Here comes the Google Chrome change that worried ad blocker creators

[numike]

With the next version of Chrome, Google is moving ahead with a plan to improve privacy and security by reining in some abilities of extensions used to customize the browser. The move had angered some developers who expected earlier it would cripple ad blockers.

Manifest v3, the programming interface behind Google's security plans, will arrive with Chrome 88 in mid-January, Google said Wednesday at the Chrome Dev Summit. Extensions using the earlier Manifest v2 will still work for at least a year.

Extensions can change Chrome's behavior through abilities that Manifest v3 exposes. Among other things, Manifest v3 limits the number of "rules" that extensions may apply to a web page as it loads. Rules are used, for example, to check if a website element comes from an advertiser's server and should therefore be blocked. Google announced the changes two years ago.

Reducing the number of rules allowed angered creators of extensions like the uBlock Origin ad blocker and the Ghostery tracking blocker. They said the rules limits will stop their extensions from running their full lists of actions to screen ads or block tracking. That could let websites bypass extensions -- and the preferences of people who installed them.

Google has defended its technology and argues that granting extensions too much freedom invites abuse. The search giant says it's listened to developers and modified Manifest v3 in response. For example, it loosened the originally proposed rule limit and added a new mechanism for applying some rules. Eyeo, the developer of one of the widely used Adblock Plus extension, said Tuesday it's content with Google's Manifest V3 approach.

The changes underscore how difficult it can be for Google to balance giving developers powerful tools and the need to thwart abuse. The balance is particularly difficult to strike given that Chrome is one of the tech industry's biggest platforms. More than a billion people use the browser, Google has said, and it accounts for about 64% of web usage, according to analytics firm StatCounter.

A Chrome change that freaked out ad blocker developers arrives in January

Google says it's addressed concerns some Chrome extension developers had with its Manifest v3 technology.

www.cnet.com

 

[ForgottenSeer 85179]

I hope Edge get this too soon.

 

[silversurfer]

We can using DNS services (Adguard, NextDNS, etc.) to block ads, but cosmetic filtering doesn't work on DNS level, finally looks like bad news for people to block/hide "Cookie Warnings" or something similar... we will see what happens on other chromium-based browsers like Brave, Opera, Vivaldi.

 

[oldschool]

During the Chrome Dev Summit, Google has formally included Manifest V3 in Chrome 88 Beta, allowing extension developers to test the changes to ad blocking, performance, and privacy. Nearly two years ago, Google first took the wraps off of the next major revision of Chrome’s extension manifest, a specification for what Chrome extensions can do and how they can do it. Being the third version, it’s been dubbed “Manifest V3,” and it’s the first major revision to the spec since Manifest V2 launched in 2012.

When first proposed, Manifest V3 was a source of significant controversy, as it aimed to deprecate the blocking capabilities of the webRequest API, used by ad blockers like uBlock Origin and Ghostery. These capabilities offered extensions in-depth information about your web traffic and in Google’s words gave extensions “access to potentially sensitive user data.”

In the time since then, the Chrome team has taken some feedback from the extension developer community about the changes included with Manifest V3. One thing Google is strongly emphasizing is that ad blockers are welcomed in the Chrome extension ecosystem, but they’ll now need to use the new declarativeNetRequest API, which is less invasive to privacy. Google has even been working with the developers of AdBlock Plus on ensuring ad blockers continue to work with Chrome’s Manifest V3.

We’ve been very pleased with the close collaboration established between Google’s Chrome Extensions Team and our own engineering team to ensure that ad-blocking extensions will still be available after Manifest V3 takes effect.
— Sofia Lindberg, Tech Lead, eyeo (Adblock Plus)

One critique of declarativeNetRequest as it existed is that it only supported a maximum of 30,000 rules, while EasyList, one of the most popular sets of ad blocking rules, has over 60,000 rules. While Chrome 88 will still only allow 30,000 rules across all extensions, Google says that limit is set to expand to 300,000 in time for Chrome 89.

Elsewhere on the privacy front, Manifest V3 also allows people to have more fine-grained control over the websites a Chrome extension is allowed to have access to. Another of Google’s core tenets of Manifest V3 is security, with the biggest change being that Chrome extensions can no longer run remote code. One advantage of this change is that it will be easier to audit the security and safety of extensions submitted to the Chrome Web Store, meaning the approval process should be much faster.

However, the flip side of that security change is that Chrome extensions like Tampermonkey that enable “user scripts” will not be able to exist in Manifest V3 as we know them today. According to Google, these extensions will need to make changes to comply with Manifest V3, and they’re specifically in talks with the developers of Tampermonkey and other extensions to find a solution to safely enable things like user scripts.

On the performance side of things, Chrome is looking to make extensions much less resource-heavy by allowing service workers to handle background tasks and event handling. Previously, this required a full “background page” to be quietly open, similar to having an extra tab open in your browser, adding to the amount of RAM Chrome uses.

All these Manifest V3 changes and more are now available to extension developers with the launch of Chrome 88 Beta, and the Chrome Web Store will begin accepting Manifest V3 extensions when Chrome 88 officially launches in January. Thankfully for those who use extensions that can’t currently be ported over, Manifest V2 extensions will continue to work for at least a year after Chrome 88 launches. In the meantime, Google will continue to take developer feedback, particularly from the public Chromium extension developers Google Group.

As Manifest V3 directly affects Chromium, other browsers that are compatible with Chrome’s extensions will also be affected by the changes of Manifest V3. For example, Microsoft has already announced that Edge will also be adopting the Manifest V3 changes.

Chrome 88 Beta brings extension Manifest V3 - 9to5Google

 

[bayasdev]

300K filters seems a reasonable limit to block most ads but I still prefer non-Chromium browsers like Firefox

 

[TairikuOkami]

finally looks like bad news for people to block/hide "Cookie Warnings" or something similar...

I imagine, that people will be forced to use multiple extensions to cover it, I sure will.

300K filters seems a reasonable limit to block most ads

But that comes with Chrome 89, Chrome 88 will have only 30K, I guess they want to test, if it is really going to be so bad. Those few weeks will be harsh for some.

 

[bayasdev]

Those few weeks will be harsh for some.

Mozilla seeing the user count suddenly increasing

 

[plat]

It's like Chrome wants to brainwash you into believing it's doing you a bigger favor than your pre-existing ad-blocker. It wants to be your browsing best-buddy or something, no thanks.

Google Chrome's high-resource ad blocking spotted in the wild

Google Chrome has now actively started targeting ads that drain device resources like network data, processing power or RAM.

www.bleepingcomputer.com

 

[bayasdev]

It's like Chrome wants to brainwash you into believing it's doing you a bigger favor than your pre-existing ad-blocker. It wants to be your browsing best-buddy or something, no thanks.

Google Chrome's high-resource ad blocking spotted in the wild

Google Chrome has now actively started targeting ads that drain device resources like network data, processing power or RAM.

www.bleepingcomputer.com

Acceptable Ads V2 (?)

 

[SpiderWeb]

It's gonna be interesting. I tried to reduce my filters to see how much I can live with. I can move all domain based blocking to my DNS blocker but cosmetic filtering is something I can't reduce. I can settle for 100k filters. 300k filter limit is good enough to the point where you have to ask what was the point of Manifest v3 if the limit won't affect 99.999999% of content filters?

 

[ForgottenSeer 85179]

Even 0 would be okay as Edge provide already anti-tracking. Most ads and malware can still be blocked with DNS anyway.

also a quote from Daniel Micay:

Enumerating badness doesn't work

Which means that blocking/ modifying tracking doesn't disable it.

 

[Gandalf_The_Grey]

Maybe i will be not that bad after all:

Did I read that v89 will bring in 300,000-rule limit and that the reduced blocking effectiveness will only be temporary? Also v2 is meant to be supposed for a full year (at least) after v3 hits prod, so there should be no effect on the end use?
Mrk

Chrome extension manifest v3 proposal: The death of uBlock Origin and uMatrix?

Azure, Trooper, the less people use Firefox, the more power will Chrome have. Remember IE6 days? Competition is the best thing you can have as a user. Mrk

www.wilderssecurity.com

30.000 in v88, up to 300.000 in v89
https://www.androidpolice.com/2020/...sions-spelling-real-bad-news-for-ad-blockers/
Chrome 88's Manifest V3 sets strict privacy rules for extension developers

Chrome extension manifest v3 proposal: The death of uBlock Origin and uMatrix?

Azure, Trooper, the less people use Firefox, the more power will Chrome have. Remember IE6 days? Competition is the best thing you can have as a user. Mrk

www.wilderssecurity.com

 

[Lenny_Fox]

All and all good news. Content blockers which will be adopting the new feature will probably be as fast (performance wise) as the build-in extensions of competing chromium based browsers (Edge, Brave, Vivaldi, Opera),.

Secondly Adguard offers a desktop version and Adguard is also so nice to offer its optimized filters to other adblockers. Although I wonder for how long AdGuard will provide the Easylist optimnized filters for everyone. Optimized filters will become a relative advantage for adblockers, so it seems weird AG offers these Easylist blocklist for competing content blockers (like uBO and AB+).

Also offering a DNS with adblocking capabilities might provide another advantage for AdGuard. Again AG offers this for everyone independently of their desktop and extension adblocker. Again wondering how long this service will be offered independantly from their adblocker.

 

[ErzCrz]

Watching how Chromium Edge gets affected with this. Worst case scenario I'll swap back to FF lol.

 

[Nightwalker]

All and all good news. Content blockers which will be adopting the new feature will probably be as fast (performance wise) as the build-in extensions of competing chromium based browsers (Edge, Brave, Vivaldi, Opera),.

Secondly Adguard offers a desktop version and Adguard is also so nice to offer its optimized filters to other adblockers. Although I wonder for how long AdGuard will provide the Easylist optimnized filters for everyone. Optimized filters will become a relative advantage for adblockers, so it seems weird AG offers these Easylist blocklist for competing content blockers (like uBO and AB+).

Also offering a DNS with adblocking capabilities might provide another advantage for AdGuard. Again AG offers this for everyone independently of their desktop and extension adblocker. Again wondering how long this service will be offered independantly from their adblocker.

Gorhill (author of uBlock Origin) doesnt agree with this, it is all about Google having more control, the speed and security aspects are just afterthoughts.

gorhill commented on 26 May 2019​

Update from Simeon Vincent Summary The blocking ability of the webRequest API is still deprecated, and Google Chrome's limited matching algorithm will be the only one possible, and with limits dictated by Google employees. It's annoying that they keep saying "the webRequest API is not deprecated" as if developers have been worried about this -- and as if they want to drown the real issue in a fabricated one nobody made. until we can run performance tests Web pages load slow because of bloat, not because of the blocking ability of the webRequest API -- at least for well crafted extensions. Furthermore, if performance concerns due to the blocking nature of the webRequest API was their real motive, they would just adopt Firefox's approach and give the ability to return a Promise on just the three methods which can be used in a blocking manner. Personal view on this What we see are the public statements, for public consumption, they are designed to "sell" the changes to the wider public. What we do not see is what is being said in private meetings by officers who get to decide how to optimize the business. So we have to judge not by what is said for public consumption purpose, but by what in effect is being done, or what they plan to do. This is how personally I see the deprecation of the blocking ability of the webRequest API in manifest v3: Excerpts from Google's 2018 10K filing (my emphasis): ITEM 1. | BUSINESS Google's core products and platforms such as Android, Chrome, Gmail, Google Drive, Google Maps, Google Play, Search, and YouTube each have over one billion monthly active users. [...] How we make money The goal of our advertising business is to deliver relevant ads at just the right time and to give people useful commercial information, regardless of the device they’re using. We also provide advertisers with tools that help them better attribute and measure their advertising campaigns across screens. Our advertising solutions help millions of companies grow their businesses, and we offer a wide range of products across screens and formats. We generate revenues primarily by delivering both performance advertising and brand advertising. [...] ITEM 1A. RISK FACTORS [...] Technologies have been developed to make customizable ads more difficult or to block the display of ads altogether and some providers of online services have integrated technologies that could potentially impair the core functionality of third-party digital advertising. Most of our Google revenues are derived from fees paid to us in connection with the display of ads online. As a result, such technologies and tools could adversely affect our operating results. In order for Google Chrome to reach its current user base, it had to support content blockers -- these are the top most popular extensions for any browser. Google strategy has been to find the optimal point between the two goals of growing the user base of Google Chrome and preventing content blockers from harming its business. The blocking ability of the webRequest API caused Google to yield control of content blocking to content blockers. Now that Google Chrome is the dominant browser, it is in a better position to shift the optimal point between the two goals which benefits Google's primary business. The deprecation of the blocking ability of the webRequest API is to gain back this control, and to further now instrument and report how web pages are filtered since now the exact filters which are applied to web page is information which will be collectable by Google Chrome. Side note: eyeo GmbH (owner of Adblock Plus) is a business partner of Google (through its "Acceptable Ads" business plan), and its business share some the same key characteristics as the Google's ones above: It gets revenues from the displaying of ads with those with which it has a contract (Google, Taboola, etc.) It expressly names uBlock Origin as a risk factor to its business[1] The "Acceptable Ads" plan, aside being the main revenues stream of eyeo GmbH, is also a good way for Google to mitigate against the expressed concerns in its 10K filing regarding content blockers.

Chrome extension manifest v3 proposal · Issue #338 · uBlockOrigin/uBlock-issues · GitHub

 

[ForgottenSeer 85179]

Gorhill (author of uBlock Origin) doesnt agree with this, it is all about Google having more control, the speed and security aspects are just afterthoughts.

So he set the importance of his addon over generally speed and security?
Wow.
It's also nonsense that Google gets more control. Control about what?

uBlock origin was a good extension but times change so it need to keep up with such or another solution does that.

 

[bayasdev]

Google's main business is advertising and data mining, that explains why there aren't extensions on Android and adblocking apps are banned on the Play Store. On the other hand Mozilla's business it's not advertising (aside from the sponsored news on the homepage) so they can be more flexible when it comes to supporting adblockers on their browser.

 

[Nightwalker]

EFF seems to share the same opinion as Gorhill about Manifest V3, so it isnt just about uBlock Origin.

Google’s Plans for Chrome Extensions Won’t Really Help Security

Note: Sam Jadali, the author of the DataSpii report referenced in this blog post, is an EFF Coders’ Rights client. However, the information about DataSpii in this post is based entirely on public reports.Last week we learned about DataSpii, a report by independent researcher Sam Jadali about the...

www.eff.org

 

[bayasdev]

EFF seems to share the same opinion as Gorhill about Manifest V3, so it isnt just about uBlock Origin.

Google’s Plans for Chrome Extensions Won’t Really Help Security

Note: Sam Jadali, the author of the DataSpii report referenced in this blog post, is an EFF Coders’ Rights client. However, the information about DataSpii in this post is based entirely on public reports.Last week we learned about DataSpii, a report by independent researcher Sam Jadali about the...

www.eff.org

Yep, speed improvements are just an excuse to execute their anti-adblocking campaign

 

[plat]

uBlock origin was a good extension but times change so it need to keep up with such or another solution does that.

Well, I agree in theory but respectfully disagree in practice. No monopolistic, self-enriching entity should dictate to me what I install on my property . If I want a million filters, that's my decision.

64% browser market share. Geez. But maybe many people aren't wanting to give up on that performance and other familiar and comfy Google stuff.