Hacker News new | ask | show | jobs
by swypych 2702 days ago
You can read the spec here

"In Manifest V3, we want activeTab-style host permissions to be the default, with a number of extra options. Instead of being granted access to all URLs on installation, extensions will be unable to request <all_urls>, and instead the user can choose to invoke the extension on certain websites, like they would with activeTab. Additional settings will be available to the user post-installation, to allow them to tweak behavior if they so desire." --- https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...

yup it looks bad.

2 comments

Yikes! I'm one of the maintainers of the Remote Browser open source project [1]. It's a cross-browser compatible automation framework which heavily leverages the power of vanilla JavaScript and the Web Extensions API to offer features comparable to those of Selenium (without the legacy cruft). Removing the ability for extensions to interact with arbitrary pages would effectively break Remote Browser's compatibility with Chromium/Chrome overnight. I have a feeling that there are a staggering number of interesting extensions that will break due to the various V3 manifest changes. Hopefully the outrage over uBlock Origin will push Google to reevaluate this decision.

[1] - https://github.com/intoli/remote-browser/

I made an extension called the "Productivity Owl." It only has 10k users, but the owl would definitely be dead with this change.
Is that for security?
Security of googles profits.
That is one of the reasons to do this.