Permissionless philosophy

[TylerLoch]

I very much respect the conviction behind uBlock Origin, and have been happily managing/using it in my Google-based organization for years.

Certainly I understand the limitations placed on MV3 extensions, and appreciate the reasoning behind making uBlock Origin Lite permissionless by default (with manual elevation by the end-user), but that manual approach makes it difficult to effectively deploy by the thousands to users of varying skillsets and ages, especially when some are children.

I'd love to see a uBlock Origin Lite variant available that has full host_permissions baked into manifest.json and Complete filtering by default, so organizations can deploy the best level of content blocking without user intervention. ("uBlock Origin Lite...Max"? or "uBlock Origin Lite for Policy Deployment")
Like the uBlock Origin Development build extension, it could be unlisted to prevent confusion for public users.

[gorhill]

See #113, which itself refers to w3c/webextensions#260.

My view is that the browser should provide a way to grant host permissions to an extension such that the dialog does not come up. This would benefit all extensions, not just uBOL, so best is to ask browser devs for this feature.

[TylerLoch]

Speaking specifically for Chromium browsers, in a managed environment where extensions are applied by policy (be it GPO or Google Workspace), users never receive permissions dialogs for them, as it is assumed that consent is "granted" by management.

I've tested this with a hack of uBOL, deployed to a group in my organization (in Google parlance, "force installed").
This variant runs at the Complete blocking level without any dialog or user intervention needed — as long as it's deployed by policy — just like the original uBO.

[gorhill]

You are setting host_permissions to <all_urls>, so it is expected that there will be no request dialog for permissions.

What I am suggesting is that the browser itself should offer to set host_permissions through policy, such that extension developers do not have to maintain two versions for the sake of deployment.

Chrome reference documentation states that using optional permissions is a best practice, hence extension developers abiding to this best practice shouldn't be burdened by the need to maintain two versions of their extension. Browsers should really offer a way to grant those optional permissions through policy to avoid the dialog.

[toasty-teacher]

I definitely agree that the browser should provide this option, but unfortunately I do not foresee Google doing this. A way to implement permissionless Complete protection via policy would be nice. In an environment managed by group policy/active directory, it's already assumed that permissions have been managed by the company and IT. The user needing to activate it only complicates things.

[gorhill]

Best is to +1 the related Chromium issue to make it more likely to be of interest to Chromium devs: https://issues.chromium.org/issues/374073122.