Google Begins Testing Extension Manifest V3 in Chrome Canary
bleepingcomputer.com
bleepingcomputer.com
In the new TOS of Youtube [1], it states that if your account is not deemed commercially viable, your Google account (i.e. your Gmail, your Google Photos, your Google Drive, etc.) can be closed down:
YouTube may terminate your access, or your Google
account’s access to all or part of the Service if YouTube
believes, in its sole discretion, that provision of the
Service to you is no longer commercially viable.
(IANAL, and I have no clue if what I said is right).
p.s., not to be snarky, but you ought to add a disclaimer that you're a Googler in your comment!
The thing that was apparently against unspoken Youtube policy here was this kind of interactive, emote-driven streaming. But I get the impression Markiplier didn't get banned, only their fans.
It's bizarre and alarming.
But that's beside the point. Losing the ability to receive email is not something that should ever happen under any circumstances.
It's insane to me that Google has gotten so hostile, they place little to no value on individual accounts, meanwhile those accounts are the lifeline of so many individuals and businesses.
> YouTube may suspend or terminate your access, your Google account, or your Google account’s access to all or part of the Service if (a) you materially or repeatedly breach this Agreement; (b) we are required to do so to comply with a legal requirement or a court order; or (c) we believe there has been conduct that creates (or could create) liability or harm to any user, other third party, YouTube or our Affiliates
https://www.youtube.com/t/terms?preview=20191210
Edit: just to be cristal clear, yes, YouTube can terminate your Google account
However, I only use it on a single tablet that is devoted exclusively to that purpose. As with all Google services, I wouldn't dare to actually use it on a machine that I use for anything else.
They probably know who I am though when I browse “anonymously”. Am I at risk?
Source?
youtube-dl --dateafter now-7days --playlist-end 10 --download-archive '/path/to/folder/downloaded.txt' -o '/path/to/folder/%(title)s.%(ext)s' -- 'https://www.youtube.com/channel/UCYO_jab_esuFRV4b17AJtAw'
You can play around with the parameters to get the behavior you want (there are tons more than I don't use), I kept it pretty simple. In my case it checks the channel page for videos that are newer than 7 days (it runs daily but this gives me a buffer). If there are more than 10 videos newer than 7 days it only checks the first 10. It stores previously downloaded video information in downloaded.txt so it doesn't download duplicate videos, and outputs the video in the format videoName.ext.
Then throw that into a shell script along with any other channels you want and set up a cron job to run it as often as you'd like. You'll also probably want to put 'youtube-dl -U' into a cron job to keep it up to date, YouTube frequently changes things that breaks functionality of youtube-dl.
Now... this may seem like a silly question: What does the '--' do before the channel url? I know '--' is normally used for parameters longer than one character, but that one is kinda just floating about haha.
It's on my github[1] if anyone wants to take a look. I don't use bash often, so if anyone sees better ways to do things I'm all ears.
You can have your YouTube account shut down and still have an email account
Terminations and Suspensions by YouTube for Cause
YouTube may suspend or terminate your access, _your Google account_ , or your Google account’s access to all or part of the Service if
(a) you materially or repeatedly breach this Agreement;
(b) we are required to do so to comply with a legal requirement or a court order; or
(c) we believe there has been conduct that creates (or could create) liability or harm to any user, other third party, YouTube or our Affiliates.
Yes, just because they can, doesn’t mean they have to, but they do it anyways.
They are now at least making it much more obvious
I bet this move is also to kill the workings of extensions like DecentralEyes and others that try to protect users from being tracked. The whole changing of the API into a "sure we'll block that URL for ya, sometimes maybe" model reeks of increasing user tracking. They'll work out the kinks to let AdBlockers function again. But they'll have their tracking back.
Clearly an unpopular opinion here, but anyway: I'm happy to let a few ads slip through (which I will happily ignore anyhow) in exchange for the possibility of a future where I dont have to drive a car to get places.
Ads are funding the Internet only because it's the easiest legal business model to pull off, so everyone gravitated to it. But it's not like there wouldn't be money for self-driving cars without adtech, and in reality, them being tied with advertising companies only ensures that the future will be shitty.
I'm convinced that in a world where collecting anonymous micropayments was as easy as serving ads, the web would look at lot different.
People look at this as a choice between paying $5 a month for every website they visit, or getting it "free" with ads. But in a world with good micropayments, most websites wouldn't cost $5. Outside of the biggest players, most sites aren't currently making $5 a month per user via ads.
But should that mean letting the fox guard the henhouse though? The problem here is that the largest ad provider also controls the largest ad display platform (i.e., Chrome), and is using the latter to benefit the former.
once they're in total control of how the blockers can operate: I doubt they'll be responsive to what the developers of the blocking extensions want...
The replacement API is incompatible with what it is replacing. The supposed gain in performance is not without loss in ability to block ads.
> ad blocking extensions won't disappear. May be some will, and new extensions emerge.
Some kinds of ad-blocking is simply impossible in the new API, without replacement or workaround. No extension can implement those methods.
This is how a company implements measures that could be a legal problem: By formally making a technical decision and having the actual goal as a by-product of that decision.
It's funny because for years MS kept officially supported, feature complete, portable format for use in interchange, while DOC being shared was kinda unintended consequence that just wasn't fought against.
The very requirements of the original DOC spec required it to be a memory dump.
So they say. I see literally no reason to believe that claim, though.
(Disclosure: I work at Google, not on Chrome, and don't have any inside information on this)
Meanwhile a bunch of unrelated extensions will be killed, the ones that rely on modifying requests and which have nothing to do with ad blocking. Innovation around extensions that involves modifying requests will be halted, and everyone will suffer as a result, except Google.
Crooks will have continued and easy access to user data, since Manifest v3 is not focused on protecting user privacy.
I can bet on that.
I will make a public prediction that after one year of Manifest V3 actually shipping to users in mainline Chrome:
- Assuming that Manifest V3's declarative API is not significantly changed from its current implementation.
- If you visit each of the top 10 publishers in the US (including open publishing platforms like Twitter/Facebook/Youtube)
- If you compare Chrome and Firefox, each with the most-recommended ad-blocking/tracker-blocking extensions on their equivalent web stores installed (currently Ublock Origin, but we'll leave it open. "Most recommended" means that among technical users, this extension is the most commonly recommended. There's a little ambiguity here, but not sure how to narrow it.).
- Firefox will block more web trackers (65% likelyhood).
- Firefox will block more visible ads and popups (55% likelyhood).
There are a couple of reasons why I feel comfortable making those two predictions:
- Twitter and Facebook both try really hard to get around adblockers, and Firefox will be more likely to be able to combat their strategies in the future.
- Extensions like Privacy Badger will already have a more difficult time working in Manifest V3, so there's potential for new adblocking strategies to develop in Firefox that can't be ported.
- Safari made similar changes, and it's already less effective than Firefox at adblocking, so it seems reasonable to guess that Chrome will follow the same path.
- Properly configured, Firefox is already better than Chrome at blocking web-trackers, and I think Firefox will roll those changes out by default to ordinary users before Chrome does.
There are a few reasons why I'm hedging my bets:
- The advertising market is volatile, and might change significantly in the next year (privacy laws, etc...) This is unlikely, but not so unlikely that I can completely discount it.
- Chrome has research teams working on some interesting privacy strategies. I think it's mostly just talk and they won't do much of significance in a year, but I can't completely discount it.
- A mass exodus to Firefox could force Chrome to adapt Manifest V3 to be more open. This is also unlikely, but again, I can't completely discount it.
- And just general uncertainty, because the longer out you predict the more uncertainty you should introduce.
55% and 65% seem like very low numbers, but I think they're a relatively bold prediction. If Firefox and Chrome are blocking basically identical numbers of trackers/ads, that doesn't count as a successful prediction. I'm not going to be pedantic about, "Chrome randomly saw one more ad on exactly one website." Right now, I consider Chrome and Firefox to be equal in terms of adblocking capabilities. So even a 50% guess would be saying, "there's a one-in-two chance that something changes and Firefox will just be an objectively better browser for adblocking."
If you asked me to make a bet on whether Firefox would be meaningfully better than Chrome on, like, SSL support, I would give that a pretty low probability -- maybe 10% off the top of my head. Because I expect that a year from now nothing drastic is going to happen that would magically make either browser be different from each other on that front.
It's not 50% "one of the two things will happen, flip a coin", it's 50% "we will see a meaningful change from the status quo."
I want to get back to the content-driven web rather than this ad-driven web we have now. I want to read what people want to share, not what people think will get them ad clicks.
Interesting thought.
Google has a stranglehold on the entire browser market through Chromium right now. Switching to non-Chromium-based browsers is a must.
1: https://en.wikipedia.org/wiki/Chromium_(web_browser)#Browser... 2: https://www.zdnet.com/article/opera-brave-vivaldi-to-ignore-...
A fork implies maintaining most or all of the code base themselves, when in reality, most Chromium derivatives simply change the “front-end” or the UI while keeping everything else upstream, except for a few tweaks here and there. To maintain an entire fork themselves would be a massive undertaking, especially since Google now has a practical stronghold on the development of the open web. “Forks” would have to ensure they work with the standards (and non-standards) that are being pushed by Chromium and there’s no easy way to do that besides using Chromium and “re-building” it with their broswer’s specific features and UI. Google could make Manifest V3 harder to exclude from those re-builds.
It’s this very reason that Microsoft moved to Chromium as they could not keep up with the changes Chromium were pushing to the open web. They have also made it very clear that they’re not “forking” Chromium for the new Edge, but rather using it as their “back-end” so they can focus on their “front-end” while contributing back upstream to improve the back-end. Too much of a divergence would land them back to square one with the issues they had keeping up with old Edge.
If a company the size of Microsoft are unable to maintain a “fork” of Chromium, it doesn’t leave much hope for the smaller companies like Brave, Vivaldi, Opera, etc. However, that does not mean that they are unable to exclude the Manifest V3 from their builds, just that they’re still beholden to the changes made to Chromium to some degree.
Microsoft is entirely able to maintain a fork of Chromium, or even their own proprietary browser.
What Microsoft has done is a cost/benefit calculation and decided that the benefit for maintaining their own stuff is not sufficient to justify the costs.
The thing about those types of analyses is that they are very company-dependent. That the C/B ratio is not good enough for Microsoft doesn't imply that it can't be good enough for other companies.
I would love a citation for that.
Are you prepared to pay for it?
Many people love sharing stuff. The move to this ad-driven web happened because companies saw they could make money here. I'm totally fine with companies not making money and the web being driven by scientists and hobbyists.
Sure. We're all paying for it anyway -- the only question is what currency we're paying with. I'd much prefer the currency be cash rather than data.
I remember early 2000's, late 1990's internet...it was truly better times. Simplicity ruled, content ruled, not design solely around selling clicks.
Using a ad-blocker in Firefox was the #1 thing I suggested for safe computing. And don't open unexpected email attachments. This killed 95% of peoples computer woes.
So good job Google, you did it, from here on out whenever I see Chrome on families computers I will strong-arm them into switching to Firefox. I did it in 2005 and was wildly successful. I can do it again. And I think my Christmas gifts this year will be domain names and three year subscriptions to Fastmail for my immediate family.
Install FF
Set it as default
Change path on desktop shortcut for "Internet" to FF
And ofc do not forget to say that is new IE version
That's just plain dumb. Explain to your users what you are doing. You seem to think they are stupid, well they are not.
And by the way, smart ones already had FF and Opera installed
However, as programmers, we should see the internet not as a browser at all. We should see it as a list of protocols and implementations thereof.
I think a big part of the oh-so-common emotional social media battles is anticipation of the other person's experience. Hopefully for you, as a programmer reading this, your view of the internet is protected by automated command line scripts that fight your internet battles for you...
Brilliant!
Of course, we all know the original Turboencabulator is GE and all the others are knockoffs, but I've tried other brands and they work just as well, if not even better.
Even the original vehicle manufacturer might purchase the parts from several of them.
You, as an typical end-user, have practically no chance to find out, whether the replacement part is "original" or not.
I understand the grandparent point, but their analogy is terrible. When you are paying for a specific brand of item and you get an alternative brand without being informed and giving consent, that is fraud. It is a crime, and it is effectively stealing from you the difference in price/value/cost of the two items, since you're paying for the other brand.
The first Google scam - yes scam - was Adsense and adwords. The search "sponsored" box was a yellow designed to be near indistinguishable from white, and was invisible on many LCD monitors. Adsense and adword links were the same blue IE used for links - because people had been conditioned to believe blue links simply traversed the web.
With hindsight, that's the moment everyone should have lost all trust in Google.
You don't have to explain what firefox is, or what IE is, just that "this isn't IE but it does the same thing and will keep you safe".
Maybe they'll have follow up questions, and you can answer those, but lying is just a good way for them to go back to IE and not tell you because they don't to be treated condescendingly.
I have no issues with my Sonos equipment - I use a local MP3 library, a Spotify subscription and TuneIn Radio all without any issues.
What problems did you have?
They do have the advantage of covering your entire LAN and working inside apps, so they are definitely useful. But they don't replace real adblockers, or even the castrated ones Google is pushing on its users.
I hope no one here is surprised by this G was more and more anti ad-blocking for years now.
This is only natural conclusion after u are a de-facto browser monopoly.
The idea behind the "I am not a robot" captcha is that if you act like a human, then you don't need to be shown pictures for further confirmation. The more you allow tracking, the more info they have to figure it out.
A big one is being logged in to your Google account. Having access to all your history really helps. And because Chrome heavily encourage you to setup a Google account, Chrome users are more likely to be logged in than Firefox (or other) users.
Spoofing your user-agent is likely to be worse. If you have a Chrome user-agent but your browser don't act like Chrome, that's a big red flag. Bots often spoof their user agents.
No AI, that's just a car, not a taxi.
But who cares, I just click anyway and feed bullshit in and in a few years it'll think everything is a taxi.
... and (probably?) the world's largest ad broker.
See this FAQ:
https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest...
Note how they say: "We have no immediate plans to remove blocking webRequest and are working with add-on developers to gain a better understanding of how they use the APIs in question to help determine how to best support them."
"No immediate plans" is weasel-speak, as is "[we] are working with add-on developers".
If Mozilla was dead sure that they weren't going ahead with it, they would say so, unequivocally. And I remind you that Mozilla "worked with add-on developers" when they unilaterally decided to drop XUL and go ahead with web extensions, while failing to include support for APIs that developers said they needed to support functionality that their add-ons provided.
IMHO, adoption of manifest v3 is not a matter of "if" but rather "when".
The question is whether Mozilla _removes_ support for webRequest like Google did. And you're right, they weaseled their way out of answering that question.
As far as organization Mozilla have my trust and I don't look for false bottoms in their statements.
I would point out the previous statement they made there:
> Firefox is not, however, obligated to implement every part of v3, and our WebExtensions API already departs in several areas under v2 where we think it makes sense.
I trust Mozilla to be on my side as customer than ad industry. Well, we will see what future brings.
https://gist.github.com/Lusito/dd6b76b93f83267903619103745cc...
"Fair warning: I don't speak for Mozilla. Everything I say here is a recording of my memories from that event. Nothing more. Nothing less."
(and yes, I noticed that the second "someone" is Mozilla's "Add-ons Policy Policer, Thunderbird Council Chair", but my point still stands: this is something "someone" said, not Mozilla's official position)
>“Firefox Software Update.app” can’t be opened because Apple cannot check it for malicious software.
Google has officially reached 90s MS levels
- lots of developers not caring at all
- businesses being businesses caring that we don't spend time on it
- ordinary people not caring even when the alternative is in another league
We got some work ahead. Hopefully Mozilla won't mess up too much during the next few months/years and then we might pull it off again.
And feel free to reuse the hashtag above : )
There’s nothing particularly inevitable about what happens next, but let’s hope they get an IE6-sized kick in the teeth.
as in: people will continue to suffer for about a decade while good alternatives readily spring up but suffer slow adoption?
For example, it takes a lot of effort and energy for me to explain to non-technical people that comparing Apple and Google in terms of their mobile devices is non-sense. Just look at their regular financial reports, I usually say, and understand that one is an online advertisement business, while the other is a purely software + device business. One wants you to use their devices at all costs, while the other wants you to buy them. Those are very different core business models, different mentality and approaches. Etc etc. And so the choice between them comes down not even to taste or quality or price; it comes down to which business model you sell your soul to.
And then there's ad blockers and understanding how modern internet works etc. It worries me that the disconnect between those who understand the inner workings of tech and those who don't becomes bigger and bigger by the day. As the tech business itself becomes more and more sophisticated (and monopolist/authoritarian).
It’s not just tech savvy people. I imagine plenty of people here have set one up for their family members.
Turns out "Don't be Evil" was more than just a feel-good marketing slogan. It may have actually been good for business as well.
Bye bye Google. It really has been great!
More like since 2014.
I use google search for one thing only these days: product search, when I'm trying to find a local dealer for a product.
For everything else, duckduckgo, which, to be completely honest, is a lot more like the old google from the early 2000s, than the current google.
I do remember remarking to somebody around this time that google search had become something of a glorified grep.
You could still get things though. What I meant in this comment is that it has gotten even worse to the point that its almost unusable. It really does remind me of Microsoft of the 00’s.
But sometimes I dream about building my own search engine. It would avoid the big ad-driven sites as much as possible, and give preferential treatment to obscure blog posts about topics nobody else has written about. I want a search result to show the many different ways it could be interpreted, rather than assume one of them based on whatever heuristic, and show me tons of identical results that aren't what I want.
Google knows I land on StackOverflow results so often that SO results appear near the top, if not the #1 result, for terms that often have nothing to do with programming or computers. I was recently looking for an online thesaurus service and Google showed me an SO post about building linguistic/semantic search algorithms. Hmmm.
Now my last visit to Google is more than a year ago because DDG got better while Google got worse.
I noticed this since around 3-4 years ago.
It seems to be based on region.
Quotes get ignored. Even very specific queries about X prioritize clickbait junk like "TOP 10 X!!"
I THINK they might be anti-competitive too; searching for particular Apple APIs is sometimes more miss than hit, though that might be because of Apple's own poor documentation.
However, most Apple-related searches used to show me Samsung crap, and that's definitely not benign. Like searching for "iPhone" literally presented an ad for the Samsung Galaxy at the top, for a while.
That's how ads work. If Samsung pays more money than Apple to show ads to people searching for "iPhone", then people will see Samsung ads.
i.e. if Samsung was shoving itself into the searches for all non-Apple phones?
I won't be using Chrome anymore once they implement this since I like my element-hiding rules which I wrote myself, but for the common rabble, Manifest v3 will be an improvement.
I think the same thing that happened with popup blockers will happen again. Advertisers will be forced to listen to the consumers and the internet will be better for it.
Have you turned off your popup blocker recently? You can surf around even to fairly sketchy sites, and I bet you won't see a pop up. The consumer won. With tracking, we'll win again.
A proxy that wants to do this before the browser will need to do a lot more work I think?
BTW I can see that you are French ^^
Chrome used to be the underdog.
And we are the ones that makes suggestions. And end users then make same suggestions to other people.
Word of mouth I believe is a VERY important marketing tool.
Basically if Chrome looses people that brought them market share in the first place... I think market can shift. Not that it happens fast enough. But having some market share for Firefox is important.
It isn't? It seems trivial to me -- what are the friction points?
If you are technical, it's still a pain to get everything imported and set back up, and the extensions you're used to may be absent or done in different ways, and the subtleties of eg: incognito mode and reader mode may be different. You may have to re-construct your personal adblock rules. And so on.
I'm always confused when people imply this isn't the case or start demanding evidence. I'm bemused when they are surprised.
I've never been a Chrome user, and I honestly don't remember ever hitting a website in the last 10 years or so that didn't work for me.
In Netscape/ie times WWW was other than nowadays, so your analogy is not correct
What matters to me is the part I can't influence that easily, and I simply prefer Firefox because it's not based on Chrome. Not something many browser developers can say nowadays.
I say this as someone who uses 99% Firefox, 1% Chrome... I had never thought about this point I'm making before.
So I’ve been a bit ahead of the crowd and gave up on Chrome long ago.
This ad block scandal made me give up on Safari too though. Firefox seems to be the only reasonable option left.
Is this true? That's a complete showstopper for me.
In any case, how do they dare disable my power management for something I didn't start myself?
Mozilla has said before that Manifest V3 is up for consideration in Firefox and that “there are no immediate plans to remove” the existing APIs (mainly webRequest). [1] If Mozilla makes the power of uBlock Origin untenable on Firefox [2], that’d be a sad day for me, and I’d probably switch to Brave (assuming it’s still able to support uBlock Origin, even though it has a built-in as blocker).
If anyone from Mozilla or the Firefox team is reading this, please lead the way on these changes in a way that improves security (one of the goals of Manifest V3) while allowing extensions to remain powerful. Letting Google dictate the terms or just following Chrome will likely make Firefox worse in the eyes of power users and those who influence others to use it.
[1]: https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest...
[2]: like it did with the XUL obsolescence (for good reasons) and the removal of great extensions like Tab Mix Plus and Session Manager (without providing a way forward for them to work; session saving extensions on Firefox are still not as good as the mozdev Session Manager was).
https://www.google.co.uk/amp/s/www.zdnet.com/google-amp/arti...
curiously i haven't noticed any changes on my day to day browsing habits.
Firefox fans want it to become a great browser. No shits given to Chrome either way.
If Anything, I am nervious of installing any ad-on that can access the web pages I visit and send god knows what who knows were. It's almost as an accident waiting to happen. The web is only secure when your browser is secure.
I like the natively handled content blocking approach much better.
AFAIK there is no way to make Safari execute any cosmetic filters at all. (My uBlock Origin setup lists ~50k network filters and 150k cosmetic filters)
There are cookie notices, social media buttons, premium newspaper article headlines, comment sections, fixed elements and content "suggestions" everywhere. Unusable.
I use css filters in ublock origin to increase the font size of the HN comment titles because I often miss the collapse or vote links. ...or to block the food suggestions in Googles shoppinglist that, by appearing as an overlay, always hide the first list entry to suggest me to buy "hamburger". (I'm not joking.)
I still do have the device somewhere and I am open for suggestions on how to get control over the content (or at least remove ads) on an ipad, but I don't think there is currently any full content-blocking solution for iOS.
Which is a shame because (in my case unbearable software aside) the device does not appear bad from a hardware perspective.
You've also included an /amp/ link, which is another part of the problem of becoming too dependent on Google.
ms thought that ie will be at the top forever too
I have no idea about the domain but 30k rules seems more than sufficient to map from a 150k set of uncompressed wildcard patterns.
> we are currently planning to change the rule limit from maximum of 30k rules per extension to a global maximum of 150k rules.
(https://blog.chromium.org/2019/06/web-request-and-declarativ...)
That aside, I wouldn't want to bend backwards just to comply with how Google wants the world to work. I'd rather use Firefox.
@dang can you change it to match the site? I think this submission violates the site guidelines on titles. The original title is "Google Begins Testing Extension Manifest V3 in Chrome Canary" and doesn't include the ad blocker flame bait.
"Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize"
But this:
>The most controversial aspect of the extension manifest v3 is the upcoming changes to the webRequest API. In v3, Google has changed the API so that extensions can only monitor browser connections, but not modify any of the content before it's displayed.
>Instead Google wants developers to use the declarativeNetRequest API, which has the browser, not the extension, strip content or resources from a visited web sites. This API, though, has a limit of 30,000 rules that can be created.
>Unfortunately, this change will break popular ad blockers such as uBlock Origin, which rely on the original functionality of the webRequest API and need more rules than are available in the declarativeNetRequest API.
Is very worrying. So thanks to the submitter.
The limit's been raised. The removed API is used by half of all detected malicious extensions to spy on users. Ad blockers will continue to work fine with the new API, just like they do on Safari now.
I thought the worrying thing isn't whether it's a 30k or 300k limit but that Google itself chooses the amount of filters users can apply.
It feels to me that this is just asking for the abuse of power.
I don't think the specific number itself is anyones primary concern.
The API wasn't completely removed. You can add still use it to monitor requests, you can't block them anymore.
No idea what Google is thinking. In one short decade they've become the new villains of the internet.
Only thing I'd really love to see are container-specific windows, so 'Work' tabs would open by default in my 'Work' window.
Full disclosure: I love this extension.
Unfortunately for Google, Chrome is open source, and Google will no longer be the dominant Chromium branch if they keep making mistakes like this.
But if I had to choose between adblock or swipe to switch tab, then they made the decision for me. There is no way I can ever browse the web without an adblocker
I use Blokada for adblocking on Android btw, and this change wouldn't affect that. Works fine.
I never knew you could do that! How did you discover this feature?
Sometimes they are useful but in most cases you need more flexible solution
If site has ads served from main domain you can't block them
You can block ads with some static files on subdomains/domains, and this drastically change content (like how is image sites looks like without images?)
So, using DNS filtering for big ads providers is OK
For small and smart ads providers will not work
And I mean ads and tracking the same thing. While you can block all kind of "analytics", at the same time you can't block web-server logs with your IP (cookies, etc)
>Instead Google wants developers to use the declarativeNetRequest API, which has the browser, not the extension, strip content or resources from a visited web sites. This API, though, has a limit of 30,000 rules that can be created.
>Unfortunately, this change will break popular ad blockers such as uBlock Origin, which rely on the original functionality of the webRequest API and need more rules than are available in the declarativeNetRequest API.
Looking at an old picture of ublock origin block lists: https://www.bleepstatic.com/images/news/u/1100723/uBlockOrig... we can see 150,000 rules. The whole point of a rules list (easylist/easyprivacy) is that they're easy to maintain, since it should be a surprise to no one that adding new ad domains is trivially trivial. EasyList alone is 30,000 rules and it alone is woefully insufficient for a modern-day browser. The declarativeNetRequest only allows for ONE type of filter to work. The static kind, i.e. the old, deprecated, bad, insufficient kind.
Recommended reading: uBlock Origin developer's comments on this change (unanswered by google ofc) https://bugs.chromium.org/p/chromium/issues/detail?id=896897...
I'd rather have lots of broken websites than websites with adverts. I suspect a lot of web users feel the same way.
I seriously doubt I'd be left with any "broken sites" I care much about by the time I've whitelisted 30k 3rd party javascript domain/paths?
(https://blog.chromium.org/2019/06/web-request-and-declarativ...)
It does not; actually, I’d argue that the adblocker I’m using right now works just fine. I cannot see how it will do in the future, but it’s just incorrect to say that this change kills all adblocking.
Losing the ability to modify content in this manner means adblockers can't compete in the arms race against advertisers. Anti-adblock scripts running locally with randomly-generated names will render this sort of declarative content blocking ineffective.
However, I think Google will exploit their browser-market-dominance to bend web tech to make escaping from ads impossible, same as what they did with DRM.
We need some benevolent dictatorship in tech to sponsor this ecosystem.
The rule limit has already been raised to 150,000.
Plenty of ad blockers will still work in Chrome.
This thread is chock full of motivated reasoning and deliberate misinformation.
And they can continue doing so because spying is passive and the passive (just eavesdropping, no modifications) webRequest API still will be there.
>The rule limit has already been raised to 150,000.
And it could be 10 billion rules. The point isn't so much the actual number, but that you cannot programmatically judge and block request anymore.
>Plenty of ad blockers will still work in Chrome.
Of course, those ad-blocker crippling changes aren't in the Stable yet, and even in Canary they are only "preview" and the old APIs still work.
>This thread is chock full of motivated reasoning and deliberate misinformation.
Yes, that's more or less what you did here.
Is it that the people posting in this thread are.. authors or stakeholders of malicious extensions? Do they all work for Mozilla? Are they a part of some rival industry which stands to benefit from the fall of adtech? Have they shorted GOOG?
Surely it would be strange to class arguments from users who want to continue to block ads in their browsers the same, effective way that they have been for years as motivated reasoning. What sinister motivation am I missing?
All we really know is that they are annoyed that Google is neutering an extension which they like to use, which makes enough sense that speculation on their motivations isn't really justified.
One has to love and admire the use of Newspeak by big companies... How is this Mr Vincent an "advocate"? He's in charge of destroying extensions!
On his Twitter bio [1] he also says he likes "helping people" and "the open web". The cognitive dissonance must be hard to bear.
> I also don't want to hijack this without the project's permission. @gorhill & contributors, do you mind having this discussion here or would you prefer if we moved it elsewhere?
I haven't really been following this issue, but I did read the linked reply, so I may be missing some bigger context.
In Google's corporate opinion, Google's ads must not be blocked. In everyone else's opinion, all ads must be blockable at a user's option.
That's not a difference that can be mediated.
What they did was to introduce a break in the discussion. Most people subscribing to that GitHub issue, which was trending on HN [2], will not start monitoring Google Groups for any new discussion that may take place, which reduces the likelihood that there will be enough people pressuring them to give clear answers.
[1] https://github.com/uBlockOrigin/uBlock-issues/issues/745#iss...
It’s so transparent, I boggle at how anyone falls for it, or that companies still think it is a viable strategy.
I remember clearly an interview of a very famous IT billionaire going this way:
- What's the most annoying myth about you? - A myth migh be that I'm the most generous philantropist of all time. [...But] I havent' sacrified my time or economic well being the same way lots of unamed, amazing people do. So they're the worlds best philantropists.
This is the least subtle humble-brag of all time. "People says I'm so incredibly amazing. But they are wrong. There are out there more amazing people." is gotta be next to the job interview answer "my biggest weakness is that I work too much" in the BS book.
But the reactions to the interview are still, to this day, "this person is so humble", "he is such a good man", etc.
I don't think it really counts as a humblebrag to say "it's a myth that I'm X" when there are in fact a lot of people saying you're X.
He could, for sure, have gone further out of his way to avoid humblebragging: he could have said something like "I think a lot of people overstate how generous a philanthropist I am". But he was asked, specifically, what the most annoying myth about him was, and all the anti-humblebrag tactics I can think of right now avoid humblebragging by not stating a specific proposition at all -- so they fail to answer the question he was actually asked.
And he could, for sure, have picked something else, maybe something about his time at Microsoft. But these days he's much better known as a philanthropist than as a Microsoft founder or executive, and I bet the things people (truly or falsely) believe about his Microsoft career aren't the things he considers the most annoying myths.
Realistically, Mr Vincent is not in charge of being an advocate for anything other than Google's corporate interests. But he is not in charge of destroying extensions either. He may well be in charge of destroying ad blockers though.
That's a minor issue. The bigger issue is the fact that, if adblockers become truly popular, websites will go back to serving opaque binary blobs instead of HTML+CSS+JS.
Remember Flash and 'Flash pages' back in the day? That, except worse.
they will just serve web assembly
Stock options and bosses with different incentives are available at other employers as well.
> Stock options and bosses with different incentives are available at other employers as well.
Most other employers don’t have a near monopoly on the web browser market.
I don't think assuming bad faith with absolute certainty is a productive form of debate.
[Edit]: As a matter of fact, I don't believe that advertising is entirely replaceable as a funding mechanism for the open web at this point in time. That doesn't mean we have to accept all its excesses without resistance.
>Most other employers don’t have a near monopoly on the web browser market.
A near monopoly is not a prerequisite for an employee to make a lot of money somewhere else, especially not for someone in a PR role like "advocate".
It’s not a debate though, Google is removing these user friendly features and sprinkling some marketing speak over their actions. It’s right to call them out on that. Also, if your job is to be the face of that marketing speak, you should expect people to question what you say.
[edit] Funding and openness are tangential. A system need not be profitable to be open. Look at open source.
I don't think open source is a viable solution for all currently ad funded services. Some services cost a lot of money to run and many indirect funding sources come with their own downsides. Open source projects are often leveraged by some of the largest corporations for their own strategic purposes that don't necessarily help openness.
But my original point was simply that this is a non-trivial debate in which all sorts of opinions can be honestly held.
Get a new job.
True. They won't change their mind. The only signal they will listen to is to stop using Chrome.
While not wishing to speculate on specifics, there is medication in common circulation that can help with such inconvenient emotions.
So communicating what the team is doing to the outside world, not defending the utility of the extensions.
Freedom is Slavery.
Ignorance is Strength.
I've been on Firefox since they launched their quantum version a few years ago after a few years of using Chrome. I like Firefox but I notice a lot of people around me seem to default to Chrome. Things work well enough on Firefox that I don't consider compatibility a problem. But I do get a lot of raised eyebrows from people who consider this an extreme thing to do. Just like back in the day where I was doing most of my browsing with alpha builds of Mozilla Phoenix instead of just using IE like world + dog.
But what matters is that the market has changed. 15 years ago when MS made their anti competitive moves with IE and in the process helped Mozilla survive their Netscape implosion through reinventing themselves through their Phoenix -> Firebird -> Firefox reinvention (I used all of those). However since then, the market has consolidated around just 3 browser engines: Chromium, Webkit/Safari, and Firefox. Of those Chromium essentially powers all of the Chrome alternatives that aren't Firefox or Safari (Edge, Brave, Opera, etc.). Another change is that the web has imploded to just a handful of websites gobbling up most of the traffic. Yes there are a lot of websites but mostly the way to them leads via Google, Facebook, Apple, or MS owned properties.
Finally the ad market has changed. GDPR and related efforts in other markets (including the US) are pushing the market towards more responsible behavior with respect to getting users to opt in and to ad experiences that are increasing harder to block because they don't necessarily come via separate websites and domains.
so long, chrome!
It seems to me that they want to reinvent the entire Chrome UI but they don't have the necessary manpower to do it properly.
Cos sure as hell no user is waiting for this.
Most of the web browsing happens on mobile devices where Chrome has a staggering 5B+ installs (though possibly not all active) vs Firefox's 100M+. Chrome on mobile never did support extensions let alone content blockers.
The manifest v3 offensive is meek compared to their hegemony already on display in the Android world which has 2B+ active users that almost exclusively use Chrome.
I see an anti-trust case in here somewhere or for Mozilla to simply buckle up and sign deals with OEMs that makes them the default browser and webview on Android.
Why do you assume Google implements features that users want? They implement features that their clients want: the ones paying for ads.
The real problem is news websites don't show restraint and shovel (so, many) ads to customers, making impressions go up and clicks go down. IMO ads won't go away and adblockers won't kill them completely as too many market forces (privacy, performance, revenue) is making the industry adapt.
Disclaimer: Personal opinion, Googler, not in ads or Chrome.
I'm not sure if this is possible in Chrome's proposal though.
Maybe this change will finally get people to prune Easylist which had 30% outdated cosmetic-filter cruft when I last sampled it along with hobby horse websites <0.00001% people would ever visit. Right now it's basically like an append-only legacy CSS file.
If this rolls out, I'm going to very loudly tell my friends to use Fox, and not stop.
I feel sad that each time this comes up even on HN it's always "Google, ad company, bad". There's a mention elsewhere about 30k limit being limiting. Why aren't we discussing alternative enforcement metrics, and request for inclusion?
Without any further explanation that sounds rather unlikely.
The change is very publicly criticized and keeping legitimate reasons that could've increased support secret is a really counter intuitive strategy.
Apart from that I think it's not far-fetched or particularly conspiratorial to assume that an ad-company might have an interest in restricting ad-blocking.
"When you hear hoofbeats, think of horses not zebras."
1) avoid being locked out of platforms by not controlling the default search. Apple and Microsoft could either extract a high toll, or crush search engines by controlling what search engines people see by default. On iOS, Apple does extract a toll to be the default, but MS was denied this, by Chrome beating out Windows Mobile and Edge/IE. If your company is wholly a web company, and someone else controls the key onramps to the web, you're potentially in trouble.
2) If the Web becomes a toxic wasteland (which was happening prior to Chrome when IE6 ruled), users flee more towards silo'ed platforms and apps. A healthy web is as beneficial to Google as a healthy forest is to a timber company.
It's like saying "The New York times is an advertising company, not a news company, so why would they invest in journalism schools if the point is to sell classified ads?"
And then there's just plain old interest in technology. Lots of projects at Google start from 20% engineers time, and grow to large successful projects, without any business model, they're just costs. You've got more than a thousand open source projects I bet being run by Google engineers, the majority of which exist because someone wanted to scratch an itch. Go, Angular, Tensorflow, Guava, et al, don't make money and aren't intended to.
I disagree that Google is a web company proper. It might have been years ago, but nowadays Google is capable of bending the very rules of the web and internet at their liking. As a result it can now essentially define what the web (okay, the modernish web) is, and that makes your points moot. Also Google's open-source projects are irrelevant to this discussion, much like that using React doesn't void your rights to criticize Facebook.
What kind of freedom do Chrome users get?
First of all, the HN title is not the title of the article. HN mods, please change it to reflect the actual title of the article.
Second, to me this does not seem as some attempt by Google to actively block Adblocker extensions. They are proposing a change to the API (Manifest) to no longer allow manipulation of content, which I think is a good thing from a security standpoint. They also propose reducing the number of content stripping rules to 30k. Now, I'm not familiar with add-on development, but this sounds like a constraint that was implemented for performance reasons. This constraint will break add-blockers in their current form, but there is no reason for me to believe that this will make content filtering impossible.
It is also clearly stated that the V3 manifest is in early testing phase. Nothing here is set in stone.
Current rules list easily exceed that number. They said back in May/June that they would consider looking increasing the number of rules - they clearly haven't chosen to increase the number in the intervening time. Maybe they are waiting for more actual testing, but they're not setting themselves up for an easy time.
It's also honestly a little rich to worry about the performance impact of ad blocking given the performance impact of ads themselves.
--
[0] https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-e...
The change here moves modifying content of the webRequest to the browser from the extension. This is fundamentally more secure. Allowing third-party extensions to inspect and _modify_ arbitrary HTTP requests is nothing short of dangerous.
The new declarative API (from the article) limits such extensions to 30,000 rules. I honestly don't know what impact this will have on ad blockers. At worst it seems like ad blockers will become less effective as simple logic tells you that some rules matter more than others and the least used rules will simply be dropped.
So rather than be alarmist and use this to feed into the tired narrative that "Google is killing ad blockers because it's an advertising company" (paraphrased) we should be pushing for changes that make this workable, such as:
1. Having a higher limit than 30,000; and
2. Working on ways to condense N rules into <N rules. There must be ways we can be more expressive so that we don't require as many rules, no?
I honestly don't like the fact that I have to give a third party developer so much privileged access to run an ad blocker and I'm surprised anyone else is. Extensions can be compromised.
That’s not alarmist, it’s the obvious truth. As a user I should have complete control over what runs on my machine. I don’t need Google “protecting” me (by breaking ad blockers). Google is the single most destructive force in the tech industry today. Very much like Microsoft in the 90s. We should resist their attempts to embrace, extend, extinguish and we should be insulted that they couch these changes in marketing speak that pretends to be pro-user when it’s the exact opposite.
You do. By running Firefox. This level of control might be useful to you but it's not to most users. As much as power users chafe against things like the App Store, for example, this is clearly a win for most users. Limiting what a malicious extension could do is very much the same because I can guarantee you there are scams to get users to install malicious extensions.
How Firefox should respond here is to make ad-blocking a first party solution. In that Firefox itself is responsible for the blocking and all extension writers are responsible for are the rules.
At that point you will have a solid story that FF is putting the user first.
I don’t think it’s “clear” at all that most users benefit from monopolistic app store practices. I think the giant tech companies do though.
1. Google wants people to use Chrome. It's clearly of benefit to them (and, for the most part, to users, at least for now);
2. Alternatives exist; and
3. Switching to an alternative is essentially trivial.
This just isn't a Microsoft Windows monopoly situation.
Okay, yes -- that would be an interesting move. Not sure they can afford it but it would be great.
Only to those who are woefully ignorant of how any large company work and are unable or unwilling to see passed their own desires. But let me ask you this, even if we stipulate it's 100% true, how does that help? What does that accomplish? You've simply stated an opinion that those who agree with you will cheer for (changing nothing) and those who disagree with you won't change (also changing nothing).
People have this overly simplistic view of how large companies work and ascribe malice to Google in particular for what's essentially just chaos. And I say this as a Xoogler.
There are conflicting forces in Google that include, but are not limited to:
1. Protecting the ad revenue business Google is utterly dependent on; and
2. Promoting user privacy and benefits because that's what gets users to keep using your products.
Even (1) comes from a wide variety of motivations such as:
- Making more money;
- The belief that ad-supported models are the only model that works so advertising is an absolute necessity to providing services on the Web.
> I don’t need Google “protecting” me
And again, you seem to be deliberately missing the point here because you say "I" a lot. What about your parents? Or grandparents? Do they need "complete control" over their machines? And consider for a second the scenario where you're not giving them tech support.
This "complete control" is exactly what enables botnets (many of them anyway), fraud, theft, DDoS attacks and so on.
On the contrary, I think google removing this ability actively removes user choice. A choice that I think users should be able to make.
Slippery slope argument: I run a PiHole on my network. Perhaps Google should also absolutely require DNS over HTTPS in Chrome, too, because it's nothing short of dangerous to allow third-party DNS servers to inspect and modify arbitrary DNS requests.
> Extensions can be compromised.
It's also Google's decision to make extensions auto-update by default.
> extensions can only monitor browser connections, but not modify any of the content before it's displayed
But server-side connection-blocking or request-blocking detection works even when JS is disabled, but it requires a lot of infrastructure and cooperation between publishers, ad-networks, and more - both technical and political/business cooperation.
Eventually in the future, web-browsers will render a page twice: one fully-loaded page, hidden from the user, that the ad code will think is what the user sees, while a network-sandboxed version is shown to the user with the already-loaded ad images replaced with white boxes or so. The client scripts can’t tell the ads haven’t loaded and even if they did they can’t phone-home to snitch on the user, while the browser still made those HTTP requests for the ads so the ad-network is satisfied it made an impression.
Perhaps we could get fake ad-loading working without wasting downstream bandwidth by spoofing the IP source address field?
Removing the dynamic capability kills heuristics, so it definitely makes ad blocking worse. There's a reason uBlock Origin is popular.
If, as the author suspects, the intent is to break popular adblockers, I have no interest in trying to make this workable.
Personally, I think this is a typical half-legit move: there's a good intention (security) but it's also hard to believe they did not realize that by pushing these changes, they were going to break several of the most popular extensions available. And, that the direct impact of this would be that for a short moment (at best) many more ads were going to be displayed on Chrome.
I think we've seen a lot of these half legit moves recently (apple battery scandal?). So I'm starting to be more and more suspicious.
So the "security" reasons google gave have long been debunked as non-sense.
The other half is the performance reasons. What's the performance burden of calling a (chain) blocking webRequest listeners? Last time I checked it was single digit milliseconds per request. So a very ad-laden worst-case website with 100 requests will spent maybe 500ms in the webRequest listeners, but will still load faster thanks to all the cruft being blocked away. So what's the win for performance exactly?
Not every surface is a slippery slope.
I don't understand, you're saying these discussions are useless because anyone can switch to Firefox anytime? But why would anyone decide to switch to Firefox if it weren't for these discussions. This is not something users can experience directly (like bad UX), clearly they need some level of understanding.
And Google taking full control on yet another thing on the web, does sound like a slippery slope to me.
False: https://developer.chrome.com/extensions/declarativeNetReques...
"There are the following kinds of rules:
- Rules that block a network request.
- Rules that prevent a request from getting blocked by negating any matching blocked rules.
- Rules that redirect a network request.
- Rules that remove headers from a network request."
But adblockers authors do know. Instead of accusing people of not reading the article, feel free to read what uBlock origin author has to say about this change.
> I honestly don't like the fact that I have to give a third party developer so much privileged access to run an ad blocker
Then don't, install another one that works the way you want. Or don't, because the limited blocking abilities you appear to find sufficient can be gained just as well using an external proxy.
> Extensions can be compromised.
So can browsers, devices and operating systems.
That's pretty much what phones do. Both iOS and Android take a white list approach for third-party add ons.