Hacker Newsnew | past | comments | ask | show | jobs | submit | throwaway73945's commentslogin

So OP got Google to patch a harmless "issue" that could've been used by addon devs to bypass MV3 restrictions. Hope it was worth the $0.


Said bypass would exist for maybe a day max before getting nuked from orbit by Google. If anything, there was a non-zero chance OP would've gotten paid and he took it. I don't blame him.


They do it for free


I don't agree with this conclusion. Google is fully responsible for MV3 and its' restrictions. There's no reason to shift blame away from them.

Let's do a thought experiment: if OP hasn't reported it, what do you think would happen then? Even if different ad blockers would find it later and use it, Google would have still removed this. Maybe they'd even remove extensions that have (ab)used it from Chrome Web Store.


Indeed.

Perhaps a hobbyist would code “MV2-capable” MV3 adblocker for the fun of it, forking UBO or something, as a proof-of-concept. How much time would anyone spend on its development and who would install it when the max runway’s a few days, weeks, or months?


It seems someone's already done it. It requires some extra setup, but I managed to get it working on my machine.

https://github.com/r58Playz/uBlock-mv3


Associated Show HN post from 5 hours ago: https://news.ycombinator.com/item?id=44543094


Google isn't any less responsible just because somebody else also did something bad. Blame is not a zero-sum game

If we think your line of argument to the logical extreme, then being upset at at somebody who ratted out a Jewish hideout to Nazis would shift blame away from Hitler. That's obviously absurd. Both are bad people, and one being bad doesn't make the other less bad. And if one enables the other being more bad then that makes both of them worse, it doesn't magically shift blame from one to the other


> Maybe they'd even remove extensions that have (ab)used it from Chrome Web Store.

So now it's abuse to make the user's browser do what the user wants, for the user's benefit, to protect the user from, you know, actual abuse.


Well, I don't think so — hence the parenthesis. Although, I am pretty sure that's how Google looks at it, given all MV3 changes.


Really? You think Google is that dumb? As soon as any ad blocker that people actually use implements it, it'll be patched. It's not something you can exploit once and benefit from it forever.


Yeah, that was my take as well. OP did some free work for a megacorp and made the web a little bit worse, because "security, I guess" ?

Good job.


Sometimes you get $0, sometimes you get more. I would like to mention this stuff on my college applications, and even if I tried to gatekeep it, it'd eventually be patched. Not sure what your argument is here.


Incredibly impressive to do this sort of work before applying to college!


The author claims to be 8 years old in 2015. So that makes them still a teenager. It is pretty cool IMO.


Are you guys honestly arguing like the zero day industry would, for a vector that couldn’t be used by any ad blocking extension since Google has them under an electron microscope 24/7? To pick on a very young, enthusiastic programmer? What the hell??


Google would have found this bug if any extensions tried to rely on it and patched it instantly anyway.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: