3 ms·

On the contrary, MV2 used onBeforeRequest which let extensions see what requests you were making. They could then take that data and use it for malicious purpos

On the contrary, MV2 used onBeforeRequest which let extensions see what requests you were making. They could then take that data and use it for malicious purposes. MV3 doesn’t allow extensions to know what requests are being made, so extensions can’t use your data maliciously. Requests to ads that are blocked are blocked. I think you’re thinking of Privacy-preserving ad measurement which is an option in Firefox and Safari. https://support.mozilla.org/en-US/kb/privacy-preserving-attribution https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

GeoAtreides 2y ago
but op wasn't talking about what extensions are seeing, but what the ad servers do. You haven't address their point at all
sunshowers 2y ago
Doesn't onBeforeRequest still exist in Manifest v3? The thing that's been removed is the ability to block on it, not the ability to register handlers for requests.
- kuhsaft 2y ago
  It still exists, but now “ad blockers” can’t use the blocking API to record and forward metrics on hits. Ad blockers don’t even need the webRequest and webRequestBlocking permissions anymore. Now, if an ad blocker has webRequest permissions it’s a red flag. For example https://developer.chrome.com/docs/extensions/develop/concepts/content-filtering#adapt_rules_based_on_observed_requests https://developer.chrome.com/docs/extensions/develop/concept... uses webRequest to send telemetry back to some remote server.
  - sunshowers 2y ago
    Thanks, I see how that can help. With Manifest v3, let's say I'm an ad blocker and I want to get access to metrics not to violate privacy, but just to report them to the user (X domains blocked, Y out of Z requests blocked, etc). How would I get access to those metrics?
    - kuhsaft 2y ago
      Separate permission for debugging only available for development essentially. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/declarativeNetRequest#testing https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... Otherwise, you can’t really without more invasive permissions. https://stackoverflow.com/questions/74813523/chrome-extension-declarativenetrequest-get-notified-on-request-blocked https://stackoverflow.com/questions/74813523/chrome-extensio...
      - sunshowers 2y ago
        Oh wow, that's wild. Closing the loop on reporting things is such an important part of a trustworthy user experience.
throwaway98346 2y ago
> On the contrary, MV2 used onBeforeRequest which let extensions see what requests you were making. They could then take that data and use it for malicious purposes. Which is something we know for a fact uBlock Origin doesn't do. It's open source, you can check the code yourself. MV3, on the other hand, doesn't do much to assure me that an addon isn't phoning home. Why not just give the user to ability to block network requests on a per-addon basis? Too difficult a task for the trillion dollar company? Or could it be that forcing users to switch to MV3 addons isn't about safety at all?

GeoAtreides 2y ago

but op wasn't talking about what extensions are seeing, but what the ad servers do. You haven't address their point at all

sunshowers 2y ago

Doesn't onBeforeRequest still exist in Manifest v3? The thing that's been removed is the ability to block on it, not the ability to register handlers for requests.

kuhsaft 2y ago
It still exists, but now “ad blockers” can’t use the blocking API to record and forward metrics on hits. Ad blockers don’t even need the webRequest and webRequestBlocking permissions anymore. Now, if an ad blocker has webRequest permissions it’s a red flag. For example https://developer.chrome.com/docs/extensions/develop/concepts/content-filtering#adapt_rules_based_on_observed_requests https://developer.chrome.com/docs/extensions/develop/concept... uses webRequest to send telemetry back to some remote server.
- sunshowers 2y ago
  Thanks, I see how that can help. With Manifest v3, let's say I'm an ad blocker and I want to get access to metrics not to violate privacy, but just to report them to the user (X domains blocked, Y out of Z requests blocked, etc). How would I get access to those metrics?
  - kuhsaft 2y ago
    Separate permission for debugging only available for development essentially. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/declarativeNetRequest#testing https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... Otherwise, you can’t really without more invasive permissions. https://stackoverflow.com/questions/74813523/chrome-extension-declarativenetrequest-get-notified-on-request-blocked https://stackoverflow.com/questions/74813523/chrome-extensio...
    - sunshowers 2y ago
      Oh wow, that's wild. Closing the loop on reporting things is such an important part of a trustworthy user experience.

throwaway98346 2y ago

> On the contrary, MV2 used onBeforeRequest which let extensions see what requests you were making. They could then take that data and use it for malicious purposes. Which is something we know for a fact uBlock Origin doesn't do. It's open source, you can check the code yourself. MV3, on the other hand, doesn't do much to assure me that an addon isn't phoning home. Why not just give the user to ability to block network requests on a per-addon basis? Too difficult a task for the trillion dollar company? Or could it be that forcing users to switch to MV3 addons isn't about safety at all?