[fezfight]

How many people use adblockers? Is there any chance manifest v3 will lead to enough users abandoning Googles Chrome to build a community around an open alternative, like we did when we abandoned IE for Firefox all those years ago?

[ainar-g]

> How many people use adblockers?

About 43 %, according to [1].

> Is there any chance manifest v3 will lead to enough users abandoning Googles Chrome […]

No. Google Chrome is pretty much in the same position as Internet Explorer used to be. It's the default browser in the most popular mobile OS and the first thing people install on their PC (or get it installed by someone else). Mozilla can barely play catch-up with all the complex web standards pushed by Goog&co., to say nothing about adding killer features that could bring enough users back from Chrome.

Modern web browsers are rapidly approaching the YouTube territory. That is, becoming a technology so complex that only a multibillion-dollar conglomerate can really maintain it without losing money.

[1]: https://backlinko.com/ad-blockers-users

[revlolz]

The 43% number is huge imo. A large quantity of devices either cannot install adblock (or cannot do so easily) such as "smart" tvs.

Even to install on Android Firefox it took more effort than I expected.

[connicpu]

It seems the actual number is 43% of those surveyed use an ad blocking tool at least once a month, so a lot of those may only have their ad blocker installed on their PC, plus the bias that comes from only having the answers of those who responded to the survey

[hsbauauvhabzb]

Still that’s a fairly overwhelming number of people who feel strongly enough about the topic to install a plug-in. I’m sure there’s a portion of ‘no’ responses that are not aware of what adblockers are or do

[tgsovlerkhgsel]

I'm using Firefox with moderately aggressive ad blocking and privacy settings. Almost everything works, and the few breakages that I encounter are usually due to the blocking/privacy settings (i.e. they'd happen the same on Chrome if I configured it similarly).

The only thing I actually have to start Chrome for is (ironically) Microsoft Teams.

[Jaepa]

    42.7% of internet users worldwide (16-64 years old) use ad blocking tools at least once a month.

That framing sets of multiple mental alarm bells.

EDIT: it looks like the source is HootSuite may have a conflict of interest, as they seem to focus on social media advertising campaigns.

[kelnos]

What does it even mean to use an ad blocking tool "at least once a month"? Like... do people have an ad blocker installed, but disabled most of the time, and just enable it temporarily when they come across a site with particularly egregious ads? That seems... an unlikely use model?

[NavinF]

It means they only use an adblocker on desktop.

[kelnos]

How does that mean that?

[fezfight]

Yeah that's good scare mongering but I dont buy it. I betcha most of that stuff is megacorporate bloat that can be extricated without hindering the average users experience.

Mozilla, unfortunately, is dead. Like Firefox did from Netscape before it during the dark times of the IE ubiquity, when people claimed what you claim now, a new browser that supports true freedom must rise from Firefox's ashes to begin the cycle once again.

43% is huge. Firefox had significantly less when it won hearts and minds.

[josefx]

> Mozilla can barely play catch-up with all the complex web standards pushed by Goog&co.

To be fair they also spend a lot of resources on dreaming up their own shit tier solutions. Like the time Google proposed federated learning of cohorts, which was universally shot down by critics. Mozilla saw that as a sign and jumped into bed with Meta to create their own version of it. Because who could think about user privacy without immediately thinking of Meta?

It is almost as if Mozillas leadership wants to prove that Mozilla is a waste of money.

[kibwen]

Adblockers are an existential threat to Google. If any appreciable percentage of the population started using a browser that allowed adblockers, Google (and Facebook, and Twitter, and Reddit, and...) would do everything within their power to block that browser from all the web properties they control (this is not an exaggeration: everything within their power, because the alternative is the death of their entire business model and the end of the company). Even if you can play cat-and-mouse games to get around the adblocker-blocking, the inconvenience of that alone would be enough to shift most non-power-users back onto Chrome.

[titaniczero]

> If any appreciable percentage of the population started using a browser that allowed adblockers, Google (and Facebook, and Twitter, and Reddit, and...) would do everything within their power to block that browser from all the web properties they control (this is not an exaggeration: everything within their power, because the alternative is the death of their entire business model and the end of the company)

Even easier, they would just sabotage their own web versions (like reddit with mobile.reddit.com) to force people to use the app versions where tracking/ads is harder to block.

The web is the best platform for us, the users, and the way to go - good sandbox, transparent, customizable. We should fight tooth and nail to preserve it.

[staticassertion]

Adblockers might be an existential threat to Google, but MV3 won't change anything for Google. Google AdSense ads will almost certainly still get blocked, they're not hard to block/ obfuscated.

I really doubt this will change anything for Google with regards to ads. At most you can argue that this is "step 1" in a larger plan to eventually bypass these adblockers or something, which I'll totally buy, but V3 has gotten better at blocking ads over time, not worse.

[antonok]

> V3 has gotten better at blocking ads over time, not worse.

That may be true, but it's still significantly limited compared to MV2. And at the current rate, that is unlikely to change by the time Manifest V2 support is removed.

What's important is that MV3 adblocker developers no longer have full control over how they're allowed to modify pages. Given how adversarial the relationship between adblockers and websites is, that lack of control will be exploited almost immediately.

[staticassertion]

Yeah, so I'm against V3 mostly because I think that the pros of developers having power outweigh the cons of potential malicious extensions. I personally would have preferred rethinking a few other areas first:

1. Auditability - both in terms of the code and the behaviors

2. Improved permissions - could we have split WebRequest up?

3. Improved performance - could we have leveraged new APIs, like the declarative API, for improved performance? What about compiling to wasm? Or new APIs?

4. Capabilities/ Sandboxing - Within an extension could we slice out capabilities?

5. Improved UX around permissions. Surfacing the permissions and performance implications of extensions would be worth exploring and aided by any ability to slice up permissions more.

Chrome could even create 'sanctioned' extensions that wouldn't trigger scary popups in order to make it that much clearer when something is scary - something like "if you publish your extension such that it is digitally signed, you use 2FA or whatever, you have good standing with us, blah blah blah, we will waive that popup". IIRC Firefox did this to lower their review burden, NoScript was one of the ones on the list I think, but that would have been many years ago and I don't know if it has changed since.

That said, I don't think V3 is the end of the world. I would have preferred the other options, and I bet some people at Google explored them too and know much more about why they are/aren't viable, but I'm OK with V3. I don't really think that Google Adsense is driving this decision at all nor do I expect it to benefit them, at least not in the short/medium term.

[antonok]

Great suggestions. The "third party buys popular extension and quietly adds malware" approach is also a huge attack vector. There really ought to be some way to prevent an extension from updating until you've had a chance to review and approve that change, especially if it requests a lot of sensitive permissions.

[staticassertion]

Well, even today, if the attacker modifies the permissions it will require a re-acknowledgement. Google can also do things there, like if the extension is tied to a key (as it should be), tell developers that they are required to not provide that key to anyone else, even if they sell / transfer ownership of the extension. Instead, the new owner should register a new key, which can trigger review/ scrutiny.

Key + 2FA means the attacker has to have code execution on a developer's machine in order to publish an update (via the local session token, which you should make short lived). And Google could require a FIDO2 token if you want to bypass the "alert users that this thing uses lots of permissions".

There's a lot of stuff I'd be working on to avoid having to remove developer power.

edit: K I've been rate limited by HN so I can no longer reply for today, but them's my thoughts.

[shadowgovt]

From Google's point of view, they generally use "How many people are running adblockers" as just another quality signal on whether the ads are actually working as intended. Google doesn't really care if a little under half the users on the web block them.

[dessant]

Google will be able to use a variety of ad delivery methods that are not yet blockable with the filtering API they will now also fully control in Chrome.

[staticassertion]

Google AdSsense has always been able to bypass adblockers, as other advertisers have worked to do. At least in the "they could if they tried", they obviously have the technical prowess. But they haven't because that would be a scandal and invite scrutiny that they likely want to avoid - they own a massive part of the market without resorting to such things, it's not yet in their interest to do that.

So yes, as I said, maybe this is step 1 in a longer term plan to completely remove adblockers. Maybe one day so many people will rely on adblockers that Google is forced to take a drastic measure.

I personally don't expect that to be the case any time soon, but that's really not based on much.

[causi]

We've been living in a golden age for some time now. We browse the clean, crisp web for free and the ignorant "plebs" pay our way by living in an ad-riddled nightmare.

[bambax]

They would have to be pretty stealth and smooth to pull this off because that kind of behavior would attract even more scrutiny from regulators. They don't operate in a vacuum.

[googlryas]

Are they? I see ad blocker ads on YouTube all the time. Presumably google would block them if they were a real threat.

[kibwen]

If adblockers can afford to pay for ads, that means they have a business model, and the one and only adblocker business model is "pay to play", where companies pay adblockers to allow their ads through.

[tgsovlerkhgsel]

Nagware/scareware (pushing subscriptions on users, possibly with misleading claims) is also a business model I've seen used.

I honestly don't mind the "pay to play" model. It's a way to establish a healthy ad ecosystem. Ad blockers define what they consider acceptable, and collect money. They have an incentive to find a reasonable balance: The less restrictive they are, the more money they make, but the second they go over the line, users will jump to another ad blocker that's more restrictive.

I've intentionally and knowingly tolerated the "acceptable ads" from ABP until they started allowing the Outbrain/Taboola chumboxes. (There even were two versions of those, the normal one full of bright colors, tits and disgusting disease images, and a slightly toned down one for the "acceptable ads" users!)

Since those ads rely on making you psychologically uncomfortable (feeling like you're missing out) unless you engage with their worthless, misleading and unsatisfactory clickbait content, they're 100% unacceptable to me, and ABP lost a user.

If uBlock Origin offered an ad whitelist that only allows ad networks that a) serve only their own JavaScript, no third party crap b) only serve static text and re-encoded static, non-animated images c) have some meaningfully enforced editorial standards, d) have some privacy oversight and follow tracking opt-outs, I would definitely give it a chance. I don't mind supporting web sites and content creators, and I don't mind seeing relevant ads (which can usually be targeted based on the content I'm looking at just fine).

I do mind having my fan try to reach escape velocity due to crappy JS, getting served malware and exploits, random "this site is trying to play DRM protected video" popups indicating that something is trying to do fingerprinting, 300 different companies getting my browsing data and 20 of them executing code in my browser (code that they haven't written themselves but have been handed by an intermediary of an intermediary), and last but not least graphic images of diseased body parts. Solve these problems, and I won't need to use an ad blocker. Don't solve these problems, and I will put protecting myself over your revenue.

I also mind having to constantly explain to my parents why the new cool product or shop they saw an ad for is an utter scam, and how exactly they'll lose money if they fall for it. I also mind having to constantly scrape crapware and malware from my friends' and relatives' computers, _including Chromebooks_. As long as ads lead to that, I have no choice but to deploy ad blockers.

[amluto]

> If uBlock Origin offered an ad whitelist that only allows ad networks that a) serve only their own JavaScript, no third party crap

Wait, why would an acceptable ad network have JavaScript at all? Maybe a minimal, pre-approved bit of JS to help the network understand where the ad is being placed, but even that is questionable.

Frankly, I consider it somewhere between bizarre and obviously wrong for any serious website that needs to follow HIPPA, PCI, or any other reasonable security standard to allow un-audited third party JS at all.

[fomine3]

It's sandboxed by iframe if it's done well

[vbezhenar]

The question is: how many people will miss manifest v2 options.

I'm using adblocker written by myself. It's pretty primitive, it uses declarative blocking by URLs and optionally inserts some CSS and JS to selected websites. So far I was able to solve all my ads issues with this approach.

[shadowgovt]

I'm a little surprised Google hasn't seen more pushback from enterprise. I'd expect the weirdest uses of broad permissions to be on intranets, where the inherent risks of such breadth can be mitigated by controlling the accessed data itself. I'm comparing the situation to one of the things that kept Flash on life support for so long: it had been used to build key internal and external tools for fortune-500 companies that they needed time to replace.

That Google hasn't seen such pushback suggests to me that corps writing their own extensions for internal use never caught on like Flash did.

[antonok]

Google actually is allowing MV2 extensions to work under enterprise policy for much longer than anyone else: https://developer.chrome.com/docs/extensions/mv3/mv2-sunset/

[staticassertion]

That's an interesting point, but I think it may also speak to the fact that v3 isn't that restrictive other than for very specific use cases.

[redox99]

It really depends on the platform and target audience.

For example for a website I manage that targets PC gamers, 80-90% desktop users use adblockers. On mobile however the majority settles for chrome (which intentionally doesn't support extensions to avoid adblockers), therefore most mobile users don't have adblockers.

[LelouBil]

Personally,that will be the motivation I needed to switch to Firefox on my main computer.

So... thanks Google I guess ?