Hacker News Reader

Sure, just like AMP was to make the web faster.

What Google says vs what's going on aren't necessarily the same thing, they have a long history of selling us the 'for your convenience' line while removing functionality that people depended on but that ultimately hurt Google's business interests: to be able to force feed you more ads.

They have long outlived their credit in the bank of the benefit of the doubt.

Google has not provided any reason to not include "block request" functionality. And that the super bad faith underlying fact that poison their "reasoning".

There is still "block request" functionality, the change is that it's now declarative. This is the same way it works in Safari, and is (a) more efficient because you don't need to execute JS to evaluate each request and (b) more private because an ad/content blocker doesn't need to be given such broad permissions. There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and easily can be used to block Google ads.

Docs: https://developer.chrome.com/docs/extensions/reference/decla...

(Disclosure: I work on ads at Google, speaking only for myself)

The safari change absolutely kneecapped content blockers. Ublock dropped it[0], and the remaining few providers, like AdGuard, have to do all sorts of trickery[1] to get even close to the same performance.

If you're going to argue this is better, don't point us to such a clearly worse result.

[0]:https://github.com/el1t/uBlock-Safari/issues/158 [1]:https://adguard.com/en/blog/safari-adblock-extensions.html

I'm not arguing that V3 is better -- I think that's a complicated question, and I was trying to describe some of the tradeoffs. What I am arguing is that V3 does, contra my parent, support request blocking.

It does not allow request blocking as that has been understood in the context of extensions until now

It is not a question that V3 breaks the gold standard privacy protecting extension.

I quibble with this. Request blocking "as that has been understood", is preventing the request from leaving the browser. That's still demonstrably doable with mv3. What's changed is the mechanism. You can argue about the value of changing the mechanism, about the burden placed on plugin developers, or the efficacy of various APIs, but the functionality is inarguably still there.

You're being disingenuous. With Manifest v3, it is not possible any more to block requests dynamically which has huge implications for the efficacy of ad blocking (example: forget blocking youtube ads). Additionally, you're limited in how many static rules you can have.

Therefore, it's not just about changing the mechanism, the end result is clearly a lot worse. One can say, they crippled ad-blocking which this change. Hopefully, once the millions of people using ublock origin start noticing what's happening, they will move away from Chrome. I already did, ublock origin is worth more to me than any feature Google puts in Chrome.

I just hate that rhetorical game of "well, prima facie I meet your standard so what's the problem?" You met the standard before too, obviously that's not the problem

Fair point, apologies if I came off a bit harsh. I'm just really frustrated in the direction Google has taken with this whole thing.

I understand the average user probably shouldn't be able to easily hand over so much control to extensions, but on the other hand, dynamic ads shouldn't be able to serve malware or cryptominers.

I'd be a bit more open to the idea of a locked-down manifest if we had seen more good-faith attempts from AdTech to change the paradigm that makes content blockers almost a requirement.

They can block Google ads for now. Google is playing a long game.

This is just an attempt to rehash the same old arguments provided by Google that have been repeatedly debunked by developers and security researchers.

> I work on ads at Google, speaking only for myself

I'm doubtful about a person's ability to speak for themselves, when they have been consistently defending their employer on HN for years, at every occasion they got.

"It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It"

Also known as Sinclair's law.

I’m sure you are an honest person working in good faith. But we saw very similar behavior from Google around AMP. They had a very narrow reasonable sounding explanation, and just ignored all criticism and requests from both users and publishers that didn’t fit their narrative. This went on for years.

Today we know AMP was also a anticompetitive plot to kill off header bidding.

Why should we to believe a word of what Google says about Manifest v3?

> Today we know AMP was also a anticompetitive plot to kill off header bidding.

I completely disagree, and I think this will become clear as information continues to come out.

It's been years since AMP went live. Disagreeing while pointing to information that's been withheld for years and does not (to my knowledge) have a timeline for release... that does not make a very compelling argument. It amounts to "trust us". But we don't-- that's kind of the point.

I interpreted coffeefirst as referring to the current antitrust action against Google, and saying that I expect more information will come out as it progresses.

There will never be a smoking gun because the people cooking up these dark pattern schemes are generally smart enough to not document them. The problem they want solved gets broken up into pieces that are given credible cover stories and then when it is all integrated together the intended outcome happens without it ever being explicitly written down in an incriminating email.

Yes-- while never on a criminal level, I have seen it happen in places where I have worked before.

Good point, that may be what they meant. Although I would not count on all of those details coming out: for years Google has been warning employees against using certain types of language that could in someway look bad from an antitrust/anticompetitive point of view. So I would expect that a lot of documentation, emails, etc will look anodine on the surface through self-censorship.

I don't expect anything that comes right out and says something like "we must implement AMP to as a strategy to remove competition from header bidding". Instead it will mostly be just the standard talking points about user experience and load times.

I could be wrong though: plenty of things have been revealed in things like text messages where people don't think of them as being part of an official record.

Is it in dispute that google added an intentional delay? If it's not, then it doesn't really matter what else comes out.

https://news.ycombinator.com/item?id=25449748

Recently a large software company managed to avoid looking into a bug report for several days about an inability to dial 911 on an Android handset until enough social media indignation was generated (1). However, the org in question ignored it until enough outrage on Reddit was generated and it was eventually noticed. Not one alarm bell seems to have gone off despite all those clever people and funky machines and the much vaunted AI/ML and stuff. That's a bug that might engender criminal liability in some jurisdictions.

In this case, it appears that multiple large orgs are involved: G and M. One provides the environment and the other appears to have dropped their drawers and crapped in it but in the end a telephone should always be able to make emergency calls regardless of what is installed or configured on it.

In the end this sort of thing might look like lack of responsibility due to arrogance due to lack of competition. I'm sure other interpretations are available.

Normally the above should be considered an example of whataboutery but I think your response deserves little else. If you have something to contribute then please do but not that sort of thing.

(1) https://www.theregister.com/2021/12/09/android_911_teams/

[Edit: weird formatting snag, content unchanged]

Stop astroturfing.. Your company is a scummy monster!!

Google has not asked me to comment here, now or previously. When I see incorrect claims about something I have background on I point it out.

But it was your incorrect claim that was trivially disproved.

So if you weren't asked to, you're just astroturfing voluntarily. That's not better, it's worse: If one gives up one's integrity, one should at least get paid for it. Otherwise, one isn't acting just scummily, but scummily and stupidly.

What claim have I made that is incorrect?

This claim: https://news.ycombinator.com/item?id=29505292 Debunked in: https://news.ycombinator.com/item?id=29505552 (as was the attempted defense a year ago that you linked to in response).

Your linked claim is that "AMP was also a anticompetitive plot to kill off header bidding". Your linked "debunking" is about AMP pages delaying loading for non-AMP ads, which is completely unrelated to header bidding.

The claim, in a broader sense, was: "AMP is shit", or perhaps even "AMP is shit, and Google are anti-competitive arseholes". And those are certainly well-established enough by to make any attempt at defending against (either of) them delusional.

I'm happy to talk about specific claims if you want, but I was trying to respond to a specific false claim about header bidding and not signing up to defend all things AMP.

> (a) more efficient + (b) more private

This is somewhat debunked in the article of this post.

> the change is that it's now declarative.

In the App MANIFEST. To my understanding, each update of those lists will require an app update (going through Store approval process).

If only it would have been dynamic, the end result would have been much better.

And again, there is no reason to disable dynamic updates if they are only lists of blocked URLs.

I would believe this more if Mv3 didn’t allow extensions to inspect all web requests programmatically, just not block them. Want to exfiltrate your users’ data to attack or track them? Fine. Want to block ads. No way!

> There are serious tradeoffs (no request time js makes it less flexible) but it's still very capable and easily can be used to block Google ads.

Those serious "serious tradeoffs" made me completely stop using the web on my iPhone. Yeah, Safari content block can block roughly 80% of web ads, but those extra 20% are extremely annoying.

Web owners use all sorts of trickery to bypass adblockers and serve malware filled ads. Handicapping our current best defense tech against this is a sure as hell way to make me never open chrome again and completely purging it from any friends and family computer.

While there seems to be some disagreement with your position, I just wanted to thank you for being transparent about your involvement at Google. More people should act like that.

> (a) more efficient because you don't need to execute JS to evaluate each request

This is true, but I think overly performance-focused. It doesn't feel like that much time, so I think there's a valid complaint that it doesn't make sense to kneecap flexibility for speed.

> more private because an ad/content blocker doesn't need to be given such broad permissions

Sure, but this doesn't seem like the only possible solution for the people that own the browser. Why not only allow a restricted subset of JS that lacks any form of IO? Or if that's impossible/risky, why not something like Starlark or Lua?

I think this is based on a fundamental misreading of the problem. The privacy concern is that your data will leak, not merely that it's accessible to a third party. The cat binary can read my data, and I'm not at all concerned about that. So can my shell, and likewise on the concern.

Privacy doesn't necessitate this solution. It is one of the possible solutions, but I think is hard to sell as the best solution to the problem. It is likely the easiest.

IMHO it's really about "those who give up freedom for security deserve neither", as that classic saying goes[1]. The excuse of "security" has been used throughout time to take away personal freedoms, and with Google (and some of the other authoritarian parts of the industry) pushing very hard in one direction especially within the past few years, it's about time we started pushing much harder in the other. Indeed, good enough is good enough.

[1] I am well aware that was not the original context of the quote, but it's a nice rallying cry of the sentiment behind the movement.

I think the fact that it will significantly limit privacy and ad blockers is sufficient reason for a high level of criticism, which I took as the main point.

I didn't see dissecting the security details as the point they were trying to make. Instead it was to partially undermine the reasons Google said they were doing this.

Basically "here's why it's bad for privacy, and here are why Google's stated reasons for the update are insufficient to justify that"

"significantly limit privacy"? You either don't know what this change does or find it "significantly more private" when an extension developer has full read / write access to your web requests

I was referring to the much higher level of difficulty adblockers and the like will have in filling their intended purpose.

It seems like this is the clear interpretation of what I wrote and that you may be purposely misconstruing my comment in order to level a soft insult and condescending language at me over an opinion you don't agree with.

To give you a little benefit of the doubt though and assume you may just be passionate about the issue and don't intend to be insulting I will address your other point: Users giving away access to their web requests without realizing it is a problem. It is also one that can be addressed without making it much harder for privacy-minded users and the providers of those extensions to get what they want as well.

The only extensin I use (and a lot of people i know) is uBlockOrigin.

After manifest v3 it will be worse off.

Ublock origin provides a lot of privacy benefits, so people like me are 100% worse off.

Well I switched to Firefox, only really use chrome for testing nowdays.

"extensions that pull in code remotely can no longer get past the review process"

When Google says "pull in code remotely" they dont mean from a remote server. Instead its 'code remote to Google' aka code you wrote yourself sitting on your hard drive. This kills greasemonkey/tampermonkey and all the other UserScript extensions. Google saw how great Apple is doing and fell in love with the concept of walled garden. Its their browser and they wont let you execute any code that wasnt approved by them.

User Agent no more, Its Google Agent now.

Anyone who pays attention to the web platform should know by now that any rationale Chrome (or Google in general) developers give for web platform decisions is made up. They repeatedly told us they had specific motives for AMP and it was all a lie, AMP was designed to tighten their grip on the advertising market. It's not the only example - the way their autoplay whitelist works is also transparently manipulative despite lies to the contrary - and I would bet money that MV3 is partially motivated by business incentives in the same way. Googlers' paychecks are signed by Ads and GCP and ad-blockers actively undermine the former.

Review by Google is completely worthless for my security considerations. I need my software to work for me, so Chrome will not be part of that anymore.

To say browser extensions pose a risk is true, but it hardly makes it in the top list of threats anymore. Malicious sites however still do and Google just restricted our ability to let third party tools provide essential services. Sure, these could be malicious, but that is generally not a wide spread IT problem of today. That should be also obvious to Chrome developers.

Accidentally they also restrict ad blockers? Come on, you are getting played.

Beneficial in what sense? If manifest v3 is still bad on net, then including chrome's counter arguments makes for bad rhetoric and thus does a poor job of advancing a valiant goal.

The security improvement is negible compared to the danger of data extraction which ad blockers pretty effectively prevent in many cases. No, the security advantages just plainly aren't there and I think this is more driven by Google business interests.

Installing random plugins is a security issue. But web tracking is by far the more significant threat.

I see a lot of people suggesting Firefox, which is great. But also, considering Chrome is basically Chromium, can't we just fork Chromium and keep using that?

Brave said they will keep the v2 capability in their Chromium fork "as long as it's possible" (paraphrasing, I can't find the exact tweet to quote).

Does Brave have their own extension repository yet, or are they still leaving that all up to Google? I don't see much value in Brave supporting a feature dropped from Chrome if it only has Chrome extensions and they all drop support for it anyway.

this kind of thing is why we need firefox, not chromium fork X.

firefox said that they will move to V3 as an effort to maximize browser compatibility

Firefox has said they will implement V3, but "we will diverge from Chrome’s implementation where we think it matters and our values point to a different solution."

Specifically, "we have decided to implement DNR and continue maintaining support for blocking webRequest. Our initial goal for implementing DNR is to provide compatibility with Chrome so developers do not have to support multiple code bases if they do not want to. With both APIs supported in Firefox, developers can choose the approach that works best for them and their users."

https://blog.mozilla.org/addons/2021/05/27/manifest-v3-updat...

Microsoft does, and it has just about everything that I use. Huge opportunity for them. None of the smaller vendors have their own extension store.

Can such a fork be upheld for a long time? Browsers are one of the most complex programs out there. I have my doubts even regarding whether Brave could maintain such a fork, let alone smaller entities.

I don’t think you quite grasp how much money Google throws at developing Chromium. Maintaining a fork is a massive undertaking.

Yeah, for an article that claims in the title to be adressing Chrome users, it does a very poor job of actually telling these users what this "Manifest v3" thing is and why exactly it's a "raw deal" for them. Provided they even know what a "raw deal" is - for me it's a rarely-used US-specific expression, and I am only aware of it because of an R.E.M. song (https://genius.com/Rem-monty-got-a-raw-deal-lyrics).