4 ms·

Prefacing every statement with "In fact,..." does nothing to assure me that you have creators interests at heart.

SpicyLemonZest 2y ago
They don't and shouldn't. Developer relations are great, but Chrome's users are the most important consumers of extensions and their interests should be prioritized over those of developers. I understand why it might be convenient for AdGuard to use a "QuickFixes filter" which changes the functionality of their extension without having to push a formal upgrade, but it seems like Chrome is right to identify this as a vector where unaudited code might arrive in the trusted Chrome sandbox.
- ghostwords 2y ago
  It's funny how a legitimate ad blocker suffers from zealous enforcement while malicious extensions are generally fine. For instance: https://palant.info/2025/01/13/chrome-web-store-is-a-mess/ https://palant.info/2025/01/13/chrome-web-store-is-a-mess/
  - SpicyLemonZest 2y ago
    Not really? One of the design goals of MV3 is to reduce the ubiquity of the "Read and change all your data on all websites" permission which shady apps like Refoorest and Karma pretty much always require. The article makes hay of the fact that Karma has pathways available to exfiltrate your data and you have to trust they're handling it responsibly, but in Manifest v2 that was true of basically all ad blockers as well. In a world where ad blockers and other responsibly written extensions don't expect to proxy all web requests, I think a lot fewer people will grant this permission to a "plant trees for free" extension.
    - ghostwords 2y ago
      I'm not talking about a fantasy future world but the world we have today. Chrome Web Store reviewers have been letting malicious extensions slide for years, and Manifest V3 did nothing to change that.
      - SpicyLemonZest 2y ago
        What it changed for me personally is that I'm no longer exposed to such extensions because I don't grant any extension permissions which would allow malicious activity. I'm sure Raymond Hill is right that some functionality couldn't make it to his MV3 adblocker, but whatever it is I'm not missing it.
        ghostwords 2y ago
        Yeah I get it, but I think we're talking past each other. You're a knowledgeable user and the new APIs made it possible not to worry about uBlock getting hijacked. I'm an extension developer, and I see an appalling disconnect between what Google says and the reality of Chrome extensions and Chrome Web Store for regular (non-technical) users.
        ghostwords 2y ago
        >some functionality couldn't make it to his MV3 adblocker One of the things that didn't make it is the entire request control dashboard. No more granular reporting or controls, at all. No more "medium mode" or "hard mode" (blocking unknown domains by default and making exceptions as you go). Sure, if you didn't use it before, you won't miss it.

They don't and shouldn't. Developer relations are great, but Chrome's users are the most important consumers of extensions and their interests should be prioritized over those of developers. I understand why it might be convenient for AdGuard to use a "QuickFixes filter" which changes the functionality of their extension without having to push a formal upgrade, but it seems like Chrome is right to identify this as a vector where unaudited code might arrive in the trusted Chrome sandbox.

ghostwords 2y ago
It's funny how a legitimate ad blocker suffers from zealous enforcement while malicious extensions are generally fine. For instance: https://palant.info/2025/01/13/chrome-web-store-is-a-mess/ https://palant.info/2025/01/13/chrome-web-store-is-a-mess/
- SpicyLemonZest 2y ago
  Not really? One of the design goals of MV3 is to reduce the ubiquity of the "Read and change all your data on all websites" permission which shady apps like Refoorest and Karma pretty much always require. The article makes hay of the fact that Karma has pathways available to exfiltrate your data and you have to trust they're handling it responsibly, but in Manifest v2 that was true of basically all ad blockers as well. In a world where ad blockers and other responsibly written extensions don't expect to proxy all web requests, I think a lot fewer people will grant this permission to a "plant trees for free" extension.
  - ghostwords 2y ago
    I'm not talking about a fantasy future world but the world we have today. Chrome Web Store reviewers have been letting malicious extensions slide for years, and Manifest V3 did nothing to change that.
    - SpicyLemonZest 2y ago
      What it changed for me personally is that I'm no longer exposed to such extensions because I don't grant any extension permissions which would allow malicious activity. I'm sure Raymond Hill is right that some functionality couldn't make it to his MV3 adblocker, but whatever it is I'm not missing it.
      - ghostwords 2y ago
        Yeah I get it, but I think we're talking past each other. You're a knowledgeable user and the new APIs made it possible not to worry about uBlock getting hijacked. I'm an extension developer, and I see an appalling disconnect between what Google says and the reality of Chrome extensions and Chrome Web Store for regular (non-technical) users.
      - ghostwords 2y ago
        >some functionality couldn't make it to his MV3 adblocker One of the things that didn't make it is the entire request control dashboard. No more granular reporting or controls, at all. No more "medium mode" or "hard mode" (blocking unknown domains by default and making exceptions as you go). Sure, if you didn't use it before, you won't miss it.