4 ms·

> Anyone jumping up and down about MV3 while using Mac or iOS are hypocrites, since MV3 is essentially doing the same thing Safari did years ago, iOS I'll give

> Anyone jumping up and down about MV3 while using Mac or iOS are hypocrites, since MV3 is essentially doing the same thing Safari did years ago, iOS I'll give you, but macOS can in fact run ex. Firefox. > finally matching the security and the privacy in that regard. "Matching" inferior security+privacy is not a good thing. The only way this is an improvement if you think the blockers are malicious; otherwise a useful tool in the users interest has been made less powerful.

drivebycomment 2y ago
One of the most common API malware extensions use is what MV3 blocks, and adblock extension is one of the common malware vectors: https://helpcenter.getadblock.com/hc/en-us/articles/9738476845203-Concerns-about-AdBlock-and-malware https://helpcenter.getadblock.com/hc/en-us/articles/97384768... https://www.wired.com/story/fake-chrome-extensions-malware/ https://www.wired.com/story/fake-chrome-extensions-malware/ This has been never ending.
- yjftsjthsd-h 2y ago
  Okay, if you absolutely must then make that specific API require extra audit approval from the extension store, but breaking it outright is throwing out the baby with the bathwater; in a world where the FBI outright recommends an adblocker because ads are such a strong malware vector ( https://techcrunch.com/2022/12/22/fbi-ad-blocker/ https://techcrunch.com/2022/12/22/fbi-ad-blocker/ ), it's irresponsible to undermine uBo.
  - kccqzy 2y ago
    Nobody likes extra audit approvals. The platform doesn't want to spend resources doing the audit. The developers don't want to be audited. The Firefox version of uBlock Origin Lite was pulled due to unsatisfactory audit process: https://news.ycombinator.com/item?id=41707418 https://news.ycombinator.com/item?id=41707418
    - Dylan16807 2y ago
      > The Firefox version of uBlock Origin Lite was pulled due to unsatisfactory audit process So make one that isn't incompetent? That's not really a counterargument to the general idea.
kuhsaft 2y ago
> The only way this is an improvement if you think the blockers are malicious Extensions and in turn MV2 blockers can easily be malicious. https://usa.kaspersky.com/blog/dangerous-chrome-extensions-87-million/28561/ https://usa.kaspersky.com/blog/dangerous-chrome-extensions-8... Look at how many in Kaspersky’s list are advertised as ad blockers. The majority of users aren’t tech savvy like HN.
- yjftsjthsd-h 2y ago
  > Look at how many in Kaspersky’s list are advertised as ad blockers By my count 5, 6 if we include "Autoskip for Youtube", out of 34. That might be an argument for dropping extensions, but I don't think it's an argument for breaking ad blockers.
  - kuhsaft 2y ago
    > That might be an argument for dropping extensions Those extensions used the same API that ad blockers used, but for malicious purposes. So, you would support removing that API? Well, that’s what they did for MV3 and implemented an API just for ad blocking.
    - yjftsjthsd-h 2y ago
      > Those extensions used the same API that ad blockers used, but for malicious purposes. Sounds like an obvious chance to flag the extension for further review, and probably a warning on the user side. > So, you would support removing that API? Of course not; that's throwing out the baby with the bath water. This brings us back to the "further review" thing; there's plenty of precedent for a platform having API surface that only a smaller subset of apps/extensions are allowed to use, because the features it exposes are legitimately needed for some things but it could be abused so it gets flagged and you have to write a detailed explanation for why your thing really needs this permission and then the reviewers can look at it particularly closely. > Well, that’s what they did for MV3 and implemented an API just for ad blocking. And then for bonus points they hobbled it so that it couldn't be used to make as good of ad blockers, which is why the whole thing is not okay.

drivebycomment 2y ago

One of the most common API malware extensions use is what MV3 blocks, and adblock extension is one of the common malware vectors: https://helpcenter.getadblock.com/hc/en-us/articles/9738476845203-Concerns-about-AdBlock-and-malware https://helpcenter.getadblock.com/hc/en-us/articles/97384768... https://www.wired.com/story/fake-chrome-extensions-malware/ https://www.wired.com/story/fake-chrome-extensions-malware/ This has been never ending.

yjftsjthsd-h 2y ago
Okay, if you absolutely must then make that specific API require extra audit approval from the extension store, but breaking it outright is throwing out the baby with the bathwater; in a world where the FBI outright recommends an adblocker because ads are such a strong malware vector ( https://techcrunch.com/2022/12/22/fbi-ad-blocker/ https://techcrunch.com/2022/12/22/fbi-ad-blocker/ ), it's irresponsible to undermine uBo.
- kccqzy 2y ago
  Nobody likes extra audit approvals. The platform doesn't want to spend resources doing the audit. The developers don't want to be audited. The Firefox version of uBlock Origin Lite was pulled due to unsatisfactory audit process: https://news.ycombinator.com/item?id=41707418 https://news.ycombinator.com/item?id=41707418
  - Dylan16807 2y ago
    > The Firefox version of uBlock Origin Lite was pulled due to unsatisfactory audit process So make one that isn't incompetent? That's not really a counterargument to the general idea.

kuhsaft 2y ago

> The only way this is an improvement if you think the blockers are malicious Extensions and in turn MV2 blockers can easily be malicious. https://usa.kaspersky.com/blog/dangerous-chrome-extensions-87-million/28561/ https://usa.kaspersky.com/blog/dangerous-chrome-extensions-8... Look at how many in Kaspersky’s list are advertised as ad blockers. The majority of users aren’t tech savvy like HN.

yjftsjthsd-h 2y ago
> Look at how many in Kaspersky’s list are advertised as ad blockers By my count 5, 6 if we include "Autoskip for Youtube", out of 34. That might be an argument for dropping extensions, but I don't think it's an argument for breaking ad blockers.
- kuhsaft 2y ago
  > That might be an argument for dropping extensions Those extensions used the same API that ad blockers used, but for malicious purposes. So, you would support removing that API? Well, that’s what they did for MV3 and implemented an API just for ad blocking.
  - yjftsjthsd-h 2y ago
    > Those extensions used the same API that ad blockers used, but for malicious purposes. Sounds like an obvious chance to flag the extension for further review, and probably a warning on the user side. > So, you would support removing that API? Of course not; that's throwing out the baby with the bath water. This brings us back to the "further review" thing; there's plenty of precedent for a platform having API surface that only a smaller subset of apps/extensions are allowed to use, because the features it exposes are legitimately needed for some things but it could be abused so it gets flagged and you have to write a detailed explanation for why your thing really needs this permission and then the reviewers can look at it particularly closely. > Well, that’s what they did for MV3 and implemented an API just for ad blocking. And then for bonus points they hobbled it so that it couldn't be used to make as good of ad blockers, which is why the whole thing is not okay.