#UBLOCK ORGIN FULL#
#UBLOCK ORGIN CODE#

Most bad extensions I've come across when trying to vet what I'm installing fall into two categories: those that are passively malicious: inserting redirections to affiliate links (or sometimes randomly spawning ad), and those that are 'actively malicious' by scanning for browsing history and then sending that over to be sold off. I don't honestly consider it a massive security win though.

I do like the idea of having a permissionless blocker that works decently and can then have the opt-in approach.

Google, please share the data and reasoning!Įdit: With regards to uBlock Lite specifically, I'm looking forward to seeing it evolve. I'd love to see 'X% of malware used it this way, we removed that way'.Ĭommunication has seemingly been pretty bad around the motivations, which has led to a lot of people being pretty upset and confused about the changes. I can think of some obvious things, like that you can't have dynamic scripts - cool, makes sense, I bet malware loves that and removing it seems like it'd be a huge win.īut WebRequests? I'm sure malware was using it, I guess, but what in V3 makes the malware use case for it harder? It seems like we're getting something that can be used maliciously just like before, but it's somewhat weaker in ways that malware won't care about? Again, data here would be great. I'd like to see case studies on malware, or even broad things like 'malware uses these permissions X% of the time'.īut back to the point, assuming that this is true, how does V3 help? Specifically, what can malware not do with V3 that it could do before? Given the data, how will this impact the threat landscape? I'd love data here! This is such a good area to share information on, as someone in security I'd really value that. The idea was initially that extensions have too many privileges and that malware can leverage those privileges for harm. I guess the biggest issue I have with V3 is I don't really 'get it'. if the tab/browser is in the background and paused, so that it wouldn't be handling event loop / network requests anyway. In that case Chrome could still want to evict the service worker i.e. I don't think that's a fundamental problem with the service worker model though-it seems easy to add a heuristic to cover this case like 'If the extension has a async network request event registered and there's an active tab open that that extension has permissions to view, be very cautious in evicting it'. Being able to do that for the vast majority of extensions that that helps, without requiring extension authors to 'opt in' to that change, is a very important goal.īut I agree that the heuristics for when to evict certain extensions (especially those with broad all-page access permissions) definitely remains tricky, and I hear you that Chrome's are currently too severe for this type of extension to be practical.

#UBLOCK ORGIN CODE#

I think most people would agree that it's important to add the ability to evict unused extension code from memory, which is what the fundamental move to a stateless ServiceWorker architecture is designed to support (since the previous stateful architecture required all extension background pages to be loaded regardless of whether they were actually doing anything). However I am willing to work on an MV3 version which does not suffer no CPU/memory efficiency issues, hence uBO Lite, which takes advantage of new possibilities in MV3 to be fully declarative, at the cost of sacrificing some capabilities. This happens repeatedly every few seconds or whenever you navigate to a new webpage.ĬPU/memory efficiency has always been a primary feature of uBO, and I can't release an MV3 version suffering such efficiency setback (this on top of matching algorithm not being fully compatible with that of uBO). When it re-spawns, the process's CPU and memory usage peaks, with memory usage shooting up to between 100-200MB. This is easy for anyone to see: open the browser's own Task Manager (Esc-Shift works) and notice how the service worker associated to AdGuard MV3 is regularly (every few seconds) evicted and respawn. Though it does its best to deal with the technical challenges which comes with MV3, the end result is poor efficiency- and reliability-wise compared to its MV2 counterpart. The AdGuard MV3 version which came out earlier this month shows this. They currently are when compared to their MV2 counterpart.

#UBLOCK ORGIN FULL#

I'm still worried that without an MV3-compatible version of full uBlock Origin, users are still going to assume that 'MV3 means that ad blockers are broken'.

Ublock orgin