Hacker News Reader

Comment by kmeisthax | Hacker News Reader

Quite honestly I'm of the opinion that Google should strictly audit all transfers of ownership of popular extensions. The options for monetizing extensions are so limited that the only thing that can motivate someone to buy an extension is nefarious purposes.

View on HN

I commented about this in the announcement thread[1]:

====

Though the extension requests the webRequestBlocking permission, that permission is not required to perform the collection of data, including sensitive ones.

====

* * *

[1] https://github.com/NanoAdblocker/NanoCore/issues/362#issueco...

How can google achieve this, realistically speaking?

I immediately wondered if the controversial Manifest V3 changes would render this a non-issue.

https://github.com/uBlockOrigin/uBlock-issues/issues/338

https://developer.chrome.com/extensions/migrating_to_manifes...

I was thinking the same thing. The reason that plugins like this, uBlock, and Stylish are so valuable is that they have access to everything on every site by nature. On one hand it sucks to have functionality taken away but on the other hand it protects against potentially large security issues.

> On one hand it sucks to have functionality taken away but on the other hand it protects against potentially large security issues.

Except that it doesn't actually protect against security issues, because v3 manifests don't break the ability to read data, only modify requests. Also, since ads are a vector for malware[0], having an adblocker is a security benefit, not a loss.

[0] ex. https://www.extremetech.com/internet/220696-forbes-forces-re...

Thanks for the clarification ;-)

Unless I missed something, no. Extensions can still have full access to the data stream as long as it's read-only. Maybe it could help a little if you're extremely careful about permissions, but how many people are?

Yeah, I was wondering the same thing actually...

Manifest V3 breaks ad blocking without doing anything about extensions spying on the user. It provides read-only access to everything that previously was available and merely removes the ability to modify or block requests.

How would that work? How would you know the new owners are bad until after they’ve pushed an evil update?

Reply on news.ycombinator.com