Hacker News Reader

Comment by notbitter | Hacker News Reader

For whatever reason, Chrome does seem to make life hard for privacy extensions like Ghostery:

"As Chrome's resource blocking API is not yet comprehensive, some elements may execute." - http://www.ghostery.com/download

View on HN

The main dev on the WebRequest API sits right behind me, and is making steady progress. It's the first synchronous extension API that interacts with the network stack, and it's a nontrivial effort to get it running. I can assure you, however, that making life hard for privacy extensions is the exact opposite of what we're being paid to do.

Look at the progress on privacy-related APIs over the last year: WebRequest is coming along nicely, WebNavigation and ContentSettings are feature complete and in the final stages of polish, and Proxy went out to stable in Chrome 13. Privacy and Clear just landed in experimental, and we're iterating on them rapidly.

(Details on the state of each are available at http://code.google.com/chrome/extensions/trunk/experimental....)

Is it possible to restrict requests to the host in the URL I'm visiting? XSS, DNT, etc. become much less of an issue when you can block all external resources requested by a page.

That will be possible with the WebRequest API, yes: http://code.google.com/chrome/extensions/trunk/experimental.... For example, you'd be able to intercept and block network requests from a particular tab that didn't hit the same domain.

The API in experimental now, so download a dev release of Chrome/Chromium, enable experimental APIs via `about:flags`, and start filing bug reports. :)

FWIW, this is already possible with Firefox by using the RequestPolicy addon.

Glad to hear it. Chrome is great in every other way.

Engineers are actively working on APIs for this, but it's quite a bit more complicated than it may seem at first. Low-level capabilities like these need to be implemented such that they don't conflict with our extension permission model and general security posture. For instance, we don't want an extension with the WebRequest API to be able to prevent you from uninstalling it, or to manipulate other extensions and internal browser configuration.

Star this issue so you can get updates as it progresses through the release cycle: http://code.google.com/p/chromium/issues/detail?id=60101

Reply on news.ycombinator.com