> our new declarativeNetRequest API is designed to be a privacy-preserving method for extensions to block network requests without needing access to sensitive data
This MV3-based AdGuard extension still requires a broad permission to "read or modify host data" on all sites[2]:
"host_permissions": [
"<all_urls>"
],
So what you have now is the same required permission to "read or modify host data" as with MV2, but with a network filtering engine capabilities gated by Google (an advertising company).We can't innovate anymore the filtering capabilities of our content blocker engines as we have been constantly doing over the years.
For a recent example, there has been discussions lately with filter list maintainers of whether uBO should support AdGuard's proposed capability of being able to support pattern-matching for `domain=` filtering option[3] (uBO supports AdGuard lists).
That sort of proposition is not possible to entertain with MV3 since only Google get to decide how the filtering engine will evolve, if at all. All content blocking issues will have to be resolved with the Google-controlled filtering engine, and left unaddressed if the solution can't be shoehorned in the declarativeNetRequest API.
* * *
[1] https://blog.chromium.org/2020/12/manifest-v3-now-available-...
[2] https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
[3] https://github.com/AdguardTeam/CoreLibs/issues/1550
* * *
Edit: removed stray `[` character.
His past post[0] was reposted and generated quite a discussion on HN [1].
For further details on why uBO is conflict free, this is the README.md on github repo[2] says:
---
Free. Open source. For users by users. No donations sought.
---
0: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
The reason why I cannot do away with uBlock Origin is because its not just an Ad-blocker as its philosophy states, I need it to make websites usable by blocking elements like auto pop-up news video player, Blocking side bars to resize the websites to preferred width (When playing videos), Disable tracking and often just to load the websites faster.
[1] https://web.archive.org/web/20210924045611/https://github.co...
We'll now need to rely on Chrome team for implementing what we need. But they do it painfully slow or not do at all.
Also, where will we get the new ideas if every browser follows that path? Take Safari for example, every little improvement that we requested [1] was inspired by what we already did in other browsers long ago.
Anyways, a working content blocker on MV3 is possible. I even think a casual user won't feel much difference. But there is a big difference under the hood and to feel the consequences we have to wait a few years.
[1]: https://bugs.webkit.org/ (search for those reported by @adguard.com). Just a very small part of what we requested was implemented, content blocking is not a priority I guess, and it won't be a priority for Chrome.
To those who argue that chrome is faster and therefore you prefer using it. You should ask yourself, what is more important to you, to see a website a few ms faster or preventing Google to to dictate how the Internet of the future works (apart from the fact that in my experience browser's are so close in performance, that I don't think anyone can consistently pick which browser their on).
[1]: https://github.com/w3c/webextensions/blob/main/_minutes/2022... (CTRL-F for "mv4")
[2]: https://github.com/w3c/webextensions/blob/main/_minutes/2022... (CTRL-F for "mv4")
I haven't heard of this plan. Do you have more information?
The only option here it seems is to switch browsers.
Stop being at the whims of the Google-controlled browser monopoly --- by filtering content before it gets there.
I'd love to be proven wrong though! Right now I run DNS-based filtering because, no, it's not perfect, but I really like having network-wide blocking.
Maybe some sort of "remote browser" remote desktop or browser-in-browser type thing will work.
What's different is the classical permissions. Previously you could use the webRequest permission to execute custom JS functions in response to network activity. In MV3 you must now write a declarative rule instead using the declarativeNetRequest permission. By moving from an imperitive model to a declarative one, Google now has exacting control over what ad blockers can and can't do.
Gorhill's argument is that the stated reasons for MV3 do not align with the implementation. The example he gives is that Google claims the new API is more private. However you still need <all_urls> so the extension is as un-private as its MV2 equivalent. The only difference is that now Google controls what blocking you're allowed to declare and how much of it you're allowed to do.
There's a similar community discovery where MV3 implementation is provably counter to Google's claims of performance enhancement - MV3 extensions need to rehydrate state every 5 minutes as Chrome shuts down their service worker and for highly active extensions such as ad blockers this is actually less performant than the MV2 implementation with a long-lived background.
Basically, Google is full of shit.
Hah. The default is to reject changes from the community. I would not pin my hopes on Chromium accepting any adblocking community changes.
I've been postponing the migration of my extensions to v3 for as long as possible. One extension should be fine, but the other one... I'm afraid of what that's going to be like.
On one of the occasions I flipped from mostly Firefox to mostly Chrome/Chromium¹ was due to significant changes to add-ons – and an add-on that was one of my significant points for friction stopping me move over more was one that didn't get updated immediately².
But I think many people will blame the add-ons, and just stick around & complain instead of moving away from the source of the problem. The many dozens of us who will move, not matter how loudly we do so, simply won't be important enough in the grand scheme of things for Google to care.
----
[1] this happens every few years² as one or the other irritates me in various ways
[2] I'm currently long overdue a move towards Firefox, maybe V3 will be the final push this time around
[3] in fact, for some time IIRC, by the time a new version appeared I no longer needed it
This is so true. It is often overlooked, but the root problem of Manifest V3 is not declarativeNetRequest, but this service worker move.
Firefox and Safari implemented an alternative to them so there's a chance.
Google proposed a different solution (called "Offscreen documents") which is also not too bad, but I doubt they'll implement it by the January deadline.
Can you replace an image URL fetched remotely with an image stored in the extension itself (via rewriting the URL from a remote fetch to a file fetch)? Maybe? No, because redirection from remote URLs to file URLs trips the resource fetch security model independent of anything else, except a developer has no reason to believe that security model applies also to extensions?
Testing against the declarative model feels very wild west and since it isn't just JavaScript, I can't just slap the debugger on it and introspect all the data going back and forth.
Analytics & Ad Blocker by Globemallow.io https://globemallow.io/ was the first Manifest v3 Ad Block extension.
I first published on 06/22/2022.
Last night actually I asked if AdGuard would want to license the software, and sent them a link to my extension. They are aware they weren't the first, and made this post after knowing it.
Then look in the Manifest.json for manifest_version.
Here's the Twitter showing the timeline: https://twitter.com/GlobeMallow_io
The best part is AdGuard is still running manifest v2.
Vivaldi? Killed, Chrome clone. Edge? Killed, Chrome clone. Brave? Killed, Chrome clone. Firefox? Technically a separate engine and in theory among the last hopes, but so sclerotic it follows Chrome in almost all of its decisions. (Can MV2 be kept as a stable basic-security-maintenance-only API? Probably not) Safari? Can be gone around on desktop (my grandparents use Chrome because of Google prompts), has a stranglehold on mobile, but that has its own problems, and likely once users can ~sideload~ install software (potentially from other app stores), there will be a Chrome surge on mobile, forcing manifest V3 over there too, and the ad trackers will win the war.
Or maybe they already have? More likely, I personally am tiring of the cat and mouse game between the spyware makers and devs that fight for the users.
[1] UPDATE: https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi... PREVIOUSLY: https://blog.mozilla.org/addons/2022/06/08/manifest-v3-firef...
* In the sense that one browser implementation, and not W3C or WHATWG web standards, drives the web browser market. Chrome is much more evergreen than IE.
[1] https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi...
https://github.com/violentmonkey/violentmonkey/issues/1555
https://github.com/Tampermonkey/tampermonkey/issues/644
The only thing we have so far is a google rep stating that they'll "reaffirm that we plan to support userscript managers in Maniest V3 before the Manifest V2 deprecation"[0] back in May, which fills me with no hope at all that they won't simply be killed.
0: https://github.com/Tampermonkey/tampermonkey/issues/644#issu...
https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi...
Brave and Vivaldi have always been built on Chromium, because that was the easiest way for them to get started as new browsers. There wasn't some pre-Chromium version of either that was killed.*
Not true. Brave was initially based on Gecko https://brave.com/the-road-to-brave-one-dot-zero/
I've just switched to Firefox. I hope they don't go off the rails here, but I fear they will with bribes from Google.
Firefox still supports Manifest V2, which allows for more efficient and accurate blocking of advertising. (Among other things.)
Just look at this very thread, every other comment is just about Firefox and not the content of the post itself.
The article mentioned Safari a couple of times, I don't see why the fact that Firefox will support both V2 and V3 indefinitely doesn't deserve a single mention.
Moreover, manifest V3 was essentially a massive middle finger from Google to everyone else (except advertisers), and it feels almost dishonest to discuss it wothout mentioning that there are better options out there.
I have a feeling that Edge will become mainstream in the near future because it is the default browser on Windows (getting IE monopolistic vibes again!) and people is using and even loving it. I think both Edge and Chrome will decide the future for the web. Firefox and Brave, unfortunately, are not mainstream enough to make their decisions count.
[1] https://twitter.com/brendaneich/status/1134141335881912320
People often forget the US underwent an administrative change between the judgement and enforcement. Microsoft spent a lot of "think tank" money on influencing the new regimes enforcement mentality, not only on their own issue, but on monopolies in general.
It was, from my recollection, definitely not for show.
https://docs.microsoft.com/en-us/microsoft-edge/extensions-c...
Also, I am not entirely sure other Chromium-based browsers will be able to maintain MV2 compatibility in the long run.
> Chromium got its webRequest API at a time it was trying to gain market share against Firefox (Sep 2011), where Adblock Plus, Ghostery, Disconnect, NoScript, and other such extensions were the most or among the most popular extensions on Firefox.
So the only reason they even implemented this browser standard was to gain market share and now that they are in the dominant position they yank it, getting rid of ad blockers. Straight out of the Microsoft playbook.
Browser builders, this is your cue: if advertising is not your business, offer an ad blocker. Firefox became popular (in my personal experience) because it came with a popup blocker by default.
Yeah. Firefox should ship with uBlock Origin by default too. They're almost doing that on mobile since uBlock Origin is one of few allowed extensions.
https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
Does anyone has stats of adguard vs ublock by chance?
AdGuard are just doing this to capture the upcoming hole in the market as uBlock Origin stops working in Chrome.
Everyone should switch to Firefox.
The only bugs I find belong to websites, which I don't count against Firefox. I used to have to support IE8... if the site broke it was my responsibility, not the browser.
They announced a Brave Extensions Store years ago and there are no news as of today.
I'm actually thinking to go back to Firefox because of this.
I said we'd support uBO and uMatrix at least, and we're discussing that with their maintainers now.
You see, now extensions are supposed to do background work in an ephemeral service worker. This service worker lifetime is very short (up to 5 minutes, then it's getting killed forcibly). So it's constantly getting killed and waked back up. Waking up includes doing some initialization which consumes additional cpu cycles.
The situation will improve when Google implements the alternative to service worker (so-called "Offscreen documents"), but no one knows when exactly this will happen.
They shouldn't do this IMHO.
Manifest V3 is a horrible attempt to kill adblocking (under the banner of "security", as always). But, the web is completely unusable without adblocking.
If there are no more (effective) adblockers for Chrome, users will frantically begin to search for an alternative; there are many: Firefox and Brave to mention just two.
Giving a boost to alternative browsers can only be a good thing; and it may also, eventually, make Google rethink this policy.
Their track record speaks against them.
XPCOM extensions? Killed, but don't worry, we will re-implement all the needed APIs as WebExtensions (didn't happen).
Fennec to Fenix mobile extensions? Killed, you get these 10 blessed ones, don't worry, we will eventually re-enable all of the webextensions on mobile, any day now, (didn't happen, you have to do hacky hacks involving nightly version to do un-blessed extensions).
This will likely be their third strike.
UPDATE: Or it's not nearly as bad as I expected. Per [1], while Firefox will be eventually deprecating MV2, the Firefox MV3 is much less 'evil' than the Chrome MV3, in that Firefox will continue to enable the WebRequest API without all the lock-down restrictions.
This makes a competitive advantage for Firefox in terms of adblocking power, if anything.
In both transitions, Mozilla made sure to support the needs of both uBlock origin and NoScript, extending the webextension API (such that uBlock origin on Firefox is more capable than on current Chromium) and working with uBlock to make its interface more mobile-friendly.
They also extended the webextension API to allow for extensions such as Treestyle tabs and Panorama-reimplementations (so not remotely all XUL use-cases, but still most of the popular ones).
Hence, they've proven that they will go considerably beyond what Google/Chromium are doing, and that they won't harm "content-blockers", which is what we care about in this case.
What do you think is the future (+2 years) for people with hatred for ads? For now I am using Firefox on computer + Kiwi in Android, but I also expect those two to go awry in the mid term.
* I see that after the edit, it doesn't look as bleak for Firefox PC. But what about Android?
I harbor the (conspiracy?) theory is that Google told Mozilla based on their "No arbitrary code"-rule that they are not allowed to run arbitrary extensions anymore. And made Mozilla promise to never tell anyone.
Yep:
Unless Firefox is released from the clutches of Mozilla, Firefox will never be a serious competitor in the browser wars.
Especially on mobile Brave is a game changer.
So just Firefox and then all the Chromes?
There really aren't "many" alternatives, there isn't even /an/ alternative because Firefox suffers from Mozilla Misguidance(tm).
Presumably the same people who bitched about the IE6 monopoly brought on and fully embraced the Chrome monopoly. We now all get to sleep in the Chrome bed.
I know Google hates the same user group, but Google also likes their money (or their money-value).
Go woke, go broke. If your trying to compete uphill, shooting yourself in the foot isn't going to make it any easier.
Also, most people care much more about "it simply works", and that is Chrome. Firefox is neither preinstalled nor as compatible as Chrome (nor as fast or user friendly). There's already a lot of popups like "this site works best in Chrome".
Let's say you have a brand new computer, and want to download nVidia drivers. Fire up your brand new computer, search for "nvidia drivers" using Bing.... and the first results are all ads for extremely scummy adware. (It's also hilarious when you search for "chrome download" when Edge begs you not to, and including when you click through, but that's a story for another time :)).
Compatible against what? The web standards or Google Chrome?
User-agent sniffing[1] and it is a webdev smell. I acknowledge that this is true, but I admit being bummed that we didn't win the war to use web standards.
I got a full screen cookie consent popup, a location permission popup, and ads were everywhere on the screen. Must have been 50% of screen space for the top part of the page. It's absurd!
AdGuard is a business, and Chrome is the world's most popular web browser. They don't have much of a choice. uBlock Origin can pass because it's not a business.
More likelier scenario: Most Chrome users do not even know what an ad-blocker is, let alone difference between Manifest v3 and v2. The franatical run, if one was ever a thing, already happened when Google announced V3, long time ago. The few people (relatively speaking) that cared about it already switched browsers.
I really don't understand the push of MV3.
I don't believe they're just for security as Google claimed but at the same time I feel thinking it's "just" to ruin ad blocking is equally baffling. Could someone who is more involved elaborate the nuance of (intent of) MV3?
It really is the case that the same mechanisms that enable adblockers ("this extension may affect your traffic on every website") are also the mechanisms that enable malware in extensions, which are not at all rare.
Google makes no money off the Chrome Web Store and their initial attempts to restrict MV2 failed. The goal was for automated approval to suffice. Still, there was certain APIs that required human review.
Google could have continued restricting MV2 until they didn't need human review but they must have got the idea for MV3 at that point. They could also hamstring ad blockers and get some promo packet material.
There's been some work done on fixing this issue (https://github.com/uBlockOrigin/uBlock-issues/issues/338) but the architecture of content blocking extensions will need to change to facilitate Google's new requirements.
If web devs want to make web experiences worse in Firefox by issuing warnings everywhere, then Firefox can even the score by having a useable ad-free experience.
It sounds like it is the extension API and process manager for Chrome. In what ways would an end user or website owner notice or care about this change, other than their extensions not working? How does it change default behavior?
The upside is some poorly behaved extensions will have less impact on browser performance.
Google ads revenue 2021: 209 billion out of 256 billion, 80%
Apple ads revenue 2021: $3.7 billion of 365 billion, 1%
We further need to understand the difference between operating an ad exchange:
https://www.eff.org/deeplinks/2020/03/google-says-it-doesnt-...
And allowing first party and purchased ads for products within a marketplace the user is already visiting:
https://searchads.apple.com/help/get-started/0001-compare-ap...
They can only be validly compared once this is true of both ad services:
> [Ad service] doesn’t buy or share users’ personal information with other companies. We don’t track people by linking user or device data collected from [first party] apps with user or device data collected from third parties for advertising targeting or measurement. And we don’t share user or device data with data brokers.
https://searchads.apple.com/privacy
Not saying they’re “all good”, just “least worst”.
Scroll down in the second link to see what Apple do gather and use for targeting. Unhappily, the user consent more about personalization than about aggregation in the first place. Note also the missing word “sell” in “doesn’t buy or share”, perhaps they think sell is implied by share, but also perhaps not.
It is also possible for the above, and collusion to all simultaneously happen, and or Apple advancing their own ad business.
If you optimize the rules engine - which you can definitely do - you can skip evaluating most of those regexes, you can evaluate them in parallel, etc. You could start preparing the request and only gate the actual tcp packets on approval from the ad blocker. You could cache the approve/deny state for each URL so that the ad blocker overhead is only paid on first visit to a site. There are lots of ways to make this stuff super fast without breaking it, but Google and Apple don't want to do the work.
People like the uBlock Origin author have already demonstrated in the past that their ad blockers are fast despite the severe limitations of current browser extension APIs. If browser vendors actually supported extension developers ad blockers could probably become faster. Instead they're attacking them and forcing people to move over to intentionally sabotaged APIs with limited feature sets and arguing that now things will be "faster" even though you're going to be wasting resources downloading a bunch of ads.
It won't be more private if ads slip through, or if the whole web experience is degraded and users prefer native apps.
On WebKit, you can still use WebRequest to intercept and log all traffic, you just can't block it. I don't think that intercepting/recording all traffic and selectively blocking it would have a meaningful difference compared to just intercepting it all and letting it through.