Remix.run Logo
matheusmoreira 6 hours ago

> Then they had to make up some reasons to justify that

Hate to be the one to defend Google here, but the reasons weren't that unreasonable. I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.

It's just that uBlock Origin is so insanely useful, important and trusted, it should get full access to the entire browser regardless. Honestly, it should be literally built into the browser instead of being a mere extension. Only the conflicts of interest inherent in an ad company maintaining an ad blocker prevent that.

codedokode 6 hours ago | parent | next [-]

Yes, but if you write your own extension maybe you want to read and modify the data. For example, patch fingerprinting script so that it gets the wrong result.

Furthermore, malicious extension can read the data from the DOM, from forms (for example, password or credit card fields), and in some cases, from JS variables. They can insert fake information into the page. So preventing extensions from reading network data still leaves a lot of options for a malicious extension.

jimmydorry 2 hours ago | parent [-]

So you're saying that because Google didn't completely up-end the security model and break almost every extension in the one-go, we should have no-progress towards a more secure extension model?

uBlock Origin via declarative blocks is almost as powerful as the original. While I would trust gorhill with almost unfettered control over my browser, I don't trust EVERY extension owner (no do I trust uBlock Origin in perpetuity).

michaelt 5 hours ago | parent | prev | next [-]

> I want my browser to prevent random extensions from directly reading web page data.

To be honest, to me it sounds like you don't want browser extensions then.

To me, directly messing with web page data and browser behaviour is the whole point of a browser extension - what else is a browser extension for?

matheusmoreira 5 hours ago | parent | next [-]

The purpose of browser extensions is to build up an install base then sell out to some corporation that then promptly leverages that user base to exfiltrate data and monetize it.

No thanks. They should have to declare to the browser what it is they want done instead.

static_motion an hour ago | parent | next [-]

And extensions do exactly that in Firefox. When installing (or updating) extensions you're notified of any and all permissions the extension is requesting from the browser and you're given the choice to proceed with the installation or not. Google goes a step further and just straight up denies user choice entirely.

tmgldn 4 hours ago | parent | prev | next [-]

This point would be far more credible if browsers weren't in business to do what you claimed extensions are there to do.

I'd also argue that creating a full browser without a profit motive is more unrealistic than creating an extension and uploading it - for free - to a web store.

a2ff6eeb0 2 hours ago | parent | prev | next [-]

I think you're confusing the extension and the browser. The browsers are generally in the business of supporting an advertising company.

jamesnorden 4 hours ago | parent | prev | next [-]

It still sounds like you don't want browser extensions then.

inigyou 4 hours ago | parent | prev [-]

... But they do that. The declaration is written in a language called JavaScript.

matheusmoreira 2 minutes ago | parent [-]

Javascript is not a declarative language.

lxgr 5 hours ago | parent | prev [-]

Why should there not be a middle ground between “can do absolutely everything with all my data” and “is basically a glorified bookmark button” based on the level of trust I have for an extension?

mzajc 3 hours ago | parent | next [-]

Because security is the pretext, not the goal here. I'm sure browsers could have better security controls for extensions, but giving users extra control over software doesn't seem to be very popular among corpos nowadays.

inigyou 4 hours ago | parent | prev [-]

Because the browser already has bookmark buttons

drtgh 5 hours ago | parent | prev | next [-]

>Hate to be the one to defend Google here, but the reasons weren't that unreasonable.

Sounds like some kind of Stockholm syndrome. Years ago, it was standard practice for software to be designed so that users could grant permissions to access invasive methods or functions.

Google relies on users' personal data (ads), which is why they introduced a unique ID to their Chrome browser (to track).

edoceo 4 hours ago | parent [-]

When was that standard practice? Cause years ago (like 2000) I remember even trivial and simple software (WeatherBug) being able to read/write all over the computer (Windows). And some crap I just installed on Win11 can see all over the box, just slightly less.

bo1024 6 hours ago | parent | prev | next [-]

Of course it's tempting to reply "don't install random extensions". But a bigger point here is that browsers have grown so massively complex that it's almost impossible to build one, so we don't have an ecosystem where you can choose your browser for safety and I can choose mine for freedom. Of course, Google has had a big incentive and hand in making it this way.

xtracto 4 hours ago | parent | prev | next [-]

> I want my browser to prevent random extensions from directly reading web page data

This is so funny to me. Coming from a Netscape Navigator world, when extensions first came out, they were supposed to allow the user to add functionality to websites.

Why would someone install "random extensions" that they dont trust. And also, what would extensions do if not read and write data to websites? .

Sign of the times I guess.

matheusmoreira 29 minutes ago | parent [-]

> Why would someone install "random extensions" that they dont trust.

Same reason why people download random stuff and run it with administrator permissions on Windows.

flomo 2 hours ago | parent | prev | next [-]

> I want my browser to prevent random extensions from directly reading web page data. The declarative API idea is pretty good.

Agreed. And you would think most paranoid HN types would too.

> It's just that uBlock Origin is so insanely useful, important and trusted

Maybe I'm foggy on the history. But isn't this like Fork #4 or #5 of some previous AdBlock extension?

Seems like the only business model for this type of extension is "selling out" for certain ads. And then the cycle repeats and forum posters tell you to install qBlock Omega or whatever. Maybe Mozilla doesn't want to get in the middle of this?

FeepingCreature 29 minutes ago | parent | prev | next [-]

"Random" is a funny thing to call an extension that you have deliberately installed.

I also don't want "random" programs accessing my home folder. That would be terrible! Who knows what programs that could be! I do however want the very specific programs that I have intentionally installed to be able to access my home folder easily. Same for extensions.

The goal here isn't really to protect me from extensions. Extensions don't do anything on their own, they just sit there and wait for me to install them. So the goal is apparently to protect me from me (installing an extension), which really is to say protect their business (ads) from me (blocking them).

ajb 2 hours ago | parent | prev | next [-]

... the greatest danger to us is masterless men; lacking a coercive power to tie their hands, they would destroy society. How else but by binding to lord and master can they be held to the laws? So thought men during feudal times.

In fact, it is possible for people to be held to good conduct without being bound into a single hierarchy, and it should be possible for software to be held to good conduct without giving such power to single monopolists. But it's not in Google's interests to build such mechanisms, any more than it was in the interests of the feudal overlords to look for alternatives to their rule.

matheusmoreira 19 minutes ago | parent [-]

I'm supposed to be the master, actually. It's my computer, any foreign code is essentially a subject in my digital domain. It should be literally impossible for them to do something I don't want them to do. As the god of my little digital realm, I should have maximum power and freedom. Foreign developers should have the minimum set of permissions, ideally none.

The fact someone gave developers a turing complete language inside the browser where random code is automatically downloaded and executed is a major reason why we even have uBlock Origin in the first place. The vast majority of developers heavily abuse this privilege and cannot be trusted, and that is why we block them with extreme prejudice.

radley 6 hours ago | parent | prev | next [-]

> I want my browser to prevent random extensions...

Why are you installing random extensions?

lxgr 5 hours ago | parent | next [-]

Not GP, but sometimes I want my browser to do pretty random/niche things without that compromising all of my browsing data.

inigyou 4 hours ago | parent [-]

How can the browser tell the difference between a random thing you want and a random thing you don't want?

matheusmoreira 5 hours ago | parent | prev [-]

I'm not. The only extension I trust enough to install is uBlock Origin.

FeepingCreature 24 minutes ago | parent [-]

Well great! You are already protected from random extensions then.

behringer 2 hours ago | parent | prev | next [-]

Of course the reasons weren't unreasonable, that's what made them great excuses for specifically blocking ublock origin.

matheusmoreira 6 minutes ago | parent [-]

They don't specifically block uBlock Origin though. I have no doubt they intended it to, and that's literally my only objection to Manifest V3: it's good but it hurts uBlock Origin therefore I don't accept it.

The right thing is to simply bypass all of that. The fact is uBlock Origin should be literallly built into the browser like the good old popup blockers once were.

If only we had a browser that was independent of ad money.

colordrops 4 hours ago | parent | prev | next [-]

Don't defend them then. Do you believe the same should be true of your operating system? If not, then it shouldn't be true of the browser either.

matheusmoreira 35 minutes ago | parent [-]

> Do you believe the same should be true of your operating system?

Yes, and I have actually started virtualizing everything inside my computer because of that belief. I don't want random software touching my trusted host.

"Random software" is currently defined as anything outside the official repositories of my Linux distribution of choice. I don't want to share a home directory with such things. I don't want to share a user and its permissions, I don't even want to share a kernel with them.

FeepingCreature 23 minutes ago | parent [-]

There's a difference between you virtualizing programs and your OS vendor virtualizing programs for you without giving you an opt-out. Cough snaps cough.

doctorpangloss 5 hours ago | parent | prev | next [-]

Nothing stops people from using a fork with manifest v2 support restored. In fact "VibeChrome" would probably be a successful product.

inigyou 4 hours ago | parent [-]

First you'd get sued because chrome is a Google trademark

cma 6 hours ago | parent | prev [-]

The Google Toolbar for Internet Explorer let users search Google directly from any webpage, block pop-up ads, autofill web forms, and highlight search terms. It also displayed PageRank metrics, translated foreign languages, checked spelling, and managed web bookmarks.

matheusmoreira 5 hours ago | parent [-]

Imagine the massive amount of data they must have harvested through it.