Hacker News new | ask | show | jobs
by devsda 49 days ago
I hope this isn't a precursor to removing support for other AdBlock addons(MV2) citing native availability of an AdBlock engine and then gradually shift to acceptable ads etc.
3 comments

The day Firefox drops MV2 is the day I find a new browser. We're already at <1% usershare, it's not like there's safety in numbers here
What exactly is your gripe with MV3?

Many people seem to treat it synonymously with "no more procedural request blocking", but that's not a thing Mozilla ever did:

> For Manifest V3 extensions, Chrome no longer supports the "webRequestBlocking" permission (except for policy-installed extensions). Instead, the "webRequest" and "webRequestAuthProvider" permissions enable you to supply credentials asynchronously. Firefox continues to support "webRequestBlocking" in Manifest V3 and provides "webRequestAuthProvider" to offer cross-browser compatibility.

The permission model also seems much more reasonable (less permissions have to be requested upfront at install time) than MV2, so I actually hope Firefox does deprecate it at some point.

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

https://blog.mozilla.org/en/firefox/firefox-manifest-v3-adbl...

> What exactly is your gripe with MV3?

Running an adblocker is the defining feature of the extensions API. ublock origin has 5x as many users as the second-most-popular extension [1]

Supporting ublock isn't just a nice-to-have add-on feature for an extension API, it's literally the only thing most users care about.

[1] https://addons.mozilla.org/en-GB/firefox/search/?promoted=re...

Firefox's MV3 implementation doesn't remove the original netRequest API though IIRC.
But MV3 supports uBlock Origin Lite.

Which, in my experience, blocks ads just as well, but also lets pages load significantly faster.

MV3 supports uBlock.

Just as one example: Chrome + uBOL on Reddit will show you plenty of "Sponsored" stuff. You can use Inspector to find the offending CSS classes and then use `display: none` on them with something like Stylus[0], but not everybody wants to play that whack-a-mole game on the many sites that push uBOL past its blocking capabilities.

[0]: https://github.com/openstyles/stylus

Reddit's sponsored posts are blocked by default in uBOL when using _optimal_ (default) or _complete_ mode.
UBO lite has a long list of all the types of filters that aren't possibly under MV3: https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...

Not sure about page load, but CPU time is about the same between the two: https://x.com/gorhill/status/1792648742752981086/photo/1

This list only applies to Chrome, so it's completely irrelevant when talking about Firefox.
It supports limited ublock functionality, not all of it, which will gradually be exploited by ad corps like google unless you think those are saints
The point is that it supports everything that currently matters in any substantial way.

Lots of people have been pointing out that ad companies will figure ways out around it. But they really haven't been.

MV3 and UBOL have been in wide usage for about a year and a half now. And nothing has been changing. Adblocking continues to be great.

The fact of the matter is, the ad block lists were getting so large and the JavaScript functionality was slow and it was significantly impacting page load times. UBOL uses vastly more efficient compiled code that is part of the browser and is just a far better ad blocking experience altogether.

But I guess that just doesn't fit the narrative that people want to believe, where MV3 was part of a big evil plan.

It supports everything on Firefox on MV3, but not on Chrome.
Most definitely not as well.
It most definitely is as well. In fact it's better because you don't have the slower page loading times anymore.

And everyone I know who used UBO and switched to UBOL has had no complaints about ads not being blocked.

Whereas people who don't actually use it love to continue to insist that it's this degraded experience that doesn't work as well. And usually when one of them comes up with an example of some ad not being blocked, it turns out because they hadn't configured UBOL to use complete blocking mode.

Reading comprehension is the defining feature of a good commenter.
Look I'm not an expert in web browsers, but I defer to those extension authors who definitely are. There's some reason uBO doesn't work well in MV3 even though they tried. Whatever technical explanation there is for why MV3 is fine, there's some caveat not mentioned.
That’s because Chrome removed an important API in their MV3 implementation, not because the MV3 specification mandates said removal.
Firefox supports webRequestBlocking with MV3, so even if they fully remove support for MV2, ad blocking is still available.
Mozilla refused to approve MV3 version of uBlock Origin
That's a problem, but an almost completely orthogonal one to MV2 being deprecated.
I wouldn't say completely orthogonal.
That's probably why they qualified it with 'almost'.
Why? Any links to this decision?
I'd be genuinely curious what you could switch to that still has MV2 because, AFAIK, Firefox is the last holdout.

Brave still allows you to install uBlock & some other extensions that should technically not be supported under MV3, but they still ship it with support for those.

Just heard about Helium browser, which is just dechromium + uBlock and it's still beta.

Helium still supports MV2, because the upstream hasn't removed related code. They basically turn on/off some macros to enable MV2 again. And this won't last long for sure.
> I'd be genuinely curious what you could switch to that still has MV2 because, AFAIK, Firefox is the last holdout.

My last hope is ladybird right now, I don't use Firefox or Chrome as my main browsers anymore, and use them only within temporary sandboxes. Without history, without cookies, without logins for the most part.

You use ladybird as your primary web browser? And it works?
For the most part, it doesn't. It's not a consumer ready browser, but a pretty nice little rendering engine. If you use ladybird as bindings, it's a bit unstable right now because they are refactoring a lot of parts in the codebase.

I built my own tools on top of it, mostly to use internet websites and selfhosted kiwix archives with my local agentic env.

I guess what I am saying is that I don't have a primary browser anymore. Not a browser where I just can trust it that it doesn't do shit with my data. Being able to selfhost kiwix is a superb internet experience if you build your own search dashboard for it, I can fully recommend it.

Have to merge my things upstream with ZIMdex when I have the time (probably around June).

[1] WIP https://github.com/cookiengineer/exocomp

[2] WIP https://github.com/cookiengineer/zimdex

It seems to me that --unless you really, strictly compartimentalize your browser usage--, using multiple browsers will only supply your data to more parties.
Ladybird supports MV2? I had no idea they have extensions.
Ladybird is many years away from being usable by a casual human. The hope is it turns out to be a great browser eventually.
I don't know if Edge supports MV2, but they do have uBlock available and it works just as well as on Firefox.
It may look like it works "just as well" but that's not true. There are numerous things that impact performance and effectiveness that are not possible with chromium-based browsers, or at least have to be done inefficiently, including

* pre-fetching

* html filtering

* use of WebAssembly

* data compression and private/incognito mode

Edge has its own extension API in addition to the Chromium one, it's possible that they've managed to mitigate or eliminate these problems.
Safari still supports MV2
> Firefox is the last holdout.

Nope, FF is being infiltrated by adtech for last year or two. Last holdout is Safari now :)

You cannot install uBlock Origin on Safari.
The Lite version, same as on Chrome, is actually available for Safari. Still not as good as the full one on Firefox though.

https://apps.apple.com/us/app/ublock-origin-lite/id674534269...

what's the diff between lite and full? i dont even remember what i use on safari, wipr or something. mostly use firefox but sometimes i casually just let things launch in safari
Exactly.
>Last holdout is Safari now

Why do people say crap like this... Safari was the first browser to completely remove mv2. From all the major browsers Safari has the worse adblocking experience and support for adblocking extensions...

> Why do people say crap like this...

1. Third-party cookie blocking by default — 2003 (Safari 1.0); industry first.

2. Intelligent Tracking Prevention (ITP), using on-device machine learning to identify and limit cross-site trackers — 2017; industry first.

3. Storage Access API prompts for embedded third-party content (e.g., social login widgets) — 2018 (ITP 2.0); industry first (co-developed by WebKit, later adopted as a web standard).

4. Full third-party cookie blocking (no exceptions) — 2020 (ITP in Safari 13.1); industry first for a major browser.

Apple only does things to progress their own business model. Apple failed at becoming an ad business so they pivoted to subscriptions and app revenue. Now they are building an ad business. Just look at their ad revenue.
That's what the marketing department says.

Ad/tracking blocking is one of the things that can only be trusted if it's open source, i.e. uBlock Origin.

By the way, does this Adblock Engine actually block trackers? Or it just stops the ads from displaying?

If Raymond Hill says blocking doesnt work anymore, ill use... umm... Lynx?
Could definitely be writing on the wall that MV2 support will be deprecated in the future but imo not necessarily a bad thing if it’s not actively developed anyways. Maintaining both MV2 & MV3 support isn’t easily sustainable long term when you factor in the need to prioritize other features.

That said, if this is writing on the wall I’d hope they’ll listen to the community this time and allow the engine to be extended / make it such that a block all ads feature always exists. I’m cautiously optimistic given Mozilla’s track record just over the past year-ish. They have released some great new features that help bring Firefox closer to feature parity with other browsers.

I am a Firefox hopeful and recently switched back to using it as my daily driver when Arc went belly up (but mainly for uBlock Origin support).

>Maintaining both MV2 & MV3 support isn’t easily sustainable long term when you factor in the need to prioritize other features.

There is no feature Firefox provides that is more differentiating than ublock origin. As long as pages load and security issues are patched it is the reason to choose Firefox as a browser. What would they prioritize over it?

And there's nothing in MV2 that uBlock Origin needs that doesn't exist in MV3 on Firefox, unlike Chrome. This issue is completely overblown.
Are you disputing uBlock Origin's list of MV3-incompatible capabilities [1]?

[1] https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-as...

That list contains issues with the APIs that Chrome exposes via MV3. Firefox still supports APIs that Chrome removed.
Not really, but this FAQ, like almost all articles published on MV3, conflates MV3 the specification with Chrome's MV3 implementation. (FWIW, I'm almost certain that this is either due to sloppy/imprecise writing or intentional, with the authors not wanting to confuse users already appropriately riled up by equally imprecise reporting on MV3. They definitely know the difference.)

In any case, for better or worse, when people say MV3, they now usually mean "Chrome's MV3 implementation", which obviously never applies to Firefox.

That's utter bullshit. The author of uBlock Origin has posted a long list of capabilities that declarativeNetRequest does not support.
Unlike Chrome, Firefox did not remove the older API.
What's this supposed to mean ? OP was saying that MV3 is feature-equivalent to MV2 and would like to see MV2 support removed from Firefox just as it was from Chrome. I replied pointing out that's utterly false.
I’d like to see more investment in their new profile manager. It feels pretty barebones at the moment. Arc had the ability to link profiles to “spaces” and you could easily switch between them without opening a new window. It was very nice to so easily swap between personal, work, & side business.
The multi user containers are also very nice.
And to go one step further, for achieving a profile-per-firefox-window workflow, I suggest to have a look at the underrated extension Sticky Window Containers [0]

While far from being perfect, I find it good enough for keeping things separated, especially when using a desktop/workspace workflow. For example, in workspace/desktop 2 I have a Firefox window opened with the first tab set to "container A", so hitting ctrl-t there opens new tabs with the same container "A", so I'm logged-in for all projects A. In another Firefox window in workspace 3 I work with "business project B" tabs (where I'm logged into different atlassian, github, cloud, gmail, ...)

Then with a Window Manager like i3wm or Sway I set keybinds to jump directly to the window (and workspace), using the mark feature [1]

It's also possible to open websites directly in specific containers so it's flexible. For example on my desktop 8 I have all my AI webchats in "wherever my company pay for it" tabs: `firefox --new-window 'ext+container:name=loggedInPersonnal&url=https://chat.mistral.ai' 'ext+container:name=loggedInBusinessA&url=https://chatgpt.com' 'ext+container:name=loggedInBusinessB&url=https://gemini.google.com' 'ext+container:name=loggedInBusinessB&url=https://claude.ai'`

It's also the only way I found to keep opened multiple chat apps (Teams, Slack, Discord, ...). The alternative electron apps are as resource-hungry, and in my experience never handled multiple accounts well (especially Teams).

[O] https://addons.mozilla.org/en-US/firefox/addon/sticky-window...

[1] https://i3wm.org/docs/userguide.html#vim_like_marks

Why does everything have to be "actively developed"? Sometimes a program is just done. Better not touch it. I actually do downgrade packages when "actively developing" causes regressions. Not curl or anything sensitive like that, but local programs definately yes.

In case of the extension manifest, that's probably layered on top of the JS engine which does get attention and scrutiny. It's not like an API needs to be updated. If you'd always do that, nothing would ever be interoperable and we'd likely have a hard time trying to communicate.

> Maintaining both MV2 & MV3 support isn’t easily sustainable long term when you factor in the need to prioritize other features.

The feature that better adblockers need is one callback that's similar to one that's still in V3. It's not difficult to keep if it's your own codebase.

Try Zen! Firefox fork with Arc-like UX.
Zen is great and still mostly Firefox. I use standard Firefox on Android and everything syncs without hassle. The experience is so much better that personally cannot imagine using Chromium anymore. Of course I do wonder if the entire Firefox ecosystem is sustainable long-term funding wise.
As long as MITM proxies still work (which is something that Enterprise customers demand --- even the notoriously-closed Chrome needs to), it will always be possible to filter pages outside of any browser. I've been using one for over 2 decades and it works in any browser.

However, I am also concerned that this is an "embrace extend extinguish" move.

Tell me more, what's your setup.

I use uBlock Origin in Firefox and network ad blocker. Wondering what other options are there.

In general, install a proxy which has its own certificate, resign every tls session with those keys, add the certificate of the proxy as a trusted certificate on your device.

I’m not familiar with off the shelf solutions for this that have ad blocking built in. Also ads are injected by JS so you need a mechanism to detect that.

More and more ads are now served from the same domain as the site making it harder to distinguish them from real content.

The open source solution is to configure the latest Squid proxy as a Squid SSL Bump proxy. There are a handful of sites it will not work with due to them still using public key pinning but its a tiny list. I do not have it handy at the moment.

Squid supports ACL's that can block URL patterns, domains, IP addresses, file extensions, mime types and much more.

Here [1] is an out of date example. There are probably better and more up to date examples. Some examples are based off Squid V3 as some distros still ship with that but Squid 6 added more flexibility around chaining options SOCKS options and such.

[1] - https://github.com/alatas/squid-alpine-ssl

ZScaler Internet Access will do it with the right blocking configurations (eg, blocking "Advertising" groups).

But then you're using ZScaler and that just feels all nice and icky.

What would prevent sites from just injecting ads into their content server-side? You'll always need both element and request blocking.
That's why GP wrote MITM, not just network blocking. MITM implies the middlebox is trusted by the browser in which it has installed a certificate, so can see and modify content.
Hm, you mean basically to edit all HTML, CSS etc. just in time? This seems significantly harder (concepts spread over files being loaded in parallel or being partially cached etc) than to do it in the browser once everything is loaded.