,
7 tweets,
2 min read
Read on Twitter
I’ve lost a lot of trust in Google since they made logins mandatory in Chrome for reasons that didn’t make sense. Now they’re proposing a new security model that threatens ad blockers. google.com/amp/s/www.tech…
The Chrome devs are good people, but are proposing basically three lines of counterargument.
1. This is only a proposal, relax.
2. Regrettably, it’s necessary for security.
3. Unfortunately it’s too expensive to make exceptions for popular ad blockers.
I’ll walk through these.
1. This is only a proposal, relax.
2. Regrettably, it’s necessary for security.
3. Unfortunately it’s too expensive to make exceptions for popular ad blockers.
I’ll walk through these.
1. “It’s just a proposal, posted for feedback.” This means now is actually a good time for people to *provide* feedback. In the past, Google has made unilateral changes, and refused to significantly walk them back when people revolted.
2. The argument for security isn’t half-baked. The idea is to prevent script injection from malicious extensions.
The problem here is that ad networks evolve their techniques, so this kind of script injection seems necessary. If you block it, you prevent some attack vectors. But you also potentially change the balance of power in ad blocking.
3. There’s a reasonable compromise that has Google deploy these changes, but make exceptions for large and popular ad- and tracker-blocking extensions. But the devs seem inclined against this.
The “don’t make exceptions” argument has two prongs. First, it’s too expensive to manually review every extension (very true). But secondly, it’s unfair to make exceptions for popular extensions. So the only alternative is to disrupt all ad blockers. 😥
