Hacker News Reader

Comment by ameshkov | Hacker News Reader

Firefox kinda also does. In both cases side loading is rather painful experience, thanks to all the malware that is exploiting the extensions feature.

View on HN

Firefox extensions don't need to be listed in the web store, but they must be signed by Mozilla, no exceptions.

I have used both browsers, and I find sideloading in Chrome to be completely painless. I use many sideloaded extensions in Chrome (mostly because I wanted to make small edits to existing extensions).

I guess I'm trying to figure out whether all this fuss is really a limitation of Manifest v3, or merely Chrome Web Store policy. If the latter, I don't see a problem as long as sideloading is possible, and I really hope UBlock Origin will just go that route.

Sideloading is the real freedom which everyone should rally around and protect. (I am extremely unhappy with Mozilla's approach to this, if you can't tell.)

The most problematic part of MV3 (removing part of the webRequest API functionality) is a part of the platform.

This remote JS stuff is a CWS policy.

So what can the webRequest API do that couldn't just be accomplished via Javascript injection? From my perspective—admittedly not really understanding how UBlock Origin works—Javascript is basically all-powerful on a web page. Once you have that, I'm surprised that anything else could be a meaningful restriction.

(I appreciate you answering my questions!)

JS is important, but it’s only a part of what’s required. webRequest allows the extension to manipulate web requests: blocking or redirecting them. MV3 tries to replace the old webRequest with a declarative alternative and it’s almost impossible to provide a declarative rule for every possible use case.

Javascript is very powerful, but simple injected Javascript can't e.g. undo requests (from other scripts or just normal resources like third-party images) that have already happened. An injected script is not guaranteed to run before the site's own scripts, I believe.

Other than that, you can probably really do everything you could do with the webRequest API, but the complexity of doing it essentially reduces to the halting problem: You'd have to statically analyze all Javascript loaded by the page and figure out if it's going to do any requests you don't want to happen and then rewrite these parts. Maybe there's clever things you could do by shimming all web APIs that can issue HTTP or other requests, but that also doesn't sound fun.

On the other hand, with an API that just gets to veto every outgoing request, you can trivially achieve the same goal.

Another area where in-page Javascript is limited compared to an extension is the same origin policy. A very fancy ad-blocking extension could e.g. run an image classification AI on third-party image resources and hide the ones that look like visually distracting, flashing etc. ads by default – in-page Javascript can't.

Thank you! I guess the main problem is figuring out which elements are ads. Blocking certain requests is a handy way to do that, at least for as long as external ad servers are the norm.

> Simple injected Javascript can't e.g. undo requests (from other scripts or just normal resources like third-party images)

But could you detect the request, see what element it loaded in, and then hide that element? Or is that much more complicated than I'm imagining?

If you only care about visual annoyances I believe that should generally be possible (although I also don't know the details!), but many people also use content filters to stop third-party tracking.

> Firefox extensions don't need to be listed in the web store, but they must be signed by Mozilla, no exceptions.

There is. But you must be running firefox on Linux, on specific distribution (i.e. Debian or Fedora), built by that distribution and the extension has to be installed system-wide by root. Then the signature won't be enforced.

So in a sense you're not running Firefox anymore, you're running a derivative from your distro which modified the source code. (I do appreciate that they do this, however.)

On Firefox for Android all extensions must be present in the AMO store at the time of installation, no sideloading - even of signed addons.

Mozilla banned non-store extensions in their last Firefox for Android overhaul a few years ago and afaik does not plan to allow them again.

This is the reason why the anti-paywall extensions are all gone/DMCAed.

It's a massive power shift away from the user. No idea why Mozilla did that.

How do you develop extensions then? Surely it must be possible somehow.

Not impossible, at all.

The answer is Firefox Nightly or Firefox Developer, you're freely to install unsigned addons in these editions.

> Not impossible, at all. The answer is Firefox Nightly or Firefox Developer, you're freely to install unsigned addons in these editions.

I do use Firefox for Android Nightly. How would I install an unsigned addon there?

I don't think it's possible. ... but if it were, this would be very useful to get the Anti-Paywall addons back.

It's called Sideload XPI, iirc Firefox Nightly allows you to sideload XPI if you enable Experimental by tapping Firefox logo in About 7 times.

But it's easier with Ice Raven or Smart Cookie Web Preview:

- https://old.reddit.com/r/browsers/comments/18ezd3g/iceraven_...

- https://github.com/CookieJarApps/SmartCookieWeb-Preview/rele...

Opera and MS Edge for Android don't support extensions as well. So my guess is, the Playstore rules won't allow it.

Reply on news.ycombinator.com