Hacker News Reader

Comment by lol768 | Hacker News Reader

Why does this extension even exist on AMO? The article says it's the "Lite/Manifest v3 version" - why would you ever install the inferior edition meant for legacy browsers, instead of the one that blocks ads properly that's meant for Firefox?

View on HN

For the few good reasons Google had for restricting addon manifests: performance and security. Declarative domain lists are easier to cache and lead to fewer (unnecessary) addon activations. Fewer permissions means the impact of a malware-infected version hitting the addon store in the future is a lot lower. uBlock's rule engine is incredibly powerful, to the point where a custom ruleset can inject code into any website. That applies to custom rulesets, but also to the built-in ones that may or may not get their accounts/hosting hacked, or bought out in the future.

Not that I would use the lite version myself, or that I agree with Google's choice, of course; they killed ad blocker APIs without providing an alternative API, after all. With the code already out there anyway, for the people stuck in their ways still using Google Chrome, they may as well make this version available for Firefox.

The other good reason that Google has is that it puts them entirely in control of the lists. If they don't want Chrome to block ads on Google properties they can opt them out of the block lists.

Because it's lighter on power usage, and that matters for firefox on android.

And because it can block ads without infinite permission to read and change every site you visit.

But now it's not even possible to use the add-on in Firefox for Android, as only add-ons from AMO can be installed.

I was curious if trying to load it via file:///storage/emulated/0/Download/... would work (as my recollection is that .xpi installation is content-type: sensitive) but insult-to-injury is that FF Nightly for Android searches for the string "file:///storage...", so they seemingly have nuked even the file: protocol handler for Android. Good times over there at Mozilla

Pretty sure file:// is very broken in different ways on every android browser.

For example, on kiwi browser typing in a file URL causes it to be searched, but using the "go to URL in clipboard" button (with the file url in your clipboard) works. Except when you randomly run into some weird android file permission issue and the browser just can't see certain files...

file:/// is gone in Firefox Android since at least 2 years ago. I discovered it a few days ago https://bugzilla.mozilla.org/show_bug.cgi?id=1806171

It works in Chrome on my Android 11 phone.

That's not true anymore. You have to press the Firefox logo on the about screen a few times, which will make the menu option appear in settings to install an extension from the local filesystem

Fixing this explanation:

You need to go Settings -> About Firefox -> Click the logo a bunch of times on this page specifically -> Press the back button

You will now see the Install extension from file option.

Wow, that's good to know, thanks!

You know what else uses power? Ads! Particularly the flashy animated ones that fingerprint the browser and hoover up data to prove you're a real human ad impression. I'd wager it doesn't take too many of those slipping through the net to completely undo your "power saving" of a slightly more efficient way of blocking resources.

Has anyone actually done some quantitative research here? I've been using Firefox with uBO for years on Android and of all the apps on my phone, Firefox is not the one that's chewing through battery.

It can run with way less permission as opposed to UBO.

I don’t think people care about giving permissions to one of the most popular extensions ever. The advantages of giving that extension full access are quite clear and the dangers minimal.

> I don’t think people care about giving permissions to one of the most popular extensions ever.

I'm going to fail to go out on a limb and say that those people shouldn't use this version in order to avoid that, then. I suspect this extension been made available for others, like those you're replying to here.

I do care. I trust Gorhill but that doesn't mean mistakes can't slip through. Maybe criminals attacked his system to steal his credentials, or maybe criminals just used old fashioned violence to force Gorhill to release a malicious extension update. Exactly because this is the most popular extension ever, criminals have so much higher incentive to take over his trusted extension to do criminal things.

Of course all of us have our own assessment of trust and danger.

I care. I'll probably just switch to Brave instead of either installing this manually (risky) or using the full-blown addon (risky). The value proposition for Firefox has just diminished.

You care, but you’ll probably just switch to a fringe browser that has far more permissions than an extension. Ok.

It’s faster and has less security implications. I accept that UBO is more powerful even if it has a slightly less secure footprint, but that’s a decision, others may choose for more security per V3

> why would you ever install the inferior edition

It's my computer. I paid for it and I maintain it. I'll do whatever I please with it.

> instead of the one that blocks ads properly that's meant for Firefox?

I have a better question. Why even use Firefox if it refuses to do what I want?

manifest v3 is actually not a bad idea at all. it's more efficient, more private.

It’s bad though in that it reduces your power over your browsing experience. We should get a choice on that. uBO is a good actor and I trust them. Also good crippled storage for lists in v3 while Firefox did not. Clearly it’s to limit size of Adblock lists on google’s part to make the adblockers more irrelevant and in their interest to put as many ads in your face as possible.

> We should get a choice on that.

this is it exactly. They should not remove manifest v2, they should make it more explicit that an addon is v2 or v3, and let the end user choose (with the default being v3, and deny v2 addons).

When an untrustworthy addon asks to be a v2 addon, the user can be made more suspicious, but allow addons like ublock to remain working at full power.

Of course, the whole reason google did it is to remove effective adblocking.

Reply on news.ycombinator.com