4 ms·

>So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress tow

>So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model? A funny argument to make because the thing that would make such a measure ridiculous as you rightly point out, is exactly what already makes the Manifest changes ridiculous in the first instance. They were making a rhetorical point and you elaborated on their point for them as if doing so expressed a disagreement.

jimmydorry 2mo ago
I think a big step forward, towards a better security model, was overall a good thing, even if it meant that a good extension no longer had unfettered access to everything your browser saw. I don't think this change is ridiculous at all. And I don't want them to stop here either! v4 should close more of the avenues that malicious extensions are abusing! Extensions should declare everything up-front, so it's easy see if abuse is occuring.
- simonra 2mo ago
  How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? After all security for individuals against commercial and otherwise organized interests is one of the, if not the most important security after life and health. Even if one values the market overall for financial reasons, there is a solid argument that preventing modifications (and thus also repairs) is anti-competitive. It would be damaging to society if manifestV4 is realized restricting what can run further, much like printers and operating systems where the users ability to run software they bring themselves is limited has been. Just as no one should have to go to a mechanic with a special deal with the manufacturer to get their car or tractor to work as desired, neither should users of software.
  - maccard 2mo ago
    You use a different browser, like Firefox.
    - Forgeties79 2mo ago
      A browser that is routinely dumped on by HN for not being perfectly managed lol
      - xboxnolifes 2mo ago
        HN routinely dumps on chrome too. There is no browser HN likes.
        Forgeties79 2mo ago
        Well chrome is obvious. Firefox always triggers the same complaints about Mozilla foundation. They’re valid, but the dog pile is always very striking. At the end of the day Firefox is a great browser and has enabled a bunch of great forks all outside of the chromium ecosystem. We can be critical and should be, but again, it’s very intense sometimes. Google is clearly worse.
      - account42 2mo ago
        "How dare you complain that I pissed on your carpet when the other guy took a dump on it."
        Forgeties79 2mo ago
        If we’re going to use this kind of metaphor, I would say Firefox is just doing a mixed job of cleaning up the mess Google made on your carpet.
        account42 2mo ago
        They doing both cleanup of Google's mess and adding their own mess. They are being criticized for the latter. Add to that that Mozilla, unlike Google, pretends to be a cleaning company when they want you to let them into your home.
  - jimmydorry 2mo ago
    >How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? If you don't like what a browser is doing, then move to another one? You're acting like you have spent a tonne of money on buying Chrome. Even if that was the case, it's not a clear case of an anti-user behaviour. There is a good reason to deprecate the webRequest API, and we'll see more browsers move towards that in the future (Safari has had declarative blocking for many years now, I believe). >preventing modifications (and thus also repairs) is anti-competitive There is nothing stopping someone from forking a manifest v2 version and maintaining it. I'd argue this can't be compared to any company actually doing anti-competitive things (e.g. tractor company, printers, ice cream machine companies, etc.)

jimmydorry 2mo ago

I think a big step forward, towards a better security model, was overall a good thing, even if it meant that a good extension no longer had unfettered access to everything your browser saw. I don't think this change is ridiculous at all. And I don't want them to stop here either! v4 should close more of the avenues that malicious extensions are abusing! Extensions should declare everything up-front, so it's easy see if abuse is occuring.

simonra 2mo ago
How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? After all security for individuals against commercial and otherwise organized interests is one of the, if not the most important security after life and health. Even if one values the market overall for financial reasons, there is a solid argument that preventing modifications (and thus also repairs) is anti-competitive. It would be damaging to society if manifestV4 is realized restricting what can run further, much like printers and operating systems where the users ability to run software they bring themselves is limited has been. Just as no one should have to go to a mechanic with a special deal with the manufacturer to get their car or tractor to work as desired, neither should users of software.
- maccard 2mo ago
  You use a different browser, like Firefox.
  - Forgeties79 2mo ago
    A browser that is routinely dumped on by HN for not being perfectly managed lol
    - xboxnolifes 2mo ago
      HN routinely dumps on chrome too. There is no browser HN likes.
      - Forgeties79 2mo ago
        Well chrome is obvious. Firefox always triggers the same complaints about Mozilla foundation. They’re valid, but the dog pile is always very striking. At the end of the day Firefox is a great browser and has enabled a bunch of great forks all outside of the chromium ecosystem. We can be critical and should be, but again, it’s very intense sometimes. Google is clearly worse.
    - account42 2mo ago
      "How dare you complain that I pissed on your carpet when the other guy took a dump on it."
      - Forgeties79 2mo ago
        If we’re going to use this kind of metaphor, I would say Firefox is just doing a mixed job of cleaning up the mess Google made on your carpet.
        account42 2mo ago
        They doing both cleanup of Google's mess and adding their own mess. They are being criticized for the latter. Add to that that Mozilla, unlike Google, pretends to be a cleaning company when they want you to let them into your home.
- jimmydorry 2mo ago
  >How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? If you don't like what a browser is doing, then move to another one? You're acting like you have spent a tonne of money on buying Chrome. Even if that was the case, it's not a clear case of an anti-user behaviour. There is a good reason to deprecate the webRequest API, and we'll see more browsers move towards that in the future (Safari has had declarative blocking for many years now, I believe). >preventing modifications (and thus also repairs) is anti-competitive There is nothing stopping someone from forking a manifest v2 version and maintaining it. I'd argue this can't be compared to any company actually doing anti-competitive things (e.g. tractor company, printers, ice cream machine companies, etc.)