9 ms·

> Then they had to make up some reasons to justify that Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser

> Then they had to make up some reasons to justify that Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good. It's just that uBlock Origin is so insanely useful, important and trusted, it should get full access to the entire browser regardless. Honestly, it should be literally built into the browser instead of being a mere extension. Only the conflicts of interest inherent in an ad company maintaining an ad blocker prevent that.

codedokode 2mo ago
Yes, but if you write your own extension maybe you want to read and modify the data. For example, patch fingerprinting script so that it gets the wrong result. Furthermore, malicious extension can read the data from the DOM, from forms (for example, password or credit card fields), and in some cases, from JS variables. They can insert fake information into the page. So preventing extensions from reading network data still leaves a lot of options for a malicious extension.
- jimmydorry 2mo ago
  So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? uBlock Origin via declarative blocks is almost as powerful as the original. While I would trust gorhill with almost unfettered control over my browser, I don't trust EVERY extension owner (no do I trust uBlock Origin in perpetuity).
  - glenstein 2mo ago
    >So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? A funny argument to make because the thing that would make such a measure ridiculous as you rightly point out, is exactly what already makes the Manifest changes ridiculous in the first instance. They were making a rhetorical point and you elaborated on their point for them as if doing so expressed a disagreement.
    - jimmydorry 2mo ago
      I think a big step forward, towards a better security model, was overall a good thing, even if it meant that a good extension no longer had unfettered access to everything your browser saw. I don't think this change is ridiculous at all. And I don't want them to stop here either! v4 should close more of the avenues that malicious extensions are abusing! Extensions should declare everything up-front, so it's easy see if abuse is occuring.
      - simonra 2mo ago
        How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? After all security for individuals against commercial and otherwise organized interests is one of the, if not the most important security after life and health. Even if one values the market overall for financial reasons, there is a solid argument that preventing modifications (and thus also repairs) is anti-competitive. It would be damaging to society if manifestV4 is realized restricting what can run further, much like printers and operating systems where the users ability to run software they bring themselves is limited has been. Just as no one should have to go to a mechanic with a special deal with the manufacturer to get their car or tractor to work as desired, neither should users of software.
        maccard 2mo ago
        You use a different browser, like Firefox.
        Forgeties79 2mo ago
        A browser that is routinely dumped on by HN for not being perfectly managed lol
        xboxnolifes 2mo ago
        HN routinely dumps on chrome too. There is no browser HN likes.
  - inigyou 2mo ago
    We should have the option to limit an extension to certain tabs or websites or at least windows, and extension authors should also have the option to specify that. An adblocker, by its nature, needs to access *. But Return YouTube Dislike could statically specify that it will only run on youtube.com, and that's fine. But the option to enable access to * is essential.
    - jimmydorry 2mo ago
      >An adblocker, by its nature, needs to access * Well that's what is in contention. Does everything claiming to be an adblocker really need access to *? Is Adblocker5++ (totally not malware) entitled to as much access as uBlock Origin? You can declare upfront all the URLs you don't want accessed (which on top of security gives a substantial performance boost), and who's to say someone won't figure out a better way of working within these constraints?
      - inigyou 2mo ago
        What does "entitled" mean here?
        jimmydorry 2mo ago
        A valid claim. The unfettered access to. etc.
        inigyou 2mo ago
        What does that mean? The CPU runs instructions, it doesn't have entitlements or claims.
  - franga2000 2mo ago
    Removing capabilities is not progress towards better security. Putting them behind opt-in permissions, making permissions more granular, more robust... those are security upgrades. Removing capabilities is a feature downgrade.
    - jimmydorry 2mo ago
      Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versions, etc. maintained backwards compatibility for a window then closed it... just like we have seen here with manifest v2 -> v3. "Please stop looking at all network requests, especially when you don't need to." doesn't result in action... while: "You can no longer look at all network requests" requires extension makers to update to the new paradigm.
      - franga2000 2mo ago
        New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together. It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions. There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...
        jimmydorry 2mo ago
        You're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption. Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
        2mo ago
bo1024 2mo ago
Of course it's tempting to reply "don't install random extensions". But a bigger point here is that browsers have grown so massively complex that it's almost impossible to build one, so we don't have an ecosystem where you can choose your browser for safety and I can choose mine for freedom. Of course, Google has had a big incentive and hand in making it this way.
radley 2mo ago
> I want my browser to prevent random extensions... Why are you installing random extensions?
- matheusmoreira 2mo ago
  I'm not. The only extension I trust enough to install is uBlock Origin.
  - FeepingCreature 2mo ago
    Well great! You are already protected from random extensions then.
    - matheusmoreira 2mo ago
      Yeah, by opting out of them altogether. I'd very much enjoy having useful extensions that are not dangerous instead.
      - aucisson_masque 2mo ago
        You can't trust a code that you didn't audit before. End of story. What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on. If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?
        Ballas 2mo ago
        Do you audit all the code running on your PC? I certainly did not audit Chrome (and I also don't really trust it).
- lxgr 2mo ago
  Not GP, but sometimes I want my browser to do pretty random/niche things without that compromising all of my browsing data.
cma 2mo ago
The Google Toolbar for Internet Explorer let users search Google directly from any webpage, block pop-up ads, autofill web forms, and highlight search terms. It also displayed PageRank metrics, translated foreign languages, checked spelling, and managed web bookmarks.
- matheusmoreira 2mo ago
  Imagine the massive amount of data they must have harvested through it.
michaelt 2mo ago
> I want my browser to prevent random extensions from directly reading web page data. To be honest, to me it sounds like you don't want browser extensions then. To me, directly messing with web page data and browser behaviour is the whole point of a browser extension - what else is a browser extension for?
- lxgr 2mo ago
  Why should there not be a middle ground between “can do absolutely everything with all my data” and “is basically a glorified bookmark button” based on the level of trust I have for an extension?
  - inigyou 2mo ago
    Because the browser already has bookmark buttons
  - mzajc 2mo ago
    Because security is the pretext, not the goal here. I'm sure browsers could have better security controls for extensions, but giving users extra control over software doesn't seem to be very popular among corpos nowadays.
  - account42 2mo ago
    Because the middle ground would require the browser defining what an extension can and cannot do which defeats the entire point of extensions.
- matheusmoreira 2mo ago
  The purpose of browser extensions is to build up an install base then sell out to some corporation that then promptly leverages that user base to exfiltrate data and monetize it. No thanks. They should have to declare to the browser what it is they want done instead.
  - jamesnorden 2mo ago
    It still sounds like you don't want browser extensions then.
doctorpangloss 2mo ago
Nothing stops people from using a fork with manifest v2 support restored. In fact "VibeChrome" would probably be a successful product.
- inigyou 2mo ago
  First you'd get sued because chrome is a Google trademark
- theragra 2mo ago
  It was by many, and it was decided to be too hard. Nobody is ready to do that.
drtgh 2mo ago
>Hate to be the one to defend Google here, but the reasons weren't that unreasonable. Sounds like some kind of Stockholm syndrome. Years ago, it was standard practice for software to be designed so that users could grant permissions to access invasive methods or functions. Google relies on users' personal data (ads), which is why they introduced a unique ID to their Chrome browser (to track).
- edoceo 2mo ago
  When was that standard practice? Cause years ago (like 2000) I remember even trivial and simple software (WeatherBug) being able to read/write all over the computer (Windows). And some crap I just installed on Win11 can see all over the box, just slightly less.
xtracto 2mo ago
> I want my browser to prevent random extensions from directly reading web page data This is so funny to me. Coming from a Netscape Navigator world, when extensions first came out, they were supposed to allow the user to add functionality to websites. Why would someone install "random extensions" that they dont trust. And also, what would extensions do if not read and write data to websites? . Sign of the times I guess.
- matheusmoreira 2mo ago
  > Why would someone install "random extensions" that they dont trust. Same reason why people download random stuff and run it with administrator permissions on Windows.
- latexr 2mo ago
  > Why would someone install "random extensions" that they dont trust. An extension that you trust today can be sold to an unscrupulous third-party tomorrow. That has happened many many times and will continue to.
  - shaky-carrousel 2mo ago
    And sometimes the unscrupulous third party decides to build a browser and take over the market via forcing hardware vendors to bundle it with their OS. Like Google.
  - feelamee 2mo ago
    so, it should not be updated automatically. so, you should not trust something that install updates (literally - install another software) without your agreement
    - xtracto 2mo ago
      Back in the mid 90s when the web started to be all the rage, I remember reading a comment I thought hilarious and kind of right. Paraphrasing a lot it went like this: "Somehow, when people get into the internet, their IQ decreases like 50 points. Like, if a guy knocked on your house door and offered you to give you a million dollars if you just gave him a thousand now, you would tell him to F. off. But somehow on the internet people thing it's right" Same with these apps, someone comes and tells you to let him install this great water appliance for your backyard. You let him come in. But somehow in the internet, you also give him the key so that he can come in again anytime he wants... he may sell the key, lose the key, do something malicious later,etc. But due to ignorance, people dont grasp what they are doing in the digital world. People lack the necessary mental models.
colordrops 2mo ago
Don't defend them then. Do you believe the same should be true of your operating system? If not, then it shouldn't be true of the browser either.
- matheusmoreira 2mo ago
  > Do you believe the same should be true of your operating system? Yes, and I have actually started virtualizing everything inside my computer because of that belief. I don't want random software touching my trusted host. "Random software" is currently defined as anything outside the official repositories of my Linux distribution of choice. I don't want to share a home directory with such things. I don't want to share a user and its permissions, I don't even want to share a kernel with them.
  - FeepingCreature 2mo ago
    There's a difference between you virtualizing programs and your OS vendor virtualizing programs for you without giving you an opt-out. Cough snaps cough.
    - matheusmoreira 2mo ago
      Agreed, and I do think it's unfortunate that our browsers are funded by ad tech. I want that to change.
ajb 2mo ago
... the greatest danger to us is masterless men; lacking a coercive power to tie their hands, they would destroy society. How else but by binding to lord and master can they be held to the laws? So thought men during feudal times. In fact, it is possible for people to be held to good conduct without being bound into a single hierarchy, and it should be possible for software to be held to good conduct without giving such power to single monopolists. But it's not in Google's interests to build such mechanisms, any more than it was in the interests of the feudal overlords to look for alternatives to their rule.
- matheusmoreira 2mo ago
  I'm supposed to be the master, actually. It's my computer, any foreign code is essentially a subject in my digital domain. It should be literally impossible for them to do something I don't want them to do. As the god of my little digital realm, I should have maximum power and freedom, while foreign developers get the absolute minimum amount of power that works, and in the ideal case this minimum is zero. The fact someone gave developers a turing complete language inside the browser where random code is automatically downloaded and executed is a major reason why we even have uBlock Origin in the first place. The vast majority of developers heavily abuse this privilege and cannot be trusted, and that is why we block them with extreme prejudice.
  - ryandrake 2mo ago
    This is the way. The owner of the computer should be the ultimate authority over what gets run and not run on that computer. Not Microsoft. Not Apple. Not Google. Not Mozilla. Not some web site developer.
  - duskdozer 2mo ago
    We seem to have a similar philosophy. Have you found a good way to deal with modifying or selectively disabling things like webpacked js or react?
    - matheusmoreira 2mo ago
flomo 2mo ago
> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good. Agreed. And you would think most paranoid HN types would too. > It's just that uBlock Origin is so insanely useful, important and trusted Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension? Seems like the only business model for this type of extension is "selling out" for certain ads. And then the cycle repeats and forum posters tell you to install qBlock Omega or whatever. Maybe Mozilla doesn't want to get in the middle of this?
- notpushkin 2mo ago
  > Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension? IIRC it was written from scratch. It was called uBlock before, then a co-maintainer tried to pull some shit, and the original author had to fork it with a new name (I don’t remember the details, it’s been ages since then). No selling out yet. The author also explicitly says they don’t accept donations. I don’t think he’s looking for a business model. But if that changes – yeah, the fork button is right there, so I don’t see a big problem here.
behringer 2mo ago
Of course the reasons weren't unreasonable, that's what made them great excuses for specifically blocking ublock origin.
- matheusmoreira 2mo ago
  They don't specifically block uBlock Origin though. I have no doubt they intended it to, and that's literally my only objection to Manifest V3: it's good but it hurts uBlock Origin therefore I don't accept it. The right thing is to simply bypass all of that. The fact is uBlock Origin should be literallly built into the browser like the good old popup blockers once were. If only we had a browser that was independent of ad money.
  - inigyou 2mo ago
    Of course the reasons weren't specific to ublock origin, that's what made them great excuses for specifically blocking ublock origin.
FeepingCreature 2mo ago
"Random" is a funny thing to call an extension that you have deliberately installed. I also don't want "random" programs accessing my home folder. That would be terrible! Who knows what programs that could be! I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily. Same for extensions. The goal here isn't really to protect me from extensions. Extensions don't do anything on their own, they just sit there and wait for me to install them. So the goal is apparently to protect me from me (installing an extension), which really is to say protect their business (ads) from me (blocking them).
- matheusmoreira 2mo ago
  "Random" is what I call pretty much every extension that is not uBlock Origin. I absolutely want them limited to the fullest extent. Maybe if they were, I would actually install some of them. > I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily. I don't. My standard operating practice is to virtualize them. My security posture is considerably more lax towards free and open source software, for obvious reasons, and even then this trust only extends to the software in my Linux distribution's repositories. Stuff coming from PyPI, npm, cargo, ruby gems, and other such "developer centric" repositories get the full virtualization treatment. If it's easy for randoms to publish packages, then it's equally easy for malware to make it in.
  - sersi 2mo ago
    What do you use for virtualization for tools from developer repositories? Run them in a VM or sandboxing like bubblewrap?
    - matheusmoreira 2mo ago
      QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side project to build software just to manage those VMs. I'm daily driving this thing even though it's my first "vibecoded" project, it's just way too useful and has saved me quite a few times from accidents. https://github.com/matheusmoreira/virtdev https://github.com/matheusmoreira/virtdev The firewall works but it's pretty clunky. I'm working on a custom Rust network stack to replace it. You'd probably prefer something that isn't literally made by one guy and his AIs though. Docker sandboxes seem to be a good solution that also employs virtualization. https://news.ycombinator.com/item?id=49239751 https://news.ycombinator.com/item?id=49239751 Before I made all this, I used to use firejail.
yjftsjthsd-h 2mo ago
> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good. I was under the impression that manifest v3 still allowed extensions to read anything, just not modify. Is that not the case? (Random link because this is hard to search for: https://news.ycombinator.com/item?id=38303446 https://news.ycombinator.com/item?id=38303446 )
- matheusmoreira 2mo ago
  Yeah, if that's true then there's little point to Manifest V3... That completely invalidates the argument that it increases security by denying private page access. Maybe I misunderstood Manifest V3.
  - inigyou 2mo ago
    All roads lead to Occam's Razor and POSIWID: the point of Manifest V3 is to block adblockers.
aucisson_masque 2mo ago
> Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good. Don't kid yourself, even with mv3 if you install a rogue extension it's going to have access to a lot more data than you would be comfortable sharing to.
- matheusmoreira 2mo ago
  Yes, which is why it is important to lock such things down.
  - inigyou 2mo ago
    How would you do that?
  - aucisson_masque 2mo ago
    You can't trust a code that you didn't audit before. End of story. What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on. If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?
tpm 2mo ago
Then don't install them. I want my extensions in my browser on my computer to do whatever I allow them to do and not what's allowed by Google.
ezoe 2mo ago
Mozilla relies 85% of income from Google for making default search engine Google. They probably have strong implicit pressure not to.
- matheusmoreira 2mo ago
  Mozilla has 300+ million dollars in the bank.
  - inigyou 2mo ago
    So does Wikipedia but they still desperately beg like they're about to go out of business.
7bit 2mo ago
No worries. Reading the rest of your comments shows, that your defense is paper thin .
latexr 2mo ago
The amount of replies this has gotten regarding the use of “random” is a fine example of the state of discussion on the internet and in general, and how HN is in no way immune. Clearly “random” was used as a means of saying “any”, to describe extensions the author hasn’t thought of. That will be obvious to anyone arguing in good faith and steel manning the argument.
safety1st 2mo ago
This sounds like another one in those class of arguments that are essentially "We can't let users accidentally harm themselves on the devices they own." While I appreciate ergonomics and sensible defaults, ultimately I don't need you, Google or anyone else telling me I can't do something with my device because it's too dangerous to me. I mean I have a huge F U for anyone who tells me that quite frankly, just as I would if they said it about my car or my kitchen knife. I cleared the age of consent decades ago, I will use what I bought and I will accept responsibility for all of the outcomes. These little poindexter dictator nerds of IT who think they get to control everything about what I own can F right off. I applaud and will participate in any class action lawsuit against them and hope for the maximum penalties to be inflicted upon them.
willis936 2mo ago
>it should be literally built into the browser Orion does this. It's still a little too rough around the edges to recommend as a daily driver though.
bambax 2mo ago
> I want my browser to prevent random extensions from directly reading web page data. I don't want that! I want to be able to install any extension whatsoever (as we still can, more or less, install programs). And if I'm clueless enough to install "random" extensions that'll harm me, then shame on me! How often has it happened for the whole existence of Manifest V2 anyway? Maybe we could have tolerated a well-hidden, well-protected "advanced" flag to open that possibility. But removing Manifest V2 altogether is unforgivable. Also, security is a very very very weak argument, as many ads are much more dangerous and toxic than any popular extension will ever be.
tremon 2mo ago
I want my browser to prevent random extensions from directly reading web page data I also want my browser to prevent random third-party javascript from doing the same. And I care more about that one, because as a user I don't have control over said third-party javascript while I do have control over the extensions I'm using. The browser is supposed to be a user agent, not act as an extension of the website owner.
AnonymousPlanet 2mo ago
If you look at all the threat vectors of a browser from a user perspective, a rogue extension is well at the lower end. If you look at the threat vectors for the revenue of a company like Google, extensions that aren't limited by the browser are pretty much number one. This should tell you everything you need about the matter.
- jimmydorry 2mo ago
  If you've run a site with CORS reporting enabled, you'd see that a significant fraction of your userbase have malware extensions running (prior to manifest v3). I was absolutely shocked when I looked at the logs a decade ago, and I bet the problem is far worse these days with the proliferation of malware buyouts of legit extensions. Google has no shortage of options for serving up ads that can't be blocked by normal ad blockers across all their properties (youtube, search, etc.). They in-line the ads these days! And if they really cared about the fraction of a fraction of a percent of people that even install any kind of adblocker, they could make the served ad content un-blockable by serving it the exact same as the content.
delusional 2mo ago
> I want my browser to prevent random extensions from directly reading web page data. Fine, then don't install them? It's like saying you want your TV to stop random people from watching it, but the obvious solution to that problem is to not invite random people into your living room.
dismalaf 2mo ago
> Honestly, it should be literally built into the browser instead of being a mere extension Aaaand that's why I'm using Vivaldi over here (which has a built-in adblocker).
franga2000 2mo ago
Your browser does prevent random extensions from reading web page data - it prevents all of the ones you don't install! More seriously: if you don't want X to do Y, the solution is to not give X the permission Y. The platform overlord removing the premission Y completely is a terrible solution.

codedokode 2mo ago

Yes, but if you write your own extension maybe you want to read and modify the data. For example, patch fingerprinting script so that it gets the wrong result. Furthermore, malicious extension can read the data from the DOM, from forms (for example, password or credit card fields), and in some cases, from JS variables. They can insert fake information into the page. So preventing extensions from reading network data still leaves a lot of options for a malicious extension.

jimmydorry 2mo ago
So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? uBlock Origin via declarative blocks is almost as powerful as the original. While I would trust gorhill with almost unfettered control over my browser, I don't trust EVERY extension owner (no do I trust uBlock Origin in perpetuity).
- glenstein 2mo ago
  >So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? A funny argument to make because the thing that would make such a measure ridiculous as you rightly point out, is exactly what already makes the Manifest changes ridiculous in the first instance. They were making a rhetorical point and you elaborated on their point for them as if doing so expressed a disagreement.
  - jimmydorry 2mo ago
    I think a big step forward, towards a better security model, was overall a good thing, even if it meant that a good extension no longer had unfettered access to everything your browser saw. I don't think this change is ridiculous at all. And I don't want them to stop here either! v4 should close more of the avenues that malicious extensions are abusing! Extensions should declare everything up-front, so it's easy see if abuse is occuring.
    - simonra 2mo ago
      How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? After all security for individuals against commercial and otherwise organized interests is one of the, if not the most important security after life and health. Even if one values the market overall for financial reasons, there is a solid argument that preventing modifications (and thus also repairs) is anti-competitive. It would be damaging to society if manifestV4 is realized restricting what can run further, much like printers and operating systems where the users ability to run software they bring themselves is limited has been. Just as no one should have to go to a mechanic with a special deal with the manufacturer to get their car or tractor to work as desired, neither should users of software.
      - maccard 2mo ago
        You use a different browser, like Firefox.
        Forgeties79 2mo ago
        A browser that is routinely dumped on by HN for not being perfectly managed lol
        xboxnolifes 2mo ago
        HN routinely dumps on chrome too. There is no browser HN likes.
- inigyou 2mo ago
  We should have the option to limit an extension to certain tabs or websites or at least windows, and extension authors should also have the option to specify that. An adblocker, by its nature, needs to access *. But Return YouTube Dislike could statically specify that it will only run on youtube.com, and that's fine. But the option to enable access to * is essential.
  - jimmydorry 2mo ago
    >An adblocker, by its nature, needs to access * Well that's what is in contention. Does everything claiming to be an adblocker really need access to *? Is Adblocker5++ (totally not malware) entitled to as much access as uBlock Origin? You can declare upfront all the URLs you don't want accessed (which on top of security gives a substantial performance boost), and who's to say someone won't figure out a better way of working within these constraints?
    - inigyou 2mo ago
      What does "entitled" mean here?
      - jimmydorry 2mo ago
        A valid claim. The unfettered access to. etc.
        inigyou 2mo ago
        What does that mean? The CPU runs instructions, it doesn't have entitlements or claims.
- franga2000 2mo ago
  Removing capabilities is not progress towards better security. Putting them behind opt-in permissions, making permissions more granular, more robust... those are security upgrades. Removing capabilities is a feature downgrade.
  - jimmydorry 2mo ago
    Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versions, etc. maintained backwards compatibility for a window then closed it... just like we have seen here with manifest v2 -> v3. "Please stop looking at all network requests, especially when you don't need to." doesn't result in action... while: "You can no longer look at all network requests" requires extension makers to update to the new paradigm.
    - franga2000 2mo ago
      New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together. It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions. There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...
      - jimmydorry 2mo ago
        You're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption. Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
        2mo ago

bo1024 2mo ago

Of course it's tempting to reply "don't install random extensions". But a bigger point here is that browsers have grown so massively complex that it's almost impossible to build one, so we don't have an ecosystem where you can choose your browser for safety and I can choose mine for freedom. Of course, Google has had a big incentive and hand in making it this way.

radley 2mo ago

> I want my browser to prevent random extensions... Why are you installing random extensions?

matheusmoreira 2mo ago
I'm not. The only extension I trust enough to install is uBlock Origin.
- FeepingCreature 2mo ago
  Well great! You are already protected from random extensions then.
  - matheusmoreira 2mo ago
    Yeah, by opting out of them altogether. I'd very much enjoy having useful extensions that are not dangerous instead.
    - aucisson_masque 2mo ago
      You can't trust a code that you didn't audit before. End of story. What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on. If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?
      - Ballas 2mo ago
        Do you audit all the code running on your PC? I certainly did not audit Chrome (and I also don't really trust it).
lxgr 2mo ago
Not GP, but sometimes I want my browser to do pretty random/niche things without that compromising all of my browsing data.

cma 2mo ago

The Google Toolbar for Internet Explorer let users search Google directly from any webpage, block pop-up ads, autofill web forms, and highlight search terms. It also displayed PageRank metrics, translated foreign languages, checked spelling, and managed web bookmarks.

matheusmoreira 2mo ago
Imagine the massive amount of data they must have harvested through it.

michaelt 2mo ago

> I want my browser to prevent random extensions from directly reading web page data. To be honest, to me it sounds like you don't want browser extensions then. To me, directly messing with web page data and browser behaviour is the whole point of a browser extension - what else is a browser extension for?

lxgr 2mo ago
Why should there not be a middle ground between “can do absolutely everything with all my data” and “is basically a glorified bookmark button” based on the level of trust I have for an extension?
- inigyou 2mo ago
  Because the browser already has bookmark buttons
- mzajc 2mo ago
  Because security is the pretext, not the goal here. I'm sure browsers could have better security controls for extensions, but giving users extra control over software doesn't seem to be very popular among corpos nowadays.
- account42 2mo ago
  Because the middle ground would require the browser defining what an extension can and cannot do which defeats the entire point of extensions.
matheusmoreira 2mo ago
The purpose of browser extensions is to build up an install base then sell out to some corporation that then promptly leverages that user base to exfiltrate data and monetize it. No thanks. They should have to declare to the browser what it is they want done instead.
- jamesnorden 2mo ago
  It still sounds like you don't want browser extensions then.

doctorpangloss 2mo ago

Nothing stops people from using a fork with manifest v2 support restored. In fact "VibeChrome" would probably be a successful product.

inigyou 2mo ago
First you'd get sued because chrome is a Google trademark
theragra 2mo ago
It was by many, and it was decided to be too hard. Nobody is ready to do that.

drtgh 2mo ago

>Hate to be the one to defend Google here, but the reasons weren't that unreasonable. Sounds like some kind of Stockholm syndrome. Years ago, it was standard practice for software to be designed so that users could grant permissions to access invasive methods or functions. Google relies on users' personal data (ads), which is why they introduced a unique ID to their Chrome browser (to track).

edoceo 2mo ago
When was that standard practice? Cause years ago (like 2000) I remember even trivial and simple software (WeatherBug) being able to read/write all over the computer (Windows). And some crap I just installed on Win11 can see all over the box, just slightly less.

xtracto 2mo ago

> I want my browser to prevent random extensions from directly reading web page data This is so funny to me. Coming from a Netscape Navigator world, when extensions first came out, they were supposed to allow the user to add functionality to websites. Why would someone install "random extensions" that they dont trust. And also, what would extensions do if not read and write data to websites? . Sign of the times I guess.

matheusmoreira 2mo ago
> Why would someone install "random extensions" that they dont trust. Same reason why people download random stuff and run it with administrator permissions on Windows.
latexr 2mo ago
> Why would someone install "random extensions" that they dont trust. An extension that you trust today can be sold to an unscrupulous third-party tomorrow. That has happened many many times and will continue to.
- shaky-carrousel 2mo ago
  And sometimes the unscrupulous third party decides to build a browser and take over the market via forcing hardware vendors to bundle it with their OS. Like Google.
- feelamee 2mo ago
  so, it should not be updated automatically. so, you should not trust something that install updates (literally - install another software) without your agreement
  - xtracto 2mo ago
    Back in the mid 90s when the web started to be all the rage, I remember reading a comment I thought hilarious and kind of right. Paraphrasing a lot it went like this: "Somehow, when people get into the internet, their IQ decreases like 50 points. Like, if a guy knocked on your house door and offered you to give you a million dollars if you just gave him a thousand now, you would tell him to F. off. But somehow on the internet people thing it's right" Same with these apps, someone comes and tells you to let him install this great water appliance for your backyard. You let him come in. But somehow in the internet, you also give him the key so that he can come in again anytime he wants... he may sell the key, lose the key, do something malicious later,etc. But due to ignorance, people dont grasp what they are doing in the digital world. People lack the necessary mental models.

colordrops 2mo ago

Don't defend them then. Do you believe the same should be true of your operating system? If not, then it shouldn't be true of the browser either.

matheusmoreira 2mo ago
> Do you believe the same should be true of your operating system? Yes, and I have actually started virtualizing everything inside my computer because of that belief. I don't want random software touching my trusted host. "Random software" is currently defined as anything outside the official repositories of my Linux distribution of choice. I don't want to share a home directory with such things. I don't want to share a user and its permissions, I don't even want to share a kernel with them.
- FeepingCreature 2mo ago
  There's a difference between you virtualizing programs and your OS vendor virtualizing programs for you without giving you an opt-out. Cough snaps cough.
  - matheusmoreira 2mo ago
    Agreed, and I do think it's unfortunate that our browsers are funded by ad tech. I want that to change.

ajb 2mo ago

... the greatest danger to us is masterless men; lacking a coercive power to tie their hands, they would destroy society. How else but by binding to lord and master can they be held to the laws? So thought men during feudal times. In fact, it is possible for people to be held to good conduct without being bound into a single hierarchy, and it should be possible for software to be held to good conduct without giving such power to single monopolists. But it's not in Google's interests to build such mechanisms, any more than it was in the interests of the feudal overlords to look for alternatives to their rule.

matheusmoreira 2mo ago
I'm supposed to be the master, actually. It's my computer, any foreign code is essentially a subject in my digital domain. It should be literally impossible for them to do something I don't want them to do. As the god of my little digital realm, I should have maximum power and freedom, while foreign developers get the absolute minimum amount of power that works, and in the ideal case this minimum is zero. The fact someone gave developers a turing complete language inside the browser where random code is automatically downloaded and executed is a major reason why we even have uBlock Origin in the first place. The vast majority of developers heavily abuse this privilege and cannot be trusted, and that is why we block them with extreme prejudice.
- ryandrake 2mo ago
  This is the way. The owner of the computer should be the ultimate authority over what gets run and not run on that computer. Not Microsoft. Not Apple. Not Google. Not Mozilla. Not some web site developer.
- duskdozer 2mo ago
  We seem to have a similar philosophy. Have you found a good way to deal with modifying or selectively disabling things like webpacked js or react?
  - matheusmoreira 2mo ago

flomo 2mo ago

> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good. Agreed. And you would think most paranoid HN types would too. > It's just that uBlock Origin is so insanely useful, important and trusted Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension? Seems like the only business model for this type of extension is "selling out" for certain ads. And then the cycle repeats and forum posters tell you to install qBlock Omega or whatever. Maybe Mozilla doesn't want to get in the middle of this?

notpushkin 2mo ago
> Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension? IIRC it was written from scratch. It was called uBlock before, then a co-maintainer tried to pull some shit, and the original author had to fork it with a new name (I don’t remember the details, it’s been ages since then). No selling out yet. The author also explicitly says they don’t accept donations. I don’t think he’s looking for a business model. But if that changes – yeah, the fork button is right there, so I don’t see a big problem here.

behringer 2mo ago

Of course the reasons weren't unreasonable, that's what made them great excuses for specifically blocking ublock origin.

matheusmoreira 2mo ago
They don't specifically block uBlock Origin though. I have no doubt they intended it to, and that's literally my only objection to Manifest V3: it's good but it hurts uBlock Origin therefore I don't accept it. The right thing is to simply bypass all of that. The fact is uBlock Origin should be literallly built into the browser like the good old popup blockers once were. If only we had a browser that was independent of ad money.
- inigyou 2mo ago
  Of course the reasons weren't specific to ublock origin, that's what made them great excuses for specifically blocking ublock origin.

FeepingCreature 2mo ago

"Random" is a funny thing to call an extension that you have deliberately installed. I also don't want "random" programs accessing my home folder. That would be terrible! Who knows what programs that could be! I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily. Same for extensions. The goal here isn't really to protect me from extensions. Extensions don't do anything on their own, they just sit there and wait for me to install them. So the goal is apparently to protect me from me (installing an extension), which really is to say protect their business (ads) from me (blocking them).

matheusmoreira 2mo ago
"Random" is what I call pretty much every extension that is not uBlock Origin. I absolutely want them limited to the fullest extent. Maybe if they were, I would actually install some of them. > I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily. I don't. My standard operating practice is to virtualize them. My security posture is considerably more lax towards free and open source software, for obvious reasons, and even then this trust only extends to the software in my Linux distribution's repositories. Stuff coming from PyPI, npm, cargo, ruby gems, and other such "developer centric" repositories get the full virtualization treatment. If it's easy for randoms to publish packages, then it's equally easy for malware to make it in.
- sersi 2mo ago
  What do you use for virtualization for tools from developer repositories? Run them in a VM or sandboxing like bubblewrap?
  - matheusmoreira 2mo ago
    QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side project to build software just to manage those VMs. I'm daily driving this thing even though it's my first "vibecoded" project, it's just way too useful and has saved me quite a few times from accidents. https://github.com/matheusmoreira/virtdev https://github.com/matheusmoreira/virtdev The firewall works but it's pretty clunky. I'm working on a custom Rust network stack to replace it. You'd probably prefer something that isn't literally made by one guy and his AIs though. Docker sandboxes seem to be a good solution that also employs virtualization. https://news.ycombinator.com/item?id=49239751 https://news.ycombinator.com/item?id=49239751 Before I made all this, I used to use firejail.

yjftsjthsd-h 2mo ago

> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good. I was under the impression that manifest v3 still allowed extensions to read anything, just not modify. Is that not the case? (Random link because this is hard to search for: https://news.ycombinator.com/item?id=38303446 https://news.ycombinator.com/item?id=38303446 )

matheusmoreira 2mo ago
Yeah, if that's true then there's little point to Manifest V3... That completely invalidates the argument that it increases security by denying private page access. Maybe I misunderstood Manifest V3.
- inigyou 2mo ago
  All roads lead to Occam's Razor and POSIWID: the point of Manifest V3 is to block adblockers.

aucisson_masque 2mo ago

> Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good. Don't kid yourself, even with mv3 if you install a rogue extension it's going to have access to a lot more data than you would be comfortable sharing to.

matheusmoreira 2mo ago
Yes, which is why it is important to lock such things down.
- inigyou 2mo ago
  How would you do that?
- aucisson_masque 2mo ago
  You can't trust a code that you didn't audit before. End of story. What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on. If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?

tpm 2mo ago

Then don't install them. I want my extensions in my browser on my computer to do whatever I allow them to do and not what's allowed by Google.

ezoe 2mo ago

Mozilla relies 85% of income from Google for making default search engine Google. They probably have strong implicit pressure not to.

matheusmoreira 2mo ago
Mozilla has 300+ million dollars in the bank.
- inigyou 2mo ago
  So does Wikipedia but they still desperately beg like they're about to go out of business.

7bit 2mo ago

No worries. Reading the rest of your comments shows, that your defense is paper thin .

latexr 2mo ago

The amount of replies this has gotten regarding the use of “random” is a fine example of the state of discussion on the internet and in general, and how HN is in no way immune. Clearly “random” was used as a means of saying “any”, to describe extensions the author hasn’t thought of. That will be obvious to anyone arguing in good faith and steel manning the argument.

safety1st 2mo ago

This sounds like another one in those class of arguments that are essentially "We can't let users accidentally harm themselves on the devices they own." While I appreciate ergonomics and sensible defaults, ultimately I don't need you, Google or anyone else telling me I can't do something with my device because it's too dangerous to me. I mean I have a huge F U for anyone who tells me that quite frankly, just as I would if they said it about my car or my kitchen knife. I cleared the age of consent decades ago, I will use what I bought and I will accept responsibility for all of the outcomes. These little poindexter dictator nerds of IT who think they get to control everything about what I own can F right off. I applaud and will participate in any class action lawsuit against them and hope for the maximum penalties to be inflicted upon them.

willis936 2mo ago

>it should be literally built into the browser Orion does this. It's still a little too rough around the edges to recommend as a daily driver though.

bambax 2mo ago

> I want my browser to prevent random extensions from directly reading web page data. I don't want that! I want to be able to install any extension whatsoever (as we still can, more or less, install programs). And if I'm clueless enough to install "random" extensions that'll harm me, then shame on me! How often has it happened for the whole existence of Manifest V2 anyway? Maybe we could have tolerated a well-hidden, well-protected "advanced" flag to open that possibility. But removing Manifest V2 altogether is unforgivable. Also, security is a very very very weak argument, as many ads are much more dangerous and toxic than any popular extension will ever be.

tremon 2mo ago

I want my browser to prevent random extensions from directly reading web page data I also want my browser to prevent random third-party javascript from doing the same. And I care more about that one, because as a user I don't have control over said third-party javascript while I do have control over the extensions I'm using. The browser is supposed to be a user agent, not act as an extension of the website owner.

AnonymousPlanet 2mo ago

If you look at all the threat vectors of a browser from a user perspective, a rogue extension is well at the lower end. If you look at the threat vectors for the revenue of a company like Google, extensions that aren't limited by the browser are pretty much number one. This should tell you everything you need about the matter.

jimmydorry 2mo ago
If you've run a site with CORS reporting enabled, you'd see that a significant fraction of your userbase have malware extensions running (prior to manifest v3). I was absolutely shocked when I looked at the logs a decade ago, and I bet the problem is far worse these days with the proliferation of malware buyouts of legit extensions. Google has no shortage of options for serving up ads that can't be blocked by normal ad blockers across all their properties (youtube, search, etc.). They in-line the ads these days! And if they really cared about the fraction of a fraction of a percent of people that even install any kind of adblocker, they could make the served ad content un-blockable by serving it the exact same as the content.

delusional 2mo ago

> I want my browser to prevent random extensions from directly reading web page data. Fine, then don't install them? It's like saying you want your TV to stop random people from watching it, but the obvious solution to that problem is to not invite random people into your living room.

dismalaf 2mo ago

> Honestly, it should be literally built into the browser instead of being a mere extension Aaaand that's why I'm using Vivaldi over here (which has a built-in adblocker).

franga2000 2mo ago

Your browser does prevent random extensions from reading web page data - it prevents all of the ones you don't install! More seriously: if you don't want X to do Y, the solution is to not give X the permission Y. The platform overlord removing the premission Y completely is a terrible solution.