Comment by krackers 2 days ago
>They decided it wasn't a security issue, and honestly, I agree, because it didn't give extensions access to data they didn't already have.
So they admit that MV3 isn't actually any more secure than MV2?
No, MV3 really isn’t more secure. MV3 still allows extensions to inspect your requests — it just doesn’t allow extensions to block them.
It’s almost comical how weak the security/privacy argument for MV3 is. Chrome could have developed a sandboxed web request inspection framework to prevent data exfiltration, but they didn’t even try. Instead they nerfed ad blockers without adding any security.
I remember that another comical argument was performance. Supposedly, having extensions run in the background all the time is bad. So it's better to constantly, completely re-initialize them whenever an event wakes them up.
From https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...
>Keep in mind that uBO's own JavaScript-based network filtering engine has been measured to be faster than a well-known Rust-based filtering engine (though the measured difference back then was low single-digit µs, not something that will ever be perceivable by a end user).
I wish I could browse the web kinda like this but minus the human:
Make Signal video call to someone in front of a laptop, provide verbal instructions on what to click on, read to my liking, and hang up to be connected with someone else next time.
(EFF’s Cover Your Tracks seems to suggest fresh private tabs w/iCloud Private Relay & AdGuard is ineffective. VMs/Cloud Desktops exist but there are apparently telltale signs when those are used, though not sure how easily linkable back to acting user. Human-in-the-loop proxy via encrypted video calls seems to solve _most_ things, except it’s stupid and would be really annoying even with an enthusiastic pool of volunteers. VM + TOR/I2P should be fine for almost anybody though I guess, just frustrated the simple commercial stuff is ostensibly partially privacy theater.)
https://stallman.org/stallman-computing.html section "How I use the internet" ?
Sometimes IceCat + LibreJS over Tor but primarily wget-ish software via email and into Lynx (text-based, 33 y/o browser). Wow. Thanks for sharing, didn't read enough of the page last time I saw it!
Downloading on a remote machine is great for read-only needs!
Maybe more I want to have a library computer at my house that somehow doesn’t use my ISP or, to go real paranoid, even click/type the way I always do.
I should already be sharing iCloud Private Relay nodes with thousands upon thousands of people. Yet:
“Your browser fingerprint appears to be unique among the [~240k] tested in the past 45 days.
Currently, we estimate that your browser has a fingerprint that conveys at least [over a dozen] bits of identifying information.”
-Cover Your Tracks results
Apparently VPN is one thing, but then sites will analyze “operating system, graphics card, firmware version, graphics driver version, installed fonts”, and more. Creepy even though I’m quite vanilla.
One of the main goals of MV3 seems to be nullifying protection against tracking URLs. Most of the discussion about adblocking technically "still working" under MV3 misses this point. It doesn't matter if you're actually served ads or not, when when your underlying habits can still easily be collected from the combination of fingerprints and tracking URLs.
> Most of the discussion about adblocking technically "still working" under MV3 misses this point.
Because it's a dishonest point. Ad blocking still works. All the same ads can still be removed from the page. Tracker blocking doesn't. This is still a huge problem for privacy. But while nearly everyone dislikes seeing ads that interrupt your content, people who actually care about tracking privacy are a much smaller group. The latter group are trying to smuggle concern for the latter issue by framing it as the more favorable issue to garner more support from the former.
I assume that those who care to block ads also care to block trackers, if they care about MV3 at all.
What I don't understand is why Google doesn't offer users the ability to add some extension ids into some whitelist to allow them using very sensitive permissions.
Force those extensions to have an prominent icon on the UI with a clear tooltip asking "did you install this yourself [No]" for easy removal, in case someone else did install it without you knowing.
There are so many ways to make this work, but they have zero interest in it.
I've started assuming bad intent after WEI, even though it was dropped.
I believe them. The restrictions are reasonable and appropriate for nearly everyone. Extensions are untrusted code that should have as little access as possible. If restrictions can be bypassed, that's a security bug that should be fixed because it directly affects users.
I also think uBlock Origin is so important and trusted it should not only be an exception to the whole thing but should also be given even more access in order to let it block things more effectively. It shouldn't even be a mere extension to begin with, it should be literally built into the browser as a core feature. The massive conflicts of interest are the only thing that prevent that. Can't trust ad companies to mantain ad blockers.
> Extensions are untrusted code that should have as little access as possible.
It's entirely possible to manually vet extension code and extension updates in the same way that Mozilla does as part of their Firefox recommended extensions program.
> Firefox is committed to helping protect you against third-party software that may inadvertently compromise your data – or worse – breach your privacy with malicious intent. Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts.
https://support.mozilla.org/en-US/kb/recommended-extensions-...
Other factors taken into consideration:
Does the extension function at an exemplary level?
Does the extension offer an exceptional user experience?
Is the extension relevant to a general, international audience?
Is the extension actively developed?
The same way it's done with V3, because no permission-level blacklist/whitelist is going to prevent the person from creating an interpreter within JS itself.
Looking at https://developer.chrome.com/docs/webstore/troubleshooting#a... it seems most of the heavily lifting is done with some combination of static/dynamic analysis during extension review. The same analysis (plus trivially catching eval) could be done with V2 as well.
It's a logic I fully agree with. As the owner of the computer, you should of course be able to do whatever you want. The APIs should still be designed around sandboxing and security though.
I only trust free software, and only after I have read its source code and evaluated the distribution channel. I don't want proprietary obfuscated third party code running on my computer without some serious sandboxing and virtualization limiting access to everything. I went so far as to virtualize an entire Linux system because I wanted to play video games and didn't trust video game companies with any sort of privileged or low level access to my real Linux system.
Malicious actors are known for buying up popular extensions that are already trusted by their user base and replacing them with malware via updates. The proper technological solition to such abuses is to make them literally impossible. Exceptions can and should be made for important technologies such as uBlock Origin.
Would that rip off the how-do-we-fund-the-web bandaid, forcing new solutions? Worry about the interim where some publishers would presumably cease to exist. And who would remain afloat—those with proprietary apps, as Zucky as they are, I’d guess…
UBO is absolutely incredibly important. Figure you might know more than me about how journalists and reviewers and the like can still earn a keep in a world with adblockers built in to every browser.
> Would that rip off the how-do-we-fund-the-web bandaid, forcing new solutions?
Absolutely. The web is mostly ad funded. Advertising in turn fuels surveillance capitalism and is the cause of countless dark patterns everywhere. Ads are the root cause of everything that is wrong with the web today. If you reduce advertising return on investiment to zero, it will fix the web. Therefore blocking ads is a moral imperative.
> Worry about the interim where some publishers would presumably cease to exist.
Let them disappear. Anyone making money off of advertising cannot be trusted. They will never make or write anything that could get their ad money cut off.
People used to pay to have their own websites where they published their views and opinions, not the other way around. I want that web back. A web made up of real people who have something real to say, not a web of "creators" of worthless generic attention baiting "content" meant to fill an arbitrary box whose entire purpose is to attract you so that you look at banner ads.
The user should of course be able to add their own extensions that do whatever they want.
I'm just saying that I think this is good interface design. Virtualization, sandboxing and gating access to data and computing resources are good things.
I get what you mean and I think we align here, but I trust the uBlock team infinitely more than I trust Google to make my own extension decisions. I know there's a subset of regular users who fall for all manner of scam, but Manifest V3 doesn't even solve any of those issues, the majority of the same attack vectors that existed before still exist now, except useful tools like uBlock can no longer do anything since they got deliberately targeted.
Besides, there's ways of having powerful extensions WITH security, but this would obviously go against Google's data harvesting ad machine. The Firefox team has a handful of "trusted" extensions that they manually vet themselves on every update, and one of these is uBlock Origin. They get a little badge on the FF extension store marking them as Verified and Trusted, and unless Mozilla's engineers are completely incompetent, nobody has to worry about gorhill selling his soul out to Big Ad in exchange for breaking uBlock or infecting people's PCs or whatever.
We agree. Note that I made an exception for uBlock Origin. I think it's so important and trusted it should be a core browser feature. Only reason it isn't is the inherent conflict of interest.
This comment reads as if those villains have to provide explanations. Bitch they are Google they ask the questions. If they want they can pirate everything then sell it to make some cash, the stupid laws that we have to follow don't apply to them.
IMO those organizations should pay the taxes for all the people in the country they're being used at. This will create the best incentive for them to succeed.
I'd be shocked if anyone actually believes them. This article starts with the obvious conflict of interest. Of course letting an extension know what websites you visit and what requests are made is an insecure lifestyle. But I still do it because I trust uBO more than I trust the ad companies and their data harvesters.