Hacker News Reader

Comment by ekianjo | Hacker News Reader

Isnt Firefox trying to copy EXACTLY what Chrome is doing with extensions?

No, there are some meaningful differences in the Manifest v3 implementation in Firefox: https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi...

One such difference (and not the least) is:

> Mozilla will maintain support for blocking WebRequest in MV3. To maximize compatibility with other browsers, we will also ship support for declarativeNetRequest.

Google's marketing is sooo good.

Instead of giving Mozilla the benefit of the doubt, many people are instead instantly complaining that Firefox is not better and it's worth sticking with Chrome anyways.

Chrome has not been supporting proper content blocking for years. E.g. Chrome will not wait for content blockers to initialize before sending out requests, so the first website that opens when you start Chrome is probably not content blocked.

https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...

I'm pretty sure this is fixed with the new API for blocking network requests MV3 added. This list of rules is persisted between browser sessions.

Can you elaborate? Firefox had extensions before Chrome existed. Firefox has always been the most versatile and secure way to browse the web. The only reason Chrome is even in the discussion is because Google abused its monopoly to push it on people. And yes a lot of people will say it's faster, all that speed lead you straight into the claws of Google doing whatever they want with you.

Firefox has dropped its own extensions to follow Chromes extension model for a long time now

the issue was more of a security / architecture than just following chrome. xul needed to change and webextensions was already open and tested.

that said, i still miss a couple of xul extensions

> more of a security / architecture than just following chrome

They could have gone for something entirely different but instead they decided to blindly copy Chrome.

> Firefox has always been the most versatile and secure way to browse the web.

Currently, a Chrome full-chain is notably harder than a Firefox full-chain, with the former being at "state actor ITW" level, and the latter being at "your friends started a never-heard of consultancy and they decided to do the classical trick - pwning Firefox at Pwn2Own" level.

Yeah but if Google keeps removing the ability to block content then Firefox will be more secure simply by filtering dynamic content from unknown domains. Drive by attacks are the most common way to spread malware, this is exactly what extensions like noscript prevent.

This isn't the first time Chrome has crippled user ability to filter content on a deep level.

So it doesn't matter how much hardening Chrome has if it allows for drive by download attacks from unknown domains.

Sure, I just hope people move to contribute hardening features to Firefox, and the first step would be singing out loud that Firefox is not the most secure browser right now.

Oh, and I suffer from using NoScript (currently on Chrome, unfortunately) every day, I very much want to have a secure enough browser to not giving me decisions like "do you want to whitelist cdn.jsdelivr.com [1] or click four times for each page you read".

[1] It distributes arbitrary shit on github, so good luck whitelisting this "known" domain.

I don't think these are especially relevant to the threat models of average users. Security for most people means not getting malware from random sites and not having all their data given away, and noone is blowing an 0day sandbox escape on an average internet user.

Adblocking extensions go a very long way in terms of keeping average users safe. If you're a potential target of sophisticated actors (of any level of sophistication above script kiddie) then you're not really the target audience of generic browser advice.

Indeed. Consider my view points biased cause my threat model does contain being popped by North Korean hackers. And I can't use the Internet without a functioning ad blocker so :(

Firefox is also supporting Manifest V3, like Chrome, but Firefox is not removing support for Manifest V2, unlike Chrome.

How long is that going to last?

They're not making Manifest V3 mandatory. They're implementing it, sure, but that makes sense to ensure compatibility with Chrome extensions.

Firefox is supporting Manifest V3 but with extra APIs which are needed by adblockers like uBlock Origin.

Yes, except for the parts that stops adblockers.

Reply on news.ycombinator.com