take what you say on face value, there is still a laundry list of limitations that the developer of uBlock Origin have outlined two years ago that the developers of MV3 have flat out refused to address - abritrary limits in terms of the number of filters, talking about regressions, Google flat out refusing to provide extensions for Chrome for Android not to mention when you try the MV3 version of the ad blockers they're a pale shadow of their former self - uBlock Origin Lite block ads but pop up windows still appear but with the message that it has been blocked (telling me after the window open kind of defeats the purpose of it in the first place), then I tried AdGuard which lets through huge numbers of ads etc. basically it is a crippled experience and the only one who benefits is Google's ad division.
ahartmetz 3y ago
What if you trust your extensions more than the websites you visit? You will have a few extensions and hundreds or thousands of websites.
- pvg 3y ago
  It's very difficult for users to make these decisions in an informed way, for either websites or extensions. The browser highly distrusts websites by default and doesn't give users many options to change that. Plus most people have some notion of how trustworthy 'the internet' is and act accordingly. This isn't the case for extensions and I think it's become clear over the years it can't be fixed with various trust knobs so they're left with fiddling with the capabilities/trying to fix the overly permissive design.

jonnycomputer 3y ago

2021. A bit dated. Firefox had adopted Manifest V3 too (or at least is compatible with it)

AlexandrB 3y ago
As I understand, Firefox left in the ability to block via the webRequest API, which is one of the biggest points of contention here.
- jonnycomputer 3y ago
  Helpful info thanks
- danShumway 3y ago
  Correct. Absent Google's more harmful changes, most of Manifest V3 is actually pretty great and I'm looking forward to broader support rolling out in Firefox. I have a couple of private extensions I maintain that use both Manifest V3 and the blocking webRequest permission in Firefox, and it works great. They wouldn't be possible to build in Chrome.

zztop44 3y ago

If Google does actually force through changes that meaningfully degrade adblocking effectiveness in Chrome, that could ironically be just the thing to motivate a critical mass of users to migrate to Firefox/some other alternative. Firefox won when it was significantly better than IE in ways that lots of people actually cared about (it had tabs). Then Chrome won when it was significantly than Firefox in ways lots of people cared about (it was fast and if a tab crashed the whole browser didn’t crash with it). For a long time, no browser has been significantly better than Chrome in ways lots of people care about. I don’t know if Manifest v3 is as bad as everyone says, but if it is, that might open up a big enough point of difference.

WarOnPrivacy 3y ago
> Then Chrome won when it was significantly than Firefox in ways lots of people cared about (it was fast and if a tab crashed the whole browser didn’t crash with it). Firefox shill here. I believe Chrome won because 1) Firefox had long been struggling with RAM consumption and stability 2) Chrome's onboarding was closer to effortless 3) It was relentlessly marketed/placed to saturation. Chrome had it's own RAM issues but #3 outweighed that. Any lock-in Chrome now has is due to A) #3, B) a better sync process that's integrated with Gmail and C) better corporate deployment (Gmail+Chrome). I've had my corp customers on Chrome over Firefox by about 4 to 1. I'm not happy about that but I have to prioritize their experience. However, Firefox has drastically improved in stability (as has Chrome). Chrome is getting less friendly. Where syncing isn't used, I see paths to swap users over the next year or so.
- FoodWThrow 3y ago
  > I believe Chrome won because 4) Chrome was faster, more responsive, and more stable than Firefox since its inception. Firefox reached parity *9* years later, with Firefox Quantum.
- zztop44 3y ago
  I agree that Chrome’s lock-in now is around syncing/integration. And, of course, the marketing. Firefox is now totally competitive on speed/stability. But it’s not a significantly better browsing experience, which is what it would need to be in order to overcome inertia and get people to switch. PS: My memory is that Firefox’s RAM issues were pretty awful when Chrome launched (if you had many tabs open it was only a matter of time until the browser crashed). Chrome was a significant improvement in that regard (and Google’s reputation was very good at the time, which probably helped).

rickreynoldssf 3y ago

I have an extension with a few hundred users (Reddit Slideshow) that's going to need to be updated in a way that will reduce privacy. Manifest V3 prevents some of the things I need to do for it to make network requests. The only solution is to deploy a central proxy that can make these requests and funnel all client requests through that proxy. Theoretically I could use that proxy to track my users. At the moment I do no tracking whatsoever. I'm sure its going to cause a bunch of users to uninstall no matter how much I promise I won't track them. A very popular extension, Hoverzoom, does the same things I need to do so its author will need the same solution, or severely limit its functionality. ...and I doubt the author will be able to support a proxy service with the volume it would get.

Drakim 3y ago
You don't understand, V3 is very important to enhance user privacy. Details about how it will decrease user privacy must fall to the wayside in favor of the important goal of increasing user privacy. And the secondary effects of it also nerfing adblockers is completely unrelated. It's about user privacy.
- e40 3y ago
  Newspeak. Bravo.
- antisthenes 3y ago
  Privacy AND safety. Think of the child safety.
- true_religion 3y ago
  There is no change in privacy. Under v2 you could intercept and modify requests within the client. Under v3, you can only do that via a proxy. It’s the same lack of privacy. You always had to trust the extension author to not be malicious. V3 only makes it obvious both to users and to the site being requested that there is a man in the middle.
davidmurdoch 3y ago
Can you use an iframe in an offscreen document?

ghostwords 3y ago

Hi, Privacy Badger dev and coauthor of a bunch of EFF posts about MV3. Here are some thoughts. We wrote the following call to action a couple of years ago in https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st... > Google needs to cancel moving to service workers, restore blocking webRequest, and halt Manifest V2 deprecation until all regressions in functionality are addressed. To their credit, Google did halt MV2 deprecation. They fixed bugs, filled in functionality gaps (examples: userScripts API, the Offscreen API cludge), and made a number of improvements to DNR, their limited-by-design replacement for the powerful and flexible webRequest API. Google also relaxed their initial, entirely unreasonable service worker lifetime requirements. So where are we now with service workers and DNR? The requirement to base extensions on service workers adds complexity and headaches to developers, but because of various policy changes and workarounds, it is no longer the issue it was two years ago. Google put in a lot of effort to make service workers kind of work for extensions. I think the end result is it's now harder to make a browser extension, but service workers are no longer a deal breaker. However, blocking webRequest is still mostly gone, unavailable outside of a specific proxy authentication use case, and DNR is still not an acceptable replacement. There are still outstanding functionality gaps such as https://github.com/w3c/webextensions/issues/302 https://github.com/w3c/webextensions/issues/302, which is interesting in that much of the tracking that privacy extensions are no longer able to properly handle is by Google! But more importantly, DNR is fundamentally not an adequate replacement for webRequest. As we wrote in https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st... > [R]emoving blocking webRequest won’t stop abusive extensions, but will harm privacy and security extensions. If Manifest V3 is merely a step on the way towards a more "safe" (i.e., limited) extensions experience, what will Manifest V4 look like? If the answer is fewer, less-powerful APIs in service of “safety”, users will ultimately suffer. The universe of possible extensions will be limited to what Google explicitly chooses to allow, and creative developers will find they lack the tools to innovate. Meanwhile, extensions that defend user privacy and safety against various threats on the Web will be stuck in the past, unable to adapt as the threats evolve. The gist is that we now all depend on Google to keep evolving the API to keep up with advertisers and trackers. Google is a massive advertising company. Chrome extensions already had one "lost decade", where nothing much happened until the Manifest V3 proposal. It's just not a good idea to let Google hold the keys to anti-tracking tech.

rlnorthcutt 3y ago

This seems like the same basic tech problem - how to balance uninformed user protections with advanced user capabilities. The problem is browser extensions and the ability for bad actors to use malicious code to harm users. This is a real threat - how do you protect users from their own actions? Putting aside the cynicism about Google's "true" motives and assuming the best intentions on their part... this still seems like an overly broad limitation without a good workaround. Personally, I use as few extensions as possible, and I'm very particular about which ones. I'm sure most readers here are as well. So, for me (us?), this is a problem, especially if we also maintain extensions. But - what about my mom? She doesn't even know how to remove extensions, never mind review them for potential problems. We should not sacrifice the many (and encourage the bad actors) to ensure that the few have the access they want. Why not put in settings that allow the user to allow extensions outside the bounds of MV3? Why not put a warning on the extension page that it "could be risky", or even hide those extensions entirely from the users who don't know to adjust their settings?

loup-vaillant 3y ago
> This is a real threat - how do you protect users from their own actions? You fucking educate them. I’m sick and tired of big tech treating people like children. Sure, in the short term perhaps consider putting fences and whatnot, but come on, general purpose computers are mainstream since at least 1995, we ought to have learned what they are by now.
tyingq 3y ago
Cynically, because there are motivations behind MV3 that aren't related to privacy or security. I don't think it's tin-foil-hatting to assume Google has an internal plan to deal with ad blockers. There's plenty of security/privacy issues that remain after MV3. It's somewhat telling that onBeforeRequest()'s synchronous blocking was the first thing MV3 went after.
dcow 3y ago
> We should not sacrifice the many (and encourage the bad actors) to ensure that the few have the access they want. It's a false dichotomy. We don't need to sacrifice anybody. Require more consent or an advanced toggle to turn on the allegedly dangerous behavior.

DiabloD3 3y ago

I don't know why Google is hard at work adding Chrome to killedbygoogle.com, but I welcome it.

CivBase 3y ago
I hate to say it, but there hasn't been a significant change in browser market share since 2018. https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share Chrome continues to have a massive lead over any other browser. The only exception is if we look exclusively at the US mobile market, where Safari has a narrow lead; though I'm sure that's because it's enforced by Apple rather than chosen by users. Worldwide across all devices, Chrome and Chromium based browsers have sat comfortably around 80% market share for the better half of the last decade and there's no sign of that changing.
- Fatnino 3y ago
  You don't think it will change when your aunt comes to you asking why the adblocking you installed for her isn't working anymore?
  - CivBase 3y ago
    No because most people - my aunt almost certainly included - still don't use ad blockers.
aqfamnzc 3y ago
I would welcome it too, but it's never going to happen. The masses just don't care enough to change their habits, especially when there's any friction to switching. It's why tactics like MS's aggressive edge pushing actually work to some degree.
- wimp 3y ago
  Internet Explorer had 95% market share in 2004, with much of the same sentiment.

jeffwask 3y ago

Remember when Microsoft had to unbundle IE from Windows (the dominate OS of the time) because it gave them too much of a competitive advantage. Google has a dominate position in: - The browser - The search engine - The Ad network - The device operating system - Email communications Plus more money than god to buy dominance where they don't own it. When is it too much control over the primary means of gathering and distributing information in the modern world. It feels like their current power position even dwarfs MS's at the start of the browser wars. Nobody gives a rat's ass about the customer anymore because the customer has nowhere else to go.

deleted 3y ago
[deleted]

lima 3y ago

I switched to uBlock Origin Lite as soon as it was available and I haven't seen a single ad. It works fine. And now I have one less thing to worry about - my adblocker extension getting compromised through a supply chain attack.

luuurker 3y ago
It works fine on sites that mostly don't do anything to bypass adblockers. It technically can't work fine on sites that do it. Restricting what the adblocker can do will also affect the way they mitigate adblocker avoidance in the future.
rodlette 3y ago
+1. I prefer to use uBlock Origin Lite, even on Firefox. The ambient permissions that uBlock Origin requires on all sites is too risky.
- kelnos 3y ago
  On the other hand, I trust uBlock Origin's developer with my privacy a hell of a lot more than I trust Google. I might even say I trust him more than I trust Mozilla these days.
  - rodlette 3y ago
    I trust the developer too, but the developer isn't the only person you must trust when you accept wide ambient permissions. You must also trust the entire supply chain. I see it as good hygiene to remove wide ambient permissions.
- zlg_codes 3y ago
  What obvious astroturfing. The Lite version is worse than the original in every way.
  - chlorion 3y ago
    I don't think its astroturfing, but if it is I have used it and I'm pretty sure I'm not an astroturfer! I used the lite version while using chromium for a little while and it worked ok for me. The issue I had with it wasn't that it didn't effectively block ads, it's that you can't block arbitrary elements with the zapper (afaik). I use the element zapper to block non-ad related things sometimes. For me, I'm torn on whether the extra security is worth this limitation or not, and so far I have went back to using the normal ublock, and I have went back to using firefox because chromium crashed fairly often when using the wayland renderer. There is some way you can grant ublock lite more permissions on specific sites, I'm not sure what this does, and I don't think it brings back the element zapper, but it would be cool if it did.

wackget 3y ago

Look, this is the most obvious advice ever but everbody needs to hear it: don't use a web browser made by the world's biggest fucking internet advertising company.

deleted 3y ago
[deleted]

hurryer 3y ago

The end game for ad blocking is a neural network inspecting the final rendered webpage frame before it's displayed to the user and painting over it to cover the ads.

Santosh83 3y ago
Web integrity DRM will make sure the ads are actually delivered to your display device. You may need to have this NN ad blocker in your smart glasses and paint over the ads there.
- hurryer 3y ago
  The user will refuse to use such a device. Just like Chrome can't block ad-blockers despite massive financial incentives, because there would be massive user uproar. Your average user doesn't try to copy movies, which is why DRM is accepted in Netflix.
  - DarkCrusader2 3y ago
    We are already there with Android, almost. Can't root it or my bank and work apps stop working. My bank's app once warned me of some app installed on my device which can be "harmful". Won't take long before they deny me access until I uninstall the "harmful" apps.
    - hurryer 3y ago
      Nobody I know wants to root their phone. Me neither. Again, same market pressure, a useful actually used feature will never be removed because people will not buy the device. Most people don't care about replaceable batteries, headphone jacks or rooting. In fact not allowing rooting is net benefit for the vast majority because it prevents spyware being installed on the device by a controlling partner, ...
      - guappa 3y ago
        > Again, same market pressure, a useful actually used feature will never be removed because people will not buy the device. When all devices are the same, you have no choice.

zlg_codes 3y ago

Anyone complaining about libre software's ability to pay them is in the wrong part of the culture. Paying someone for labor is a capitalist thing and completely beside the point. Human societies are deliberately designed to disincentivize volunteering or doing anything without getting profiting. These cultures promote the idea that people are only worth what's in their bank account. So why should people start paying money for things when it's the fault of the developers for choosing to give away their time and work? I write that as someone who has FOSS projects. If you want to be paid, don't write code or deliver support until you get the paycheck.

manonthewall 3y ago
Humans aren't really built for communism on a large scale either. We are tribal, capitalism gets around that with incentive and greedy individual reward for doing something that generates social improvement at scale (nation-state) level--trade, commerce, interaction, communication. Communism, Marxism will never provide that. You either have to use the carrot (capitalism) or the stick (despotism) at scale to get results. Communism (real communism) fails beyond a few hundred (may only tens) of souls, again we didn't evolve for that,
- zlg_codes 3y ago
  There are more than two economic systems, and none of them are natural or aligned with humanity's nature. That's something capitalists tell themselves to feel better about the level of exploitation needed to create a 1% class. So, is exploitation and lying and theft part of our nature? Capitalism only rewards sociopathic behavior. It cannot be prosocial.