The transition to the Manifest V3 framework means extensions like uBlock Origin can’t use remotely hosted code. According to Google, it “presents security risks by allowing unreviewed code to be executed in extensions.” The new policy changes will only allow an extension to execute JavaScript as part of its package.
Is this a badly worded paragraph, but is uBlock Origin really using remotely hosted code? I thought it was a different restriction in manifest V3 that stops as blockers being effective.
Is this a badly worded paragraph, but is uBlock Origin really using remotely hosted code? I thought it was a different restriction in manifest V3 that stops as blockers being effective.
I think it kinda is badly worded, and it refers to code/data that is dynamically loaded by an extension, after it’s installed by the user, which uBlock Origin does use for filter lists. They can’t be bundled with the extension, because they get out of date really quickly and often need to get updated, so uBlock Origin just downloads a new blocklist and saves it in its cache. MV3 wants to prohibit this, making adblockers almost useless. Updating the extension every time there is an update to one of uBlock’s many blocklists just isn’t feasible. I think they can also hold back updates to the extension in the Chrome Web Store, which they might to if a blocklist starts to include something Google doesn’t like (e.g. YouTube ads). All of this is just a shitshow and people should switch to better browsers with actual API compatibility for purposes like adblocking. The best examples are Firefox and LibreWolf.
I think Google might just be calling block lists “externally hosted code”. As I understand it, there are several restrictions: the severe limitation on the number of rules, the requirement to bundle rules with the addon (and the associated delay due to extension store review), and the loss of many advanced rule types that change blocking behavior based on different factors in order to avoid detection and otherwise be effective.
Is this a badly worded paragraph, but is uBlock Origin really using remotely hosted code? I thought it was a different restriction in manifest V3 that stops as blockers being effective.
I think it kinda is badly worded, and it refers to code/data that is dynamically loaded by an extension, after it’s installed by the user, which uBlock Origin does use for filter lists. They can’t be bundled with the extension, because they get out of date really quickly and often need to get updated, so uBlock Origin just downloads a new blocklist and saves it in its cache. MV3 wants to prohibit this, making adblockers almost useless. Updating the extension every time there is an update to one of uBlock’s many blocklists just isn’t feasible. I think they can also hold back updates to the extension in the Chrome Web Store, which they might to if a blocklist starts to include something Google doesn’t like (e.g. YouTube ads). All of this is just a shitshow and people should switch to better browsers with actual API compatibility for purposes like adblocking. The best examples are Firefox and LibreWolf.
I think Google might just be calling block lists “externally hosted code”. As I understand it, there are several restrictions: the severe limitation on the number of rules, the requirement to bundle rules with the addon (and the associated delay due to extension store review), and the loss of many advanced rule types that change blocking behavior based on different factors in order to avoid detection and otherwise be effective.
The ublock FAQ has some interesting details too: https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-asked-questions-(FAQ)#filtering-capabilities-which-cant-be-ported-to-mv3