Ad blockers struggle under Chrome's new rules
- Reference: 1662632887
- News link: https://www.theregister.co.uk/2022/09/08/ad_blockers_chrome_manifest_v3/
- Source link:
And so far, when these extensions are rewritten to work with Chrome's new Manifest v3 (MV3) API, you tend to end up with hobbled software that doesn't work as well.
Google began working on a revised API for Chromium browser extensions in 2018 to deal with what it characterized as the security, privacy, and performance consequences of its MV2 extension architecture. In Google's mind, ad blockers and similar extensions, under the MV2 regime, have too much control over and access to the pages you've got open in the browser. If one of these add-ons turns rogue, it can harvest all kinds of sensitive data about you from these pages as you visit them.
[1]
Its successor spec, MV3, got rid of powerful but potentially exploitable capabilities, such as the ability to intercept and rewrite requests for pages – a useful weapon for extensions that seek to preserve your privacy and security by blocking requests to undesirable stuff, such as trackers, malware, and ads.
[2]
[3]
Developers maintaining or creating privacy and content blocking extensions found they would have to rethink how their code might work under the new rules and API, if it would at all. Since MV3 began to take shape – it remains a moving target – privacy-focused developers and advocacy groups [4]have warned that Google's ostensible effort to promote privacy (by limiting data access and enforcing permissions) will end up harming extensions that promote privacy.
Now, two recent experiments by makers of popular content blocking extensions have confirmed that MV3 represents a regression rather than an advance in terms of what browser extensions can do.
[5]
Raymond Hill, the creator of [6]uBlock Origin , among the most well-regarded privacy extensions available, on Tuesday published source code for an experimental version that relies on MV3. In what may be taken as a sign of his expectations, he calls the variant " [7]uBO Minus. "
Makers of ad blockers and browser privacy extensions fear the end is near [8]FULL STORY
uBO Minus relies on the declarativeNetRequest API in MV3 to block content. This [9]function replaces the webRequest API from MV2, which allows a JavaScript event handler to modify network requests and has been the primary mechanism for intercepting unwanted network content.
As Hill explains in his commit text, his extension uses declarativeNetRequest to conform with Google's stated goal for MV3 to not require the broad "read/modify data" permission. This approach avoids presenting the extension user with an installation warning that the installed code can "Read and change all your data on all websites" – which may sound scary but is generally what you want when using an add-on that cleans up all the webpages you visit.
But this "permission-less" approach means the extension cannot carry out operations supported by uBlock Origin, such as custom JavaScript injection or filtering of redirects, CSP (content security policy) directives, URL parameters, and cosmetic page elements.
Hill's conclusion is that adhering to the ad giant's vision makes for a subpar content-blocking extension. He wrote, "At this point I consider being permission-less the limiting factor: if broad 'read/modify data' permission is to be used, than there is not much point for an MV3 version over MV2, just use the MV2 version if you want to benefit all the features which can't be implemented without broad 'read/modify data' permission."
Google: We're not killing ad blockers. Translation: We made them too powerful, we'll cram this genie back in its bottle [10]CONTEXT
That advice won't be viable as of January, when Manifest v2-based extensions will stop working in Chrome. That's likely to be the case for those using Apple Safari and Microsoft Edge, both of which endorsed Manifest v3 for their browsers. Outliers like Brave and [11]Mozilla have said they plan to continue support for MV2, though some resources will be required to do so. Brave, for example, will need to launch [12]its own extension store because the Chrome Web Store won't be an option.
[13]Dmitriy Seregin from AdGuard offered a slightly more optimistic take in his description of his firm's effort to [14]create AdGuard AdBlocker MV3 Experimental.
[15]
While MV3 forced extension makers to rely on declarative rules (set in advance) rather than dynamic ones (generated on the fly), Seregin nonetheless suggests AdGuard will manage.
"Although the experimental extension is not as effective as its predecessor, most users won't feel the difference," said Seregin in [16]a blog post just over a week ago. "The only thing you might notice is ad flickering due to the lag in the application of cosmetic rules."
The future of content blocking in web browsers looks a lot like the way it was described by Alexei Miagkov and Bennet Cyphers from the EFF last December. They [17]wrote , "Under Manifest V2, extensions are treated like first-class applications with their own persistent execution environment. But under V3, they are treated like accessories, given limited privileges and only allowed to execute reactively." ®
Get our [18]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YxoRmlzD-6dkP@N84DeNTAAAAEI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YxoRmlzD-6dkP@N84DeNTAAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YxoRmlzD-6dkP@N84DeNTAAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2022/06/08/google_blocking_privacy_manifest/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YxoRmlzD-6dkP@N84DeNTAAAAEI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en
[7] https://github.com/gorhill/uBlock/commit/a559f5f2715c58fea4de09330cf3d06194ccc897
[8] https://www.theregister.com/2022/06/08/google_blocking_privacy_manifest/
[9] https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/
[10] https://www.theregister.com/2019/06/13/google_chrome_ad_blockers/
[11] https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/
[12] https://github.com/brave/brave-browser/issues/20059#issuecomment-992720832
[13] https://adguard.com/en/blog/author/dmitriy.html
[14] https://agrd.io/adguard_mv3
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YxoRmlzD-6dkP@N84DeNTAAAAEI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://adguard.com/en/blog/adguard-mv3.html
[17] https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation
[18] https://whitepapers.theregister.com/
No. It isn't.
Brave is the answer. Always has been the answer.
Why aren't you using it? That's the question.
I'm not using Brave because of their cryptocurrency bollocks.
It's not forced down your neck, you can say no to it.
*throws Vivaldi into the ring*
what else?
Is Vivaldy good yet?
Given its startup time and memory requirement, I used to call it Wagner. Has Vivaldi improved recently?
Re: Is Vivaldy good yet?
A bit - but it's still slow when inserting usernames and passwords from it's cache.
Re: Is Vivaldy good yet?
It's nice to have a translate function that doesn't go via Google, though, and built in adblocking.
You could not be more wrong.
Librewolf.
where is the mic drop icon?
I had not heard of Librewolf, so I will check it out. Thanks for the recommendation! That said, my experience with hipster niche browsers (e.g. Palemoon or Waterfox) is that they don't seem to offer that much of an improvement over stock Firefox, so why bother maintaining the additional browser on my PC? Looking at the Librewolf's list of enhancements, most of those are things I already do:
* Disable telemetry
* Use DDG
* uBlock Origin
* Block autoplay
Etc.
It seems like most of what they're doing is taking stock Firefox and cranking up the privacy and blocking settings, and there's nothing wrong with that. It seems like the developers could solve most of the problem by distributing a custom configuration file, though.
Security & Privacy
I think the question here is "What they are trying to protect?"
Clearly it is not the security or privacy of the user........
Re: Security & Privacy
Of course is the security and privacy of Google's revenues.
That what happens when a software application becomes an enabling product of the real business. Chrome is not there to let user navigate the web - is there to let Google profile and track users - and present the information Google is paid to display them. So what user think or need becomes irrelevant, after all they don't pay for the product, advertiser do.
People have been brainwashed into thinking open source is for their own good - but most of the time it is not. Sure, someone could fork and keep the old API and store alive - but where the resources would come from?
Maybe Brave could achieve it, but it wont' be easy.
Re: Security & Privacy
"People have been brainwashed into thinking open source is for their own good - but most of the time it is not. Sure, someone could fork and keep the old API and store alive - but where the resources would come from?"
I would definitely not say that MOST of the time open source is not for peoples own good.
There are a lot open source projects such as Linux, Libreoffice, Apache, Blender, Firefox, GIMP, VLC etc that respect peoples privacy and are often as good as proprietary closed source software.
Imagine we were all still reliant browsers such as Internet Explorer or original Edge, then you wouldn't have much choice if it were Microsoft that made this change as you can't fork them since they closed source.
FYI im not defending Google i personally use Firefox and open fire up Chrome for badly written website that break in FF.
Re: Security & Privacy
When talking about security and privacy, one has to always ask for whom and from whom . In this instance, it's the "from whom" which differs:
uBlock & co. are trying to protect users from malicious websites.
Google are trying to protect users from malicious browser extensions.
"Outliers like Brave and Mozilla have said they plan to continue support for MV2, though some resources will be required to do so."
It's almost like the part of the FOSS community that isn't Google needs to create a "primary" fork of Chrome that everybody but Google can use going forward, instead of relying on Google's good graces (which, eh, ain't always that "good").
Konquerror
What I don't understand is that all this "Chrome" thing started with the http engine of Konquerror. Later used by Apple as WebKit for their Safari http engine .... but then, why don't other browsers use the original Konquerror http engine ? Or a pre-google version of it ? Why rely on google for anything web related ? It's like the fox guarding the hen-house.
Re: Konquerror
I'd love it if the teams around Brave, Vivaldi and Opera - plus maybe the smaller uncommercial FOSS developers - would fork Chromium and rename the forked Blink engine something like "Rekonquered"
Advertising weary?
People don't want to pay for apps or websites (including ElReg) so the only way to get that revenue to pay for the app/website is via advertising. Then these same people want to block those adverts but still want the app/website to be "free". Well, time to wake up people. FREE is a marketing con. There is no such thing as FREE. You pay one way or the other. I don't blame Google at all for wanting to kill off Ad Blockers as they are devaluing their main source of income. Personally I tolerate apps and websites that have reasonable levels of advertising (like ElReg), and avoid the ones that seem to feel that they have to ram their adverts down your throat.
Re: Advertising weary?
The problem are not ads. The problem is the tracking and profiling. If ads comes without tracking and profiling, I have no reason not to display them.
Re: Advertising weary?
Disclaimer: I am old enough to remember the internet Pre-Advertising.
Sites used to advertise by having footers & headers which contained static images hosted on the server, these contained one or more adverts for companies which paid the company showing the adverts directly. These also tend to be unblockable by adblock because they look like any other image.
The biggest grumble about adverts is that they are not hosted by the same site and often contain video & sound AND MALWARE!!!
On a news site I want to read the news not watch a badly produced video of it. The Register is white-listed in adblock but I still don't see adverts due to Pi-Hole which is blocking google, etc....
tl;dr run your own adverts and get revenue, use an ad agency and get blocked.
Re: Advertising weary?
" footers & headers which contained static images hosted on the server "
The problem is that it's the brokers who make the real money once ad space is dynamically auctioned. Several researchers have found that the party that makes most out of this is the ad broker, and one research paper on this came to the conclusion that personalised adverts were quite ineffective as those who responded to them had a high likelihood of making the purchase anyway in the absence of the advert. But the ad brokers have got businesses hooked in just the same way as they struggle to get to page one of Goooooooooogle. The gigantic con works simply because nobody dare take the risk of dropping off the hamster wheel in case they lose business.
Re: Advertising weary?
Two forums I use
Forum 1 offers a £12 PA option with no ads, so I paid £12, even though I was running U Block origin.
Forum 2 Has ads, relevent ads I have bought from as the companies advertising are directly relevant. Hosted on the forum.
News sites, one I use has no adverst, the others I admit I use blockerss, but only read one or two articles so not worth subscribing. One particular site can afford to pay a relative well so no money issues there.
Re: Advertising weary?
reasonable levels of advertising
I have actually bought a couple expensive and several not-so-expensive items from YouTube ads.
Not the random YouTube ads that intrude into the video (those are blocked) but the sponsored portions of the video.
The sponsors are usually very related to the subject of the video and are thus actually relevant to my interests.
So advertising does work, to some extent, but they have to put in a bit more effort than just flinging $XX,000s at Google or Amazon whoever.
And tracking is RIGHT out and gets blocked.
Re: Advertising weary?
I prefer to pay in my own sweat and blood, supporting my community of likeminded individuals. In the wider world this is known as charities, in software land it is known as F/LOSS.
Re: Advertising weary?
"Personally I tolerate apps and websites that have reasonable levels of advertising (like ElReg)"
Personally, I don't. I have a no-holds-barred approach to blocking advertising (Pi-Hole, Blokada, and uBlock Origin are my weapons of choice) because most ads these days are insanely intrusive (I find El Reg's liberal spraying of advertising on the side banners to be unbearable), and then there's are the tracking and malware issues brought up already by other posters. I think paywalls are a perfectly valid approach to preventing "freeloading" by ad blockers, and if a site wants to use ad-blocker blockers, that's also fine by me in terms of me going elsewhere. Advertising has become so prevalent, pervasive, and pernicious, however, that for the sake of my own sanity and for the well-being of my various computers, I do my best to avoid consuming it as much as possible.
And don't even get me started on auto-play video ads, especially on mobile.
Easy as solution
Don't use Chrome, it is the stuff of nightmares.
Use Firefox and avoid the insanity of Google's sticky fingers with DuckDuckGo as your default search engine.
Next problem?
Re: Easy as solution
I have to ask how deep Google's sticky fingers stick in Firefox though.
Re: Easy as solution
DuckDuckGo is rubbish. It uses Google underneath so it’s results are basically crap
In fact, it’s worse than that - at least Google is fairly good at localised results (or used to be). DDG doesn’t know what a localised result is
I don’t understand why DDG is promoted as much as it is. It’s a crap search engine
Re: Easy as solution
Agree with you on DDG's lack of localised results. It's too US-focused.
By the way, DDG is based on Bing and Yandex. Startpage is the one the regurgitates Google's results.
If you want a completely independent yet capable search engine I'd recommend Brave Search. It's giving relevant and localised results and even has the same !bangs as DDG (!d for a DDG search, !s for a Startpage search...)
Re: Easy as solution
you make your choice:
1. an efficient and easy search with bells and whistles which profiles and tracks everything you do. everything.
2. a less efficient engine that is privacy focussed.
DDG may not be perfect but it is better than most. Brave Search is similar.
Google keeps saying this is necessary to reign in the potential damage that malicious extensions could do, but it's their extension store. Moderate it, jackasses.
Pihole, all the way
Simply use Pihole. This combined with Wireguard VPN for DNS can also ensure your mobile browsing is ad- and tracker-free.
Re: Pihole, all the way
That is only helpful for people who are aware of the issues.
For the average user, they have no idea and just click the big button to accept all cookies. Add blockers and such like are an irrelevance.
At least some antivirus/anti-malware products now have some blocking built in and will stop inadvertent access to the worst sites.
Dumb thinking
" the ability to intercept and rewrite requests for pages – a useful weapon for extensions that seek to preserve your privacy and security by blocking requests to undesirable stuff "
What a silly way to block requests for anything. Why not just not issue the requests? Rewriting requests can be abused, but doing nothing can't.
Re: Dumb thinking
If the request just fails, the website will keep trying. They have to edit the request to return a null value so the request "succeeds" but doesn't contain anything.
Re: Dumb thinking
" If the request just fails, the website will keep trying. "
Presumably, it's actually the browser that initiates the request on the basis of some statement in the content it's already acquired. Let's suppose it just chooses to ignore the statement. This is indeed what happens when I turn off automatic image loading in Firefox.
NSS
Company that gets a lot of its revenue from displaying adverts to users makes tools that prevent the displaying of adverts less effective.
How are people surprised by this?
I try to avoid Chrome
I have a copy inside a ZIP file on my main Mac and Windows machines. (I noticed that somehow copies not in ZIP files updated themselves, and wondered what else they were doing) I take Chrome out of the ZIP if, and only if, a site gives significant trouble with Firefox, Safari, and Brave. I use Chrome long enough to locate the Contacts line on the site (if present, some sites don’t have one) and to fire off a note, requesting that they support browsers other than Chrome, as I won’t be coming back unless they do. I then shut down Chrome, put it back into a ZIP, and drive on. To date more than 90% of Chrome-only sites have ignored me, so I don’t do business with them. I’m in charge of IT around here, and Chrome use requires special permission from me, so no-one at the company goes to those sites either. Some individuals and departments have complained; I say that Chrome represents a security problem, and that they can use it if they sign a form stating that they take responsibility for any problem that may result. Strangely enough, no-one’s signed. Imagine that.
I find it amazing that some companies apparently are incapable of building sites accessible to non-Chromium browsers. Did they learn nothing from the Great MSIE 6 Debacle? When our company builds a site, you better believe that we make sure that it works properly with Firefox, Safari… and Chrome, and Chromium in general, even Edge. (Site builders are among the few who have Chrome live on their machines, which are locked off from the rest of the network. It’s not paranoid when they are out to get you.) We also test for various screen sizes, down to smaller cell phones. We _want_ people to be able to access the site, on whatever system they have. We are not going to try to dictate to our customers what they must use in order to give us money. Doing that may work in the short term, but long term users will be annoyed and will go elsewhere as soon as they find a source more to their liking.
I use Firefox or Safari on my personal machines.
Consequences
"...to deal with what it characterized as the security, privacy, and performance consequences."
Ah yes, Google were upset that people were using extensions to improve their OWN security, privacy and performance - at the expense of Big G's data siphoning, presumably.
Firefox it is then.