Hacker News Reader

> On the other hand, the manifest v3 will not prevent extensions from being slow, or doing bad things. Extensions will still be able to use content-scripts, inject arbitrary content in pages or send any private data home. WebRequest listeners will also still be accessible (only not in blocking mode) which can allow any data collection.

I can choose to not install extensions that do these things, while using ones that only have a manifest list…

View on HN

I agree with you, and that's why I would like to see this declarative API being an addition to the current WebRequest API. This way there could be extensions using it exclusively and users could decide to pick these if they offer sufficient privacy protection for their taste. On the other hand, you would still have the option of installing more powerful extensions using the dynamic APIs (allowing things which will never be possible with the declarative API).

Yup, I’m not saying that the old API should be killed; it’s just that it’s convenient to have the new one and be able to “trust” the extension to not be able to slow down my browsing, steal information from the page, etc. but also be able to fall back to something I do trust for what gets through if necessary.

Reply on news.ycombinator.com