Chrome’s next weapon in the War on Ad Blockers: Slower extension updates

Google's war on ad blockers is just gearing up, with YouTube doing its best to detect and block ad blockers and Chrome aiming to roll out the ad block-limiting Manifest V3 extension platform in June 2024. A new article from Engadget detailing the "arms race" over ad blocking brings up an interesting point regarding the power that YouTube and Chrome have in this battle: a dramatic update advantage over the ad blockers.

In addition to hamstringing Chrome's extension platform with no real user-centric justifications, Manifest V3 will also put roadblocks up before extension updates, which will delay an extension developer's ability to quickly respond to changes. YouTube can instantly switch up its ad delivery system, but once Manifest V3 becomes mandatory, that won't be true for extension developers. If ad blocking is a cat-and-mouse game of updates and counter-updates, then Google will force the mouse to slow down.

Chrome's "Manifest V3" makes dramatic changes to the Chrome extension platform. The current platform, Manifest V2, has been around for over ten years and works just fine, but it's also quite powerful and allows extensions to have full filtering control over the traffic your web browser sees. That's great for protecting privacy, speeding up the web, and blocking ads, but it also means you can download a browser from the world's biggest ad company and use it to block ads—and that was only going to last for so long.

Google's first attack on ad blockers is blowing up the "WebRequest API"—the primary API that ad blockers use—and replacing it with a more limited filtering API that Google has more control over. The new declarativeNetRequest API now has extensions ask Chrome to block a network request on their behalf, features arbitrary limits on the number of filtering rules, and puts limits on how effective individual rules can be.

We've covered this already. But we haven't talked about the other side of the equation: Ad block rules can't be updated quickly anymore. Today, ad blockers and privacy apps can ship filter list updates themselves, often using giant open-source community lists. Manifest V3 will stop this by limiting what Google describes "remotely hosted code." All updates, even to benign things like a filtering list, will need to happen through full extension updates through the Chrome Web Store. They will all be subject to Chrome Web Store reviews process, and that comes with a significant time delay.

Engadget's Anthony Ha interviewed some developers in the filtering extension community, and they described a constant cat-and-mouse game with YouTube. Ghostery’s director of product and engineering, Krzysztof Modras, said that YouTube is “adapting [its] methods more frequently than ever before. To counteract its changes to ad delivery and ad blocker detection, block lists have to be updated at minimum on a daily basis, and sometimes even more often. While all players in the space are innovating, some ad blockers are simply unable to keep up with these changes.”

uBlock Origin's FAQ on YouTube's ad blocker detection says, "YouTube changes their detection scripts regularly" and adds that ad block users might briefly be blocked for "brief periods of time after [YouTube changes] scripts and before we updated our filters."

When Manifest V3 becomes mandatory, those updates that need to arrive "at minimum on a daily basis" will no longer be an option. Limiting remotely hosted code sounds like a totally reasonable limitation until you realize that. like most Manifest V3 changes, it seems carefully crafted to cripple ad blockers more than other extensions. Is a filtering list update, which is essentially just a list of websites, really something that needs to be limited by the "no remotely hosted code" policy?

Firefox is basically being forced to support Manifest V3 extensions due to the popularity of Chrome, but it isn't shutting down Manifest V2 support any time soon. Firefox's Manifest V3 implementation doesn't come with the filtering limitations, and parent company Mozilla promises that users can "rest assured that in spite of these changes to Chrome’s new extensions architecture, Firefox’s implementation of Manifest V3 ensures users can access the most effective privacy tools available like uBlock Origin and other content-blocking and privacy-preserving extensions."

So since all filter list updates now need to go through the Chrome Web Store, how long does a review take? Multiple sources on the web put it at anywhere from a few hours to three weeks, depending on the whims of Google's review system. Keep in mind these timelines are before Google will dramatically increase the workload of Chrome Web Store reviews by requiring absolutely all changes to go through the review process.

That's the other key weapon. In the future, YouTube will be able to roll out new ad blocking updates whenever it wants, and the ad blockers' response can be slow-rolled by the Chrome Web Store. Ghostery’s Modras thinks this is the future that is coming, telling Engadget, “Through Manifest V3, Google will close the door for innovation in the ad blocking landscape and introduce another layer of gatekeeping that will slow down how ad blockers can react to new ads and online tracking methods.”

Google claims that Manifest V3 will improve browser "privacy, security, and performance," but every comment we can find from groups that aren't giant ad companies disputes this description. The Electronic Frontier Foundation has called Google's Manifest V3 communication "deceitful and threatening," and both the EFF and Mozilla have critiqued most of Google's user-focused justifications for the project. Both groups agree that Manifest V3 won't do much for security, since it doesn't stop what extensions usually get caught doing: spying on a user's browser history. Manifest V3 extensions have access to just as much data as before. Ghostery has a page on Manifest V3 warning that "nothing Manifest V3 introduces in its current state can help protect privacy" and calling the project "ultimately user hostile."

For now, Chrome still works like it always has, but Manifest V3 will start becoming mandatory in June 2024.