Hacker News Reader

Comment by bambax | Hacker News Reader

The state of the debate is unsatisfactory.

Google employees such as Justin Schuh are aggressively defending the move on tech/security principles and denying commercial motivations, while uBlock Origin dev (Raymond Hill) says the change will cripple or kill uBO on Chrome and evil motives are its raison d'être.

It's good that mainstream media articles raise the awareness of the issue, but a good technical discussion by impartial analysts would also help.

Is it possible to fix the security issues of the existing webRequest API without deprecating it? Or by replacing it with something safer but just as powerful? There should be a simple answer to those questions.

(I'm tempted to side against Google because they keep invoking "performance issues", which is a ridiculous argument: nothing helps Chrome's performance more than efficient ad-blocking. But still, I'd like to know more.)

View on HN

I'd say in practice it doesn't really matter. For the sake of the argument let's assume that gorhill is wrong and the Google engineers really think this is the right technical decision, that's good for them but we still end up with subpar ad-blockers.

Of course these types of compromises crop up all the time when you're designing software, but then the problem is: if in the near future one Google engineer has an idea to improve the ad-blocking interface by, say, redesigning a certain component, would they do it? Would management let them do it?

There's a clear conflict of interest here, I expect ad-blocking to suffer death by a thousand cuts on Google's platform. Not necessarily because there's an evil master plan to kill it, but merely because every time there'll be a technical argument in favor of gimping it they're very likely to go with it while every time there'll be a proposal to improve it I'm sure there won't be a lot of motivation to implement it.

So even if we give Google the benefit of the doubt here I still believe that it's a huge problem and we can't let them effectively control the web. Beyond that in this particular case I'm not even sure I'm willing to give them the benefit of the doubt, the technical justification seems iffy to me (and the burden of proof is clearly in their camp) and there's been a clear pattern lately of Google moving to reduce the impact of ad-blocking (such as them bundling a minimal ad-blocking with chrome, most likely as an effort to dissuade people from looking for better third-party blockers).

> Is it possible to fix the security issues of the existing webRequest API without deprecating it?

The WebRequest API is not being deprecated though, only the ability to block through it is. And I don't think blocking a request has very negative security implications. It's hard to not attribute malice to this move when the status quo was absolutely fine, and google is raising a strawman to try and justify their changes.

They have to raise a strawman though, their cash cow is advertising and often advertising to people who don't want advertising, ublock origin and others allows those people (including me) to block the advertising.

To put it in a simple form, I will not use a browser that can't run ublock origin, full stop, I don't care what other features it has, ublock origin is the single killer feature for me.

I think Google may be about to find that a non trivial number of people share that last sentiment.

I'm sure they did the calculation of users lost vs advertising increase from users who still use them after they break adblockers.

Honestly though it makes me glad that I never stopped using FF as my primary browser, Chrome is used for dev/testing so this doesn't really affect me directly, I'll just make sure that Chrome can only access sites under dev/testing and carry on.

I've also seen privacy issues cited, and I don't understand the argument at all, since a read-only, async API will remain, so privacy isn't improved.

There have been extensions out there that are close to amusing the current behavior.

Example: https://www.zdnet.com/article/google-cuts-fake-ad-blockers-f...

My understanding of the current behavior is that an extension like uBlock can programmatically read requests. Extensions will be made to abuse an API and people will install them unwittingly.

The existing webRequest API lets extensions run arbitrary third-party code over all the requests you make, and Chrome won't process the request until it's done. That inevitably means that a badly written extension can hurt page loading performance, and a malicious extension can get a lot of sensitive data about you.

Whatever Google's true motivation is, there's no way to solve those problems without limiting the power available to ad blockers.

The performance concern can be addressed by monitoring it and informing the user when extensions slow down page loads.

The security concern is difficult to solve (more fine-grained permissions might help), but also seems a bit disingenuous since extensions can also inject code into the HTML of all sites and already syphon off a lot of data if they want to. Sure, it's a sharp knife, but some tough issues require sharp tools.

> evil motives

Nowhere did I ever say "evil motives". I merely pointed out that Google has a duty to its shareholders.

Are they removing url-rewriting requests as well? Perhaps adblockers could modify the URL of the ad to go to a different domain (example.com) rather than blocking it entirely.

Reply on news.ycombinator.com