Google postpones MV2 shutoff in Chrome stable to June 2023
developer.chrome.com
developer.chrome.com
> as we shift our focus to Manifest V3. This change will give Chrome users increased safety and peace of mind while browsing and installing extensions by providing more transparency and control over permissions, adding stricter protocols for accessing resources outside the extension’s context, and ensuring that extensions work well on all devices
It sounds like government gobbledygook, with even more lies (there are no extensions on Chrome on mobile, so what "all devices" means is anyone's guess).
I often wonder what goes on in the mind of people writing this. Are they happy? Why did they choose to work in tech instead of some administration, if BS is their thing? Is it just for the money?
I regretted the decision for a while afterwards, but i've since realized i don't want this shutdown threat hanging over my head. Thanks for the 10+ years of hosting but i don't have to be treated like this, I'm better off without them.
"Google Apps for Your Domain" for anyone who (like me) could not figure out what that acronym means.
Just noticed the typo heh.
There were outrage but Google had provided a flag to turn it off. It was in chrome://flags/#account-consistency.
Edit: Google removed the flag shortly after.
Behind the scenes every major change like that is a flag that's deployed first off then slowly flipped to default true as a rollout so that it's as low risk as possible of unintended damage / failure.
Another good example is how the Rashidun Caliphate granted conquered Zoroastrian Persians Dhimmi or "people of the Book" status. I'm sure it seemed kind at the time since Zoroastrianism is obviously not "of The [Abrahamic] Book". This merely postponed persecution of the unconverted until such a time as they were disperse, weak and with less sovereign resolve. They got a worse and worse deal as the centuries wore on.
I'm not justifying Google here, but this is really every hegemon's SOP: corporate, tech or cultural.
I'm just as mad with Microsoft forces me to use a Windows account after juggling the slow creep Mojang deprecation, when Mozilla gives you fewer and fewer ways to install apps outside of their extension store until it's a Nightly-only feature, or when [your favorite app] is acquired by [your least favorite company] and starts down a path you'd *never expect*. It's all garbage.
Even Chrome has a flag you can flip and install an unpacked extension from file. Sending this stuff up to Mozilla for them to grace or relegating developers and corporate users to some unbranded or esoteric dev binary is offensive to the end user IMO. I mean, it's not even federation, just centralization. Sure you can host it on your webpage, but it needs to be signed by the mother ship either way.
Firefox removed "about:config" from Firefox on android as well. Maybe we'll get a cli flag escape hatch for a year when they do the same on desktop. Not trusting the end user in the name of security is not a Google-only play despite all the Moz Marketing.
These days I don't use Firefox because I want to, but because it's the least worse choice.
I'm confident their hostile behavior towards user control is one of the reasons why they're hemorrhaging users. And no, giving users way to change UI colors not control. It's a fucking pacifier and an insult.
Why would Google ever commit to keep ad blockers working, unconditionally. It makes no sense.
I use Firefox in sometimes on mobile. I use Chrome for online banking and shopping. This usage is an extremely small portion of web use for me. (Does that make me an "actual user" under the Google employee's definition.) The majority of the time using the web I do not use a popular browser from a "tech" company. I use simpler software I can edit and compile myself, quickly and easily. I have all the "features" I need.
As such, 99% of the time I never see any ads. Google can do whatever it wants with Chrome. I still see no ads. I am not using it.
Unless and until one considers that there are other ways to access the web besides those dictated to us by "tech" companies, then one cannot seriously claim to be trying to avoid advertising. Firefox is funded by Google and other "search provider" profits from advertising services. Mozilla is against some forms of online tracking, but they are absolutely pro-advertising. I just watched their "Chief Security Officer" state this on video to the FTC earlier in the month. Are we supposed to believe there is some "standoff" between Mozilla and Google (or any other "tech" company, i.e., "search provider") over advertising. That would be pure fantasy. Mozilla (Corporation)^1 is like any other "tech" company. It has no business plan. It has nothing to sell that could sustain it as an employer of software developers. It only has its position as an intermediary, to assist with online advertising, in Mozilla's case to assist by sending search traffic to Google, and whatever else is required by their royalty agreements with "search providers".^2
1. https://assets.mozilla.net/annualreport/2020/mozilla-fdn-202...
2. Mozilla even sells its own advertising services:
Advertising revenues - Mozilla also offers advertising services in three formats. The first is the New Tab advertising service, which places links to sponsored content when a new tab is opened in the Firefox web browser. The second format is through Pockets email product, Pocket Hits. Pocket Hits may include paid advertisements, which are placed in email newsletters that get delivered to global Pocket users. Lastly, Mozilla also sells web advertisement spots on content that Mozilla licenses and syndicates from publisher partners across the web.
Along with a "service" to remove advertising:
Subscription revenues -
Included in a Pocket Premium subscription are features like full text search on saved articles, removal of advertising from Pocket properties, the ability to create unlimited highlights and the ability to create a permanent library of everything a user has saved.
For me, playing both side of the coin, charging for advertising services and charging for advertising removal services, does not rank high on the scale of company integrity. But this sort of "playbook" seems quite common for "tech" companies. For example, Google does it with YouTube ("YouTube Red", now "YouTube Premium").
We are the end users of this software and, while clearly a minority, we do expect things to work. If a useful feature is being neutered, it is considered bad for the users. Thankfully, Google is not, yet, in a position where it can just force its adoption. Thankfully, there are still other options ( including some recent moves creation of non-G and non-F browser; and interesting variants of Chrome ).
Those vocal end users ( and that includes me ) want things in one specific way. For two different reasons:
1. I recently was forced to browse net without adblockers and it was a horrid experience. I pity the poor souls that live without them. 2. I still basically do everything tech related around the house. If Google starts being annoying, I will drop it like a hot potato. Thankfully, I am not longer local tech guy for my extended family.
In other words, it still makes sense for Google to appease the people, who do the work of converting and then supporting their software, because people sure don't call Google, when it raining ads.
By the by, didn't we go through the exact period with infinite pop-up ads and agreed that it was a really bad idea? Why would anyone think users want it back?
fuck you Google!
> Sponsored Images: Striking, high-definition images that are featured in the Brave new tab image rotation. Advertisers have the opportunity to feature their brand prominently in this coveted space in front of millions of consumers.
"Fuck Google, have Brave shove ads in your face instead!"
Google doesn't want ad blockers to exist, the evidence is not that they make the majority of their revenue from ads. It's that the most popular version of Chrome already has 0 ad blocking capability! Ad blocking and extensions are legacy features.
Do you really think Google is on some vendetta against adblock? Adblock has lived on the Chrome webstore for a decade, and many, many, many copies have appeared too. Google could have easily nuked any of them but hasn't.
MV3 is not about adblock. Maybe one day the web will turn into some WASM-driven advertising shitshow, but we're thankfully a long way from that.
*Google knows this, which is why they haven't stopped ad-blocking.
I don't see any other reason for the features they killed to be killed. Specifically the preload hooks that ad blockers used.
Yes, quite obviously. Google’s revenue is from advertising. Google is an advertising company.
"But they did not nuke it before" is not an argument btw. They didn't had utter market dominance before in case you somehow fucking forgot.
They said some stuff after the backlash, but they never retracted or renounced their plan. Indeed, portions of the code are now in the current released OS.
Happy holidays to me, I can kick this can down the road too.
Look at some of the known issues: https://developer.chrome.com/docs/extensions/mv3/known-issue...
Userscript managers support
Estimated timeline: Canary support around October, 2022.
Service workers are not started in response to webRequest events
Estimated timeline: Targeting Canary support before October, 2022.
No way they were going to be ready to disable v2 in January for the stable channel.
"Chrome browser provides 5 channels: Stable, Extended stable, Beta, Dev, and Canary."
I was about to hop in the car and didn't have time to Google it, and pre-cognitvely figured others might also like to know without needing to also actively search it 100x, collectively.
Looking at my comment history, it's clear I frequently do research things myself and post a thorough comment in an effort to educate as well as inform others about terminology in HN discussions.
Please strive to be generous in your interpretations of others.
There are 3 posters including me replying to your question re what channels are, 2 including the same link. Hopefully that answers your question! (and by that I mean that I hope you didn't interpret that to be me sending you to a mistaken answer? if that's what you were refering to?)
That link is indeed genuinely from google.
I did downvote, but people also downvoted my comment as well, so I don't treat downvotes or upvotes as that important, sorry if that made you feel any other way.
The important thing is : did you get the answer to your question?
As a news website you don't NEED to use AMP. You'll just never appear in Google's news carousel, and won't be at the top of the news search results anymore. Sorry :(
Way too risky for devs to ignore the deadline and possibly get de-ranked from store search results.
It wouldn't make any sense to let V2 extensions keep running until June but disallow updates. What about security issues? They have to allow security updates.
> There are two key dates for the phase-out:
> January 17, 2022: New Manifest V2 extensions will no longer be accepted by the Chrome Web Store. Developers may still push updates to existing Manifest V2 extensions, but no new Manifest V2 items may be submitted.
> January 2023: The Chrome browser will no longer run Manifest V2 extensions. Developers may no longer push updates to existing Manifest V2 extensions.
So V2 would be disabled in the stable channel simultaneously with the end of updates, in January 2023.
Only a special enterprise policy could keep V2 extensions running for a while after that time.
The timeline has now been updated too: https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/
I wonder how long things will stay that way though, when sites will tailor their tracking/ad annoyances to exploit the MV3 limitations. I really wouldn't want to opt into every single site I visit.
[1] https://github.com/gorhill/uBlock/releases/tag/uBOLite_0.1.2...
MV3 adblockers are still going to, broadly, work fine, if slightly worse than before. There's slightly more concern over privacy blockers, but as usual it gets more clicks to mislead users about something they care about (adblocking) rather than get them to really care about privacy.
An immediate test with Youtube gave pre-roll ads. Oh well. But a later Youtube visit, and all since, have been like Ublock Origin - ads gone, preroll, superimposed and in-video ad breaks. I have no idea how all this works and frankly am glad I don't have to. But yes, of course, Youtube may change in the future to precisely sidestep the MV3 limitations of ad blockers.
I just don't think this is true, ad blocking will be substantially degraded and, more importantly to certain companies involved, the ability to block tracking cookies and request metadata will be almost entirely removed.
> just poorly-informed fluff around attempts to rephrase comments from gorhill.
gorhill's comments here indicate many issues remain with MV3 and that it still fails to meet his own requirements.
https://github.com/uBlockOrigin/uBlock-issues/issues/338#iss...
> There's slightly more concern over privacy blockers
I don't know if users of ad blockers make this distinction.
How do you figure? Gorhill actually states that there are many improvements only possible because of V3. What's also said is that for some features in the future there's further investigation required. And the last thing said in that comment is:
> Many users of uBO will dislike the limitations of uBOL when compared to uBO. There is no point complaining about it, it's just not for you, it's meant for another kind of users -- you do not have to use it.[..] but I want to offer an option for those who use uBO as an install-and-forget blocker without ever interacting with it.
I think you're kind of mischaracterizing the comment.
I think that's a charitable - to the Chrome team - misunderstanding of an artificial limitation they've imposed. The improvements are possible without MV3:
* declarativeNetRequest is implemented today, they could expose it in MV2
* nothing prevents Google Chrome from continuing to offer the current onBeforeRequest API as a permission extensions can request in MV3
* nothing prevents Google Chrome from working with developers like gorhill, who are sensitive to performance concerns as you'll see below, to develop more powerful APIs that fit within a security and performance profile that satisfies end users, gorhill, and the Chrome team.
On performance: While many of the performance improvements are made possible with a declarative API, uBlock Origin uses WebAssembly for an extremely performant fully dynamic blocking implementation that has almost no impact on battery life. (I believe other experiments have shown that blocking these requests yields increases in battery life, even.) You can see some benchmarks here that were posted from his experimentation: https://raw.githack.com/gorhill/uBlock/master/docs/tests/hns...
On security: gorhill has proven that he's capable of writing WebAssembly to implement highly performant and sandboxed checking of dynamic filters. WebAssembly is in fact the perfect technology for a "declarativeNetRequest" to use. Could Chrome cut the Gordian knot of enabling performant and safe ad blocking extensions with an API that registers a WASM program as web request filter?
The program could be limited to pass/fail/redact actions, where redact would involve removing headers, query parameters, trailing path parts. That is, "utm_campaign=..." could be removed, but the extension would not have a side channel for injecting information into requests.
> This API is available in Manifest V3 or higher in Chrome and Firefox 101. In Safari and Firefox 102+, this API is also available in Manifest V2.
When I say, it's not possible in MV2, I of course mean Google's version of MV2.
---
[1] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
Right, that's precisely what I mean. Trackers are a privacy issue, not an "ad" issue.
>I don't know if users of ad blockers make this distinction.
Contrary to what people on HN think, the absolute majority of users care little about tracking and a lot about whether there's a huge banner ad in the middle of their content. MV3 does comparatively little to affect the latter (which can be removed through cosmetic blocking). Most users use adblockers purely to get rid of ads.
>gorhill's comments here indicate many issues remain with MV3 and that it still fails to meet his own requirements.
Right, that's my point. Tech news sites just running specifically gorhill's comments through an "underpaid intern" filter and then printing them, without actually explaining or probably even understanding them. Gorhill is complaining loudly because it makes his specific software worse, and everyone interprets this as "Google getting rid of adblockers".
That is of course nonsense. Ad blockers can block trackers with much the same mechanisms and it's just a pure and utter improvement at no cost.
It's one thing to degrade service quality for the greater good of the userbase (see spectre/meltdown exploit mitigations for example), and it's another thing entirely to do so to the detriment of your userbase.
What you're saying here is the equivalent of me stepping on your brand new shoes and then saying "what... They still work fine!".
That’s a good thing. Sensationalism works and we all want content blocking to be as effective as possible. While “it still works”, it’s not as good or as efficient as the MV2 version.
Why would anyone accept going to a "slightly worse" situation? We're literally going backwards in terms of functionality and we should just accept this?
Sandboxing extensions is a good thing, not a bad thing, and if the price is only a slightly less effective adblocker, then I am totally ok with the change.
So hasn’t that incentive already existed?
It looks like 25-40% of internet users block ads. Depends on country. I can’t find per-browser stats, which would be somewhat fascinating.
According to uBlock Origin’s creator, we don’t yet know if the performance truly is better: https://github.com/uBlockOrigin/uBlock-issues/issues/338#iss...
Manifest v3 freezes the capabilities of adblockers in time (it regresses them). Perhaps it’s sufficient for today’s ads but over time websites will take advantage and the effectiveness of adblockers will wither: websites have a financial incentive to circumvent all those chrome users.
Many terrified that these "hackers" will steal their credit cards and take in dump in their dinner plate if they install such extension.
When I showed Bypass Paywall plugin to some friends, they all freaked out and looked at it like some dark magic. They look at ad blockers the same.
https://www.statista.com/statistics/351862/adblocking-usage/
close to zero, as there are perfectly fine ad blockers that still work?
case in point: been using safari with an ad blocker for years now. no change in web browsing.
Switching browsers is a big ask for a lot of people, especially tech people who have their settings and extensions just right.
As a Firefox user, articles like this are just noise, not a possible attack on my personal privacy. When was the last technical scandal with Firefox? Adding an optional bookmarking service? How are people still defending chrome?
1) You go to https://i.imgur.com/vuUyLnz.gifv.
2) You decide to skip the beginning so you "Right Click > Show Controls" and use the controls to skip the beginning.
3) You decide to skip to the end so you move your mouse over to where the controls should be but they don't reappear.
4) They're gone and the only way to get them back is to "Right Click > Show Controls" again.
There are a lot of rough edges like that. I'd almost rather not use browsers than use Firefox in its current state.
Your other commentmentions i.imgur.com being the case? Maybe libredirext can help you never hit the i. Site?
Afraid not. In Chrome and Safari the controls reappear in step 3. In Firefox step 4 is required.
I wouldn't be surprised if it was an imgur thing but I have seen it in non-imgur embeds on reddit.
> Maybe libredirext can help you never hit the i. Site?
That could work. Thank you!
Chrome seems to ignore this attribute being set to false and continue to show controls anyway, which appears to be a spec violation from my reading of it. Of course it ends up being a desirable behavior in this case.
Just skimming through the first few pages and it looks like all of the videos are gifv:
NSFW
Mozilla gets 95% of its revenue directly from Google.
cough Proton cough
That being said, most of the extensions I use have survived the last two years of Firefox development.
I'd take Proton any day over a neutered ad blocker
I mean, sure it's great that ad blockers still work, but let's not pretend that Firefox is some kind of bastion of pro-user sentiment.
It's like one setting in about:config
> Switching to Firefox means accepting ads built-in to the browser, something that (AFAIK) Google has never done
Google might not build ads into the browser, but if you use it as they intend and log into the account all of your activity gets tied to your account. I would rather have pocket then not be able to sign into a google account without google signing it in across the browser
> I mean, sure it's great that ad blockers still work, but let's not pretend that Firefox is some kind of bastion of pro-user sentiment.
Yeah mozilla has a shitty track record I'll admit and firefox is a lower quality product, but at the end of the day it's still the lesser of two evils
Oh really, which one?
> at the end of the day it's still the lesser of two evils
Never said it wasn't.
Also if you compare from a fingerprinting side of view then Brave is better than Firefox+uBlock (and all privacy lists involved). You can compare that easily between your Firefox and Brave here: https://coveryourtracks.eff.org/
For me personally I also don't want to miss Chromecast capabilities (it's a nice system and unfortunately there is no good alternative) in my mobile browser.
No it fucking doesn't. Firefox have been aping chrome since version 4 and really sealed the deal with version ... 29, I think.
Unfortunately it does not, as other replies and plenty of HN Firefox posts demonstrate.
> I honestly don't understand why more people, especially on hn, haven't switched over still.
There are several important areas where Firefox is lacking. Automation on macOS is one of them (it’s the sole major browser without AppleScript support) but in every thread I see people complaining of something different.
I use neither Firefox nor Chrome. I don’t want to support Google, but it’s also not feasible to use Firefox as my daily driver or to support it in the tools I release.
It's been marked as fixed, though only "for the moment". There's a somewhat similar MV2 issue: https://bugs.chromium.org/p/chromium/issues/detail?id=131658.... Both have been active for a while.
I almost committed, but there is a many-years-old bug in Firefox that they haven't fixed which won't let you use alternate audio devices for webrtc, which made it so I couldn't use google meet with my headphones.
Isn't it curious how audio works fine when it's from Netflix, Hulu, Amazon Prime, etc but when using a Google property (Google Meet) suddenly it doesn't work under Firefox... curious indeed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1473070 and https://bugzilla.mozilla.org/show_bug.cgi?id=934425
- go to about:config page in Firefox (load it like you would a website with URL 'about:config', and accept the warning to proceed with caution)
- paste 'media.setsinkid.enabled' into the search bar at the top
- default setting is false, click the button on the right to toggle it to true
- reload google meet, hopefully you'll now be able to choose non-default audio output (I think non-default microphone can be chosen even without this toggle?)
(edit: there's one comment in that bug I linked saying that audio worked with Google Meet's pre-call test noise, but not on an actual call itself. I can't test myself right now, but if I've raised hopes falsely then apologies!)
> Starting in June in Chrome 115, Chrome may run experiments to turn off support for Manifest V2 extensions in all channels, including stable channel.
They're giving themselves wiggle room on this instead of saying they're just straight up going to turn it off (or even committing themselves to starting to phase it out at that point).
Also, they're showing support for MV2 extensions through Jan 2024, as long as they're marked Private. That's huge — I'm considering scrapping our update for now and just waiting to see how this all unfolds until then. Most of our users come from our website, and I can just link them to Private instances of our extension in the Store. (Also, our extensions are fairly mature, and we can go a year without submitting an update.)
I have no need to be Google's guinea pig as they sort out this mess!
I wonder if they can switch over to supporting installs from the Firefox addon store instead/in addition?
from their website
https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/
So far all I've heard is that it'll destroy ad-blocking, except that it sounds to me like the ad-blocking abilities it has are fairly close to Apple's content blocking abilities, and while ad-blocking on iOS isn't perfect, it's still a thriving ecosystem.
ads
As always, it's probably a little from column A and a little from column B, but mostly column A with the "unfortunate" side effect of column B. Google has had years to remove ad blockers from the extension marketplace, for example, and they'd need to write a lot less code relative to MV3.
Not building uBlock Origin into Chrome was the mistake they made here. Once there is a known-good ad-blocker built in, nobody cares about extensions anymore. (Except for the steal-your-data extensions, whose authors are definitely amongst us on HN.)
It might also solve issues with security, but Google's complete refusal to work with the community to find common ground shows what they're really after.
You make this sound easy. It isn't.
Manifest V3 doesn't stop this.
Also, Google reviews every extension and update on the Chrome Web Store. The API is irrelevant when Google is asleep at the wheel.
Absolutely not true. No one has the manpower to actually review/understand all the code that is being pushed to the store. Extensions are automatically approved after a few minutes.
Mozilla tries but it's more of a spot check after the extension is being published.
This is not true in my experience. In fact I've experienced reviews lasting days or weeks with the Chrome Web Store.
I think GPs point stands - whether or not they actually review every update, they make the claim that extensions are reviewed, and they're reviewed often enough that they should be able to catch genuinely dangerous extensions.
Most users are not like this. They really do benefit from a restricted experience. That's why app store and extension restrictions should exist.
The problem is when engineers go all in on the restrictions, and completely abandon the other set of users. This is software, it can have an infinite number of knobs and customisations. It's not a table, which can only have a fixed number of legs.
Obviously uBO and noScript would be bigger losses, but those seem to be taken care of on Firefox and some other Chromium browsers.
This isn't an evil move, it's just a dumb one. The kerfuffle over adblockers is obvious & huge, but ultimately MV3 will definitely do something to make adblocking acceptable. Google is not going to make themselves look like a monster; this is perhaps the only "good" (one giant neutral nothingburger on both sides) news.
But my god, the other people being hit with various degredations are in such a hell-grade nightmare pickle. Userscript extensions are still fully hosed (ed: recent movement in issues spotted[1]!). Running dynamic code via Function (a common speed optimization for performance critical JS systems) or eval is still outlawed. Extensions lifecycle is far less clear & persistent than it used to be, and there's thousands of people who simply don't have an extension runtime to hold state for them anymore. Extensions used to be able to use a wide variety of "page" style APIs which are all now suddenly missing and "limited event pages"[2] and "offscreen pages"[3] arent making visible progress.
Meanwhile there's seemingly no visible advantages to users here. This 24th hour rewrite of what a webextension is (right before it's specified (rather than a tacit slowly evolved semi-agreement)) seems to serve a primarily abstract/rarely-experienced security concerns, while reducing extension power enormously. There's been no one to negotiate this trade-off. Extension developers have gotten nothing, users have gotten nothing, and extension capabilities have shrunk enormously. Personally I'd like to see the proprietary closed extension-store maintainers do a more active job of weeding out, helping us see good from bad, or giving us tools to peer-moderate, rather than simply shutting the door on the most critical user-agency boosting system, at the most critical 24th hour.
There's endless web spec discussions that go on, but this is the most enormous & massive re-negotiation of power the web has ever seen. So far, it's going poorly for everyone except the extensions-store operators, who seem chiefly to be concerned about making their jobs easier in the future, by making extensions far less capable. I can feel real & good intent underneath that: this isn't being done because of bad will. But the visible effects, the impact, is cruel: how could short lifecycle service workers with far less api & far less capability[4] be seen as anything less than a boldfaced theft of user-agency? To be honest: it's unclear how such a deeply impotent position as this was ever proposed or considered. Change is super hard, change management is hard, but this was not a good footing to start on.
Adblocking will be ok. This isn't evil. But this is for sure a much deeper, far more complicated fiasco of the highest & most critical importance to the web.
[1] https://github.com/w3c/webextensions/issues/279
[2] https://github.com/w3c/webextensions/issues/134
What will Brave do?
So this won't change anything for brave users.
For a few years, I will need to use Chrome.
You meant the non enterprise shut off? Brave committed to MV2 as long as it's in Chromium.
> During the deprecation period, we can keep this functionality via patch (since it's there for Enterprise). After V2 is pulled from store, we'll need to stand up our own extension store for manifest v2
Complete deprecation means shut off for enterprise. MV2 items will be unlisted before.