dessant

Firefox no longer allows extensions to have full control over requests in Manifest V3, despite their repeated public statements.

https://bugzilla.mozilla.org/show_bug.cgi?id=1786919

They have merged a change that makes it impossible to access and download certain website content the user is viewing and wants to process. Now that Firefox has introduced this limitation without offering an alternative, it is now much easier to port some of my extensions to Manifest V3 on Chrome, despite Chrome not supporting the blocking webRequest API.

It's disheartening to see how these changes are introduced without any planning or care for how it affects extensions that are being ported to Manifest V3, and the general lack of respect towards extension developers.

There were no official statements, but an engineer at Apple working on extensions said that "Apple sees extension APIs as long term support".

https://github.com/w3c/webextensions/issues/298#issuecomment...

Your comment just got better and better as it progressed, I wish properly informing patients was standard practice for dental care.

It's worrying that any website can access real-time data from sensors by default in Android browsers, and there is no option to deny access to these APIs in Firefox for Android and Samsung Internet.

https://sensor-js.xyz/demo.html

Google has decided to show these popups by default to everyone that is browsing the web with tracking protection enabled since October 2022. This prompt has started to pop in our faces on most sites that integrate Google Sign-In as soon as we visit a page, often covering the content we are trying to view, and the website operators need to take specific steps to change the default behavior. We can only applaud DuckDuckGo for attempting to mitigate the destructive actions of Google.

https://developers.google.com/identity/gsi/web/guides/itp#op...

It was inevitable to delay the rollout, the adoption of Manifest V3 is way too low among the most popular extensions. Take a look at the various featured categories on the Chrome Web Store, only a small fraction of featured extensions have migrated to Manifest V3. In 3 weeks all of them would have had to be removed from those promotion pages and the Chrome Web Store would have been in ruins.

The deprecation timeline is too aggressive considering that Manifest V3 is still missing important features, so many developers have decided to brace for impact, even if it meant losing the Featured badge for their extensions in January 2023.

Before that we didn't have anyone to contact, and the Chrome extensions team definitely did not react to feedback in any meaningful way.

The Chrome extensions team has been considerably more responsive to criticism since Simeon Vincent has become a Developer Advocate. It's important to see the perspective of developers who've been working with these APIs for years, and I'm glad that they are finally listening.

It's also alarming that GNOME extensions are updated in the background without user interaction, and the feature cannot be disabled. These extensions are not sandboxed, can run arbitrary commands, and have access to the entire system. Extensions are practically a backdoor for the entire GNOME user base that can be accessed by compromising the update server.

https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/2514

All the more disheartening that they resort to all this sliminess when they're at the top.

I'd love to see an Apple that acknowledges the coil whine in Mac Studio and Studio Display. An Apple that does not distort the meaning of privacy, and markets ad watching as a premium experience.

You're right, and this is what the Digital Markets Act will help achieve. Though considering how tech companies behave in the face of new consumer rights (see how it took Google half a decade and multiple fines to show a GDPR compliant consent popup with a REJECT ALL button), it will be a couple more years before you can install a third-party app store on iOS or sideload an app.

> The author of the article wrote that all he had to do was request his data from Apple

You observation has nothing to do with what is being discussed, we have a right to inspect the network activity of our devices.

I remember you posting in threads criticizing Apple, almost always coming to their defense. You've been doing this for years.

The public dismissal of the evidence these researchers presented in the last few weeks was surprising. It isn't truly important whether the App Store is an integral component of iOS, which it practically is until Apple becomes compliant with the provisions of the Digital Markets Act, it merely compounds their legal issues due to ignoring user intent when iOS analytics are disabled.

The main issue here is that Apple has been collecting personal data for years through its own apps without informed consent, which is in breach of GDPR. You need to ask for express consent to collect personal data in the form of non-essential user analytics, having a privacy policy and a toggle in settings to opt out of data collection is not enough, and it does not matter if the data collection is done by a website, app or an operating system.

It was particularly frustrating to see people argue that it's just an older version of iOS, when the reality is that one needs to hack an iPhone to see how this data is being syphoned off, and that jailbreaks for new iOS versions can be prohibitively expensive to achieve. Despite that, researchers pointed out that they see similar encrypted packets being sent with a recent iOS version.

I think it's worrying that consumers can't inspect the traffic of a device they own, and this is also an area that should be regulated so that our rights are respected.

Fun fact: Mozilla projects are now developed in part by Cognizant Softvision, including Firefox for Android. Their employees are everywhere on Mozilla bug trackers, and their numbers seem to have increased since 2020, right after Mozilla fired a quarter of its workforce.

https://www.cognizantsoftvision.com/blog/pedal-metal-mozilla...

It's almost as if one is expected to keep sharing until their last day, without ever being entitled to change the terms of sharing.

Chrome Web Store reviewers leave a lot to be desired. My only effective strategy over the years has been to shame them in public and let them know that our interactions are immediately published across the web. You have to be relentless, otherwise they will destroy a decade of your work in a snap.

These threads will surely give PTSD to any extension developer:

https://github.com/dessant/search-by-image/issues/57

https://github.com/dessant/search-by-image/issues/63

It's actually the Digital Services Act, I have corrected my comment.

Luckily all of this will be illegal in the EU thanks to the Digital Services Act, developers will have the right to know the exact reason for a rejection, and Google will need to provide real human support.

Selfies are collected by a limited number of companies because it is a convenient way to satisfy KYC, but it is by no means legally required to collect this biometric data, nor is it secure to verify customers this way thanks to the proliferation of AI.

KYC checks are already being tested with electronic IDs, and the identity of the customer is verified by the presence of a government ID, and the input of a PIN. No selfies or similar farces are involved.

They should just verify identities without selfies, like most payment providers. This trend of using selfies comes from shady crypto companies that were eager to pretend that their users have been verified, while also benefiting from the collected biometric data.

Recently I've signed up with Paddle, and they have opted to verify user identities with Onfido, so they have asked for a government ID and a selfie. I have contacted Paddle and refused to provide a selfie, so they eventually asked me to upload my ID too in place of a selfie and manually approved the submission.

Paddle has no excuse for collecting selfies, they are providing services to businesses that can be verified in more humane and secure ways, such as an electronic signature.

Verifying people with selfies is a degrading and insecure practice, especially when you encounter Onfido during the installation process of a bank's app that you already have an account with, opened in person at a local branch in the EU. This bank also asks you to create a video of yourself and submit your speech to configure their mobile banking app. I'm sure the data will be useful for someone when Onfido eventually gets hacked, or just sells your biometric data.

My hope is that biometric data collection for online account verification will become illegal once all EU member states have intoduced electronic IDs which have an NFC chip. The verification should consist of a person holding their ID next to their phone, and the online service would only receive the minimum amount of personal data to complete the verification.

Good luck with that ridiculous generalization, and the partial quote that removes the context.

I'm not sure what you're understanding from my comments at this point, but I said it early on that I see no problem with a bad faith question when it comes to questioning a Meta enginner's employment choice. I kept repeating the same thought over an over. You can be content with something in a specific case, and at the same time not engage in it. This also doesn't mean that someone will usually support a bad faith argument, or engage in it, as you seem to want to conclude.

No, I don't think any method of direct or indirect questioning is bad in this context, while you have a problem with both a roundabout and a direct critique of someone's employment choice, be it Meta or Amazon. You said it yourself that I should be direct in my critique so that I hopefully get deplatformed.

Find a less harmful employer instead of projecting your insecurities into someone's question, and trying to silence critique of any kind to ease your conscience.

I think you're reading the least charitable interpretation into my comments. The question was not asked in bad faith, but genuine surprise, while I'm also bothered by people acting as if a Meta employee could not be called out. You can be offended by the matter of an allegation being framed as something bad, and also not commit the alleged act.

For example an Amazon employee could be bothered by their union related question being perceived as critique, while also seeing no issue with someone condemning Amazon for their illegal union busting, and general disregard for the safety and well being of their warehouse staff.

I think you're the one who's attacking users here. Asking why someone would join a company is not an attack, even if I have my reservations about the company, and I had no plans to further interact with them, but probably continue to have my opinions about their choice, unless they make a compelling argument.

My question was not made in bad faith, but insinuated to be a bad faith question by a different user, though as I said, I do understand the people who directly call out Meta employees, which I did not do here.

It is you and your peer who attacked the question, brought up conspiracy theories and called for deplatforming. So if you continue perhaps I'll be the one to reach out to mods. I have every damn right to ask someone on HN why they would work for Meta, without expecting intimidation from other users.

And yes, I continue to be surprised by people who would join Meta given all the shady and illegal things they've been doing over the years. So maybe one of you could give an honest answer, one that does not involve an attack. Maybe they weren't fully aware of Meta's issues, or people there generally don't care about these problems? That is what I was trying to understand.

> Do you seriously struggle to think of possible reasons for why someone would want to work for Meta?

Yes, I struggle to think of a good reason to work for such a harmful company as Meta. People usually don't land there because of a desperate need for money, which would probably be one of the very few acceptable reasons for joining that company.

And why should my question be in good faith? Why should we not call out people who cheerfully join organizations that pose a threat to our future, and show no civic responsibility?

I can imagine you haven't been involved in anything illegal, but I'm sure you've aware of Meta's documented track record of coordinated illegal actions. Do engineering teams just fall head first into a bucket of 2FA phone numbers and start using the data for ad targeting, and nobody bats an eye from the legal department to product managers? Or are they hypnotized to build services for biometric data collection without consent? Nobody does anything nefarious, but their collective actions which benefit the company just end up being illegal, again and again?

The tech companies you work for do often engage in illegal activities, and some of your collegues are complicit. I'm sure it is an uncomfortable thought for some of you, but this is all part of the public record.

Facebook was already caught using 2FA phone numbers for ad targeting, and they have also collected biometric data without consent for years, so you can fully expect that picture of your face to be eventually used in illegal ways by Meta.

How would you reward open source maintainers? Donations can rarely sustain a project, so my own solution was to also start selling my work on app stores, but that may not work for everyone.