New permissions

[mozmorris]

Noted in the 0.9.8.2 release that uBlock requires a new permission "privacy".

Is this warning related? "Read and change all your data on websites you visit."?

[gorhill]

Yes, Chromium will inform you when a new permission is requested by an extension.

[mozmorris]

Why does it need to "Read and change all your data on websites you visit"?

[gorhill]

Ok, first, the new permission is related to "Change your privacy-related settings", not "Read and change all your data on websites you visit", this last one has been required since day 1 of uBlock.

Please read https://github.com/gorhill/uBlock/wiki/About-the-required-permissions, it's all explained.

[mozmorris]

Thanks @gorhill.

[LazyBoot]

Please read https://github.com/gorhill/uBlock/wiki/About-the-required-permissions, it's all explained.

Why is this not linked on the chrome web store?

[HenrikBengtsson]

Came here for same reason as OP. 👍 for traceability and explanation.

[os6]

I think that explanation should be displayed in a more prominent location, as I suspect a lot of people will be searching why these new permissions are required. I just got this chrome notification as well and found this. Thank you for everything you do @gorhill

[gorhill]

I put a link on the front page of the project and added more details.

I didn't foresee this would disable uBlock etc. and cause a lot of questioning.

I kind of take for granted people trust uBlock since absolutely all aspects of it are developed in full public view (I also completely refuse to engage in private emails for anything related to uBlock), but reality is that not everybody is aware of the open nature of the project, so I should have been more diligent.

I try to avoid adding permissions and will be glad to remove any were possible (downloads was removed a while ago), but in the current case it's definitely for the benefits of users given that the setting "Prefetch resources to load pages more quickly" is enabled by default and it's easy to forget about it -- assuming one know its consequences in the first place.

[HenrikBengtsson]

@gorhill, there are always apps/extensions out there that get take over, are sold etc. I had awesome apps that sold out to the dark side. It has happened before and will happen again. Then when searching web for the recent permission updates/notification and I find that uBlock was dropped from Chrome Store with first paragraph reading "Raymond Hill (Gorhill), the creator of uBlock, left the project", then I as user of course get suspicious. There is only so much you can do about this - I guess all you can do is to make the information as easy as possible to find.

I'm glad to see that this is still a sound open-source project, but I just wanted to share what it could look like from a user's perspective, especially since this great little extension normally just sits there silently without making a single sound. Thanks for your great work.

[LosD]

Soo... Prefetch, it is now impossible after installing uBlock?

That is honestly an incredibly stupid decision. Not only are you destroying a major performance boost on most websites, you are doing it for something completely unrelated to blocking ads.

Oh well, it was good while it lasted.

[gorhill]

completely unrelated to blocking ads

Front page of uBlock:

uBlock Origin (or uBlock₀) is not an ad blocker; it's a general-purpose blocker.

And it will do whatever it takes to do its job competently. Just like Privacy Badger also requires exactly the same permissions.

[gorhill]

major performance boost

You have nothing to back "major performance boost". In the context of a blocker, those created/established but otherwise unused connections are actually pointless overhead. I don't deal in the realm of made up claims, I rely on real data from real benchmarks with rigorous methodology. Your claim of "major performance boost" is completely baseless.

Oh well, it was good while it lasted

I won't compromise user's privacy for user counts. I am sure most other blockers out there care more about user counts, but it's completely irrelevant to me as the whole project is driven with users' interests in mind first.

[mateon1]

The last update required access to my browsing history. Why is that?

[gorhill]

The last update required access to my browsing history

Apparently Chrome is not wording things correctly. uBlock does not ask or care about your browsing history. It does however intercept all network requests to evaluate whether they need to be blocked. All blockers requires these permissions in order to work.

The only change with last version was to add a new permission, it's explained (now thoroughly) in the release notes.

[mateon1]

@gorhill Alright, might be a mistranslation then. The changed permissions in Polish clearly state access to browsing history. The exact wording is "Odczytywanie historii przeglądania.", which means reading the browsing history.

[LazyBoot]

So does the English

[gorhill]

I only added privacy.

"Reading your browsing history" was probably already reported before, it's just that Chrome reports all the permissions, not just the new one, "Change your privacy-related settings" in the current case.

"Reading your browsing history" is probably related to the tabs and/or webNavigation and/or webRequest permissions, all of which have been in uBlock since first publication -- they are required for uBlock to function properly, just like other blockers.

[szym]

I'm guessing it's related to tabs. This change in displayed warning is most likely related to this Chromium CL: https://chromium.googlesource.com/chromium/src/+/63b2854330a8432e51e041b988cb397aa7a21463

This Chromium CL (available in 44 - beta but not yet in 43 - stable) enables the new permission system: https://chromium.googlesource.com/chromium/src/+/7b45a34b0d0da16f07829b471d01d878ac170da2

[Tkael]

As a privacy-conscious individual, I want to control my own privacy settings. I can't accept the new permissions because ceding control to this extension runs contrary to the personalized privacy control that I am trying to achieve.

A better solution, in my opinion, would be to add a screen when the extension is installed and/or in the configuration options. The screen would inform me of the problems with prefetching, advise disabling prefetching to maximize the extension's effectiveness, and explain how I can disable prefetching on my own account. It would also leave me in complete control of my own privacy settings.

[gorhill]

It would also leave me in complete control of my own privacy settings.

How will you disable hyperlink auditing? That setting is not available from Chrome UI.

I can't accept the new permissions

Sorry but it stays.

In the long run it will prove the right thing to do: it allows uBlock to work against those dark patterns, i.e. those dubious browser settings which work against the user by default (opt out), where only the benefits are disclosed up front, while the negative consequences are tucked away from view, if disclosed at all. I consider Chromium's prefetching to be such a dark pattern setting.

To worry that uBlock can control Privacy settings while you give the extension the ability to read all your network traffic (webRequest, webNavigation, tabs) and the ability to inject scripts in pages (contentScripts) is nonsense.

In 0.9.8.3 (now available in Chrome store) you can re-enable pre-fetching if you wish, at least now (0.9.8.4) I provide a link directly to the negative consequences of that feature, and by just having the setting in there makes people become aware that there is something of concern with that feature. I have no doubt that data miners would be unhappy that the disabling of pre-fetching is at risk of becoming more widespread -- every bit of data matters to them.

[Tkael]

How will you disable hyperlink auditing? That setting is not available from Chrome UI.

Actually it is if you go to the chrome flags: chrome://flags/#disable-hyperlink-auditing, click 'disable'