Hacker News Reader

Comment by Shank | Hacker News Reader

> There was controversy over changes to the WebRequest API but that was two years ago and, I believe, changes have been made. Are there still changes that break functionality? What changes were made over the past two years? Have things gotten better or worse?

The WebRequest API’s blocking functions, which are central to the functionality of uBlock, are still slated to be removed.

View on HN

Blocked under the supposed reason of privacy, but extensions can still see every request, and inject whatever javascript they want, exfiltrate your data, etc. Meaning the reason is pretty clearly not privacy.

Can you back this up?

Seems like a pretty clear case of being two-faced, and a small page laying out the details would be super helpful.

That Google said it was about privacy? There's some quotes in this article: https://whotracks.me/blog/manifest_v3_privacy.html

Or that extensions can still inject javascript, observe and log requests, exfiltrate data? I mean the api docs will tell you that. Extensions can do all that because they couldn't do a whole lot without those capabilities...normally used for legit purposes, but the apis can't really glean intent.

See things like onBeforeRequest for observe. Injecting javascript is called a "content script" in chrome extension terms. Exfiltrating data could be done in many ways, given that you can inject a "content script".

Thank you. I hope the author of the article reads this thread and ads a proper summary of the problematic changes that Manifest V3 introduces to the article.

Reply on news.ycombinator.com