8 ms·

Chrome disabling uBlock Origin is a serious security threat

100 points by ewenquim 2y ago

ewenquim 2y ago
[flagged]
deleted 2y ago
[deleted]
G_o_D 2y ago
[flagged]
- ewenquim 2y ago
  That's horrible.
maximecrp 2y ago
For those who can, i'd say migrate to firefox-based privacy respecting browsers (librewolf, zen, waterfox, ironfox, ...) And help those who can't find alternatives to uBlock Origin and keep some of their privacy
- deleted 2y ago
  [deleted]
- paulryanrogers 2y ago
  Security fixes to Firefox may take days or weeks to reach downstream forks. That tradeoff may be worse than just setting them up with some privacy settings in Firefox itself.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
irjustin 2y ago
I'll go against the grain and say this is not a security threat. if missing ublock is a true security concern you shouldn't be using chrome. Because the opposite is not true - that chrome+ublock is keeping you secure from tracking. We just don't want to see ads. Isn't that enough?
- nijave 2y ago
  Not a big deal on the desktop and a small deal on the laptop, ad blocking gives a noticeable performance gain on Android. Years ago when I had one of those Intel Atom netbooks you could tell a pretty big difference since it was pretty RAM constrained.
  - everdrive 2y ago
    This is unpopular every time I say it, but by in large people just shouldn't be browsing the web on mobile. Every single aspect of the experience is worse, and is likely to continue to get worse over time: - tiny phone screen - objectively worse mobile-site - far worse touch-screen-based UI - the entire iOS side of things has far fewer choices for any sort of effective ad blocking Is it possible for a savvy technologist to overcome these problems? Yes, but it's like disabling junk in Windows: you're playing a game of cat and mouse and slowly losing the battle over time.
    - eek2121 2y ago
      Disagree. Most of my web browsing is done on mobile (iPhone). iOS has many different ad blockers, including system wide ones that are VPN based. I use a good one that even blocks Youtube ads.
    - jraph 2y ago
      > This is unpopular every time I say it Speaking for me, but this might be because while your points are valid: > Every single aspect of the experience is worse this is wrong (I can tell you that when my SO falls asleep hugging me in the bed, the mobile is a far better experience than a laptop to browse the web for instance - the tiny screen is a feature in this case), and it seems you are missing the elephants in the room that explain why people are using mobile despite those issues, and you are not addressing the use cases. This makes your comment read like you are disconnected from reality. You might not be wrong, and it might just be a matter of changing the perspective a bit. In the new perspective, you would show that you understand why people actually browse the web on mobile and address the issues from there. "You should not browse the web from a mobile" doesn't help at all. Most people do it, and although it's imperfect, people seem to go on on their lives anyway. You probably need to motivate your view a bit more (so we can go from "is it indeed the case that we should stop browsing the web from a mobile?" to "this person is right, we should definitely stop doing this, what now?"), and address the specific use cases where people use the mobile and provide alternatives. Alternatives like "just don't browse at the bus stop, allow your mind to be bored / to relax a bit" are perfectly valid. One can disagree with the proposal, but that's one solution.
TekMol 2y ago
I guess it would be easy to block ads via a proxy? An http proxy in Python is just a few lines of code. It could simply drop the requests to known ad servers. And in Chrome, there is a setting to use a proxy. So all one had to do is run ./my_ad_blocking_proxy.py and set the proxy in Chrome to something like 127.0.0.1:8080?
- salzig 2y ago
  up next: chrome ignores proxy configurations if content is available without.
  - speckx 2y ago
    I thought chrome was already doing this for some google domains and using their own DNS vs. the operating DNS? Maybe I’m wrong, but I thought this was a thing.
- ewenquim 2y ago
  Good idea! But I'll have to install this on my relative's computer or router, that's not as convenient as a browser extension
  - tkzed49 2y ago
    I run a pihole and I don't regret it, but it's nowhere near ublock in capability. Ublock's more important filters are selecting individual scripts and even page elements.
- ale42 2y ago
  This is what I was doing around 25 years ago before ad blockers were a thing, and the web was not encrypted... (Python didn't exist yet, the proxy was a lot of code in Object Pascal, i.e. Delphi)
- Fokamul 2y ago
  Nope, cannot be done like this. You can block just some of the ADs on websites. But for example YouTube requests for video chunks, is same domain as ADs. So you would have Youtube with ADs. Much easier solution, which everyone should made years ago, STOP using Chrome crapbrowser.
asterios33 2y ago
"There are a few alternatives available. Unfortunately, moving to Firefox may not be a viable option for her, especially given Mozilla’s recent behavior." The world has gone crazy. So this relative has casually used the most bloated spyware disguised as a browser for literally a decade, but she can't switch to firefox because 'Mozilla’s recent behavior'.
- phito 2y ago
  It's crazy the mental gymnastics people will go through to justify not using Firefox. They should just be honest and say they're too lazy to switch.
  - nijave 2y ago
    I've been using Firefox for nearly 15 years and there's technical reasons, too. Mainly memory leaks (which I haven't noticed for a few years anymore) and loading just "feels" slower. Webrender with GPU acceleration helped but it was much more complicated poking at about:config than it "just working" Recently, I've noticed a "this SaaS only works in Chrome" trend again. Usually that means "only works in Blink" but it still sucks if you need to use SaaS (for work) that has this silly limitation. I've noticed cheaper restaurant web ordering software tends to have problems in Firefox. For technical or even semi-technical folks those aren't an issue. For non-technical folks, those issues above can easily lead to a poorer web experience without them understanding why. On the other hand, the author didn't actually call out technical issues
    - madeofpalk 2y ago
      You'll be happy to know that recently I shipped a bug that only crashes (in) Chrome, but not Firefox, because I only really develop in Firefox.
      - paulryanrogers 2y ago
        Wow, crashes all of Chrome and not only the tab process?
Havoc 2y ago
It's probably a threat to your mind & sanity more than security. This is very obviously aimed at streaming more ads into your head. I don't doubt google's security/engineering chops but if google could prop up your eyelids with toothpicks to ensure continuous ad watching they would...
- ewenquim 2y ago
  Yeah but that's another topic (maybe more important, but less immediate and actionnable). yesterday my relative just downloaded a malware. That's something we can do something about!
  - Gigachad 2y ago
    Some people would just be better off with an iPad where you can't download malware.
baq 2y ago
Sad realization: blocking ad blockers is copy protection from a decade or two ago and blocking ads is nowadays basically cracking websites and browsers.
- pacifika 2y ago
  HTML is a human readable source editable interactive document format, which can be optimised for reading. When I peel an apple to optimise it for eating I’m not cracking an apple.
  - baq 2y ago
    Good luck doing that on a WASM <canvas>
junglistguy 2y ago
[dead]
tim333 2y ago
They don't mention uBlock Origin Lite which does much the same and works with v3. It's a bit disingenuous not to do so.
- timbit42 2y ago
  I have clients who use Chrome and when uBO was removed, I installed the Lite version and now some of them have gotten malware. It's not good enough. Will need to switch to another browser.
- ewenquim 2y ago
  I just didn't know. Thanks for the info, I'll have a look at it!
kennysoona 2y ago
It really isn't, because Lite is practically as effective, just less efficient.
exiguus 2y ago
I stopped using Google services at the beginning of this year. I transitioned from Chrome to Firefox and from a standard Android device to one without Google accounts and apps. While this setup is suitable for tech-savvy individuals, it can be challenging for someone like my mom. To address this, I bought her a Fairphone with a de-googled Android operating system installed out of the box. This solution works well, especially for those who prefer not to use Apple products. For enhanced ad-blocking and security, I set up an OpenWRT router in front of the provider's router. This includes features like Adblock, DNS over HTTPS (DoH), DNS over TLS (DoT), and DNSCrypt. This setup has been running smoothly in my parents' house for over three years without any issues.
exiguus 2y ago
I am confused. uBlock Origin is still available in the webstore <https://chromewebstore.google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm https://chromewebstore.google.com/detail/ublock-origin/cjpal...>. Do we talk about the same extension and/or is it just disabled for Chrome and not for Chromium/Brave etc.? Just curious.
- exiguus 2y ago
  I answered the questions half way myself.The ext. gets disabled because it is manifest 2 not manifest 3. Manifest 2 will be disabled by ~mid 2025 in the Store. Seeing: seeing https://github.com/uBlockOrigin/uBlock-issues/wiki/About-Google-Chrome's-%22This-extension-may-soon-no-longer-be-supported%22 https://github.com/uBlockOrigin/uBlock-issues/wiki/About-Goo... And asking: What are the diff between manifest 2 and manifest 3 ext? Answer: https://chat.mistral.ai/chat/9e66fbc8-0df2-4248-a252-5acb6fb6700c https://chat.mistral.ai/chat/9e66fbc8-0df2-4248-a252-5acb6fb... What is the problem to move to M3? And why is this a ban?
1vuio0pswjnm7 2y ago
Maybe in part due to regulatory pressures over privacy, IDN, Chrome includes "site settings" to disable Javascript, etc. on a site by suite basis. It also includes "request blocking" in DevTools. These settings can provide some of the blocking that uBlock provides. To some this can be quite useful. Why there is no way to export and import these settings. It is commmon with open source mobile apps in the www/networking category for example to have the ability to import and export settings.

100 points by ewenquim 2y ago

ewenquim 2y ago

[flagged]

deleted 2y ago

[deleted]

G_o_D 2y ago

[flagged]

ewenquim 2y ago
That's horrible.

maximecrp 2y ago

For those who can, i'd say migrate to firefox-based privacy respecting browsers (librewolf, zen, waterfox, ironfox, ...) And help those who can't find alternatives to uBlock Origin and keep some of their privacy

deleted 2y ago
[deleted]
paulryanrogers 2y ago
Security fixes to Firefox may take days or weeks to reach downstream forks. That tradeoff may be worse than just setting them up with some privacy settings in Firefox itself.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

irjustin 2y ago

I'll go against the grain and say this is not a security threat. if missing ublock is a true security concern you shouldn't be using chrome. Because the opposite is not true - that chrome+ublock is keeping you secure from tracking. We just don't want to see ads. Isn't that enough?

nijave 2y ago
Not a big deal on the desktop and a small deal on the laptop, ad blocking gives a noticeable performance gain on Android. Years ago when I had one of those Intel Atom netbooks you could tell a pretty big difference since it was pretty RAM constrained.
- everdrive 2y ago
  This is unpopular every time I say it, but by in large people just shouldn't be browsing the web on mobile. Every single aspect of the experience is worse, and is likely to continue to get worse over time: - tiny phone screen - objectively worse mobile-site - far worse touch-screen-based UI - the entire iOS side of things has far fewer choices for any sort of effective ad blocking Is it possible for a savvy technologist to overcome these problems? Yes, but it's like disabling junk in Windows: you're playing a game of cat and mouse and slowly losing the battle over time.
  - eek2121 2y ago
    Disagree. Most of my web browsing is done on mobile (iPhone). iOS has many different ad blockers, including system wide ones that are VPN based. I use a good one that even blocks Youtube ads.
  - jraph 2y ago
    > This is unpopular every time I say it Speaking for me, but this might be because while your points are valid: > Every single aspect of the experience is worse this is wrong (I can tell you that when my SO falls asleep hugging me in the bed, the mobile is a far better experience than a laptop to browse the web for instance - the tiny screen is a feature in this case), and it seems you are missing the elephants in the room that explain why people are using mobile despite those issues, and you are not addressing the use cases. This makes your comment read like you are disconnected from reality. You might not be wrong, and it might just be a matter of changing the perspective a bit. In the new perspective, you would show that you understand why people actually browse the web on mobile and address the issues from there. "You should not browse the web from a mobile" doesn't help at all. Most people do it, and although it's imperfect, people seem to go on on their lives anyway. You probably need to motivate your view a bit more (so we can go from "is it indeed the case that we should stop browsing the web from a mobile?" to "this person is right, we should definitely stop doing this, what now?"), and address the specific use cases where people use the mobile and provide alternatives. Alternatives like "just don't browse at the bus stop, allow your mind to be bored / to relax a bit" are perfectly valid. One can disagree with the proposal, but that's one solution.

TekMol 2y ago

I guess it would be easy to block ads via a proxy? An http proxy in Python is just a few lines of code. It could simply drop the requests to known ad servers. And in Chrome, there is a setting to use a proxy. So all one had to do is run ./my_ad_blocking_proxy.py and set the proxy in Chrome to something like 127.0.0.1:8080?

salzig 2y ago
up next: chrome ignores proxy configurations if content is available without.
- speckx 2y ago
  I thought chrome was already doing this for some google domains and using their own DNS vs. the operating DNS? Maybe I’m wrong, but I thought this was a thing.
ewenquim 2y ago
Good idea! But I'll have to install this on my relative's computer or router, that's not as convenient as a browser extension
- tkzed49 2y ago
  I run a pihole and I don't regret it, but it's nowhere near ublock in capability. Ublock's more important filters are selecting individual scripts and even page elements.
ale42 2y ago
This is what I was doing around 25 years ago before ad blockers were a thing, and the web was not encrypted... (Python didn't exist yet, the proxy was a lot of code in Object Pascal, i.e. Delphi)
Fokamul 2y ago
Nope, cannot be done like this. You can block just some of the ADs on websites. But for example YouTube requests for video chunks, is same domain as ADs. So you would have Youtube with ADs. Much easier solution, which everyone should made years ago, STOP using Chrome crapbrowser.

asterios33 2y ago

"There are a few alternatives available. Unfortunately, moving to Firefox may not be a viable option for her, especially given Mozilla’s recent behavior." The world has gone crazy. So this relative has casually used the most bloated spyware disguised as a browser for literally a decade, but she can't switch to firefox because 'Mozilla’s recent behavior'.

phito 2y ago
It's crazy the mental gymnastics people will go through to justify not using Firefox. They should just be honest and say they're too lazy to switch.
- nijave 2y ago
  I've been using Firefox for nearly 15 years and there's technical reasons, too. Mainly memory leaks (which I haven't noticed for a few years anymore) and loading just "feels" slower. Webrender with GPU acceleration helped but it was much more complicated poking at about:config than it "just working" Recently, I've noticed a "this SaaS only works in Chrome" trend again. Usually that means "only works in Blink" but it still sucks if you need to use SaaS (for work) that has this silly limitation. I've noticed cheaper restaurant web ordering software tends to have problems in Firefox. For technical or even semi-technical folks those aren't an issue. For non-technical folks, those issues above can easily lead to a poorer web experience without them understanding why. On the other hand, the author didn't actually call out technical issues
  - madeofpalk 2y ago
    You'll be happy to know that recently I shipped a bug that only crashes (in) Chrome, but not Firefox, because I only really develop in Firefox.
    - paulryanrogers 2y ago
      Wow, crashes all of Chrome and not only the tab process?

Havoc 2y ago

It's probably a threat to your mind & sanity more than security. This is very obviously aimed at streaming more ads into your head. I don't doubt google's security/engineering chops but if google could prop up your eyelids with toothpicks to ensure continuous ad watching they would...

ewenquim 2y ago
Yeah but that's another topic (maybe more important, but less immediate and actionnable). yesterday my relative just downloaded a malware. That's something we can do something about!
- Gigachad 2y ago
  Some people would just be better off with an iPad where you can't download malware.

baq 2y ago

Sad realization: blocking ad blockers is copy protection from a decade or two ago and blocking ads is nowadays basically cracking websites and browsers.

pacifika 2y ago
HTML is a human readable source editable interactive document format, which can be optimised for reading. When I peel an apple to optimise it for eating I’m not cracking an apple.
- baq 2y ago
  Good luck doing that on a WASM <canvas>

junglistguy 2y ago

[dead]

tim333 2y ago

They don't mention uBlock Origin Lite which does much the same and works with v3. It's a bit disingenuous not to do so.

timbit42 2y ago
I have clients who use Chrome and when uBO was removed, I installed the Lite version and now some of them have gotten malware. It's not good enough. Will need to switch to another browser.
ewenquim 2y ago
I just didn't know. Thanks for the info, I'll have a look at it!

kennysoona 2y ago

It really isn't, because Lite is practically as effective, just less efficient.

exiguus 2y ago

I stopped using Google services at the beginning of this year. I transitioned from Chrome to Firefox and from a standard Android device to one without Google accounts and apps. While this setup is suitable for tech-savvy individuals, it can be challenging for someone like my mom. To address this, I bought her a Fairphone with a de-googled Android operating system installed out of the box. This solution works well, especially for those who prefer not to use Apple products. For enhanced ad-blocking and security, I set up an OpenWRT router in front of the provider's router. This includes features like Adblock, DNS over HTTPS (DoH), DNS over TLS (DoT), and DNSCrypt. This setup has been running smoothly in my parents' house for over three years without any issues.

exiguus 2y ago

I am confused. uBlock Origin is still available in the webstore <https://chromewebstore.google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm https://chromewebstore.google.com/detail/ublock-origin/cjpal...>. Do we talk about the same extension and/or is it just disabled for Chrome and not for Chromium/Brave etc.? Just curious.

exiguus 2y ago
I answered the questions half way myself.The ext. gets disabled because it is manifest 2 not manifest 3. Manifest 2 will be disabled by ~mid 2025 in the Store. Seeing: seeing https://github.com/uBlockOrigin/uBlock-issues/wiki/About-Google-Chrome's-%22This-extension-may-soon-no-longer-be-supported%22 https://github.com/uBlockOrigin/uBlock-issues/wiki/About-Goo... And asking: What are the diff between manifest 2 and manifest 3 ext? Answer: https://chat.mistral.ai/chat/9e66fbc8-0df2-4248-a252-5acb6fb6700c https://chat.mistral.ai/chat/9e66fbc8-0df2-4248-a252-5acb6fb... What is the problem to move to M3? And why is this a ban?

1vuio0pswjnm7 2y ago

Maybe in part due to regulatory pressures over privacy, IDN, Chrome includes "site settings" to disable Javascript, etc. on a site by suite basis. It also includes "request blocking" in DevTools. These settings can provide some of the blocking that uBlock provides. To some this can be quite useful. Why there is no way to export and import these settings. It is commmon with open source mobile apps in the www/networking category for example to have the ability to import and export settings.