6 ms·

Google's 7-year slog to improve Chrome extensions hasn't satisfied developers

51 points by lapcat 2y ago

tetris11 2y ago
Prefacing every statement with "In fact,..." does nothing to assure me that you have creators interests at heart.
- SpicyLemonZest 2y ago
  They don't and shouldn't. Developer relations are great, but Chrome's users are the most important consumers of extensions and their interests should be prioritized over those of developers. I understand why it might be convenient for AdGuard to use a "QuickFixes filter" which changes the functionality of their extension without having to push a formal upgrade, but it seems like Chrome is right to identify this as a vector where unaudited code might arrive in the trusted Chrome sandbox.
  - ghostwords 2y ago
    It's funny how a legitimate ad blocker suffers from zealous enforcement while malicious extensions are generally fine. For instance: https://palant.info/2025/01/13/chrome-web-store-is-a-mess/ https://palant.info/2025/01/13/chrome-web-store-is-a-mess/
    - SpicyLemonZest 2y ago
      Not really? One of the design goals of MV3 is to reduce the ubiquity of the "Read and change all your data on all websites" permission which shady apps like Refoorest and Karma pretty much always require. The article makes hay of the fact that Karma has pathways available to exfiltrate your data and you have to trust they're handling it responsibly, but in Manifest v2 that was true of basically all ad blockers as well. In a world where ad blockers and other responsibly written extensions don't expect to proxy all web requests, I think a lot fewer people will grant this permission to a "plant trees for free" extension.
      - ghostwords 2y ago
        I'm not talking about a fantasy future world but the world we have today. Chrome Web Store reviewers have been letting malicious extensions slide for years, and Manifest V3 did nothing to change that.
        SpicyLemonZest 2y ago
        What it changed for me personally is that I'm no longer exposed to such extensions because I don't grant any extension permissions which would allow malicious activity. I'm sure Raymond Hill is right that some functionality couldn't make it to his MV3 adblocker, but whatever it is I'm not missing it.
        ghostwords 2y ago
        Yeah I get it, but I think we're talking past each other. You're a knowledgeable user and the new APIs made it possible not to worry about uBlock getting hijacked. I'm an extension developer, and I see an appalling disconnect between what Google says and the reality of Chrome extensions and Chrome Web Store for regular (non-technical) users.
        ghostwords 2y ago
        >some functionality couldn't make it to his MV3 adblocker One of the things that didn't make it is the entire request control dashboard. No more granular reporting or controls, at all. No more "medium mode" or "hard mode" (blocking unknown domains by default and making exceptions as you go). Sure, if you didn't use it before, you won't miss it.
Justsignedup 2y ago
Wait, has anyone had any illusion that google wanted to continue to allow developers to make good content filtering? They are in a full-blown war against adblocking.
- tmpz22 2y ago
  Devil's advocate: the main objective was to limit full read access required by many extensions and naively installed by most users. There was no way to facilitate traditional content blocking AND achieve that objective.
  - lapcat 2y ago
    > Devil's advocate Why do people use this phrase? Do you believe what you said in your comment? If so, why not accept attribution to yourself? If not, then perhaps you should make a counterargument to balance out the "Devil".
    - vosper 2y ago
      > Why do people use this phrase? Google are being depicted as the bad guys (devil) in the original comment, and the person you're replying to was advocating for Google's stated position of trying to improve user security. They were being an advocate for the devil. Is this not pretty much a perfect use of the saying? > why not accept attribution to yourself? Because this is Google's claim, being repeated here by their advocate. > If not, then perhaps you should make a counterargument to balance out the "Devil". The counterargument was the very first comment saying that the changes are really about adblocking. Google's statement on Manifest V3: > Manifest V3 aims to be the first step in our platform vision to improve the privacy, security, and performance of extensions. Along with the platform changes, we are working to give users more understanding and control over what extensions are capable of. The changes will take several years to complete.
      - lapcat 2y ago
        No, there's a big difference between (1) "Devil's advocate: X" and (2) "Google said X". If someone just means (2), that's unexceptional, but the use of the phrase "Devil's advocate" in that case is unnecessary, misleading, and weird.
jeffbee 2y ago
MV3 hasn't satisfied developers because it is intended to help users and, to a significant extent, thwart developers. Many things that many developers want to do are bad for users, so you can't take both sides simultaneously. I am glad Google is on the side of the users.
- grayhatter 2y ago
  Some users. I a former user, had no problem with MV2 and have many problems with MV3. It's remarkable how this is in support of users who don't understand the implications of this compulsory upgrade, somehow excluding the interests of users who do understand the implications of the change.
- croes 2y ago
  Many things developers wanted to help users are made impossible by MV3. That’s bad for the users.
blibble 2y ago
> AdGuard, a privacy service that makes an ad blocking extension for Chrome and related applications, recently complained that MV3 is making it hard to deliver its desired features. > In late January the company reported that Chrome's remote code execution policy under Manifest V3 (MV3), the revamped API for writing browser extensions, has forced it to remove its Quick Fixes filter and temporarily drop its Custom filter. > The Quick Fixes filter is used to quickly resolve critical content filtering issues on popular websites without having to upgrade AdGuard’s extension. well yes, that's the entire point, giving Google control of updates this way they can push out a youtube release with an ad blocker detection update then sit on extension updates until they're ready to push out another youtube release with a different way of detecting ad blockers result: ad blockers on Google properties effectively and completely extinguished if you haven't done it already: get your friends and family onto Firefox, now

51 points by lapcat 2y ago

tetris11 2y ago

Prefacing every statement with "In fact,..." does nothing to assure me that you have creators interests at heart.

SpicyLemonZest 2y ago
They don't and shouldn't. Developer relations are great, but Chrome's users are the most important consumers of extensions and their interests should be prioritized over those of developers. I understand why it might be convenient for AdGuard to use a "QuickFixes filter" which changes the functionality of their extension without having to push a formal upgrade, but it seems like Chrome is right to identify this as a vector where unaudited code might arrive in the trusted Chrome sandbox.
- ghostwords 2y ago
  It's funny how a legitimate ad blocker suffers from zealous enforcement while malicious extensions are generally fine. For instance: https://palant.info/2025/01/13/chrome-web-store-is-a-mess/ https://palant.info/2025/01/13/chrome-web-store-is-a-mess/
  - SpicyLemonZest 2y ago
    Not really? One of the design goals of MV3 is to reduce the ubiquity of the "Read and change all your data on all websites" permission which shady apps like Refoorest and Karma pretty much always require. The article makes hay of the fact that Karma has pathways available to exfiltrate your data and you have to trust they're handling it responsibly, but in Manifest v2 that was true of basically all ad blockers as well. In a world where ad blockers and other responsibly written extensions don't expect to proxy all web requests, I think a lot fewer people will grant this permission to a "plant trees for free" extension.
    - ghostwords 2y ago
      I'm not talking about a fantasy future world but the world we have today. Chrome Web Store reviewers have been letting malicious extensions slide for years, and Manifest V3 did nothing to change that.
      - SpicyLemonZest 2y ago
        What it changed for me personally is that I'm no longer exposed to such extensions because I don't grant any extension permissions which would allow malicious activity. I'm sure Raymond Hill is right that some functionality couldn't make it to his MV3 adblocker, but whatever it is I'm not missing it.
        ghostwords 2y ago
        Yeah I get it, but I think we're talking past each other. You're a knowledgeable user and the new APIs made it possible not to worry about uBlock getting hijacked. I'm an extension developer, and I see an appalling disconnect between what Google says and the reality of Chrome extensions and Chrome Web Store for regular (non-technical) users.
        ghostwords 2y ago
        >some functionality couldn't make it to his MV3 adblocker One of the things that didn't make it is the entire request control dashboard. No more granular reporting or controls, at all. No more "medium mode" or "hard mode" (blocking unknown domains by default and making exceptions as you go). Sure, if you didn't use it before, you won't miss it.

Justsignedup 2y ago

Wait, has anyone had any illusion that google wanted to continue to allow developers to make good content filtering? They are in a full-blown war against adblocking.

tmpz22 2y ago
Devil's advocate: the main objective was to limit full read access required by many extensions and naively installed by most users. There was no way to facilitate traditional content blocking AND achieve that objective.
- lapcat 2y ago
  > Devil's advocate Why do people use this phrase? Do you believe what you said in your comment? If so, why not accept attribution to yourself? If not, then perhaps you should make a counterargument to balance out the "Devil".
  - vosper 2y ago
    > Why do people use this phrase? Google are being depicted as the bad guys (devil) in the original comment, and the person you're replying to was advocating for Google's stated position of trying to improve user security. They were being an advocate for the devil. Is this not pretty much a perfect use of the saying? > why not accept attribution to yourself? Because this is Google's claim, being repeated here by their advocate. > If not, then perhaps you should make a counterargument to balance out the "Devil". The counterargument was the very first comment saying that the changes are really about adblocking. Google's statement on Manifest V3: > Manifest V3 aims to be the first step in our platform vision to improve the privacy, security, and performance of extensions. Along with the platform changes, we are working to give users more understanding and control over what extensions are capable of. The changes will take several years to complete.
    - lapcat 2y ago
      No, there's a big difference between (1) "Devil's advocate: X" and (2) "Google said X". If someone just means (2), that's unexceptional, but the use of the phrase "Devil's advocate" in that case is unnecessary, misleading, and weird.

jeffbee 2y ago

MV3 hasn't satisfied developers because it is intended to help users and, to a significant extent, thwart developers. Many things that many developers want to do are bad for users, so you can't take both sides simultaneously. I am glad Google is on the side of the users.

grayhatter 2y ago
Some users. I a former user, had no problem with MV2 and have many problems with MV3. It's remarkable how this is in support of users who don't understand the implications of this compulsory upgrade, somehow excluding the interests of users who do understand the implications of the change.
croes 2y ago
Many things developers wanted to help users are made impossible by MV3. That’s bad for the users.

blibble 2y ago

> AdGuard, a privacy service that makes an ad blocking extension for Chrome and related applications, recently complained that MV3 is making it hard to deliver its desired features. > In late January the company reported that Chrome's remote code execution policy under Manifest V3 (MV3), the revamped API for writing browser extensions, has forced it to remove its Quick Fixes filter and temporarily drop its Custom filter. > The Quick Fixes filter is used to quickly resolve critical content filtering issues on popular websites without having to upgrade AdGuard’s extension. well yes, that's the entire point, giving Google control of updates this way they can push out a youtube release with an ad blocker detection update then sit on extension updates until they're ready to push out another youtube release with a different way of detecting ad blockers result: ad blockers on Google properties effectively and completely extinguished if you haven't done it already: get your friends and family onto Firefox, now