Hacker News Reader

Comment by devsda | Hacker News Reader

I hope this isn't a precursor to removing support for other AdBlock addons(MV2) citing native availability of an AdBlock engine and then gradually shift to acceptable ads etc.

View on HN

The day Firefox drops MV2 is the day I find a new browser. We're already at <1% usershare, it's not like there's safety in numbers here

I'd be genuinely curious what you could switch to that still has MV2 because, AFAIK, Firefox is the last holdout.

Brave still allows you to install uBlock & some other extensions that should technically not be supported under MV3, but they still ship it with support for those.

Just heard about Helium browser, which is just dechromium + uBlock and it's still beta.

> I'd be genuinely curious what you could switch to that still has MV2 because, AFAIK, Firefox is the last holdout.

My last hope is ladybird right now, I don't use Firefox or Chrome as my main browsers anymore, and use them only within temporary sandboxes. Without history, without cookies, without logins for the most part.

You use ladybird as your primary web browser? And it works?

For the most part, it doesn't. It's not a consumer ready browser, but a pretty nice little rendering engine. If you use ladybird as bindings, it's a bit unstable right now because they are refactoring a lot of parts in the codebase.

I built my own tools on top of it, mostly to use internet websites and selfhosted kiwix archives with my local agentic env.

I guess what I am saying is that I don't have a primary browser anymore. Not a browser where I just can trust it that it doesn't do shit with my data. Being able to selfhost kiwix is a superb internet experience if you build your own search dashboard for it, I can fully recommend it.

Have to merge my things upstream with ZIMdex when I have the time (probably around June).

[1] WIP https://github.com/cookiengineer/exocomp

[2] WIP https://github.com/cookiengineer/zimdex

It seems to me that --unless you really, strictly compartimentalize your browser usage--, using multiple browsers will only supply your data to more parties.

Ladybird supports MV2? I had no idea they have extensions.

Ladybird is many years away from being usable by a casual human. The hope is it turns out to be a great browser eventually.

> Firefox is the last holdout.

Nope, FF is being infiltrated by adtech for last year or two. Last holdout is Safari now :)

>Last holdout is Safari now

Why do people say crap like this... Safari was the first browser to completely remove mv2. From all the major browsers Safari has the worse adblocking experience and support for adblocking extensions...

> Why do people say crap like this...

1. Third-party cookie blocking by default — 2003 (Safari 1.0); industry first.

2. Intelligent Tracking Prevention (ITP), using on-device machine learning to identify and limit cross-site trackers — 2017; industry first.

3. Storage Access API prompts for embedded third-party content (e.g., social login widgets) — 2018 (ITP 2.0); industry first (co-developed by WebKit, later adopted as a web standard).

4. Full third-party cookie blocking (no exceptions) — 2020 (ITP in Safari 13.1); industry first for a major browser.

That's what the marketing department says.

Ad/tracking blocking is one of the things that can only be trusted if it's open source, i.e. uBlock Origin.

By the way, does this Adblock Engine actually block trackers? Or it just stops the ads from displaying?

ITP is mostly part of WebKit and open source.

Apple only does things to progress their own business model. Apple failed at becoming an ad business so they pivoted to subscriptions and app revenue. Now they are building an ad business. Just look at their ad revenue.

You cannot install uBlock Origin on Safari.

The Lite version, same as on Chrome, is actually available for Safari. Still not as good as the full one on Firefox though.

https://apps.apple.com/us/app/ublock-origin-lite/id674534269...

Exactly.

what's the diff between lite and full? i dont even remember what i use on safari, wipr or something. mostly use firefox but sometimes i casually just let things launch in safari

https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...

https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...

really appreciate you dropping links thank you!

Related discussion: https://news.ycombinator.com/item?id=44795825

I don't know if Edge supports MV2, but they do have uBlock available and it works just as well as on Firefox.

It may look like it works "just as well" but that's not true. There are numerous things that impact performance and effectiveness that are not possible with chromium-based browsers, or at least have to be done inefficiently, including

* pre-fetching

* html filtering

* use of WebAssembly

* data compression and private/incognito mode

Edge has its own extension API in addition to the Chromium one, it's possible that they've managed to mitigate or eliminate these problems.

Helium still supports MV2, because the upstream hasn't removed related code. They basically turn on/off some macros to enable MV2 again. And this won't last long for sure.

Safari still supports MV2

Firefox supports webRequestBlocking with MV3, so even if they fully remove support for MV2, ad blocking is still available.

Mozilla refused to approve MV3 version of uBlock Origin

That's a problem, but an almost completely orthogonal one to MV2 being deprecated.

I wouldn't say completely orthogonal.

That's probably why they qualified it with 'almost'.

I would say "almost orthogonal".

Like "partially pregnant" :)

How are correlation or orthogonality binary conditions? Things can be almost (but not entirely) unrelated to other things as well.

Why? Any links to this decision?

I take it they mean this https://www.neowin.net/news/ublock-origin-lite-maker-ends-fi...

https://github.com/uBlockOrigin/uBOL-home/issues/197#issueco...

What exactly is your gripe with MV3?

Many people seem to treat it synonymously with "no more procedural request blocking", but that's not a thing Mozilla ever did:

> For Manifest V3 extensions, Chrome no longer supports the "webRequestBlocking" permission (except for policy-installed extensions). Instead, the "webRequest" and "webRequestAuthProvider" permissions enable you to supply credentials asynchronously. Firefox continues to support "webRequestBlocking" in Manifest V3 and provides "webRequestAuthProvider" to offer cross-browser compatibility.

The permission model also seems much more reasonable (less permissions have to be requested upfront at install time) than MV2, so I actually hope Firefox does deprecate it at some point.

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

https://blog.mozilla.org/en/firefox/firefox-manifest-v3-adbl...

> What exactly is your gripe with MV3?

Running an adblocker is the defining feature of the extensions API. ublock origin has 5x as many users as the second-most-popular extension [1]

Supporting ublock isn't just a nice-to-have add-on feature for an extension API, it's literally the only thing most users care about.

[1] https://addons.mozilla.org/en-GB/firefox/search/?promoted=re...

But MV3 supports uBlock Origin Lite.

Which, in my experience, blocks ads just as well, but also lets pages load significantly faster.

MV3 supports uBlock.

It supports limited ublock functionality, not all of it, which will gradually be exploited by ad corps like google unless you think those are saints

The point is that it supports everything that currently matters in any substantial way.

Lots of people have been pointing out that ad companies will figure ways out around it. But they really haven't been.

MV3 and UBOL have been in wide usage for about a year and a half now. And nothing has been changing. Adblocking continues to be great.

The fact of the matter is, the ad block lists were getting so large and the JavaScript functionality was slow and it was significantly impacting page load times. UBOL uses vastly more efficient compiled code that is part of the browser and is just a far better ad blocking experience altogether.

But I guess that just doesn't fit the narrative that people want to believe, where MV3 was part of a big evil plan.

the narrative that google, largest ad company proposed MV3 which limits current functionality of UBO so that UBO Lite can be implemented? Yeah, such a narrative... It's clear google is our buddy here who will never squeeze and exploit any option to push more intrusive and targeted ads and we should totally trust it

It supports everything on Firefox on MV3, but not on Chrome.

Just as one example: Chrome + uBOL on Reddit will show you plenty of "Sponsored" stuff. You can use Inspector to find the offending CSS classes and then use `display: none` on them with something like Stylus[0], but not everybody wants to play that whack-a-mole game on the many sites that push uBOL past its blocking capabilities.

[0]: https://github.com/openstyles/stylus

Reddit's sponsored posts are blocked by default in uBOL when using _optimal_ (default) or _complete_ mode.

I will recheck my uBOL settings, then, sir. Thank you for your work!

EDIT: I did have it set to `Complete,` so perhaps I have something else going on.

Best is to report the issue using the "Report an issue" in the popup panel while on Reddit site. There could be other issues causing this, for instance if you didn't grant uBOL the permission to inject scripts on the site. Depending on which browser/os the issue occurs, we should be able to narrow down potential causes.

As the creator of UBO, what are your thoughts on uBO vs uBOL? Do you think Firefox’s MV3 will be an issue down the line?

> There could be other issues causing this, for instance if you didn't grant uBOL the permission to inject scripts on the site.

Bingo. That was it. Again, thanks.

Most definitely not as well.

It most definitely is as well. In fact it's better because you don't have the slower page loading times anymore.

And everyone I know who used UBO and switched to UBOL has had no complaints about ads not being blocked.

Whereas people who don't actually use it love to continue to insist that it's this degraded experience that doesn't work as well. And usually when one of them comes up with an example of some ad not being blocked, it turns out because they hadn't configured UBOL to use complete blocking mode.

> And everyone I know

Everyone who you know is irrelevant. I've tested and see that ads pass through, and tracking passes through with uBo light on Chrome. I can see it in the browser trace, and I can see it in DNS logs.

Your test is irrelevant. There is always going to be some tiny percentage of ads that passed through with any ad blocker. So the fact that you have seen ads passed through with it doesn't actually mean anything.

The only thing that means anything is how well it operates with your average browsing on a daily basis. And it's such a popular extension because it does an amazing job at blocking ads. That's just a fact. The only people who seem to claim otherwise appear to be the ones with an ideological axe to grind. It's silly.

Your opinion is nothingness. I've tested on the same page that uBo on Firefox blocks more than Chrome, and especially it blocks hidden tracking. That's the reality. All else is irrelevant.

Your one-page test is "nothingness." The internet does not consist of one page.

And other things are relevant, like resource usage.

So you’re familiar with everybody’s web browsing? Impressive!

> It most definitely is as well.

No. uBlock Origin works best in Firefox: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...

uBlock Origin Lite can't do everything uBlock Origin does: https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...

If Lite is working for you then good. If you want fuller capability then you want uBlock Origin in Firefox.

UBO lite has a long list of all the types of filters that aren't possibly under MV3: https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...

Not sure about page load, but CPU time is about the same between the two: https://x.com/gorhill/status/1792648742752981086/photo/1

This list only applies to Chrome, so it's completely irrelevant when talking about Firefox.

Reading comprehension is the defining feature of a good commenter.

Firefox's MV3 implementation doesn't remove the original netRequest API though IIRC.

Look I'm not an expert in web browsers, but I defer to those extension authors who definitely are. There's some reason uBO doesn't work well in MV3 even though they tried. Whatever technical explanation there is for why MV3 is fine, there's some caveat not mentioned.

That’s because Chrome removed an important API in their MV3 implementation, not because the MV3 specification mandates said removal.

If Raymond Hill says blocking doesnt work anymore, ill use... umm... Lynx?

Could definitely be writing on the wall that MV2 support will be deprecated in the future but imo not necessarily a bad thing if it’s not actively developed anyways. Maintaining both MV2 & MV3 support isn’t easily sustainable long term when you factor in the need to prioritize other features.

That said, if this is writing on the wall I’d hope they’ll listen to the community this time and allow the engine to be extended / make it such that a block all ads feature always exists. I’m cautiously optimistic given Mozilla’s track record just over the past year-ish. They have released some great new features that help bring Firefox closer to feature parity with other browsers.

I am a Firefox hopeful and recently switched back to using it as my daily driver when Arc went belly up (but mainly for uBlock Origin support).

>Maintaining both MV2 & MV3 support isn’t easily sustainable long term when you factor in the need to prioritize other features.

There is no feature Firefox provides that is more differentiating than ublock origin. As long as pages load and security issues are patched it is the reason to choose Firefox as a browser. What would they prioritize over it?

I’d like to see more investment in their new profile manager. It feels pretty barebones at the moment. Arc had the ability to link profiles to “spaces” and you could easily switch between them without opening a new window. It was very nice to so easily swap between personal, work, & side business.

The multi user containers are also very nice.

And to go one step further, for achieving a profile-per-firefox-window workflow, I suggest to have a look at the underrated extension Sticky Window Containers [0]

While far from being perfect, I find it good enough for keeping things separated, especially when using a desktop/workspace workflow. For example, in workspace/desktop 2 I have a Firefox window opened with the first tab set to "container A", so hitting ctrl-t there opens new tabs with the same container "A", so I'm logged-in for all projects A. In another Firefox window in workspace 3 I work with "business project B" tabs (where I'm logged into different atlassian, github, cloud, gmail, ...)

Then with a Window Manager like i3wm or Sway I set keybinds to jump directly to the window (and workspace), using the mark feature [1]

It's also possible to open websites directly in specific containers so it's flexible. For example on my desktop 8 I have all my AI webchats in "wherever my company pay for it" tabs: `firefox --new-window 'ext+container:name=loggedInPersonnal&url=https://chat.mistral.ai' 'ext+container:name=loggedInBusinessA&url=https://chatgpt.com' 'ext+container:name=loggedInBusinessB&url=https://gemini.google.com' 'ext+container:name=loggedInBusinessB&url=https://claude.ai'`

It's also the only way I found to keep opened multiple chat apps (Teams, Slack, Discord, ...). The alternative electron apps are as resource-hungry, and in my experience never handled multiple accounts well (especially Teams).

[O] https://addons.mozilla.org/en-US/firefox/addon/sticky-window...

[1] https://i3wm.org/docs/userguide.html#vim_like_marks

And there's nothing in MV2 that uBlock Origin needs that doesn't exist in MV3 on Firefox, unlike Chrome. This issue is completely overblown.

Are you disputing uBlock Origin's list of MV3-incompatible capabilities [1]?

[1] https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...

That list contains issues with the APIs that Chrome exposes via MV3. Firefox still supports APIs that Chrome removed.

Not really, but this FAQ, like almost all articles published on MV3, conflates MV3 the specification with Chrome's MV3 implementation. (FWIW, I'm almost certain that this is either due to sloppy/imprecise writing or intentional, with the authors not wanting to confuse users already appropriately riled up by equally imprecise reporting on MV3. They definitely know the difference.)

In any case, for better or worse, when people say MV3, they now usually mean "Chrome's MV3 implementation", which obviously never applies to Firefox.

That's utter bullshit. The author of uBlock Origin has posted a long list of capabilities that declarativeNetRequest does not support.

Unlike Chrome, Firefox did not remove the older API.

What's this supposed to mean ? OP was saying that MV3 is feature-equivalent to MV2 and would like to see MV2 support removed from Firefox just as it was from Chrome. I replied pointing out that's utterly false.

MV2 and MV3 are feature equivalent on Firefox when it comes to request blocking.

> Maintaining both MV2 & MV3 support isn’t easily sustainable long term when you factor in the need to prioritize other features.

The feature that better adblockers need is one callback that's similar to one that's still in V3. It's not difficult to keep if it's your own codebase.

Try Zen! Firefox fork with Arc-like UX.

Zen is great and still mostly Firefox. I use standard Firefox on Android and everything syncs without hassle. The experience is so much better that personally cannot imagine using Chromium anymore. Of course I do wonder if the entire Firefox ecosystem is sustainable long-term funding wise.

Why does everything have to be "actively developed"? Sometimes a program is just done. Better not touch it. I actually do downgrade packages when "actively developing" causes regressions. Not curl or anything sensitive like that, but local programs definately yes.

In case of the extension manifest, that's probably layered on top of the JS engine which does get attention and scrutiny. It's not like an API needs to be updated. If you'd always do that, nothing would ever be interoperable and we'd likely have a hard time trying to communicate.

As long as MITM proxies still work (which is something that Enterprise customers demand --- even the notoriously-closed Chrome needs to), it will always be possible to filter pages outside of any browser. I've been using one for over 2 decades and it works in any browser.

However, I am also concerned that this is an "embrace extend extinguish" move.

Tell me more, what's your setup.

I use uBlock Origin in Firefox and network ad blocker. Wondering what other options are there.

In general, install a proxy which has its own certificate, resign every tls session with those keys, add the certificate of the proxy as a trusted certificate on your device.

I’m not familiar with off the shelf solutions for this that have ad blocking built in. Also ads are injected by JS so you need a mechanism to detect that.

More and more ads are now served from the same domain as the site making it harder to distinguish them from real content.

ZScaler Internet Access will do it with the right blocking configurations (eg, blocking "Advertising" groups).

But then you're using ZScaler and that just feels all nice and icky.

The open source solution is to configure the latest Squid proxy as a Squid SSL Bump proxy. There are a handful of sites it will not work with due to them still using public key pinning but its a tiny list. I do not have it handy at the moment.

Squid supports ACL's that can block URL patterns, domains, IP addresses, file extensions, mime types and much more.

Here [1] is an out of date example. There are probably better and more up to date examples. Some examples are based off Squid V3 as some distros still ship with that but Squid 6 added more flexibility around chaining options SOCKS options and such.

[1] - https://github.com/alatas/squid-alpine-ssl

What would prevent sites from just injecting ads into their content server-side? You'll always need both element and request blocking.

That's why GP wrote MITM, not just network blocking. MITM implies the middlebox is trusted by the browser in which it has installed a certificate, so can see and modify content.

Hm, you mean basically to edit all HTML, CSS etc. just in time? This seems significantly harder (concepts spread over files being loaded in parallel or being partially cached etc) than to do it in the browser once everything is loaded.

Reply on news.ycombinator.com