Comment by SquareWheel | Hacker News Reader

Comment by SquareWheel | Hacker News Reader

Parent Full thread

They've addressed a number of complaints about limitations of the new API:

>Since the original announcement of the Declarative Net Request API, we have added significant functionality to the API as a result of these discussions. The Declarative Net Request API now allows for the registration and removal of dynamic rules - specified at runtime rather than statically in the manifest. We’ve also added the capability to remove common tracking headers, such as Referer, Cookie, and Set-Cookie.

>We are actively exploring other ways to expand this API, including adding methods to get feedback about matched rules, and support for richer redirects leveraging URL manipulation and regular expressions. Additionally, we are currently planning to change the rule limit from maximum of 30k rules per extension to a global maximum of 150k rules.

They posted a simpler post to the Security blog also addressing these issues.

https://security.googleblog.com/2019/06/improving-security-a...

They lead with the point that most-seemed to get lost in translation, even on technical sites like HN.

>No, Chrome isn’t killing ad blockers

>They lead with the point that most-seemed to get lost in translation, even on technical sites like HN.

>>No, Chrome isn’t killing ad blockers

They’re just neutering them with a ridiculously low limit of rules.

One of the benefits of doing this declaratively is that they can optimize the shit out of these blocking declarations. There is no need for such a low limit. Or even a limit at all.

Even EasyList, which is probably the largest list out there, has 42,000 rules. So I wouldn't consider a 150,000 limit to be "ridiculously low".

However I do agree that there shouldn't be a limit, in accordance with https://en.wikipedia.org/wiki/Zero_one_infinity_rule. I think they were just trying to get people to actually clean up EasyList to prune dead rules.

EasyList has 91k rules. Combine that with malware domain lists and other regional lists, and you can easily get to that limit.

I just checked and my uBlock Origin -- which doesn't have any social filter lists applied -- has 148,339 rules applied in total.

>EasyList has 91k rules.

I read 42K from a source earlier today. That's where I got my figure.

https://www.ghacks.net/2019/01/22/chrome-extension-manifest-...

Might it be different for different extensions?

My current uBlock extension has 99,596 network filters. Easylist alone has 90,000 for me, the rest are miscellaneous ad-on lists -- so maybe it is different for different apps. The direct download from the official site has about 75,000 filters[0], though maybe that includes some cosmetic ones?

150,000 is definitely better than 30,000, but it's probably not a future-proof number.

EDIT: Actually, given Apple's 50,000 filter limit, I wonder if your source was looking at a version of Easylist that was trimmed down specifically for Safari.

[0]: https://easylist.to/easylist/easylist.txt

I have 91k in ublock origin on my firefox install also.

Killing? No. Handicapping? Yes. And why are we surprised? It’s in their best interest to do so; expecting a for-profit company to go against its own monetary best interests forever is naïve, at best.

The rule limits Google's proposing are more generous than the limits Apple puts on content blockers. Apple allows only 50K rules. And it turns out 50K rules is actually fine!

Declarative rules engines are better and preserve privacy better. This is Google following Apple's lead and doing the right thing.

It does nothing for privacy because extensions will still be able to see the requests, they just won't be able to block them.

No, manifest v3 extensions will only be able to observe requests for specific hosts, with permission from each host.

This isn't mentioned in the public version of the v3 spec (perhaps I'm looking in the wrong place) or in today's blog post. Do you have a reference?

One of the other comments has a link to this tweet about it:

> Yes, but network requests won't be observable without permission on the relevant hosts. And host permissions are changing significantly in Mv3 (e.g. they can't be granted as blanket install time permissions).

https://twitter.com/justinschuh/status/1138889508512866304

there's also some stuff in the design doc: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...

Which explains the specific hosts part, but only makes vague mention of how extensions that users do want to run on every site will get permission to do so.

Thank you. If Google were trying to be obfuscatory they could hardly do a better job.

There's a reason apple doesn't have as much of the browser market share, and this is part of it. The lack of good ad blocking is literally the thing that drove me off of safari.

If you can block Google Ads equally as well in the new system as the old, how does this affect their "monetary best interests"?

let's say they didn't up the limit from 30k.

whose ads are getting blocked as a priority? doubleclick is going to be in there so is there really a difference to them either way.

Reply on news.ycombinator.com