Manifest V2 to V3

Topic

New Reply

[alejr]

January next year sees the Introduction of a new API in Chromium based extensions called Manifest v3. This API is to supersede Manifest v2 on the basis of improved security for extensions whilst improving browser performance
Expect Mv2 extensions to stop working once this is introduced for those browsers around that month.
Fortunately, amoungst others, a certain Raymod Hill, (uBlock Origin creator) is working on a Manifest V3 version tagged uBO Minus which will no doubt be neutered to googles advertising conformance policy.

Unaffected:
The Brave browsers will continue to work using the existing Manifest v2 beyond January 2023 and seems to be developing it’s own independent Brave Store for that switchover, which can only be a good thing if extensions are security scrutinized properly unlike some..

Wonder where Opera and Vivaldi fit into the scheme of things?

Anyone shed any light on those? just curious..

Keep IT Lean, Clean and Mean!

• This topic was modified 6 months, 2 weeks ago by alejr.

3 users thanked author for this post.

alejr, Alex5723, Moonbear

Reply | Quote

Replies

Can I assume by the lack of mention of it that Firefox is not affected by this?

Experience is that marvelous thing that enables you recognize a mistake as soon as you make it again.

Reply | Quote

Firefox is not a Chromium based browser.

1 user thanked author for this post.

Charlie

Reply | Quote

Charlie wrote:

Can I assume by the lack of mention of it that Firefox is not affected by this?

Hi Charlie:

I also use Firefox as my default browser.  See the discussion in Alex5723’s 30-Aug-2022 topic AdGuard Launches Manifest V3 Compatible Ad-blocker for Chrome, which includes a link to Martin Brinkmann’s 19-May-2022 ghacks.net article Mozilla Expects to Launch Extensions Manifest V3 Support in Firefox in Late 2022 and a brief discussion on the different approach that Google Chrome and Mozilla Firefox developers are taking to Manifest V3.  Martin Brinkmann’s article states in part that:

“… While Mozilla plans to introduce support for Manifest V3 in Firefox, it won’t remove support for APIs that are essential to privacy extensions. Content blockers and other privacy extensions will continue to function in Firefox as before, provided that developers continue to support them…”

————–
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.1889 * Firefox v104.0.2 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1751 * Macrium Reflect Free v8.0.6979

3 users thanked author for this post.

SueW, Charlie, oldfry

Reply | Quote

Vivaldi has said that they will act to preserve adblocking, but the specifics will have to wait until Google actually drops the bomb:

https://www.zdnet.com/article/opera-brave-vivaldi-to-ignore-chromes-anti-ad-blocker-changes-despite-shared-codebase/

There is some concern that as the codebase continues to evolve, it will get further and further away from the solution that Brave, Vivaldi, etc., settle on, which will make it more and more difficult to integrate their changes with each new release of Chrome, and will lead to their eventual capitulation. It’s the same issue that Waterfox Classic faces… it was a relatively simple thing to backport security fixes from Firefox 58 to Waterfox Classic (based on Firefox 56), but a whole other thing to backport fixes from Firefox 92, let alone new web features as they emerge. It is a lot for a single dev or small dev team to handle.

The interesting bit for me is that enterprise users of Chrome will still get to use the full WebRequest API. Google tells us they are making the change because of security and privacy concerns, not concern for their own revenue as an advertising company, and if that really is true, why are enterprise customers less important to “protect” from this potential security and privacy vulnerability than consumers?

I wonder where this “enterprise” code lives.

Chromium is the open-source base for Chrome, Vivaldi, Brave, Opera, Edge, and many others. The developers of each of those products take the open-source code from Chromium and make whatever changes they wish, and because the Chromium code is mostly licensed under the permissive Berkeley/Apache license, those downstream devs are not obligated to make their changes to the Chromium code available to the public. This is how an open source project like Chromium can be turned into a closed-source product like Chrome (which is often mislabeled as open source by some), just as the open-source AOSP mobile OS becomes the closed-source Android. Google gets the benefits of an open-source development model (especially the bit where regulators from various governments are presumably less likely to come after them for antitrust violations) and the benefits of having a closed-source model, like being able to decide who gets to use a given feature.

If any of those browser developers were using Firefox as the base, they would be obligated by the terms of the MPL (Mozilla Public License, which is very similar to the GNU Public License of Linux and lots of other stuff) to release the code for those changes to everyone, also under the MPL.

The GPL/MPL is a double edged sword. It prevents a bad actor like the Microsoft from the “bad old days” from doing its embrace, extend, extinguish routine, which is a good thing for the project in question. On the other side, corporations that want to keep their code a secret are not apt to use GPL/MPL projects as their base. It’s most certainly a big part of why Apple chose to use a BSD derivative (Berkeley licensed) rather than Linux. If they had used Linux, they would be obligated to release pretty nearly their entire OSX (now MacOS) code base to the public (as most bits of broader Linux that are not part of the kernel are also GPL licensed).

I would guess the changes that re-enable the full API in Chrome are within that closed-source bit Chrome adds in, so developers of other Chromium-based browsers can’t simply use the enterprise version as their base. That would be neat if it was, but I haven’t seen any of the players in this mention it as a possibility, so it probably isn’t so easy.

The good part is that the continued existence of the patch that re-enables the full WebRequest API in the enterprise version means that the code may not tend as much to drift away from any such patch that is reimplemented by the likes of Brave or Vivaldi.

Firefox does not use Chromium code, so it will not be affected by this directly, but it’s Mozilla, and they have been dutifully following Google’s business plan for years, not to mention removing most features not present in Chrome (giving people as little reason as possible to use the 5% market share bit player rather than the web standard).

In a boxing metaphor, they’ve been taking a dive continuously over the last ten years, then running to the bank and cashing the check from the opponent that “defeated” them in the ring. Google keeps them around so they can claim they have competition in the browser market, but if that competition ever threatened their market share or impeded their business plan, they may think twice about that.

Mozilla is not the same plucky entity that was unafraid to stand toe to toe with the corporate giant in the early 2000s. They are completely cowed and controlled by Google. That’s why it concerns me when Mozilla says they have no plan to cripple the WebRequest API at this time. At some other time, if Google wants them to start having a plan to cripple WebRequest, will they risk biting the hand that feeds?

Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

4 users thanked author for this post.

wavy, Alex5723, Microfix, oldfry

Reply | Quote

@Ascaris, read all that previously from links within:
https://github.com/einaregilsson/Redirector/issues/316
and that Opera are supporting Manifest v3 (official? last post)
https://forums.opera.com/topic/50569/manifest-v3-opera/3?_=1661346156340&lang=en-US

Whereas Vivaldi seem to be partially (with surgical coding to suit) adopting MV3 as per your provided link.

Although no further recently updated posts/blogs/docs that I can find..

Came across this EFF article:
https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-still-hurts-privacy-security-innovation

removing blocking webRequest won’t stop abusive extensions, but will harm privacy and security extensions

Microsoft’s documentation:
https://docs.microsoft.com/en-us/microsoft-edge/extensions-chromium/developer-guide/manifest-v3

Then there’s an article on the Register:
https://www.theregister.com/2022/09/08/ad_blockers_chrome_manifest_v3/?td=rt-3a

Although the experimental extension is not as effective as its predecessor, *most users won’t feel the difference,” said Seregin in a blog post just over a week ago.
“The only thing you might notice is ad flickering due to the lag in the application of cosmetic rules.

in relation to AdGuard using Manifest V3 https://adguard.com/en/blog/adguard-mv3.html
* My bolding

I also see Martin Brinkmann has today posted a blog with a closing statement in relation to uBlock Origin for chromium based browsers affected:

Many Chrome users are probably unaware of the announced changes at this point.
Those who know about it, may want to check out other browsers that won’t be affected by the change.

https://www.ghacks.net/2022/09/09/ublock-origin-minus-an-experimental-manifest-v3-compatible-extension/

And all this when google CANNOT provide essential security within it’s own ‘Play Store’ due to malicious apps for computers or smart mobile devices over the last few years.
Looking for an answer to their problem lays elsewhere does not constitute a FIX relative to the EFF article concerns, when the buck stops at google’s diluted Play Store security checks.

Keep IT Lean, Clean and Mean!

2 users thanked author for this post.

oldfry, Alex5723

Reply | Quote

Google already tags some extension using v2 with errors :

Reply | Quote

Charlie wrote:

Can I assume by the lack of mention of it that Firefox is not affected by this?

https://www.ghacks.net/2022/09/09/opinion-it-is-time-to-switch-from-chrome-to-another-browser/

…Firefox will continue to support Manifest V2 but also Manifest V3; this means, that Manifest V2 extensions continue to be supported for the foreseeable future…

1 user thanked author for this post.

Charlie

Reply | Quote

Vivaldi says its ad blocker will continue working even after changes in Manifest V3

Not sure.

Vivaldi has outlined the future of its ad blocker, and how it could work when Manifest V3 is enforced

An article published on Vivaldi’s blog points out that Manifest V2 is not being deprecated completely, only the ability to block requests from webRequest is. V2 will be available for enterprise users until June 2023. The developer says that the underlying code for webRequest will remain intact until that time, and since declarativeNetRequest is built on top of it, Vivaldi’s native ad blocker written in C++, should be able to use the Chromium API and on paper, continue to function when Manifest V3 becomes the norm.

If Vivaldi continues to support Manifest V2, existing add-ons including ad blockers will remain unaffected, won’t they? The developer says this largely depends on how Manifest V3 develops, and also on which the APIs that the extensions use. The browser maker plans to remove whatever restrictions Google adds, but does admit it could be a difficult ride.

AdGuard recently released a Manifest V3 compatible content blocker, but the extension hasn’t had an impressive start. Raymond Hill, the developer of uBlock Origin, released an add-on called uBlock Lite (formerly uBO Minus), it seems promising, but it’s not as good as the original version…

Mozilla reaffirms that Firefox will continue to support current content blockers

..Mozilla reaffirmed this week that its plan has not changed. In “These weeks in Firefox: issue 124”, the organization confirms that it will support the WebRequst API of Manifest v2 alongside Manifest v3…

1 user thanked author for this post.

lmacri

Reply | Quote

More details on the transition to Manifest V3

..In January 2023, use of Manifest V3 will become a prerequisite for the Featured badge as we raise the security bar for extensions we highlight in the store.

In June 2023, the Chrome Web Store will no longer allow Manifest V2 items to be published with visibility set to Public. All existing Manifest V2 items with visibility set to Public at that time will have their visibility changed to Unlisted.

In January 2024, following the expiration of the Manifest V2 enterprise policy, the Chrome Web Store will remove all remaining Manifest V2 items from the store…

Reply | Quote

Brave : We realize many of our users still want to use third-party ad blocker extensions.

To give you as many options as possible for online privacy and security, Brave will support Manifest V2 extensions such as uBlock Origin even after Chrome stops doing so.

https://twitter.com/brave/status/1574822799700541446

1 user thanked author for this post.

Microfix

Reply | Quote

Pausing Manifest V2 phase-out changes

to Chromium Extensions
Greetings extension devs,

As we head towards Manifest V3 migration, we are intently monitoring comments from the developer community to help inform our timelines. We’ve heard your feedback on common challenges posed by the migration, specifically the service worker’s inability to use DOM capabilities and the current hard limit on extension service worker lifetimes. We’re mitigating the former with the Offscreen Documents API (added in Chrome 109) and are actively pursuing a solution to the latter.

We’re committed to providing developers solutions to migration challenges with new functionality, bug fixes, and adequate time for adoption. For this reason, we’re postponing any January experiments to turn off Manifest V2 in pre-release channels of Chrome and changes to the featured badge in the Chrome Webstore, and we’ll be evaluating all downstream milestones as well. Expect to hear more about the updated phase-out plan and schedule by March of 2023. Our guiding principle will be to give developers sufficient time to update and test their extensions after the launch of these new capabilities before turning off Manifest V2.

Thank you for all the feedback and passionate discussion thus far, and we wish you a happy start to 2023…

1 user thanked author for this post.

lmacri

Reply | Quote

Alex5723 wrote:

Pausing Manifest V2 phase-out changes

Additional details about the rollout delay were posted in Martin Brinkmann’s 13-Dec-2022 Google Delays Chrome Manifest V3 Rollout Once Again on ghacks.net.

1 user thanked author for this post.

Alex5723

Reply | Quote

Just to update this topic:  Firefox 109 is now supporting Manifest V3, however, it is still supporting Manifest V2.  Correct me if I’ve got this wrong, but that’s how I read it in Mozilla’s new features webpage.

Experience is that marvelous thing that enables you recognize a mistake as soon as you make it again.

1 user thanked author for this post.

Microfix

Reply | Quote