Re:Google postpones MV2 shutoff in Chrome stable to June 2023
by tyingq on Wednesday September 28, 2022 @09:51PM
(#33015463)
Where MV3 happily still allows you to inject arbitrary javascript into pages, it's not about privacy.
Re:Google postpones MV2 shutoff in Chrome stable to June 2023
by btown on Thursday September 29, 2022 @01:05AM
(#33016621)
“It’s not arbitrary JS, it needs to be reviewed by the Chrome Web Store team, unless it’s a userscript or we miss it in our review process!”
https://groups.google.com/a/chromium.org/g/chromium-extensio...
It’s the equivalent of an airport security policy - as I mentioned before, to reduce risk. Which, both in that analogy and here, can indeed be part of a defense-in-depth. But such a policy is not without tradeoffs, and it cannot be evaluated in a vacuum.
Re:Google postpones MV2 shutoff in Chrome stable to June 2023
by xani_ on Thursday September 29, 2022 @06:26AM
(#33018637)
I bet far more people got scammed by malicious ads than people deciding to install malicious extension.
Re:Google postpones MV2 shutoff in Chrome stable to June 2023
by hombre_fatal on Thursday September 29, 2022 @11:28AM
(#33022044)
Well, you’d need to compare the number of people pwned by ads that couldn’t be blocked by MV3-style adblocking rather than all ads.
Static rule based adblocking works just fine for me on iOS so I’m not going to assume that’s going to be a large number of people.
If you think of privacy solely as reducing the risk of an extension going rogue and leaking data - then sure, MV3 is a win.
But if you include the issue of sites sharing data, then reducing the ability of extensions to use advanced heuristics to block advertising and tracking may cause more harm than good.
There are plenty of users who understand that extensions are extremely powerful, thoroughly vet the organizations that have the capacity to update those extensions, and are also required to visit numerous less-trusted websites (and in a modern age of advertising technology, that's practically all of them) whose data sharing practices they cannot vet. MV3 will be a net negative for the privacy of those users.
Now, it may be reductive to say that those users, and that privacy threat model, matter more than others. But it is equally reductive to pretend that MV3 is a universal good.