“UBO Minus (MV3)” – An Experimental uBlock Origin Build for Manifest V3

Hmm, I guess it depends on what this will look like long-term, but I'd expect that regular uBO will be "upgraded" to this version when MV2 is deprecated in Chrome for good, possibly including the name change (if allowed by Google).

Edit: ah, looking at gorhill's comments it looks like this is not intended to be the MV3 version of uBO, but just one that has minimal permissions. Then I guess uBO will migrate in its own time.

Probably more like one year. The DMA just passed (I think? I don't follow too closely)

I'm told ungoogled android distros exist, and are decently usable.

Check out https://www.bromite.org/, it's a android chromium fork with adblocking built in like brave but without the crypto stuff. Also has support for userscripts!

What do you mean by non-native scroll behavior? I'm asking seriously, never noticed anything.

Have you used Firefox for Android recently? That scroll issue was fixed with the release of GeckoView, at least from what I've noticed.

Isn't there some rule that any browser on iOS must use the native Safari engine? So if iOS Safari doesn't support something, there's no way for Firefox to add that support. It's basically just a skin.

What? Install Firefox Focus on iOS. Use it directly, or select it as a content blocking provider for Safari to get ad blocking in Safari.

iOS user here.

I forgo the on-device ad-blocking and use DNS blocking. It's a decent catch-all for most things I'm worried about.

NextDNS is one of the better hosted DNS blocklists, IMO

You can enable translation on Firefox Nightly - I blogged about this (and other) extensions: https://www.quippd.com/writing/2022/01/26/most-wanted-add-on...

This comment is perhaps the most accurate take on the fall of IE.

Firefox dethroned IE not because it was "MuH fReE oPeN sOuRcE sOfTwArE" or "MuH nEtScApE", it was because Firefox was superior to IE in performance and feature set. It was better than IE at being practical and enabling users to do things they needed or wanted to do.

Shortly after, Chrome rolled around and it was superior in performance (RAM hogginess aside) and feature set (for Joe Average, not necessarily power users) to Firefox and dethroned the dethroner.

Firefox will not be a dethroner again, because Firefox is not superior to Chrome. In fact, it's inferior to Chrome: It's been a third-rate Chrome ripoff for at least the last 10 years. None of the Chromium forks will dethrone Chrome either, because they are also third-rate Chrome ripoffs by their very nature.

It is conceivable that some browser superior to Chrome will eventually come out and dethrone it, but that's probably still a long ways away and I would argue the challenge of dethroning Chrome is several orders of magnitudes harder than dethroning IE ever was.

Strong disagree here. Flash represented a proprietary takeover of web standards. It was bad technology with a bad license and had bad consequences. Apple’s ideology resulted in a pure gain for the open web.

Apple’s dictatorial control over browser engines on iOS represents, somewhat ironically, the last significant defense in the cause of browser engine diversity. While Apple’s motives might be less pure here, the outcomes are no less of a win for the open web.

Flash was a kind of devious problem in the same way as IE was and Chrome is:

Those who depended on it got benefits while messing up the lives for everyone else.

To be fair to IE and its modern replacement Chrome, if you develop and test mostly on IE and Chrome you can make things cross browser if you put effort into it, something you couldn't with Flash.

Getting rid of Flash - whatever the reasons was - was a huge gift to the web and by extension people like me who develop on and for an open web.

This isn't reasonable. Today on iPhone, even if you pay $100/year to be able to run unsigned code, you can't get a copy of Firefox running, because nobody maintains the port. That kind of crippling grasp on the ecosystem is difficult to tolerate, and simply nothing compared to what's going on with Google.

Today with Pixel phones, you can secure boot third party OSes without even voiding your warranty. You can unlock the bootloader. Even if this ever were to go away, Android still has multiple ecosystems and you can sideload apps as long as your OEM doesn't disable this, and Google doesn't.

Apple isn't getting more consumer friendly. iOS is less private than ever, not more, and Apple seems intent on making it worse; they dropped the needless CSAM debacle, but that doesn't mean it should be ignored. Apple has made their position clear: an iPhone is not your phone. It's Apple's phone. You may borrow it on their terms. The law may say otherwise, but Apple thwarts your attempts to work around it.

Android is imperfect; it's definitely not good for privacy if you use stock ROMs, it's behind on security in many fronts, and Play Store lock-in has definitely put a damper on innovation. That having been said, though, at the end of the day, Google gives you options that lets you take control over the device. The future of being able to control your own devices is unclear with remote attestation once again on the horizon, but being able to control what software runs on your device to a decent degree is absolutely an important feature for me, especially after hoping and praying that Apple would eventually fix the problems I had with iOS. But they were not bugs to Apple, they were features, and Apple knows if people could run their own code, those features wouldn't work very well.

That left a bad taste in my mouth. Until it's fixed, I don't think I can consider phones that Apple sells today as serious options as they are a different class of device to Android phones the way that a game console is a different class of device to a typical laptop.

It makes no sense to assume how companies will act in the far out future, as companies are not people and their motivations shift with management, investors, and markets. You can at best look at the motivation as an explanation of the short to medium term. Long-term, the company might be in entirely different hands. Look at Sun. Apply your strategy to Sun as of a few years before they went under and chunks were bought by Oracle. Sun's motivations meant very little in the end, only what they actually did (such as open sourcing things) survived.

Apple offers a Content Blocking API which is leveraged by most apps and similar to mv3.

Most of these apps (now) also include a JavaScript extension to block the harder ads (eg youtube). This a recent development that apple seems to encourage.

Some apps also offer network-level adblocking by using a local VPN server, which allows for blocking in apps.

postmarketOS is incredibly promising, but unfortunately the devices I've tried it on are still very unstable.

Full-fat Firefox felt surprisingly usable on Pinephone under Phosh though.

Even then: Fennec F-Droid is a compelling choice. It has a pretty good mobile experience.

But you can already work around adblockers by just serving ads directly from your own servers.

Frankly - you can also move to a service that implements adblocking at a different layer (I've seen an explosion of dns based adblockers as a service, likely inspired by the likes of pi-hole). Those services are using roughly the same feature set that's still available in m3.

The big dealbreaker (imo) was the inability to configure rules at runtime, and the requirement that they be declared in the manifest - and that never actually happened (you can dynamically configure them with https://developer.chrome.com/docs/extensions/reference/decla...)

Since adblocking on Safari (both Mac and iOS) is mostly done by Content Blocker API that's like manifestV3. Many mobile users already in such situation. People still fine with current adblockers on iOS.

Oh, I understand the bitterness around Manifest and a lot of it is justifiable.

I was referring to the two developers (both seemingly not Google/Chromium affiliated) arguing about a workaround involving an “injectable tab” and taking pot shots at one another’s comprehension and ability.

See that's just completely wrong. Google Ads are trivial to block with declarativeNetRequest. They're as plain jane simple as it gets. If any ad company will benefit, it'll be the exotic ones that are more difficult to block.

I understand that, but it seems like the most frequently-used features (eg. cosmetic filtering) are possible in MV3. So a version with those features included would still offer value.

Correct me if I'm wrong, but it seems most of the missing capabilities are power user features - even by HN standards.

It's of course your discretion if that's something you wish to work on. I think a Minus and Plus version (or "Regular" if you prefer) offer a nice option for users to choose between. But I understand if the development overhead of managing two versions cannot be justified.

I initially punished a comment disagreeing with you, but after thinking about it more, I agree. Google's clearly signalled that they don't want Adblockers to use "read/write data on all websites"; just like Apple did, Chrome's whole idea with Manifest v3 was to make that go away. Frankly, with the genuinely malicious extensions people keep installing, probably for the best. Furthermore having uBlock Origin "continue to behave as normal" will confuse users and make them think uBO is still blocking everything users expect it to (i.e. tracking), which can surely endanger some users.

Does this mean that you're planning to migrate "regular" all-website-data uBO to MV3 at some point as well, with the caveat that some features won't work on Chrome?

I use cosmetic filtering a lot on Firefox Android. I routinely remove all the sticky-ish headers and footers from sites I visit often, because they are distracting, sometimes move, appear and disappear and uselessly take away space and distract me. Some popups too, even on Firefox desktop.

I'm sure that there are other extensions doing that (Stylish? but the element picker of uBlock origin is extremely quick to use) however Firefox allows only very few extensions to run on Android. They are moving to v3 too [1] so I'm worried that I'm going to lose that feature on my phone or that it's going to become so inconvenient to use that I won't hide annoying elements as much as I do (lazyness, other things to do, etc.)

I'm more than happy to give "read/modify data on all websites" permission to a trusted extension. I hope that you'll keep maintaining the current permission-full version of uBlock Origin too.

[1] https://blog.mozilla.org/addons/2021/05/27/manifest-v3-updat...

    Using this declarative approach dramatically reduces the need for persistent host permissions

Reduces != eliminate. Obviously, for some features, like adblockerblocker unblockers and cosmetic filtering, you still need persistent host permissions. Nobody has ever disputed that. The fact that DNR can remove persistent host permission for some ad blockers doesn't mean that it needs to remove them for all ad blockers. Also, you're taking that statement out of context: the documentation lists *three* separate reasons for DNR: privacy, performance, and compatibility with service workers. This reduces both the time it takes to process a network request (no need to serialize it to background page and then execute filter list matching in slow javascript) and the memory footprint of the browser (no need to keep an entire DOM background page loaded). It's clear that the performance goals here are at least as important as the security goals, if not more important, and they both go hand in hand.

    I don't understand what you perceive this negatively.

By calling this the "MV3" version of uBlock, you're implying that MV3 has limited uBlock to these features and these features only, when nothing could be further form the truth. It's simply a form of misinformation to label this as the "MV3" version of uBlock. That's why I'm reacting to it negatively—it's hard not to see this as a continuation of your frustration with Chromium development team, and an attempt to paint MV3 in a bad light by purposefully releasing a crippled version of the extension. Users are going to see this extension, see that it's named "MV3", and then blame Google for the lack of features. It's just the same as lying to your users.

I do keep using uMatrix. Its matrix UI is a nearly perfect. I also use uBlock Origin and I can't understand how to achieve the same results with the mini-matrix in its UI. ++ -- ??? It lacks the columns that explain what you're blocking or allowing. I read the documentation more than once and I still don't understand how to use it. Maybe I lack the incentive because uMatrix still works and it's so much better at that.

> This is distinct from regular advertising (billboards et al) because your engagement directly and quickly affects what ads are served to you.

This is exactly the same as TV and radio ads have been for decades now. Which ad is served is not at all relevant.

> You can make the case that 'if you can't handle YouTube ads, don't go on YouTube', but then that runs counter to a lot of YouTube's content marketing and brand image. So if you take that stance, you then have to necessarily question the motives behind their other choices.

Take some damned personal responsibility. If something is causing you distress, stop doing it. Whether it's cigarettes, alcohol or youtube, it doesn't matter.

OK but you can use other Chromium based browsers that will keep good adblocking support, if you dislike Firefox.

Yeah, so I'm against V3 mostly because I think that the pros of developers having power outweigh the cons of potential malicious extensions. I personally would have preferred rethinking a few other areas first:

1. Auditability - both in terms of the code and the behaviors

2. Improved permissions - could we have split WebRequest up?

3. Improved performance - could we have leveraged new APIs, like the declarative API, for improved performance? What about compiling to wasm? Or new APIs?

4. Capabilities/ Sandboxing - Within an extension could we slice out capabilities?

5. Improved UX around permissions. Surfacing the permissions and performance implications of extensions would be worth exploring and aided by any ability to slice up permissions more.

Chrome could even create 'sanctioned' extensions that wouldn't trigger scary popups in order to make it that much clearer when something is scary - something like "if you publish your extension such that it is digitally signed, you use 2FA or whatever, you have good standing with us, blah blah blah, we will waive that popup". IIRC Firefox did this to lower their review burden, NoScript was one of the ones on the list I think, but that would have been many years ago and I don't know if it has changed since.

That said, I don't think V3 is the end of the world. I would have preferred the other options, and I bet some people at Google explored them too and know much more about why they are/aren't viable, but I'm OK with V3. I don't really think that Google Adsense is driving this decision at all nor do I expect it to benefit them, at least not in the short/medium term.

Google AdSsense has always been able to bypass adblockers, as other advertisers have worked to do. At least in the "they could if they tried", they obviously have the technical prowess. But they haven't because that would be a scandal and invite scrutiny that they likely want to avoid - they own a massive part of the market without resorting to such things, it's not yet in their interest to do that.

So yes, as I said, maybe this is step 1 in a longer term plan to completely remove adblockers. Maybe one day so many people will rely on adblockers that Google is forced to take a drastic measure.

I personally don't expect that to be the case any time soon, but that's really not based on much.

Nagware/scareware (pushing subscriptions on users, possibly with misleading claims) is also a business model I've seen used.

I honestly don't mind the "pay to play" model. It's a way to establish a healthy ad ecosystem. Ad blockers define what they consider acceptable, and collect money. They have an incentive to find a reasonable balance: The less restrictive they are, the more money they make, but the second they go over the line, users will jump to another ad blocker that's more restrictive.

I've intentionally and knowingly tolerated the "acceptable ads" from ABP until they started allowing the Outbrain/Taboola chumboxes. (There even were two versions of those, the normal one full of bright colors, tits and disgusting disease images, and a slightly toned down one for the "acceptable ads" users!)

Since those ads rely on making you psychologically uncomfortable (feeling like you're missing out) unless you engage with their worthless, misleading and unsatisfactory clickbait content, they're 100% unacceptable to me, and ABP lost a user.

If uBlock Origin offered an ad whitelist that only allows ad networks that a) serve only their own JavaScript, no third party crap b) only serve static text and re-encoded static, non-animated images c) have some meaningfully enforced editorial standards, d) have some privacy oversight and follow tracking opt-outs, I would definitely give it a chance. I don't mind supporting web sites and content creators, and I don't mind seeing relevant ads (which can usually be targeted based on the content I'm looking at just fine).

I do mind having my fan try to reach escape velocity due to crappy JS, getting served malware and exploits, random "this site is trying to play DRM protected video" popups indicating that something is trying to do fingerprinting, 300 different companies getting my browsing data and 20 of them executing code in my browser (code that they haven't written themselves but have been handed by an intermediary of an intermediary), and last but not least graphic images of diseased body parts. Solve these problems, and I won't need to use an ad blocker. Don't solve these problems, and I will put protecting myself over your revenue.

I also mind having to constantly explain to my parents why the new cool product or shop they saw an ad for is an utter scam, and how exactly they'll lose money if they fall for it. I also mind having to constantly scrape crapware and malware from my friends' and relatives' computers, _including Chromebooks_. As long as ads lead to that, I have no choice but to deploy ad blockers.

Still that’s a fairly overwhelming number of people who feel strongly enough about the topic to install a plug-in. I’m sure there’s a portion of ‘no’ responses that are not aware of what adblockers are or do

It means they only use an adblocker on desktop.

Reduce Motion in display or accessibility settings I think it’s called.

I’m on M1. Just updated FF from the menu.

I’m using the trackpad, but again, I changed my system settings, as I don’t like the default speed and acceleration.