(a) it’s simpler for alternative blockers to exist and provide the same functionality

I don’t consider this an upside, webRequest allows significantly more flexible code (and by extensions more techniques to defeat anti-adblock) than the rulesets made for specifically content blocking extensions do. The only thing this does is ossify content block capability.

(b) you don’t have to audit or trust that the blocker is being sane/safe with your browsing history, because it never has it.

This is moot because I don’t think any mortal user is informed adequately enough to give consent for extension permissions. If you give any permission, you’re extending trust to the extension author to not abuse it. Authors don’t even have to give you inline justification for why any specific permission is required.

Mozilla realized this problem and reviews extensions that go through the extension store before signing it, I have my gripes with the system but it’s what we’re left with.

The bizarre history of the various things referred to as “ublock” is a pretty clear indication that people can’t and shouldn’t trust that extension makers are currently or will in the future do what’s right.

Whatever transgressions done, the current status quo is significantly better than whatever ABP and friends are doing with “”“acceptable ads”“”.

It’s also going to be significantly better than trusting yet another Chromium fork to patch in an engine per patchfiles, which is my argument :/

score 1 · canonical

Extensive security and hardening fixes across the core decoder/encoder, box buffers, and plugins (EXR, GIF, APNG/PNG, PAM/PNM/PGX). This includes fixes for integer overflows/underflows, out-of-bounds reads/writes, buffer overflows, and null pointer guards

Oh damn I didn’t know about that, for sure then.

score 1 · canonical

Content Blocking For starters, extensions are always bad. Especially MV2 extensions, like uBlock Origin. Since MV2 extensions can access any site as well as a great many features without permission. MV3 prevents this, but it isn’t too much better since many extensions just ask for access to all sites anyway to work properly, but at least it offers the user control. With that in mind uBOL (uBlock Origin Lite) in Basic mode is pretty good, since it has no access to sites while still being able to deliver decent content-blocking. It also allows granting access to specific sites, such as Youtube (yes it works), for better filtering if needed. Other extensions and uBOL global modes risk security and weaken site isolation.

Hm? That adblocking extensions can intercept (any) network request on any site is by design. If you ignore the scriptlet injection and the cosmetic filtering, uBO is also a network request filtering engine, which allows you to precisely filter requests (like specific site while visiting certain domain) than DNS blocking could.

You have to put scary warnings on that capability because letting an extension intercept all requests is easily abused in the wrong hands, but that doesn’t make this access bad.

The author goes on to say that filtering engines (not made by the Chromium team) patched into Chromium or Brave’s in-browser blocking is better, but I don’t understand why it matters where the content blocking code lives (outside of the author complaining about attack surface).

score 1 · canonical

\o/

I hope that we can finally discuss image formats without it getting torpedo’d with “jxl is the format Google doesn’t want you to use”

I’m also curious if the decoder being in Rust pays off into tangibly less surface considering how devastating the libwebp and libvpx memory exploits were, I suppose only time will tell

score 1 · canonical

edit: this post got a handful of comments on lobste.rs and Hacker News. Commenters disagree with my first point, arguing that keeping your head down means you lose power. I certainly agree that you shouldn’t behave like you’re worthless or easily replaced. But in my view most power in tech companies comes from being useful, not from being willing to unionize or pick political fights.

Author ended up replying to this indirectly here, which, considering the gender disparity in IT, which I imagine is not getting better, I’m not entirely sure if I buy that you get political power through usefulness.

(Ironically I feel like that’s the same ZIRP meritocratic argument we’ve heard to defend that gender disparity, and that’s when money was good and engineers were valued)

Often (but of course not always) you’re powerful because you won the cosmic dice (in more ways than one).

score 2 · canonical