Bypassing Google's big anti-adblock update

So OP got Google to patch a harmless "issue" that could've been used by addon devs to bypass MV3 restrictions. Hope it was worth the $0.

Yeah, that was my take as well. OP did some free work for a megacorp and made the web a little bit worse, because "security, I guess" ?

Good job.

Sometimes you get $0, sometimes you get more. I would like to mention this stuff on my college applications, and even if I tried to gatekeep it, it'd eventually be patched. Not sure what your argument is here.

I don't agree with this conclusion. Google is fully responsible for MV3 and its' restrictions. There's no reason to shift blame away from them.

Let's do a thought experiment: if OP hasn't reported it, what do you think would happen then? Even if different ad blockers would find it later and use it, Google would have still removed this. Maybe they'd even remove extensions that have (ab)used it from Chrome Web Store.

Google would have found this bug if any extensions tried to rely on it and patched it instantly anyway.

The author claims to be 8 years old in 2015. So that makes them still a teenager. It is pretty cool IMO.

Indeed.

Perhaps a hobbyist would code “MV2-capable” MV3 adblocker for the fun of it, forking UBO or something, as a proof-of-concept. How much time would anyone spend on its development and who would install it when the max runway’s a few days, weeks, or months?

Really? You think Google is that dumb? As soon as any ad blocker that people actually use implements it, it'll be patched. It's not something you can exploit once and benefit from it forever.

Are you guys honestly arguing like the zero day industry would, for a vector that couldn’t be used by any ad blocking extension since Google has them under an electron microscope 24/7? To pick on a very young, enthusiastic programmer? What the hell??

Incredibly impressive to do this sort of work before applying to college!

It seems someone's already done it. It requires some extra setup, but I managed to get it working on my machine.

https://github.com/r58Playz/uBlock-mv3

Associated Show HN post from 5 hours ago: https://news.ycombinator.com/item?id=44543094

Said bypass would exist for maybe a day max before getting nuked from orbit by Google. If anything, there was a non-zero chance OP would've gotten paid and he took it. I don't blame him.

> Maybe they'd even remove extensions that have (ab)used it from Chrome Web Store.

So now it's abuse to make the user's browser do what the user wants, for the user's benefit, to protect the user from, you know, actual abuse.

Well, I don't think so — hence the parenthesis. Although, I am pretty sure that's how Google looks at it, given all MV3 changes.

They do it for free

Google isn't any less responsible just because somebody else also did something bad. Blame is not a zero-sum game

If we think your line of argument to the logical extreme, then being upset at at somebody who ratted out a Jewish hideout to Nazis would shift blame away from Hitler. That's obviously absurd. Both are bad people, and one being bad doesn't make the other less bad. And if one enables the other being more bad then that makes both of them worse, it doesn't magically shift blame from one to the other