3 ms·
> but the changes basically align with Apple's browser/content APIs that they introduced in like 2016 This, but Apple's changes are just as bad and should be u
by danShumway 3y ago
> but the changes basically align with Apple's browser/content APIs that they introduced in like 2016
This, but Apple's changes are just as bad and should be used as evidence of how this kind of restriction can go wrong, not how it can go right.
Adblocking capabilities on Safari are unarguably weaker than they are on Chrome and Firefox. People will occasionally get upset at me when I say this, but it's really not debatable, there is a reason why uBlock Origin is not on Safari. There is a reason why the best adblocking apps for Safari run as desktop applications and then communicate with an extension.
Safari has a ton of other great privacy features, but adblocking is not one of them. So when we talk about how Manifest V3 is going to harm adblockers, we have good reason to make that claim -- we can look at Safari and see how it played out when Safari did the same thing.
> That's the point - it restricts the ability for extensions to monitor, snoop, and steal content from every website you browse.
Most of the changes in Manifest V3 are actually pretty good, especially changes around the permission models. Active click is great, the optional permissions improvements are good.
I understand why people are phrasing this as "Manifest V3" because you need a name for it, but I hope it's not lost in this conversation that Firefox is also moving forward with its own implementation of Manifest V3 and it has the vast majority of the privacy improvements and almost none of the downsides.
Getting rid of blocking request handlers doesn't really improve privacy. Active tab permissions and optional runtime permissions improve privacy. When people talk about Manifest V3 being bad, what they usually mean is the extra restrictions Google has imposed on top of the privacy stuff; restrictions that do very little if anything to improve privacy (seriously, it is still trivial to spy on users using Chrome's Manifest V3 across all sites) but that cripple adblockers.
It's possible to get the privacy improvements without the downsides.
- dwaite 3y ago> There is a reason why the best adblocking apps for Safari run as desktop applications and then communicate with an extension. This is the only supported model for web extensions under Safari. There are no pure JavaScript distributions, they must be in an app.
- danShumway 3y agoI'm not just talking about distribution (although you are correct to bring up that restriction, because it's also a kind of wild idea for extension security) -- I'm talking about just how much logic is fully moved outside of Safari. Adguard was (I haven't checked in a while, maybe it still is) one of the more popular Safari content blockers for Mac, and it shipped with an Electron app -- and one that had to actually be running with a tray icon and everything at the same time as the browser. This is not a model that any other browser maker should be trying to copy. I feel like if we're looking at browser adblockers and they're setting up system trays and system-level proxies just so they can do basic stuff like HTML rewriting, then that's not something the browser maker should be proud of. Congrats, people can't spy on your browser's web-traffic anymore, instead they have to MITM their entire computer. It's possible to make something so restrictive that the end result is that people are actually less secure, because they're forced to compromise security at much lower levels in order to get that basic functionality back. Safari's current extension ecosystem is a great example of that.