> You can still see every request

I pointed this out in a thread yesterday too, but the whole point is that you will no longer need to grant "see all my requests" permissions to ad blockers. In fact, due to the removal of the old blocking API, if an ad blocker asks for such permissions it's highly suspicious.

I imagine ad blockers also use content scripts for things like blocking ads based on images that are known IAB sizes. In that case, they have another avenue to watch requests.

I'd give the privacy angle more credence if they were really locking down everything. They aren't, because extensions would then be of very limited use.

Why does uBlock Origin need to be able to block things dynamically?

It blocks requests based not merely on the full url, but just parts of it such as the the filename or path, or based on which tab or frame the load is for.

It's impossible to provide a list of all ads urls. Simple RegEx matching works better, but that requires a dynamic approach

Heuristics can use information like parts of the url, context of the request (origin domain for example, or "request is coming from an iframe"), existence of third-party cookies, already detected page behavior, and so on. It also allows for updating the rules on the fly. Like if I allowed something, but it turned out to be a bad idea.

And Chrome won't allow the extension block lists to include regexps/wildcards, they all have to be FQDNs?

It seems reasonable to require a static list for privacy reasons. But not supporting pattern matching rules would seem to be an explicit attempt to stop ad blockers.

> It seems reasonable to require a static list for privacy reasons.

It's rich to cite privacy reasons for not allowing the blocking of ad sites whose goal is to spy on you.

The privacy advantage is not giving extensions access to what domains you are browsing. The extension declares a static list but doesn't know what did/did not match.

Because if the extension knows what URLs you're accessing, and can send that data somewhere, that's a major privacy concern.

So this makes sense and seems good for privacy. But if it breaks uBlock Origin significantly, that seems like a very bad thing.

Ad sites know which urls I’m accessing, too. Google should prohibit those, too.

It’s a good theory, but it will still be possible to get an event for every single item that gets loaded. All they removed was the ability to block individual loads in that event. It is still entirely possible to collect that list of urls and snitch on the user.

They aren't removing the capability to monitor browsing.

The block list rules can have regexes, yes:

https://developer.chrome.com/docs/extensions/reference/decla...

I don't personally believe that solves anything. Domain names are cheap. If I don't want my ad to be blocked, I can just rotate through lots of them.

Google has responded to some pressure by upping the max number of rules and allowing some amount of dynamically defined rules.