Comment by rasz | Hacker News Reader

Comment by rasz | Hacker News Reader

Right now (as of ~81) Chrome will load first website from previously saved session without waiting for extensions to initialize - all privacy/blocker extensions are ignored on first page load, "run_at": "document_start" is not obeyed, because loading first website 200ms faster once per daily session is more important than loading adblocker! https://github.com/Tampermonkey/tampermonkey/issues/1083

The 'making extensions safer for everyone' Manifest V3 keeps the ability to spy on all traffic, but removes ability to modify headers/block requests. Killing Blocking (blocking = synchronous meaning wont complete until extension decides what to do with it) webRequest API means no more:

-intelligent/dynamic blockers

-User Agent modifications

-modifying CSP rules to disable javascript/web fonts etc

Google is removing control from users hands, from the code users want to run. This is one of the steps in a battle against general computing. https://boingboing.net/2012/01/10/lockdown.html You no longer own a computer, you own a Google Web Appliance.

We've all been watching with disbelief as Google evolved the narrative around the declarativeWebRequest API, coming up with new angles and changing the goalposts to wear people down as critics have disproved all of Google's reasons for deprecating the blocking capabilities of the webRequest API, and nothing substantial has changed.

It does not matter what any of you think and say to this company.

What you have to do now is organize.

Google's strategy is to promise they'll look into changes when their feet are next to the fire, and then when everyone forgets they continue the despicable anti-privacy behavior.

The undisclosed X-Client-Data telemetry, the adblocker-busting Manifest V3 and the new APIs that are used almost exclusively for ad network fingerprinting (AudioContext and others).

Chrome is the DoubleClick browser and now that market share is so strong the facade can lift.

Stop using Chrome. You’ve got Firefox, Safari, Edge, Brave, etc.

There's a good chance that none of those browsers will support the blocking webRequest API in 3 years, and that's because of Google's thumb on the scale. Quitting Chrome solves nothing.

Break up Google.

2/4 of those are Chrome

chromium, with modifications.

And 1/4 (Safari) already only implements declarative request blocking, and has done that for years while being touted as the alternative for privacy conscious folks.

Microsoft begins Manifest v3 tests in Edge that impacts extensions like content blockers

https://www.ghacks.net/2020/10/15/microsoft-begins-manifest-...

You still own the computer, you just download Chrome (rather than any of the alts) and give them power.

It's Google that are breaking the internet for people, and getting away with it because of their market share. I've not used Chrome for ages and use Edge only where things don't work (like Google Photos).

What about users who own Chromebooks?

It's ironically pretty straightforward to install Firefox on most chromebooks, through the Debian container/VM, with opengl + audio passthrough.

Only on HackerNews is that considered pretty straightforward. I barely understand what a container is, and I know the BIOS mbr magic number off the top of my head. We should not all have to be Andy Dufresne to escape privacyhell. A bit of a tangent coming here, if you will indulge me.

The battle for privacy is lost on so many fronts; I do not believe it can be won, any longer. Even the language used by proponents for privacy shows this. What Google and others represent is not the opposite of privacy, that would be transparency. I've never heard Google's (nor Facebook's) practices designated as transparency friendly. Perhaps there is a good word for it, but as an ESL person, I've at least never heard of it.

As programmers we should know all about the benefit that proper naming provides. And things should be called by their proper name.

I am not for privacy, I have nothing to hide. Rather, I am against the exploitation of data I generate. So this comment can be taken as either a call to arms and naming the enemy, or as a statement of my ignorance of the queen's own english :p

It's interesting to think about, that the two ways to prevent the misuse of your data would either be total privacy or total transparency.

I was mostly joking, since I can't imagine anyone buying a Google Chromebook in an attempt to avoid Google. But, for the sake of argument, I do think it's genuinely straightforward.

The internal details are slightly complicated, but from a user's perspective, all you have to do is press one button from inside settings, open a terminal, and type "sudo apt install firefox".

That's not as easy as downloading a setup.exe file, but I think it's pretty straightforward. ChromeOS will even associate URLs with Firefox, if you choose. Then, even if you open Chrome, it will redirect all links back into Firefox.

Just a small technical tangent of my own. :D

transparency

provability

interoperability

reimplementability

> Rather, I am against the exploitation of data I generate

do you really think your "data" is valuable? or was this just an idea put in your head by journalists?

ponder that for a moment

Obviously it is, otherwise everyone wouldn’t keep trying to get more of it.

Oh, come on. Anyone who worked with FB ads system as "client" understands the power and price of the data that they collect. This is not conspiracy theory but fact. And I can't imagine the amount of data that browser owner able to collect. I'd guess that even MS knows less about me than Google despite of the fact that I use Windows.

The reality turned out to be that Chromebooks are not exactly PCs.

I don't use chrome, and things like this are a big reason why. But, otoh, it is getting harder and harder not to use chrome. I'm seeing more sites that have functionality that only works in chrome. Firefox is falling behind chrome in several areas, and a lot of firefox development seems to just be mimicking chrome.

It's a catch-22. Chrome's marketshare and the power that gives Google is just further entrenching chrome's hold on the market.

You can modify headers and block requests.

Great news, please share how.

https://developer.chrome.com/docs/extensions/reference/decla...

Snippet from rules.json:

    {
      "id": 1,
      "priority": 1,
      "action": { "type": "block" },
      "condition": {"urlFilter": "google.com", "resourceTypes": ["main_frame"] }
    },
    {
      "id": 11,
      "priority": 1,
      "action": {
        "type": "modifyHeaders",
        "responseHeaders": [
          { "header": "h1", "operation": "set", "value": "v4" },
          { "header": "h2", "operation": "append", "value": "v5" },
          { "header": "h3", "operation": "append", "value": "v6" }
        ]
      },
      "condition": { "urlFilter": "headers.com/12345", "resourceTypes": ["main_frame"] }
    },

Last time I looked Google position was: "Regarding which headers will be allowed, we'll look at the feedback from devs and the current metrics and decide. In general, we want to take a closer look at the security implications of header modification."

tldr: CSP modification was strictly forbidden. Digging in further it seems this changed somewhere in 2020 and appears to be working now https://bugs.chromium.org/p/chromium/issues/detail?id=111648...

Reply on news.ycombinator.com