Comment by mappu | Hacker News Reader

Comment by mappu | Hacker News Reader

Parent Full thread

The scary part is gorhill is able to sell or hand over the extension - as he has done in the past - to someone with looser morals and/or goals.

How much do you think NSO Group would pay for this kind of access?

If you ran uBlock Origin, would you like to retire early?

Jbk from the VLC project has a lot of stories about turning down 6, 7 figure payments to bundle malware in VLC. Not everyone has the strong morals and unlimited stamina to withstand that.

Manifest V3 is created to solve a real problem. I have had browser extensions go rogue on me before (Stylish), and i would like it to not happen again. At the same time, uBlock Origin is a hugely important extension for making the web usable for hundreds of millions of people. A compromise must be found that moves their safety out of a single person's hands.

It's a good point. Probably best to build it into the browser and let me add my own lists for it to use. That would be a good move for Firefox, they could have it off by default but it would help to reduce the chance of a compromised extension have too much access.

This is almost exactly what Manifest V3 is - it reduces the extension to just be a list manager for a built-in blocker.

The only real complaint is that Chrome did not anticipate how large these lists need to be in 2021, and the limits are too low.

Another problem is that it's static; my understanding is the extension creator needs to make a new list, get it approved by Google, put it in the repository, and get the user to download the update, before a new ad is blocked. Probably requires a restart of the browser, also.

Not sure if it removes the ability for the user to on-the-fly add any blocking, but I suspect it does.

New rules can be added at runtime - https://developer.chrome.com/docs/extensions/reference/decla...

has gorhill really sold an extension to someone in the past?

"sell or hand over the extension", he handed over the original uBlock to someone who immediately tried to monetize it.

He sold/handed over 'uBlock'. The new owner was malicious. Gorhill learned from his mistakes, started uBlock origin and decided he'll rather let an extension die than hand it over the next time.

wait, Stylish went rogue?

Yes. See https://robertheaton.com/2018/08/16/stylish-is-back-and-you-...

Use Stylus (https://addons.mozilla.org/en-US/firefox/addon/styl-us/) instead.

Reply on news.ycombinator.com