Hacker News Reader

Comment by eikenberry | Hacker News Reader

If I remember right then the difference is more about ad-tracking/privacy than blocking. V2 allowed UBO to find and intercept the calls to the ad servers before the calls were made. Where V3+UBL still makes the calls it just doesn't display the results. So while you might not see the ads, the ads see you.

View on HN

> Where V3+UBL still makes the calls it just doesn't display the results. So while you might not see the ads, the ads see you.

That's not what the docs say [1]:

  A single rule does one of the following:

  - Block a network request.
  - Upgrade the schema (http to https).
  - Prevent a request from getting blocked by negating any matching blocked rules.
  - Redirect a network request.
  - Modify request or response headers.

Does "block" not mean block? Can you provide a source? Or am I looking at the wrong docs? I'm searching online and can't find anything that says the request is still sent.

[1] https://developer.chrome.com/docs/extensions/reference/api/d...

On the contrary, MV2 used onBeforeRequest which let extensions see what requests you were making. They could then take that data and use it for malicious purposes.

MV3 doesn’t allow extensions to know what requests are being made, so extensions can’t use your data maliciously.

Requests to ads that are blocked are blocked.

I think you’re thinking of Privacy-preserving ad measurement which is an option in Firefox and Safari. https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

but op wasn't talking about what extensions are seeing, but what the ad servers do. You haven't address their point at all

Doesn't onBeforeRequest still exist in Manifest v3? The thing that's been removed is the ability to block on it, not the ability to register handlers for requests.

It still exists, but now “ad blockers” can’t use the blocking API to record and forward metrics on hits. Ad blockers don’t even need the webRequest and webRequestBlocking permissions anymore.

Now, if an ad blocker has webRequest permissions it’s a red flag.

For example https://developer.chrome.com/docs/extensions/develop/concept... uses webRequest to send telemetry back to some remote server.

Thanks, I see how that can help.

With Manifest v3, let's say I'm an ad blocker and I want to get access to metrics not to violate privacy, but just to report them to the user (X domains blocked, Y out of Z requests blocked, etc). How would I get access to those metrics?

Separate permission for debugging only available for development essentially. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

Otherwise, you can’t really without more invasive permissions.

https://stackoverflow.com/questions/74813523/chrome-extensio...

Oh wow, that's wild. Closing the loop on reporting things is such an important part of a trustworthy user experience.

> On the contrary, MV2 used onBeforeRequest which let extensions see what requests you were making. They could then take that data and use it for malicious purposes.

Which is something we know for a fact uBlock Origin doesn't do. It's open source, you can check the code yourself. MV3, on the other hand, doesn't do much to assure me that an addon isn't phoning home. Why not just give the user to ability to block network requests on a per-addon basis? Too difficult a task for the trillion dollar company? Or could it be that forcing users to switch to MV3 addons isn't about safety at all?

Reply on news.ycombinator.com