top 81 comments

sorted by: hot top controversial new old
[–] 275 points 2 months ago (16 children)
  • [+] -114 points 2 months ago (15 children)

    Not really. UBlock Origin Lite works really well. They even added content scripts recently. From a technical perspective MV3 offers more security by default.

  • source
  • parent
  • hideshow 15 child comments
  • [–] 67 points 2 months ago (4 children)

    The following filter options can't be translated into DNR rules:

    strict1p, strict3p: whether a network request is same-origin as its initiator
    Entity-based values for domain= filter option (webextensions #394)
    redirect-rule=: the DNR API does not support redirect-if-blocked concept (webextensions #493)
    Click-to-load embedded contexts through redirect=click2load.html filter option
    Regex-based removeparam= modifier filter options
    Exceptions for all modifier filter options are not possible
        Workarounds exist for removeparam= and csp= by carefully tuning the priority property.
    Many very useful regex-based filters used in uBO are not allowed, or are rejected by the DNR API (webextensions #344)
    replace=, can't modify the response body (full support is only possible with Firefox MV2)
    ipaddress=, can't use IP address as a condition to block/unblock (full support is only possible with Firefox MV2)
    urlskip=, this requires programmatic steps to extract a URL from another URL (partial support, for strict-blocked pages only)
    

    aside from that it is somewhat better than default ublock but that's a pretty big list of issues.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 12 points 2 months ago* (1 child)

    There's also pretty restrictive length limits on filter lists iirc, so ubo lite would have to select top filters at some point. This getting worse as websites add more ads or obfuscate more requiring more rules.

  • source
  • parent
  • hideshow 1 child comment
  • [–] -2 points 2 months ago (1 child)

    Some of those limitations were never supported in Chrome to begin with. MV3 still supports webRequestBlocking at the engine level but it is gated behind enterprise policy (ExtensionInstallForcelist in the Windows Registry, macOS MDM, or Linux managed policy JSON). If an extension with webRequestBlocking is installed via policy, it restores programmatic interception.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 12 points 2 months ago*

    In practice, I found it breaks sites more, lets some things through, triggers more adblock detectors, and doesn't work as well with the annoyance list.

    It doesn't work on YouTube. And the maximum number of entries to block is limited.

    Its not catastrophic though.

    So UBO Lite is not wholly ineffective, no. It works great, mostly. Buts its definitely more of a nuisance to use, which is exactly what Google wants.

  • source
  • parent
  • [–] 4 points 2 months ago (4 children)

    No, they're intrinsically less secure.

    They generate memory issues (use-after-free, dangling pointers, double free(), zombie processes, uncomplete teardown, GC failures or abrupt stops, race conditions, etc.) because of their shitty isolation, and their poor service-workers and IPC architecture.

    What's worse, they greatly limit the network APIs needed to active defense (DNR instead of webRequest).

  • source
  • parent
  • hideshow 4 child comments
  • [–] -3 points 2 months ago (3 children)

    No, they’re intrinsically less secure.

    GrapheneOS disagrees with you:

    https://grapheneos.org/usage#web-browsing

    I agree however that Chromium has some issues still. I have personally managed to crash my browser when calling the Mojo APIs via JavaScript. However, it wasn't related to security. As GrapheneOS notes, no other browser engine provides the same levels of sandboxing. Recognizing the effectiveness of Chrome's sandbox, Microsoft began evolving Windows kernel access control to formalize and harden these techniques at the OS level. The upcoming Windows Updates implements this in its new ProcessContainer support.

    Blaming process isolation and IPC for memory bugs like Use-After-Free and dangling pointers fundamentally confuses language-level C++ problems with OS containment architecture. Memory corruption exists across all C++ engines (Gecko, WebKit, Blink); isolation is what prevents those bugs from compromising the host OS.

    Handing third-party extensions blanket permissions to inspect and modify live plaintext traffic across all tabs creates a massive MITM exfiltration surface. Moving rule matching to declarativeNetRequest enforces least privilege by executing filters in the native engine without exposing sensitive network payloads to extension code.

    webRequestBlocking is not deleted in MV3. The synchronous blocking engine still exists in Chromium. If an extension is installed via local policy or the Windows Registry (ExtensionInstallForcelist), full programmatic webRequestBlocking executes in Manifest V3 just as it did in MV2.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 2 months ago* (last edited 2 months ago) (2 children)

    Blaming process isolation and IPC for memory bugs like Use-After-Free and dangling pointers fundamentally confuses language-level C++ problems with OS containment architecture. Memory corruption exists across all C++ engines (Gecko, WebKit, Blink); isolation is what prevents those bugs from compromising the host OS.

    Yeah, but they instead greatly compromise the browser, and the problem is that these are not as likely to happen in MV2 (i.e., Firefox).

    Why? Simple:

    1. You have a long operation running inside an extension.
    2. Your system (or the browser itselfs) suspends or even kills the associated Service Worker.
    3. A new one has to be created.
    4. If the previous memory chunk goes unreferenced, then you have a double free and/or an UAF.
    5. If the previous memory chunk doesn't get unreferenced, then you get a dangling pointer.
    6. Either way you get a race condition if it's something concurrent.

    The problem is, if an attacker and/or a malicious process do compromise that unreferenced or unallocated memory, then any and all sandboxing will be esentially irrelevant and thus vulnerated, vulnerating not only the browser (something that itself can compromise sensible information), but even the OS.

    Then you have the zombie processes because the current memory model in V8 causes SWs to forcedly stop before they can do any cleanup.

    MV3 is not about security at all, is about more control over your own computer and about more control over the network (that way they can let more trackers, zero-days, ads, malvertisers and even malware to pass because browser-level blockers and firewalls won't be able to block them).

    Edit: MV3 is a perfect example of inverse tivoization.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 2 months ago* (last edited 2 months ago)

    webRequestBlocking is not deleted in MV3. The synchronous blocking engine still exists in Chromium. If an extension is installed via local policy or the Windows Registry (ExtensionInstallForcelist), full programmatic webRequestBlocking executes in Manifest V3 just as it did in MV2.

    It is in practice.

    Not all users are able to do that (local policy install), as not all users are (or have to be) that tech savvy. That's an exclusionary barrier towards inclusion and accesibility of security and sovereignity features.

  • source
  • parent
  • Handing third-party extensions blanket permissions to inspect and modify live plaintext traffic across all tabs creates a massive MITM exfiltration surface. Moving rule matching to declarativeNetRequest enforces least privilege by executing filters in the native engine without exposing sensitive network payloads to extension code.

    You're doing a false equivalence here.

    It's not about blanket permission vs. almost no permissions.

    You can have granular ACLs (which are being hindered by MV3), or OCap/CapSec, or even other security and permissions approaches.

    They're or incompetent or malevolous, these are the only two options left when you think a bit about it.

  • source
  • parent
  • [–] 0 points 2 months ago (2 children)

    That's a whole truckload of copium you're consuming there, fella. Watch out for the side effects.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 113 points 2 months ago* (last edited 2 months ago) (5 children)

    This is gonna be so bad because now there is only uBlock origin lite and "uBlock", if you couln't guess: the 2nd one is a scam that google never tried to remove(it's been up for some years IIRC) and i am sure that everyone will try to install this scam because they can't find the original uBlock origin (and everyone just refers to uBlock origin as uBlock which makes it worse)

  • source
  • hideshow 5 child comments
  • [–] 67 points 2 months ago (2 children)

    the 2nd one is a scam that google never tried to remove

    It's a little more complicated. uBlock was the original name, gorhil handed it off when he felt the maintenance burden became too high. Then he forked it to make his own uBlock Origin version.

    At some point later uBlock was bought up by the AdBlock people, who in turn were later bought by the AdBlock Plus people.

    So it's not a scam exactly, more like an inbred sideline of the royal family.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 205 points 2 months ago (9 children)
  • [–] 31 points 2 months ago (6 children)

    Just a crying shame Mozilla has turned into a commercial nightmare making them relatively poor custodians of the only free choice we have left.

    Mozilla needs to die so Firefox can live.

    The income stream from Firefox is plenty for a highly technical, deeply competent, widely dispersed team could work full time on the product using something like OpenCollective.

    Instead what we get is prime SF real estate offices, β€œcompetitive” SF salaries and a commercial organisation that seeks weird and increasingly desperate income streams to justify looking like β€œreal company”.

    I want an actual non-profit governing Firefox.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 10 points 2 months ago* (last edited 2 months ago) (5 children)

    It's called the forks, dude.

    Also, hopefully the ladybug thing or whatever gets off the ground someday.

    Edit: Servo is the better project to follow.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 8 points 2 months ago (1 child)

    But it isn’t really. The forks rely on the majority effort of Mozilla and they would never be able to maintain Firefox on their own.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 9 points 2 months ago

    This this true but if Mozilla closed it doors tomorrow there would be enough support for a team to be built to maintain it. The market share is small compared to chrome but it's still an enormous user base.

  • source
  • parent
  • [–] 14 points 2 months ago* (2 children)

    I think you mean ladybird, right?
    Just FYI The core maintainer is very close to the alt right open source sphere.
    Rejecting inclusivity as he deems it as too political and just rubbing shoulders with really weird guys.

    https://drewdevault.com/blog/Cloudflare-and-fascists/
    https://kvibber.com/reviews/software/ladybird-inclusivity/

    There is servo though which is picking up speed lately, im following their rss for a while now.
    https://servo.org/
    The money behind is also a lot more public and the project is more open to people. originally developed internally at mozilla it is now in the hands of the linux foundation europe.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 2 months ago* (last edited 2 months ago)

    Netsurf hasn't seen any love lately. It's still being developed on git but no releases. Same with Dillo.

    Dillo rejects scripting. Makes perfect sense to me. It also rejects automatic redirects, which also makes sense but the web has already been established around that as given so it can't pass the most passive anti-bot.

    The state of scripting support on Netsurf is uhm, quite interesting. Scripts can write to the page parse time (like a snowflake generator) but can't do ANYTHING after the page loaded, EXCEPT text fields and text areas. And scripts can always read but not write checkbox state. There aren't any button events, either, but if you check the state of a text field repeatedly you can do interactivity. What is also interesting is that the new way of finding elements (getElementById) is functional, but the old way (document.formName.elementName) ISN'T. So that means that basically nothing existing functions (apart from again, the snowflake generators from geocities). But you can do the old style text animations if you specifically program it to use the new method despite being old style shit. Netsurf also passes "GoAway" and the most basic setting of Anubis (the passive redirects).

    Both are good enough to browse "old Lemmy", although I haven't tried to login since my instance doesn't have it and the owner ghosted me (hi @milan@discuss.tchncs.de).


    There's also a half public domain half permissive (BSD) text mode browser, https://chawan.net/ . Extraordinarily good concept! However, it avoids some of the bloat by forcing bloat onto your terminal emulator and having it render images, and my terminal emulator does not bother itself with such tasks and emulates a terminal, so image heavy sites like Lemmy fucking suck on it. No, it cannot just weight different characters from some public domain font (spoiler: if converted, all of them by international conventions are public domain) by brightness and by individual pixel similarity to an actual image and then just display those. That would make too much sense. I have high hopes for it, though. Also, I find the keybinds really weird.

    I have not tested Chawan's scripting support much at all, all I can say is that it's certainly better than Netsurf. And that everything I've written in the worst fucking programming language ever for Netsurf (not released yet, very soon I hope) runs on Chawan. However, they are unusable since textboxes open your preferred editor. Makes perfect sense, a browser shouldn't be a text editor. But like, that breaks my gimmick that makes it work with Netsurf, damn. Checkboxes can be written to, for once, tho no access key support. The JS is still not enough to login to Lemmy (the default bloated frontend).


    Let's use Gemini.

  • source
  • parent
  • [–] 64 points 2 months ago (13 children)
  • [–] 50 points 2 months ago* (last edited 2 months ago) (2 children)

    A thin layer of chromium on the surface of a metal to make it shiny and protect from corrosion.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 24 points 2 months ago (1 child)
  • [–] 2 points 2 months ago

    I used to work in manufacturing and we made a sort of tube socket that was cadmium plated on the outside and chrome plated on the inside.

    I wonder how many people got cancer plating those things. Ironically, all of the platers were in California because it was banned for new plating centers in most other states.

  • source
  • parent
  • [–] 16 points 2 months ago (3 children)

    Isn't that the shiny stuff you hang from trees in the winter?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 10 points 2 months ago (2 children)
  • [–] 14 points 2 months ago (4 children)

    Chromium is the browser that I open a few times a year for websites that don't support Firefox. A few may be a gross over estimate.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 11 points 2 months ago (3 children)

    Fair, I just abandon the site. It's their problem not mine.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 9 points 2 months ago (1 child)

    It's really seldom, but a few years back there was a government website that only worked with chrome or edge that I had to use. I had one the other night and found a work around. It's a rare occurrence, and usually I can avoid it, but sometimes I have to just suck it up, do the deed, and bail.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 2 months ago* (last edited 2 months ago)

    I don't design web apps but I've heard from some that do that firefox occasionally has problems with them, because it relies a lot on caching (actually they used the term "aggressive caching", with a few extra choice words).

    Anyway, usually not a problem. I use edge only for work since it's the default browser and I barely do any actual browsing with it, mostly light app clients. On my own devices, it's been firefox only for years.

  • source
  • parent
  • [–] 112 points 2 months ago* (10 children)

    Given how long ago this was announced, anybody still using Chrome doesn't care.

  • source
  • hideshow 10 child comments
  • [+] 69 points 2 months ago (6 children)
  • [–] 57 points 2 months ago* (5 children)

    Yeah, pretty much this. In regards to tech, the fediverse often suffers from the average familiarity problem:

    The average user barely even knows how to check their email.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 15 points 2 months ago (3 children)

    My empathy for this view dies on shit that impacts you every single day of your life. At that point it's not a bit of information you just haven't needed yet - it's willful ignorance that I'm not giving you a pass on.

    How long do I need to watch people crap themselves before I'm allowed to demand they learn to use a toilet?

  • source
  • parent
  • hideshow 3 child comments
  • And i removed Chrome from my devices

  • source
  • [–] 48 points 2 months ago* (10 children)

    I think I'll be switching to librewolf at home. It can install mozilla extensions and comes with ublock origin baked in. Pulling a stunt like this is just going to drive people away from the Chrome environment. Corpos can't help but shoot themselves in the foot.

  • source
  • hideshow 10 child comments
  • [–] 38 points 2 months ago (9 children)

    Most people I know simply don't care. They will use it because it's convenient and they don't care about the privacy dangers. I can't comprehend it myself though. Drives me up the wall.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 23 points 2 months ago (1 child)

    They will use it because it's convenient

    Using web without ublock is amongst the most inconvenient things I've experienced

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 2 months ago

    I think most people who don't know better just think that's "the internet" and that it's the same no matter how you access it. The whole concept of browsers and extensions is just not in the realm of concern.

  • source
  • parent
  • [–] 17 points 2 months ago (5 children)

    I've seen some shift among the tech illiterate in my immediate vicinity, but most are still in the "I got nothing to hide" category of clueless twits.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 12 points 2 months ago (3 children)

    Funnily enough my two kids have expressed hatred of AI. It's mainly people around my age or higher that can't let any sort of convenience go even if shown the dangers.

    Otherwise I'm just "scaremongering".

  • source
  • parent
  • hideshow 3 child comments
  • [–] 12 points 2 months ago (2 children)
  • [–] 5 points 2 months ago (1 child)

    My 14yo hates the current AI but says most peers are using it and can't understand how to write an essay or such without it.

    I think only some of the kids are alright. Many, if not most, are in trouble.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 1 month ago

    Fair. I said that out of hope. I'm young. Just 24. But I've always been progressive. I want younger people smarter, and not dumber than me, LOL.

    I hear this nightmare stories of kids lacking basic comprehension skills. AI should be severely limited in educational settings, though not outright banned, as it can supplement learning when used appropriately.

  • source
  • parent
  • [–] 9 points 2 months ago*

    The problem is that everyone's internet experience is very different these days. Your friends might be boring and actually have nothing in their lives that need compartmentalized/obfuscated. It's unlikely but not impossible.

    The easiest way to demonstrate the problem would be when they show you something on an unprotected device you note the ads and give them shit for it. Those ads are likely targeted, and so your jabs would be targeted and personal too. Then point out that those ads are tied to THEM. Just ask every time, "have you been looking at X? Gross dude." It doesn't matter what it is. It's the point that they are uncomfortable with your guess and it's an opening to explain that, yeah it's not just those ads buddy.

  • source
  • parent
  • [–] 47 points 2 months ago (1 child)
  • [–] 37 points 2 months ago*

    Sing it with me:

    Chrome, huh, yeah.
    What is it good for?
    Absolutely nothing, uhh….

  • source
  • [–] 71 points 2 months ago (7 children)

    company which makes most of it's revenue from advertising fucks with their browser's ability to remove ads. Go figure!

  • source
  • hideshow 7 child comments
  • [–] 15 points 2 months ago

    i am surprised it took this long, but i know that getting everybody using chromium, or at least webextensions, was part of the plan that had to exist first. and the path down mv3 started not long after both mozilla and microsoft were both roped-in.

  • source
  • parent
  • [–] 1 point 2 months ago (5 children)

    I have to say I'm not surprised. No one wants to pay for a browser.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 2 months ago (3 children)

    The irony is that Chrome's rendering engine was a fork of WebKit, which was a fork of KHTML, a free and open source rendering engine created by KDE for Konqueror. They basically took something free, used Microsoft's "embrace, extend, extinguish" tactics on it. Now KHTML is vestigial, only found in the UserAgent string.

    But we could have had a truly free open source cross platform browser with Konqueror.

    Best we have now is Firefox, but the bulk of Mozilla's development funding comes from setting Google as the default search. So it is also hijackable.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 2 months ago (1 child)

    We could maybe have done that. But Konqueror has never been that good every time I tried it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 month ago

    In circa 2003-2004, it was as close to on par with browsers at the time as it would get. I think the WebKit fork did damage to the momentum. By 2008 with KDE4, the rework that split it and Dolphin into to products was basically the final nail I think, as development work effectively stopped.

  • source
  • parent
  • [–] 35 points 2 months ago

    Firefox users right now:

  • source
  • load more comments
    view more: next β€Ί