Google is already pushing WEI into Chromium

https://github.com/chromium/chromium/commit/6f47a22906b2899412e79a2727355efa9cc8f5bd

by topshelf • 3 years ago

1376 786 3 years ago

github.com

topshelf2• 3 years ago

Disappointing to see such a 180 on 'don't be evil'.

I'm recommending Mozilla Firefox to all friends and family.

fps_doug2• 3 years ago

I do, and I keep having those tiring conversations, but it's really hard to get the point across in layman's terms. I have enough friends in tech who stick with Chrome out of convenience instead of just falling back on it in case something actually doesn't work in Firefox. how do I convince tech illiterate people of doing this?

erklik• 3 years ago

It's faster. The same old justification that was used to switch to Chrome can now be used for Firefox.

AdamN2• 3 years ago

For the tech illiterate recommend Safari. For tech people, appeal to their privileged position and the importance of defending the web by choosing any other browser (or Safari).

Both users can keep Chrome installed as a fallback - that will help with convincing too.

jckahn• 3 years ago

You can’t, realistically. I don’t think there’s any repeatable or effective way to make non-nerds (AKA most people) care about this sort of thing.

Buttons840• 3 years ago

Start referring to them as "Chrome developers" -- what's this "web" thing you keep talking about?

hummingly• 3 years ago

Whenever a new device needs to be setup for my parents, I just install whatever I use (Firefox in this case). Then I show them the things they need on a day by day basis. The problem are people who did grow up with tech. They will say things like it will take too long. In cases like this you need to manipulate them based on their personality.

maxloh• 3 years ago

Unfortunately Firefox doesn't have a good UI/UX after all.

The last time I checked, multiple profiles support is somehow half-baked.

wsgeorge5• 3 years ago

Not sure why you're getting downvoted, but this is a big deal IMO. We're here because Chrome has been the better product for a long time. Firefox not doing things people want well enough will hurt its adoption, which will impact its capacity to influence the Web.

Add to Mozilla's perceived not-very-good management and you have a death spiral on your hands, and more power to Google and Apple to shape the Web towards their interests.

FWIW, first-class profiles support matters a lot: https://medium.com/sort-of-like-a-tech-diary/profiles-the-on...

mozball3• 3 years ago

Multiple profiles is fully supported. It's just hidden behind a clunky UX.

Also check out firefox containers which is to profiles what docker is to virtual machines.

realharo2• 3 years ago

Firefox is also missing a don't allow any website to play audio unless explicitly enabled setting (mute tabs by default, except on allowed sites), as far as I can tell.

slowmovintarget2• 3 years ago

I was just able to finally move my wife back to Firefox. Chrome just stopped working on her Mac. Wouldn't pull up a page. Everything else worked.

She's now happily using Firefox with a non-hobbled version of uBlock Origin.

smolyeet• 3 years ago

I don’t think this indicative of chrome being bad on Mac. What did you try to resolve the issue?

Because I could say chrome always works for me (which would be true in my experience), but that doesn’t mean it always does.

lemper• 3 years ago

this is where you should vote with your wallet and feet. and I think it's not really a stretch to ask Google's engineers who work on chrome/ium to get a job somewhere else.

djaychela• 3 years ago

I think it would be interesting to get their views on it. I wouldn't be surprised if a lot think this is a good idea. Not that I agree, but I think it's unlikely that everyone sees it the same way as those outside the organisation.

fps_doug2• 3 years ago

Obviously, if you get paid to implement this you don't want the cognitive dissonance of knowingly doing something bad, so I'm sure those folks have already laid out their justification for this technology.

I wish Google could and would make Chrome closed source. It would at least give all those rebranded Chromiums (Opera, Vivaldi, Brave) a strong reason to reconsider their choice of engine, or at least maybe work together on a more divergent fork of it that stays away from Google's evil stuff.

serial_dev• 3 years ago

"It is difficult to get a man to understand something, when his salary depends upon his not understanding it".

I imagine it's hard to push back against it even internally. Not to be jaded, but one or two people raising a stink about it will only achieve them screwing up their career prospects within Google.

ailef• 3 years ago

Can somebody explain what are the practical implications of this?

gostsamo2• 3 years ago

If adopted by publishers, the web will be closed to everyone but allowed browsers on allowed OSes on allowed hardware. No ad blockers, no extensions, no customizations beyond what the few chosen browsers allow explicitly.

criddell• 3 years ago

I have a website so I guess that makes me a publisher. Say I wanted to block Chrome on Windows and Firefox on Debian? How would I use this?

csomar• 3 years ago

You'll need an "approved" browser and potentially "approved" hardware to access the web. Since Cloudflare is on this too, most of the web will be locked for anyone who doesn't use mainstream hardware.

leesalminen• 3 years ago

But why do they care so much about this? Is it only for DRM on media playback?

thejosh2• 3 years ago

Cloudflare want to be the internets backbone. And they've honestly succeeded.

Now it's almost impossible to access websites in an automated way -- the CTO posted you can just email him (https://news.ycombinator.com/item?id=34639212) and he'll sort it. Because that scales.

edit: Mispoke about the CTO, said he would approve you, I was wrong. Apologies.

Their DNS is "privacy focused", but they provide "aggregated results" of domains. How is that privacy focused?

Cloudflare came from the approach of being a developers friend ("Look! SSL is now free!") but was given the internet on a silver platter.

xyzal2• 3 years ago

This needs to get to the European Parliament, we need legislation to protect web interoperability ASAP.

knaik943• 3 years ago

From a very top level view, this gives Google, and other websites, the ability to block requests from devices/browsers they don't approve.

This implements device level verification of the code running your browser. If the device identifies as something Google, or other implementing websites, don't approve, you'll get an error similar to how you see 404 errors for missing/wrong links.

smallstepforman• 3 years ago

The Browser application needs to pass a binary image check, and if the browser hash doesn't match Google database, you cannot proceed to the website (since your browser may be corrupted). A major big deal for non main-stream browser, and for non Google browser developers, extension developers (eg. AdBlock), etc. In summary, some websites (like banks, Netflix, etc) will no longer be available for non mainstream browser users. Also, even if you're using Google Chrome, you may need to run the latest version to satisfy the hash check. Every day, the number of broken websites will continue growing until all non Google Chrome users have a blocked internet.

nonane• 3 years ago

Can you please explain why a third party browser can’t lie about its hash, just like it can lie about it’s user agent?

px434• 3 years ago

Nothing will happen. People have been making the same complaints about every new crypto standard for decades, and yet here we are. TPMs are a thing, EME has been around for over a decade now, DRM on the web is as pervasive as it's ever going to get, and yet no one's user experience is any worse than it was before these technologies existed.

jiggawatts2• 3 years ago

Yes, and I am still unable to play 4K Netflix on a PC that has been able to play 4K videos for about 7 years now.

It's permanently blocked to prevent piracy, or something, mumble, mumble...

jjulius• 3 years ago

DRM on the web is as pervasive as it's ever going to get...

Apple and Google only just now implemented this kind of web DRM, which absolutely can have further restrictions added to it. Careful with your absolutes.

asciimov• 3 years ago

Unblockable ads, sites can serve you data that you can’t manipulate or copy, micropayments can exist, invasive surveillance.

Surveillance is possibly the worst of the bunch. They say it’s just to do a better job of serving ads, but that’s only the tip of the iceberg. Governments could easily use it to know and track everything you do online. Just wait till the next elected nut job wants a list of everybody that has ever looked at or searched for a certain type of information, maybe they don’t like that you looked up info on abortions or lgbt info, now they can know the full extent of what you saw and when.

Ads will be worse. You think YouTube ads are bad now, just wait till you can’t visit any page without the mandatory viewing of their ads. They can require a cam installed to make sure your eyes are on the ad, helpfully pausing the video when you look away.

beckler• 3 years ago

Getting some "PLEASE DRINK VERIFICATION CAN" vibes...

https://imgur.com/dgGvgKF

DoItToMe81• 3 years ago

ENORMOUS fingerprinting potential and capability to disrupt the user's ability to block content. Or access it.

amalcon2• 3 years ago

This is essentially a backdoor attempt to TiVoize[0] web browsers. The only difference is that, instead of directly using hardware to prevent you from running a modified browser, the intent is to use network effects to accomplish the same thing.

[0] https://en.wikipedia.org/wiki/Tivoization

gorhill• 3 years ago

To turn your browser (an agent acting on your behalf) into a proprietary application (an agent acting on behalf of a website) -- i.e. the equivalent of forcing you to install a proprietary application in order to visit a website.

omoikane• 3 years ago

If websites wanted this feature, and the choice is between Chrome implementing it versus me installing proprietary software, I would rather choose Chrome, especially since Chrome is implementing it in the open.

There are already various services that require proprietary applications to be installed, most of which are closed-source with dubious security track record. Replacing those propriety apps with a common web browser is not necessarily a bad outcome.

Personally I am voting with my money and just avoid services that are user-hostile, independent of which user-agent I use to access those services.

c0l0• 3 years ago

I feel like I have to repeat this, since so much is at stake here, where it is about the preservation of the web as we know it today, at the peril of having it turned into yet another walled garden:

The only way around the dystopia this will lead to is to constantly and relentlessly shame and even harass all those involved in helping create it. The scolding in the issue tracker of that wretched "project" shall flow like a river, until the spirit of those pursuing it breaks, and the effort is disbanded.

And once the corporate hydra has regrown its head, repeat. Hopefully, enough practise makes those fighting the dystopia effective enough to one day topple over sponsoring and enabling organisations as a whole, instead of only their little initiatives leading down that path.

Not a pretty thing, but necessary.

doliveira3• 3 years ago

Yeah, financial and social pressure is basically the only weapons we have against corporations when regulations don't exist. And honestly, financial pressure doesn't work at this scale or in this case.

mwint• 3 years ago

Regulation is just social pressure enforced by guns.

jjoonathan6• 3 years ago

Yes, but this will be an uphill battle. Every campaign must be financed, so every politician must effectively be vetted by monied interests. The same monied interests that we see here on a strategic offensive against the rest of us. Regulators will tend to be sympathetic to them, not us, until things get really bad.

Is EFF still the place to send money?

hartator• 3 years ago

when regulations don't exist

It’s very likely governments will make this mandatory if they have the chance to regulate over this.

xeonmc• 3 years ago

Speaking of regulations, I think an angle that can help spread awareness to the general public is casting this as essentially being the equivalent of SOPA/PIPA but being pushed by Big Tech rather than Big Gov.

amalcon2• 3 years ago

If you live in a representative democracy, and Google has a presence there, contact the offices of those representatives. These things don't always seem like they matter, but sometimes they do. Big tech generally (and Google specifically) is a pretty popular target right now -- seemingly worldwide and across most ideological divisions.

api• 3 years ago

Financial pressure won't work because you are not Google's customer. Google's customers are its advertisers.

alexb_• 3 years ago

Financial and social pressure are the only ways you convince anybody to do anything that isn't biological.

foobarbecue2• 3 years ago

Is https://github.com/RupertBenWiser/Web-Environment-Integrity/... the best place to shame?

elbybasolis• 3 years ago

Attempting to open an issue yields this message:

"An owner of this repository has limited the ability to comment to users that have contributed to this repository in the past."

jjoonathan6• 3 years ago

Yoav Weiss is closing concern threads, calling them "spam."

Ben Wiser ( https://benwiser.com ) turned off comments altogether.

shmde• 3 years ago

https://github.com/chromium/chromium/commit/6f47a22906b28994...

Here.

38• 3 years ago

https://support.github.com/contact/report-abuse?category=rep...

dang10• 3 years ago

the best place to shame?

Please don't do this here. It's not what this site is for, and destroys what it is for.

Edit: I suppose I need to add—no, we're not pro-$MegaCorp or pro-$web-destroying-dystopia. We're just trying to have an internet forum that doesn't suck, and you guys need to make your substantive points without degenerating into mob behavior.

https://news.ycombinator.com/newsguidelines.html

ParetoOptimal• 3 years ago

Has anyone compiled a list of those pushing forward and/or working on WEI?

mwill• 3 years ago

https://github.com/RupertBenWiser/Web-Environment-Integrity/...

larata_media• 3 years ago

I agree with your overall ideal of free access to information but I disagree that harassment is a necessary or even effective option to push against this. I think the harassment puts us in a category of ineffective, bitter malcontents and that’s not what we are.

We are capable of going to elsewhere to free and open access to information, and we would be better off spending our energy on positively influencing others to follow us in that direction. They can’t take away tcp, http, ftp, irc and all the other protocols that these megaliths have built their empires on, and we can still use those tools even if it’s a demoralizing regression to move back to the basics. Giants like google, Amazon and others depend on our unwillingness to rebuild. Let’s use our efforts and our ingenuity to show them that they’ve underestimated us.

We have the tools, we have the knowledge. Let’s be builders instead of petty complainers.

LikelyABurner• 3 years ago

We’ve been doing that for years, larata_media. Decades, even.

And what do we have to show for it? Our tools power their botnets and they flaunt the CoCs in our faces when we try to do something about it as “not constructive”.

MetaMalone• 3 years ago

We must believe in ourselves. We are too quick to be cynical about the future of the web - too quick to forget our ingenuity in the face of adversity.

pseg134• 3 years ago

Well we can build something too but first we need to get rid of these people.

MSFT_Edging7• 3 years ago

Every time you see someone abandon an open source project, one of the biggest reasons is people suck and ask too much, harass, etc.

Therefore, one of the most efficient ways to kill a dangerous new standard is to endlessly harass anyone who works on it.

Sorry, the poor individual can not hide from their responsibility.

otikik• 3 years ago

https://www.purewow.com/wellness/what-is-tone-policing

nvm0n1• 3 years ago

a category of ineffective, bitter malcontents and that’s not what we are

There are enough top voted people demanding harassment in this and other threads to say that well, maybe that's what HN is, actually.

zeteo• 3 years ago

It won't do anything. You don't think they've anticipated random angry outbursts going into this? Plus, the people you're harassing are simply implementing a policy that they don't have the power to change.

The only pressure that Google has been shown to consistently respond to is political. Get a couple of senators (... of the right party) to send them a mild rebuke and they will indeed retreat a little (... and try something else later). But that's a lot harder than posting angry comments until the next piece of outrageous news comes along, isn't it?

cliffy• 3 years ago

I was just following orders!

userbinator3• 3 years ago

Directly sending a message to the implementers doesn't preclude involving politicians in this too, and I absolutely agree that the latter should be involved.

JohnFen8• 3 years ago

the people you're harassing are simply implementing a policy that they don't have the power to change.

I'm not on board with harassing people (sad that I have to include this disclaimer).

That said, the people are not simply implementing this. They're actively and publicly justifying and defending it.

throwaway71271• 3 years ago

what exactly do you want to preserve from the web as we know it today?

let it burn

focus on building something new, new protocols, new networks, new browsers

swayvil• 3 years ago

Something that isn't dependent upon the whims of princes.

nfw27• 3 years ago

Tiktok is literally controlled by the CCP. If consumers don't care about that, they aren't going to care about DRM.

anonym292• 3 years ago

Tech-literate folks really should make a concerted effort to move to our own darknet, something like freenet or I2P, to recreate the internet before the advent of mass adoption of smartphones by the public. Forums, IRC, vent/TS, webrings, XHTML 1.0. No WebGL. No Canvas. No WebAssembly. No damn WEI.

Normies can f&$% off and enjoy the data-mined, DRM'd, ad-infested, CCP-propagandized, upload-your-photo-ID-to-post-here, privacy-free dump their illiteracy, careless disregard for harm, and data exhibitionism fetish has allowed the clearnet to turn into.

Mountain_Skies3• 3 years ago

All they'll have to do is make a pronouncement of support for some trendy social issue and everything will be forgiven and forgotten. Virtue signaling has turned into the most effective corporate tool for manipulating society into allowing corporations to do almost anything they want. And the public's addiction is so strong that even when this is pointed out and agreed that it is happening, the addiction still must be fed, so corporate sociopathic parasitism on society continues with the joyous approval of society in general.

orangecat• 3 years ago

Yeah. I won't be surprised if the marketing for this misfeature pivots to "it will prevent harassment of marginalized groups".

userbinator3• 3 years ago

Indeed. Negotiations have already turned out to be completely ineffective. The next step is war.

Cory Doctorow came up with the phrase "The War on General-Purpose Computing", which describes the situation perfectly.

teddyh4• 3 years ago

Even before that, there was “The Digital Imprimatur”: <https://www.fourmilab.ch/documents/digital-imprimatur/>

PaulDavisThe1st• 3 years ago

He came up with it more than 9 years ago, during which time no such war has been generally apparent, and if anything, the conditions for general purpose computing have improved.

insanitybit5• 3 years ago

That sounds entirely unhelpful. They can just close the issue tracker + people will obviously just move on. This sounds like the Reddit 'blackout' that did nothing and is already forgotten.

What we really need is for the collective browser vendors to refuse to implement this and, if Chrome pushes forward, to bring Google to court over it. Nothing short of legal intervention is going to help here.

zoul• 3 years ago

Similar feature is already in production Safari, alas: https://httptoolkit.com/blog/apple-private-access-tokens-att...

shadowgovt5• 3 years ago

What sort of regulation do we imagine a government putting into place to stop this? If anything, governments tend to lean in favor of identification and verification systems because they make corporate commerce run more smoothly.

account42• 3 years ago

Or we could show Chrome users what the future will look like for alternative browsers - by blocking Chrome now.

lopis• 3 years ago

constantly and relentlessly shame and even harass all those involved in helping create it

If this ever helped, we wouldn't have absolutely unethical products created. Turns out people's morals have a price tag, that Google and others are willing to pay their employees.

rightbyte• 3 years ago

Well at least you can increase the price tag for Google, Facebook etc by taunting their employees as bad people.

It is quite incredible actually, because it was not many years ago that working at Google had this coolness factor to it. Hopefully, it is a broader change of view, other than mine?

Mindwipe2• 3 years ago

The battle is already lost legislatively.

Multiple US states, France, Germany and the UK are going to make the web unnavigable unless you type your credit card number or scan your face for age verification in two out of every three sites.

We are going to need to at least try to create ways to secure those credentials in as zero trust model as possible.

(Note that the legislation is a disaster, but it is done. Nobody paid enough attention. It has passed or will pass in weeks.)

prox3• 3 years ago

Time to build a fresh web. Get me my hypercards!

magic_hamster• 3 years ago

I don't like Google's grasp on so many vital parts of the web but somehow, it seems like google is actually in trouble.

AI is going to completely change search if it hasn't already, and google is not even close to compete in this space.

Video has some massive competition from the likes of TikTok. Anyway, YouTube isn't the only option on the market.

Gmail is still popular but since google has been pressuring users to pay, it's been easier than ever to find a reason to try another service.

Chromium can always be forked and have some parts removed or added, and as we all know quite a few browsers do this, some are quite popular.

Is google also losing IOS ads like Meta? If they do, that's another reason for alarm for them.

I'm not sure google is in the best position for the future and WEI is not going to be their golden ticket either.

And, if your prediction that web will change actually comes to pass, well then it'll be just another cycle for this space that has changed countless times since the age of dialup. The web is going to change, again and again, but as long as people are still free to set up a server and let the world access it, we can still do what we like with it.

knewter• 3 years ago

Except increasingly the world will access it via drm aware browsers because their banks require it, and the open web audience will subsequently dwindle.

The Halloween memos called this "Embrace, Extend, Extinguish". Google didn't just ignore the moves that provided M$ dominance.

teddyh4• 3 years ago

To paraphrase John Maynard Keynes: Google can stay irrational a lot longer than you or I can retain our freedoms. And when the precedents have been set, a new normal has been established, and when/if Google does finally fail, the next actor will step in and keep those freedoms from us all.

pornel3• 3 years ago

Corporations will dismiss all of that as asshole Luddites, and do it anyway. You're not Google's customer. The advertisers are.

The only way to stop Google from treating the Web as their own OS is to take that power away from them, by switching to other browser engines.

pornel3• 3 years ago

And we have this crappy paradox that Mozilla is held to an impossibly high standard. People want to burn them to the ground for daring to use Google Analytics, or the Pocket acquisition, and keep using a 100% Google browser, with preferential integration with all of Google's services/protocols/APIs.

anon7331• 3 years ago

Ah yes. The "Uncle Ted" approach, but a bit more mild. At what point do we go full Ted?

verisimi• 3 years ago

Imo, the idea that this is about selling advertising and maintaining market share is being used as a false justification. This is not about being able to drive users to ads.

The bigger picture is that Google et al are actually part of the control structure. The governance system wants deanonymised Internet. Corporate interests are how this is being promoted - government legislation would be a harder pill for the masses to accept.

But all the recent mega changes tell us (Elon buying twitter, etc) tell us that this is on the way. Apparent anonymous internet will be sandboxed. Knowing everything about everyone all the time, and having that data being crunched by ai's is an amazing, audacious goal, that seems close to being achieved.

hot_gril8• 3 years ago

Just saw https://github.com/chromium/chromium/pull/187/files

It's even funnier with the auto-reply "Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA)."

smashah• 3 years ago

Oh but that would be against the respective projects' code of conduct. /s

dang10• 3 years ago

constantly and relentlessly shame and even harass all those involved in helping create it

Not on HN, please. I realize that you're trying to protect something you care about (and that maybe we all care about) but this leads to ugly mob behavior that we don't want and won't allow here.

https://news.ycombinator.com/newsguidelines.html

cmrdporcupine7• 3 years ago

Is adding a feature-flag really the same as pushing the feature into the browser immediately? It can easily just be part of a SWE needing the flag in place in order to continue work without impacting anything else, even if that thing never ever launches.

In general Google engineers don't tend to work on branches, especially long-running ones. Incremental small code reviews are the expectation. The general process would be to stick things securely behind flags and continue development without turning it on, even if it never ever launches.

Not saying this work should be done -- it shouldn't -- but code being pushed is not the same as "we're going to make this happen tomorrow, no matter what."

knaik943• 3 years ago

Yes, because a feature flag shows intent to implement it before any real discussion have taken place with privacy and non-corporate security advocates.

orlp• 3 years ago

Is adding a feature-flag really the same as pushing the feature into the browser immediately?

"Don't mind me guys, I'm barely boiling the frog."

BlargMcLarg2• 3 years ago

When was the last time you heard Google or anything Google-related backing down from getting their paws in deeper? It's no longer a fallacy when there's a sign next to the slippery slope.

jvolkman• 3 years ago

https://killedbygoogle.com/

cmrdporcupine7• 3 years ago

I worked in that code base. Things were feature flagged then murdered all the time.

Xelbair• 3 years ago

Is adding a feature-flag really the same as pushing the feature into the browser immediately? It can easily just be part of a SWE needing the flag in place in order to continue work without impacting anything else, even if that thing never ever launches.

Yes, because that's a such anti-consumer issue. It shouldn't exist in the first place, it should never be merged to master. There's no reason to not keep it on a separate branch if you don't intend to use it.

cmrdporcupine7• 3 years ago

Honestly, if the work is going to be done (again it should not be done), I'd rather have it out in the open.

duerra• 3 years ago

Companies don't usually make a habit of having their employees work on something they don't intend to pursue.

nullindividual• 3 years ago

I wish that were true in corporate America! Think of all of the waste that would eliminate.

cmrdporcupine7• 3 years ago

Yes, they actually do. Or rather, there is no "company", there are thousands of different decision makers.

My point is that at some other company (e.g. Apple) it would be done in secret on a branch somewhere, then big-bang merged later.

Google's process doesn't tend to work that way.

gmerc5• 3 years ago

What you think they push the flag without the intention to make it happen?

cmrdporcupine7• 3 years ago

Because I worked at Google. People get tasked on working on things that get killed later all the time.

Don't underestimate how much money they have to burn and how incompetent upper management is at making hard decisions and planning.

wasmy• 3 years ago

Another tame article in The Register:

https://www.theregister.com/2023/07/25/google_web_environmen...

Despite the spec's half-baked state, the blowback last week was swift – in the form of a flood of largely critical comments posted to the WEI GitHub repository, and abuse directed at the authors of the proposal. The Google devs' response was to limit comment posting to those who had previously contributed to the repo and to post a Code of Conduct document as a reminder to be civil.

The usual way to deal with opposition these days.

ben_w2• 3 years ago

Limiting posting and asking for civility is the only way for individuals to meaningfully engage with even a mere thousand others. Nothing about the human mind was meant for social internet at the scale of the internet, where there are more distinct voices than you have heartbeats in a lifetime.

notpachet• 3 years ago

more distinct voices than you have heartbeats in a lifetime

Quotable!

ynniv• 3 years ago

Yes, and the response should be to make the repo private. Only allowing interactions from previous contributors to a public repo is disingenuous.

btown2• 3 years ago

Also worth noting that this locks reactions (thumbs up, hearts, etc.) - providing plausible deniability that "only a small number of people raised concerns about specificTopicX." Journalists should be more aware of this!

On a separate note, for journalists and others who wish to communicate with the spec's author directly, his public website (which lists a personal email) is one of the other repos on the Github profile under which the specification was published. It's painfully absurd that he wrote this sentence in 2022 [0]:

I decided to make this an app in the end. This is where my costs started wracking up. I had to pay for a second hand macbook pro to build an iOS app. Apple’s strategy with this is obvious, and it clearly works, but it still greatly upsets me that I couldn’t just build an app with my linux laptop. If I want the app to persist for longer than a month, and to make it easy for friends to install, I had to pay $99 for a developer account. Come on Apple, I know you want people to use the app story but this is just a little cruel. I basically have to pay $99 a year now just to keep using my little app.

[0] https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-...

user3939382• 3 years ago

If you want to protest the knife we're driving into your stomach, you can do so, but we need to see credentials and civility.

JohnFen8• 3 years ago

And limit your protesting to technical critiques about how the knife is made, not whether it should be in your stomach.

prox3• 3 years ago

“Please be civil while we destroy the web as we know it. We also put earplugs in, just in case.”

mozball3• 3 years ago

If this isn't the straw that breaks the camel's back, there is never going to be one.

Google needs to be broken up.

They own the browser market. They own the web (through Adwords). They own Search. They own mobile. They own most of the video sharing market with 2.5 billion monthly annual users. They own a good chunk of email with 1.2 billion monthly annual users.

They have amassed an incomprehensible amount of power and influence over humanity and they have proven repeatedly that they are willing to use that power to the detriment of humanity and to entrench themselves further.

Google needs to be broken up.

px434• 3 years ago

Google broke itself up in 2015. What are you even asking for here?

Chrome and Android are open source, and there are several forks of both thriving in the ecosystem. Yeah it would be cool if there was a decent open source alternative to GMail and Drive, but no one else seems to have figured out how to get the incentives right for something like that.

troupo8• 3 years ago

That "incentive" for Google is "80% of our revenue comes from ads".

Google's open source projects are open in name only.

BlargMcLarg2• 3 years ago

It's not the lack of open source, it's ease of use. Alternatives exist, but no company is going to run a charity case for you to store tons of data for free. Mail in particular is commonly known to be a hassle which has nothing to do with Gmail the software, as much as Gmail the provider.

alistairSH3• 3 years ago

Google broke itself up in 2015. What are you even asking for here?

No, it didn't, it restructured itself into Alphabet, with many subsidiaries. But, all the core businesses are still under that umbrella organization, with most web-related businesses remaining inside the current Google entity.

A forced divestment of the browser business might help. Same for the productivity products.

goffer• 3 years ago

Say that to Huawei.

coldpie8• 3 years ago

Google needs to be broken up.

To make it explicit: the only way this happens is by Americans voting for it. The FTC has been more active on anti-trust issues in the past two years than at any time in the past 30. That's a direct result of the 2020 election. Elections matter.

soumyadeb2• 3 years ago

Citation? FTC against Google doesn't produce much results on Google (kind of an irony :))

Have seen FTC going against Amazon because the FTC chair had published prior work against Amazon's practices. Not defending Amazon but FB/Google are a much bigger threat than Amazon.

tomschlick• 3 years ago

The FTC isn't going to do anything as Google/Alphabet is a big donor to the Democrats.

https://www.opensecrets.org/orgs/alphabet-inc/recipients?id=...

Here is them lobbying specifically around antitrust reform legislation: https://www.opensecrets.org/federal-lobbying/bills/specific_...

yyyk2• 3 years ago

The FTC has been more active on anti-trust issues in the past two years than at any time in the past 30.... That's a direct result of the 2020 election.

Active against Google though? Remember, Google can help a certain political party in tough times (e.g. rollout of healthcare.gov).

Mountain_Skies3• 3 years ago

How much of that involves the tech industry? Are you seriously claiming that Silicon Valley and Donald Trump were besties while the Democrats and tech hate each other?

ChatGTP3• 3 years ago

Don't forget, increasingly transport, you won't be able to get a taxi in SF soon without being monitored / tracked by Google.

hellojesus2• 3 years ago

How so? Are they requiring request of taxis via a site with Google analytics?

mardifoufs2• 3 years ago

Why should the US break up an asset like Google? Would be completely self defeating. This isn't like standard oil or at&t, that mostly had influence and market share inside the US. It would basically be handing power to foreign competitors who would pounce at the opportunity

And I'm not American so it's not even some sort of patriotic comment. If Europe , or anywhere else, had a Google sized Behemoth, they wouldn't mess with it no matter how "anti tech" they might seem now. If anything they are anti tech because they don't want foreign big tech to have massive influence over them. You'd bet they wouldn't cripple big tech if they were European. On the other hand, as long as they are American that massive power is a feature, not a bug for the US government.

The reaction to Tiktok is a good example of how nationalism/geopolitics shape the reaction to big tech, which is why google is probably safe.

lacrimacida• 3 years ago

One thing comes to mind: antitrust! It happened to Microsoft as well!!

paganel• 3 years ago

Why should the US break up an asset like Google?

I'm also European and I think almost pretty much 100% as you think on this, but to play devil's advocate, and how I think this should have worked in theory in a free-market economy, is that the US, by allowing companies like Google to do their nefarious and frankly evil things right now and in the near future is also, at the same time, not allowing future potential companies, more innovative than Google is now, to take Google's place.

But what happens is that the US is focusing on having a strong and national security-enhancing company (Google) on its side now and in the near future, versus having an even stronger and, potentially, even more national-security enhancing company (the one that would have taken Google's place had the free market been allowed to do its thing) in the medium to long future.

On the face of it this compromise of security now and in the near future vs security in the medium to long future looks like a decent bet, the problem is that evil colossuses like Google are actively getting rotten from the inside, and at some point in the medium to long future they'll fall almost in an instant, with no company to take their place. That will leave the US highly vulnerable at that point in the future.

strix_varius4• 3 years ago

Why should the US break up an asset like Google? Would be completely self defeating.

Because in the short term it would disrupt a major company (ala Standard Oil), but in the long term it would allow the US to remain competitive in the global market.

If we allow Google to continue abusing its monopoly power in the US, that guarantees that the US will not be the home of the future technologies of the world. Innovations will be sucked up and killed as acquisitions. Enormous energy will be focused on blatant moat-building like WEI instead of developments that benefit the world. etc.

mozball3• 3 years ago

In which case foreign governments, the EU and the like who collectively represent the interests of the other 7+ billion people, should start levying taxes, penalties and fines on Google and haul it and the US in front of international agencies like the WTO for unfair trade practices.

threatofrain• 3 years ago

What would it mean for Chrome to be spun-off into a separate business? How would it survive?

cmrdporcupine7• 3 years ago

Google Ads and Search would have to pay Chrome for search placement. Just like they do to Mozilla right now.

rolph3• 3 years ago

ideally, it wouldnt survive.

pndy2• 3 years ago

That would be a desirable action but look what happen in the end of 90s to Microsoft. It was about to be broken up and in the very end it didn't. They become dormant and polite only to strike back some 10 years ago with Windows 10, its telemetry, ads and cloud services which are being pushed onto users whether they like or not. And somehow, no regulators decided to step in to clean up this company's behavior - everyone seems to be ok with what MS is doing. Whether it's the US or EU. I take that the business and lobbing goes extremely well in both markets.

And because of this, I don't believe that the US is able to break Google or the other flagship companies despite of reasons existing for such action.

nologic01• 3 years ago

Google needs to be broken up.

Not going to happen. Rationally there should be broad political consensus about cutting Google back to size: from rabid libertarians worshiping the miraculous abundance generated by "competition and free markets" to bleeding-heart socialists keen on pushing back corporate power as the root of all evil.

Alas, these political categories no longer have any meaning. The US political system has mutated into something else (the messenger being a horned man) which will probably require some time to properly characterize and name using terminology that is appropriate to use in good company.

So the fate of Google will be more shaped by actions of external entities than as part of US regulatory efforts. Powerful countries that antagonize the US are simply degoogling and creating their own copycat panopticons.

The question is what will be the course of action of powerful countries that are alies of the US (i.e. Europe and a few others). Will they accept that their digital society will be feudal in nature because the broken US political system cannot deliver on even basic responsibilities?

Dracophoenix• 3 years ago

Will they accept that their digital society will be feudal in nature because the broken US political system cannot deliver on even basic responsibilities?

The Germans, British, Australians and French are also attempting to build their own panopticons.

ep103• 3 years ago

And also, to switch back to Firefox

PedroBatista2• 3 years ago

Who has been mismanaged for at least a decade and depends on Google to pay their bills..

I'm a FF user since the early 00's and Firefox will mostly not go away because Google has an interest in using it against monopoly accusations but the reality is bleak..

And the reality is these people ( Google in this case ) are so far removed from any moral compass about the Web ( at least what most people here think of "the Web" ) that it's near impossible to do anything about it. These companies are huge and from top to bottom there are certain groups that are hired guns to do a job, no matter what "job" it is, they'll do it, achieve those KPIs, get promoted, get paid. Even for their own detriment in the future, it doesn't matter. Big money now, screw the rest.

Btw, this is how every big company operated since forever, the only "news" here is the disproportionate impact their acts do to the World due to their huge size and influence.

bee_rider4• 3 years ago

I hear Firefox is mismanaged all the time, but it seems to be a perfectly fine browser for the most part. I hear all about sites that won’t render in comments on this website, but they must all be internal tools or something because I never encounter them.

gmerc5• 3 years ago

You’re gonna have to swallow your pride and use the best option here. If you are American you already have lifelong training in this dynamic and you know if you don’t, it just gets so much worse.

ChatGTP3• 3 years ago

Who has been mismanaged for at least a decade and depends on Google to pay their bills..

I don't see how this matters, it's an open source project, if people find enough value, it will be forked and improved by community or a new organization will form around it. This is the beauty of open source, you must embrace.

viraptor• 3 years ago

I'm not really seeing the dilemma here. Would you choose a browser from a mismanaged organisation, or a browser from a corp actively subverting the very basic idea of having a web client you can control, which has a chance of forever changing how we get to interact with businesses online? (In likely the worst way possible)

Seriously, how is this a question? (Unless you want to go with another independent option, then sure)

Renaud• 3 years ago

None of that should prevent anyone from using Firefox. There are no alternatives, nearly all other browsers are built on Chromium.

Making FF more prominent will not give Google more power, it will give Mozilla more power to negotiate better deals with Google and Bing to become the default search engine, because in the world of browsers, that's what pays the bills.

Giving more power to Mozilla hinges on them having a larger user-base so their voice is heard on these technical issues.

I'm tired of people complaining about how much better they could do "if only" this, or that FF was % slower on some tasks 10 years ago.

Firefox is a better alternative. It's the only alternative, and we can make more demand on its direction if we actually use it.

It doesn't mean that we shouldn't hold Mozilla to higher standards, but if we keep waiting for them to be perfect before we will consider using and pushing FF, we're just going to lose the only alternative not controlled by Google or Microsoft.

It's Firefox here and now. There probably won't be a tomorrow otherwise. Google is making that very clear.

ddq2• 3 years ago

Sad that the broader message of this post was ignored in favor of “but you should use Firefox” replies.

prmoustache6• 3 years ago

Who has been mismanaged for at least a decade

Do you think Google is better managed?

unmole• 3 years ago

And what happens when website owners decide supporting Firefox is not worth it?

ewgoforth• 3 years ago

So many sites don't work correctly in Firefox. Chrome is the new IE6.

gmerc5• 3 years ago

The same that happened to the ones who decided to stick with powered by IE.

bee_rider4• 3 years ago

It will be annoying if bank sites and other companies that are hard to avoid drop Firefox support (I mean I can switch banks I guess but it is a long term customer relationship, I don’t really want to).

Most websites aren’t bank websites. If a website doesn’t support Firefox, leave. If a website doesn’t support good old HTML, it is probably made by some kind of dummy who is trying to replace lack of content with glitz, this sort of person shouldn’t be listened to.

ricree• 3 years ago

It would be much less likely if we could get the market share back to 2010 levels.

Is that a realistic goal? I don't know, maybe not, but it seems like there's little will even in tech to try.

There was a time when tech was the biggest driver of alternate browser adoption, and even managed to make serious inroads into the mainstream. It's a huge shame that this attitude seems long gone.

JeremyNT• 3 years ago

The best time to switch back to Firefox was 10 years ago.

The second best time is today.

Maybe it's too late, maybe it's not, but it's literally the only option we have if we want an open web.

At this point, anybody who runs Chromium is just enabling Google and has become part of the problem.

worksonmine• 3 years ago

I never have any real issues with Firefox, and when I do I simply don't use that site. I have my girlfriend and mother using Firefox as main browser on desktop and mobile, with uBlock Origin and they've never complained.

I did have issues during an interview in Microsoft Teams refusing to play my video. "Your browser is not supported", yeah fuck you it's not supported. I explain why, ask if we can switch to Hangouts and send a link.

Works fine, if more people had the balls to do the same we wouldn't be in this situation today. It's our duty to educate people instead of conforming to the path of least resistance.

sn0wleppard• 3 years ago

Then Firefox users decide visiting those websites is not worth it

johnnymorgan• 3 years ago

You mean Brave

mdale• 3 years ago

Brave runs on Chromium; I am sure if WEI helped some crypto scheme for attention token it would be embraced there. But not as relevant as this relates to the "on by default" nature of these tools to validate web viewers.

fsniper3• 3 years ago

I suppose this is more important.

When the usage metrics drop for Chrome based browsers they would need to start respecting other users, instead of just ignoring them.

Currently they can just ignore the users and continue as they do. As the rest would not hint a dent on their bottom line.

mhx1138• 3 years ago

Exactly. I use Firefox for everything. It renders all the pages fine and is speedy enough so that I never question its performance. But even if it had some issues, those were minor compared to the danger the web is in now.

FooBarBizBazz3• 3 years ago

Firefox' killer feature on mobile is that it supports uBlock Origin, while Chrome doesn't. Browsing the web without it is horrible -- the screen covered in popups with tiny Xes. There's a decent fraction of the time that you can't even read the content underneath. Firefox solves all that.

However.

Try opening any article from The Guardian on Firefox mobile. Even a good phone will start feeling sluggish and laggy and weird. An old phone will just go catatonic, get hot, and OOM the whole browser.

Surely this is partly The Guardian's fault. (Should it surprise me that the paper that poses "left" for the upper middle class is also incompatible with any but corporate software from Big Tech?)

But it's also definitely Firefox' fault too. Something is wrong with the implementation. If Chrome can render these sites smoothly, Firefox should be able to.

Firefox would only have an excuse if Google had some special APIs on Android, or were doing something to actively sabotage the Firefox experience. I'm not willing to get quite that paranoid yet.

There are some other browsers, but who the hell wrote them? How much of what you see in the app store is legitimate open source, and how much is OSS that some opportunist put their own trackers into? I'd love a good alternative, but I don't see a lot worth trusting.

So it's Firefox for most things, and Chrome when Firefox gets all slow and laggy. Or, Firefox for news articles, and Chrome for businesses' websites.

LegitShady• 3 years ago

Firefox mobile on Android, ublock origin and darkreader installed. No lag on guardian articles on a pixel 6a.

rollcat• 3 years ago

Obligatory mention of WebKit/Safari.

robertoandred• 3 years ago

Unless you're already using Safari.

dang10• 3 years ago

We detached this subthread from https://news.ycombinator.com/item?id=36876504 since that thread broke the site guidelines and this one didn't.

makingstuffs• 3 years ago

Is it just me or does this sound a lot like the DPOS solutions offered by many scammy ponzis under the name of a blockchain/cryptocurrency?

pluc3• 3 years ago

This is a crisis of our own making. You don't want Google taking decisions for the web at large? Then don't let them own 85% of the browser market share. When that's the case they don't need W3C or anything to implement whatever they want, they effectively control the client-side internet.

j1elo• 3 years ago

It's proven that mass marketing works. Tell me how a minority of informed and caring users can avoid on their own that a single large scale bad actor pours millions over millions of dollars to convince the uninformed masses about whatever they want. It even happens in actual elections when some factions use misinformation campaigns to alter the average voter's perception! So not an easy task to solve without help.

pluc3• 3 years ago

Totally. In most things, you need to have the ability to trust that users will make (or at least see) the right choice even over multi-million marketing initiatives. Given today's people and today's marketing, I'd say we're properly fucked.

Dalewyn2• 3 years ago

Tell me how a minority of informed and caring users can avoid on their own that a single large scale bad actor pours millions over millions of dollars to convince the uninformed masses about whatever they want.

Firefox.

No, not Firefox of today; I'm talking about Firefox 20 years ago that defeated IE6 by sheer force of nerds alone.

Of course, the landscape is vastly different now and Firefox today is about the most not-nerd thing next to Chrome. If there's a a browser here to save us anywhere, I'm not seeing it.

strix_varius4• 3 years ago

One of the things that led to Google's current dominance is folks like us (certainly me, at least) pushing folks to replace their default IE installation with Chrome as soon as they set up a new computer.

I hope, pragmatically, something similar might happen with this: say that Brave (my daily driver) disables WEI in their Chromium build, and a new Chromium-derived browser surges in popularity... like judo, using their own power against them.

TremendousJudge2• 3 years ago

What's wrong with Firefox?

knaik943• 3 years ago

Since Google controls the implementation and the featureset of this API, they are effectively controlling the entire chain of access.

Having open source implementions does not make a difference, because a Google, or implementing website, server will control whether the content is served. Having the mechanism of access open sourced makes no difference in this situation.

It is the same situation with the "latent" passkey attestation mechanism. Apple and Google have general guidelines that the feature will not be used, but that only true currently. This should not be part of the browser for the same as with passkeys, it gives corporations final say in what you are allowed to use.

doliveira3• 3 years ago

I was watching a video about nesting in CSS and how it's just in Chrome and comments were all about how cool it is and how they can't wait to use it, and so on, and so forth. I think it's quite a representative example: we can do that much better with SASS today, but I guess Google needs to keep features pushing at full speed so no one else can keep up.

We developers are so gullible. Just give us some shiny things and we don't even realize they're heating up the pan.

JimDabell2• 3 years ago

I was watching a video about nesting in CSS and how it's just in Chrome

Nested CSS is supported in the latest version of all major browsers.

https://caniuse.com/css-nesting

Izkata• 3 years ago

It will be supported in Firefox 117, the latest release is 115 and needs you to manually enable a feature flag.

The center row of versions with the gold border is how caniuse indicates the current release.

doliveira3• 3 years ago

That's not the point...

londons_explore3• 3 years ago

One of the proposals for WEI is to make it probabilistically fail.

Ie. on a given device, for 10% of websites, WEI pretends to be unsupported.

That means websites can't deny service where WEI is unsupported. Yet it still allows statistical analysis across bulk user accounts.

If WEI was implemented like this, I would support it as being good for the web ecosystem.

phpnode2• 3 years ago

This is the bait to make it sound reasonable. Of course this hold-back feature will be quietly disabled at some point in the future. The whole proposal is full of weaselly half truths and misrepresentation about their real plans

londons_explore3• 3 years ago

this hold-back feature will be quietly disabled at some point in the future.

Will it though? Googles main reason for WEI I assume is to combat ad-fraud. Ie. to prevent someone making a bot farm to click ads to earn money from advertising or exhaust competitors ad budgets or manipulate search engine user ranking signals.

With WEI, all ad clicks without WEI could just be ignored (ie. not billed to advertisers, ignored when calculating statistics and signals). If 10% of clients have WEI 'cloaking', you just inflate the final advertising bill by 10% to account for those users - the end result is the same as billing for all real users and no bots.

WEI still achieves all of Googles goals even with cloaking.

throwaway3757582• 3 years ago

That’s a silly proposal that will eventually be turned off as it causes issues. Users will complain that sometime websites are broken for no reason and the first proposed fix would be to turn the failure probability to zero. Then the zero failure setting will become the default.

throwaway3757582• 3 years ago

Also if Netflix or Twitter decide to require device authentication they can give you an error message and instruct you how to turn the holdback feature off

maest• 3 years ago

And what guarantees do you have that the probabilistic failure rate won't be turned to 0 at some point in the future?

Except for Google's pinky swear, I mean.

Koffiepoeder• 3 years ago

Workaround: check WEI across 4 domains, P(failure) = 0.000001%

wzdd• 3 years ago

The attitude from Google towards this has changed significantly over the last few days (unsurprisingly).

From the "explainer": "we are evaluating whether attestation signals must sometimes be held back [...] However, a holdback also has significant drawbacks [...] a deterministic but limited-entropy attestation [i.e. no holdback] would obviate the need for invasive fingerprinting".

From the Google worker's most recent comment on the issue: 'WEI prevents ecosystem lock-in through hold-backs [...] This is designed to prevent WEI from becoming “DRM for the web”'

So, in other words, WEI could be used to prevent fingerprinting, but won't be able to if holdback is introduced -- 5-10% of clients would still get fingerprinted.

Looking at the list of "scenarios where users depend on client trust", all of them would be impacted by a holdback mechanism:

- Preventing ad fraud: not for the holdback group

- Bot and sockpuppet accounts on social media: not for the holdback group

- Preventing cheating in games: not for the holdback group -- and thus not for anyone playing against someone in the holdback group

- Preventing malicious software that imitates a banking app: not for the holdback group

In other words, if there was holdback, WEI would require places which currently fingerprint to retain and maintain the fingerprinting code and apply it to fewer users, in the best case, or would be completely useless in the worst case (for things like games).

However, it's also quite interesting to look at the implications of successfully attesting a browser which supports arbitrary extensions:

- Preventing ad fraud: install an automation extension

- Bot and sockpuppet accounts: as above

- Cheating in games: install an extension which allows cheating

- Malicious software which imitates a banking app: a malicious browser extension could do this easily.

In other words, unless you attest the browser with its extensions, none of the trust scenarios outlined in the explainer are actually helped by WEI. It's not obvious whether the Google employee who wrote this deliberately didn't think about these things, or whether the 'explainer' is just a collection of unconnected ideas, but it doesn't appear to hold together.

It is not surprising that the first target of WEI -- Chrome on Android -- does not support extensions.

ohgodplsno• 3 years ago

Here's how this goes:

WEI randomly fails, website sees it, has never implemented any error checking (or fails on purpose without WEI), WEI becomes effectively mandatory.

Google is a gun manufacturer telling people on the other end of it "don't worry, every one in 20 bullets doesn't fire".

pimterry• 3 years ago

That's currently just an idea in the 'Open questions' section of the spec, but there is already pushback against it from others closely involved in the spec & discussion around this (https://github.com/RupertBenWiser/Web-Environment-Integrity/...) and notably the attestation feature Google already shipped on Android for native apps in the same situation does _not_ do this.

kmeisthax4• 3 years ago

The antifraud company that worked with Google on the WEI proposal is already calling for the removal of holdouts from the spec[0], because:

- Attestation does not work as an antifraud signal unless it is mandatory - fraudsters will just pretend to be a browser doing random holdout otherwise.

- The banks that want attestation do not want you using niche browsers to login to their services.

[0] https://github.com/RupertBenWiser/Web-Environment-Integrity/...

pzo4• 3 years ago

If you have 50% of people having adblock then websites loosing 10% of traffic because of WEI probabilistically fail it still seems like win for big tech if they force user to their approved unmodified OS/browser.

siquick• 3 years ago

Is Brave browser safe from this considering it uses Chromium?

lagrange775• 3 years ago

I guess they could un-cherrypick this 'feature', but that doesn't mitigate google or publishers requiring a response from this API, in order to serve a request.

_fat_santa• 3 years ago

Not a lawyer but this seems ripe for antitrust action. Microsoft got sued back in the 2000's for simply bundling IE with their operating system. The behavior of Google (and quite frankly Microsoft with Edge) seems way way worse than whatever MS was doing when they got sued.

hot_gril8• 3 years ago

But MS still bundles IE, and they've gotten more pushy about it lately.

andy99• 3 years ago

Has anyone come across a good nontechnical summary that could be shared more broadly?

Edit: the Register article linked elsewhere looks as good as it gets for now https://www.theregister.com/2023/07/25/google_web_environmen...

blacklight• 3 years ago

I'm sick of these guys trying to break the web. From now on it's personal. We need to make sure that Google gets very hurt, and ideally they are wiped out from our industry.

lagrange775• 3 years ago

Apple would be in the position to fight this.

luuurker2• 3 years ago

"Apple already shipped attestation on the web, and we barely noticed"

https://news.ycombinator.com/item?id=36862494

lagrange775• 3 years ago

D'oh!

progbits• 3 years ago

And somehow this barely registers on HN, there have been over thousand comments on WEI this week, this was mentioned maybe in 5 (few of them mine - yes I'm repeating this point because it is important).

Attestation bad. Chrome is just catching up to what Safari is already doing, with in fairness more open standard.

We need to kill both.

andersa7• 3 years ago

All of the major tech companies are in on this. Google and Apple already deployed it for their phone and desktop platforms (iOS, Android, macOS, ChromeOS, all support attestation already). Microsoft is getting there with Windows 11, and all new devices shipping since ~2015 have the hardware support. Google is now closing the gap on desktop browsers.

Soon the percentage of people supporting it will be high enough to make it mandatory - the last 5% can just get a new device or something like that. They'll do it when their bank website tells them so.

The day Cloudflare flips the switch to require it for all connections is the day the open web dies.

lagrange775• 3 years ago

Thanks for the info, i wasn't aware of that at all.

They'll do it when their bank website tells them so.

Right.

The day Cloudflare flips the switch to require it for all connections is the day the open web dies.

Makes sense and unfortunately seems realistic.

beanjuiceII• 3 years ago

apple is one of the bad guys before the bad guys know they're bad guys..they already implemented this stuff

fnordpiglet• 3 years ago

This is googles answer to the threat LLM pose to their search engine - cement their ad business into the core protocols.

adontz• 3 years ago

Is there no EU regulation against this?

andersa7• 3 years ago

Careful, with the right arguments from Google the EU might just make this mandatory in the name of "security".

sgjohnson2• 3 years ago

And if they prohibit it, Google will just pay a several billion dollar fine. At the end of the day, it's just a cost of doing business. Something like an extra 2% tax raise or something. Whatever. Dividend time.

mardifoufs2• 3 years ago

The EU is at the forefront of wanting only "real people" online. So no, if anything digital identity is squarely within what would appease the EU

itissid• 3 years ago

I am a bit confused. This sounds a bit stupid. If this is DRM for web content, then what would non chrome browsers like FF for web pages that ask for such authentication? Refusing to work with other browsers than chrome seems like a lawsuit waiting to happen.

[1]https://arstechnica.com/gadgets/2023/07/googles-web-integrit...

thesuperbigfrog4• 3 years ago

It looks like they do not care if they have consensus or approval for WEI, they are implementing it regardless.

Wherever you live, you should contact your government representatives and regulators and put a spotlight on this issue for what it is--monopoly abuse of power.

Grassroots efforts are great and it is good to let your friends, family, and associates know what they are doing and why it is wrong. However, government regulation of this abuse is needed to stop it by force of law.

andersa7• 3 years ago

Why do you think they don't have consensus or approval from all the people that matter? This is far too big for that. Google, Apple, Microsoft, Cloudflare, etc, are all working together on this. Governments will like it for "security", and 99% of users won't care.

jmvoodoo• 3 years ago

That looks an awful lot like a cartel.

calgarymicro3• 3 years ago

Google, Apple, Microsoft, Cloudflare, etc, are all working together on this.

Are they? Is there any evidence those companies support the proposal? I haven't seen any statements to that effect, but I might have missed something.

throw_m2393395• 3 years ago

The web stopped being open when W3C accepted EME. Now that effectively Google IS the web, they don't even have fake attempting to convince anybody and will just turn the web into another proprietary technology.

tzs4• 3 years ago

The web stopped being open when W3C accepted EME

The web was more open when to play those videos you had to use a proprietary Flash or Silverlight plugin?

throw_m2393395• 3 years ago

The web was more open when to play those videos you had to use a proprietary Flash or Silverlight plugin?

That's what you are claiming with your sarcasm hidden behind a rhetorical question, I've never said anything about Flash or Silverlight in the comment you've answered to.

There is absolutely no difference from a conceptual perspective between EME implementation and proprietary plugins, EME is necessarily based on a proprietary spyware, but you can't fathom that fact apparently.

cosmaioan• 3 years ago

maybe it's their IE6 moment.

gmerc5• 3 years ago

Stop contributing to chromium. Fork it.

guerrilla• 3 years ago

Stop using it altogether. Use Firefox and contribute to it.

mmastrac3• 3 years ago

I've been holding on to my Firefox installation after switching back around ~2016 or so. I was on the Chrome bandwagon when they were the upstart (still have the comic from the launch!) but it didn't take long to see how dangerous things were getting with monoculture.

If you want to help, push back on all the anti-Firefox rhetoric that amplifies every little misstep that they take. Firefox is so much better from a user-respect perspective and the vitriol over little things (a couple of anonymous, tracking-free sponsored links on a new tab page?) are losing the plot.

hot_gril8• 3 years ago

Maybe they shouldn't have added the Pocket links if they didn't want the vitriol. Tracking or not (I'm still not 100% convinced that they're not), it doesn't look good when your browser greets you with that stuff. It's like entering a neighborhood and seeing a "checks cashed" store.

mmastrac3• 3 years ago

Thank you for providing an excellent example of what sort of comments contributed to our current situation.

BLKNSLVR• 3 years ago

Could be an epic troll on Google's part

codedokode• 3 years ago

What you can do:

- stop using Chrome

- do not implement web DRM on your personal site

- do not use providers like Cloudflare if they will support web DRM

- maybe add a warning on your personal site for Chrome users

Maybe something else?

goku12• 3 years ago

One problem I find is that all that we do is in a bubble. I can convince a dozen like-minded people about the dangers and actions to take. However, the vast majority of the population is completely oblivious to all this and are negligently complicit in enabling bad behavior. This sort of things need to be discussed on the streets and in mainstream media (not tech media) for regular people to become aware. Remember that during the previous browser wars (IE vs Netscape), it was much more in the open and a lot more people knew.

baal80spam• 3 years ago

I'd go even further and say that vast majority of population equates google with "the internet".

"IT people" live in a bubble and HN crowd even more so. There is nothing to stop this.

anshumankmr3• 3 years ago

As someone who is a somewhat new to web technologies, can someone really explain why this is bad? I saw the techical discussions in the PRs made to the WEI repo but it was all super technical that I was not able to understand the arguments made for and against it.

mplewis• 3 years ago

WEI turns non-compliant browsers into second-class citizens. You’re perfectly free to use whatever compliant browser engine and OS combo you like today – but in a world with WEI, you’ll have to use Approved Chrome on an Approved OS on Approved Hardware with Approved Signing Keys, or you won’t be able to sign into your bank.

netdur• 3 years ago

isn't this good? banks can raise security while we can still use any browser to check hackers news! or this 3 cows story?

anshumankmr3• 3 years ago

Approved Signing Keys -> Will this require for the end user to do it? If so, then this might be a short lived change, cause for a lot of people having a username and password is already super complicated.

minsc_and_boo3• 3 years ago

Is there any way around this, like spoofing headers or OS specs?

rochak• 3 years ago

Oh fuck no. This is bad. Google wtf.

javajosh3• 3 years ago

It's a change to the browser that gives site-owners the ability to require a positive attestation of non-modification before running. The stated goal of this change is to make it more difficult for end-users to block ads. As the spec states, blocking ads violates the deal you make with content creators to use your attention to ads as a form of payment.

In practice, this will make it harder, but not impossible, to run ad blockers. Now instead of just finding and installing a plugin, you'll have to first find and install a forked browser that implements the attestation as something like 'return true'. This will predictably decrease the number of people blocking ads.

Personally, I don't object to this. The easy solution for most people is simply: don't consume the content. Or pay money instead of watching ads. Content creators, it must be said, also have the option of self-hosting and/or creating content as a hobby rather than a career. As someone who has grown more and more despairing of any paid-for speech, especially by ads, I welcome this change.

Far more troubling is the possibility of attestation for "important apps" like banking or government. In general this mechanism gives the org a way to prevent you from doing what you want with your data. For example, they can prevent you from scraping data and automating end-user tasks. This takes away your degrees-of-freedom, and using a modified browser will certainly become an actionable offense. In my view this is by far the more troubling aspect of this change, since it take away significant aspects of user autonomy in a context where it matters most.

Technically sophisticated users will note that it's not possible to secure a client, and foolish to try. This misses the point. These changes stochastically change behaviors "in the large", like a shopping center that offers two lanes in and one lane out, or two escalators in and one out. This represents a net transfer of power from the less powerful to the more powerful, and therefore deserves to be opposed.

EDIT: please don't downvote, but rather reply with your objection.

mindslight5• 3 years ago

This has been litigated to hell on HN, but no, there is no implicit contract when loading a webpage that your user agent will display ads or any other content as envisioned by the publisher. A user agent has always been intended to be something that displays content according to the wishes of the user. Even this "modest proposal" phrases itself in terms of user desires (albeit completely disingenuously). Ads have become prevalent because most users go with the default and don't install content filters to block them, but this does not create some obligation for all users to display ads. Rather, the core dynamic remains that ads essentially display at the pleasure of users.

There is no option to "implements the attestation as something like 'return true'". There is a chain of verification from the hardware manufacturers building in software surveillance, through OS developers treating the device owner as an attacker, this proposal of carrying the same user-hostile dynamic through browsers, and finally to the website that by verifying the signatures can force a user to only use software that enforces all of the above.

You should very much object to this! Today, "unsupported browser" is a CYA term that doesn't really mean much besides that the website has limited testing budget (and who doesn't?). With this proposal it would become a hard blocker. Goodbye Linux/BSDs/etc. Goodbye `make install`. Goodbye virtual machines. Goodbye computers that last longer than the rapid e-waste treadmill of mobile phone land. You will of course be able to keep running user-representing operating systems, old computers, "jail" breaking them, etc. You just won't be able to access banking websites, followed by web stores, then general sites. Basically anywhere today that hassles users with CAPTCHAs will be looking to implement these restrictions eventually (which is basically everywhere).

thurn• 3 years ago

Like any technology, there are both positive and negative aspects of it. The positive take would probably be that this technology is already widely used by iOS and Android apps. People use Apple's AppAttest to e.g. ensure that high scores submitted for a game are from a legitimate copy of the game and not just someone calling the SubmitHighScore API.

But it's absolutely fair to argue that the web operates on a different set of expectations than the Play Store/App Store, and I think the concerns that this will create a second-class citizen status for browsers are totally valid. There's a huge difference in character between "in order to prevent piracy and ensure ad revenue we are only releasing our app on the Play Store" and "we are only releasing our web app for Chrome".

awesomeMilou3• 3 years ago

People use Apple's AppAttest to e.g. ensure that high scores submitted for a game are from a legitimate copy of the game and not just someone calling the SubmitHighScore API.

But that's for Apps. Native Apps, not websites. If we argue this way, then this becomes a solution seeking an issue, since the first thing you learn in web programming is to never trust the client. I don't even see how this changes here, given that it won't mitigate any bugs, except giving me proof that the only bugs present on the client side system are the ones written by me.

The reason Google actually want's to implement this, is because they risk loosing huge amounts of revenue due to adblocking, something they can control on mobile (since they control the software supply chain there) but cannot do in the browser (since I have access to the DOM).

peter422• 3 years ago

It’s like having the “I’m not a robot” button embedded in your web browser.

mordae6• 3 years ago

To put it simple, it makes it possible for service provider to reject providing service to clients not running corporate-owned white-listed clients. Thus making it virtually impossible to create independent clients for such services.

It will be swiftly adopted by well meaning but clueless bank and government clerks who will accidentally use to lock all open hardware, open operating system, open browser users out and mandate you need to purchase at least one locked down corporate device to exist.

It's the trusted computing story all along. Eventually you will need permission to run your code on your own device and such "unlocked" device will be blocked from accessing any digital infrastructure because it might be otherwise used to breach ToS.

sir_brickalot• 3 years ago

Isn't this already the reality in the mobile space?

I own a rooted Samsung device and have to jump through 100 hoops to be able to use my banking app or Netflix or some rando game (which I don't actually play). SafetyNet broken, hardware fuse blown, Magisk Hide + some other havks just to still be able to do online banking.

I just want to be able to ssh into my own device or install a real ad blocker, like Adaway without losing access to real world applications.

This is all very depressing.

btown2• 3 years ago

From the spec author, in 2022 [0]:

I decided to make this an app in the end. This is where my costs started wracking up. I had to pay for a second hand macbook pro to build an iOS app. Apple’s strategy with this is obvious, and it clearly works, but it still greatly upsets me that I couldn’t just build an app with my linux laptop. If I want the app to persist for longer than a month, and to make it easy for friends to install, I had to pay $99 for a developer account. Come on Apple, I know you want people to use the app story but this is just a little cruel. I basically have to pay $99 a year now just to keep using my little app.

The double-think is absolutely astounding.

[0] https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-...

Waterluvian• 3 years ago

My understanding is that Ben gets his paycheque from Google.

toyg9• 3 years ago

It's hard to get someone to understand if his salary depends on not understanding.

freeAgent2• 3 years ago

This is especially surprising coming from a Linux user who presumably understands the desire to have a device that runs code one can read, write, compile, execute, and share freely and without needing to receive approval from a Big Tech gatekeeper.

caskstrength• 3 years ago

Maybe desire for great performance review is much greater in the author than being able to access the Web from his Linux laptop?

kalleboo3• 3 years ago

I don't think it's double-think, it's just a lack of consequential thinking. I believe the writers of the spec when they say that they just want to be able to see which ad views are real or not. They even lay out some (far too weak) ideas to keep the system from being mandatory and abusable. But they don't realize just how quickly things will go out of hand once the rest of the organization realizes what they have created.

The road to hell is paved with good intentions.

dogleash• 3 years ago

it's just a lack of consequential thinking

Googlers tend to trust google, even when its readily apparent tool/system design obviously puts them in a control position above anyone else in matters that extend beyond their own walls. I've only met a few that will coyly admit they don't trust google, but maintain they have to keep up appearances.

I think it also explains their outspokenness on societal issues outside google's control. It's a distraction from thinking too hard about what societal bad google does have control over.

dmvdoug• 3 years ago

The road to hell is paved with good intentions

Fine. Then, when we arrive in hell because this person took us there, it should follow him all the rest of his days that he was too Pollyannish about the consequences of his own designs.

toyg9• 3 years ago

The guy seems to have deleted most of his social accounts. Clearly he values privacy for himself, just not for everyone else.

jgaa• 3 years ago

Just say no.

Ignore Google and educate your friends and family about the alternatives. Make it your mission to save the Internet.

chris_wot• 3 years ago

Firefox accepted EME. Why are we all suddenly so surprised this is the ultimate outcome?

scott_joe• 3 years ago

Can someone please explain what this actually is. Without the poetry.

Alifatisk2• 3 years ago

This is about WEI, Web environment integrity. The article below sums it up pretty good.

"The proposal suggests that websites should be able to request an attestation from the browser about its “integrity”. Such attestations are to be provided by external agents, which – presumably – examine the browser and its plugins, and issue an approval only if those checks pass.

The attestation is sent back to the website, which can now decide to deny service if the agent did not give approval." [1]

1. https://interpeer.io/blog/2023/07/google-vs-the-open-web

In other words, websites can now force you to comply with their shitty behaviour in order to allow you access, otherwise you get denided access.

icoder2• 3 years ago

The way you put it, it's like a captcha (but stronger, and with a high risk of unwanted side effects)?

papruapap• 3 years ago

ELI5: Server: Are you a real user capable of viewing ads? Client: Hmmm, not sure. Server: 404

rchaud2• 3 years ago

Are there forks or earlier versions of Chromium browsers that can be maintained separately without folding in these changes?

Roark66• 3 years ago

I realise all the negative effects if this starts becoming a thing, but could someone explain how is it they propose to technically enforce this "signed browser binary" requirement? What's stopping me from writing my browser to submit false info? Any encryption keys or hashes present in the "certified" binaries can be extracted (the binary after all needs access to it to use it, right?).

The only way this has a slightest chance of working is in connection with trusted hardware. Microsoft has been trying hard to push tpm on everyone and failed. What makes them think they'll succeed?

eganist• 3 years ago

Edge is based on Chromium now, has been for years. Wouldn't be a leap to have TPM enforcement here too.

encody4• 3 years ago

It's small, but here's a real actionable item that you can do to help:

Put a gentle "Use Firefox" (or any other non-Chromium-based browser) message on your website. It doesn't have to be in-your-face, just something small.

I've taken my own advice and added it to my own website: https://geeklaunch.io/

(It only appears on Chromium-based browsers.)

We can slowly turn the tide, little by little.

idlewords2• 3 years ago

This advice has strong 1998 vibes.

encody4• 3 years ago

to be fair, WEI has strong 1984 vibes

ChatGTP3• 3 years ago

Yes, put it right near the "Under Construction" gif.

Tao33002• 3 years ago

That's high praise.

empty_banana• 3 years ago

I don't think seeing something like "Works best on Chrome" is rare. Also blocking websites at all for other browsers than Chrome.

afandian• 3 years ago

It makes up for all of the "your browser is outdated" banners I see when using Firefox.

mdibaiee• 3 years ago

For people who want to put something like this, here is the code snippet:

  <span id='browser' class='hidden'>
    This website is designed for <a target="_blank" rel="noopener noreferrer" href="https://firefox.com/">Firefox</a>, a web browser that respects your privacy.
  </span>

  <script>
    if (window.chrome) {
      document.getElementById('browser').className = '';
    }
  </script>

Class .hidden must hide the element somehow, in this case I do:

  .hidden { display: none; }

returningfory2• 3 years ago

Thanks for the code! I would slightly change the phrasing. "This website is designed for X" is traditionally, in my opinion, a user-hostile statement which indicates the user has to do something to accommodate the website. "We recommend you use Firefox, a web browser that respects your privacy" or something doesn't have this vibe IMO.

zzo38computer2• 3 years ago

I would make a few changes:

1. Instead of using CSS to hide it by default, make the script to only add it (perhaps by document.write, or alternatively by adding text to an empty <div> or <span>) if Chrome is detected. (This way it will be compatible even if CSS is disabled (or not implemented).)

2. Instead of Firefox, mention something else such as Line Mode Browser (it has some features I had not seen in other web browsers, but which I think are good and would like to have), or some other uncommon one which doesn't have Google and Mozilla etc, or more than one.

Cthulhu_2• 3 years ago

The issue with that is that most people here will only have their own website or product, which is already aimed at more tech-savvy people, who will already have made a conscious decision to use Firefox, Chrome, or whichever browser they prefer.

But we / this site only represents a small percentage. 85% market share means there are hundreds of millions, if not billions of users that would have to switch to make any kind of impact.

And you can't do that without being a very large company with an operating system or the most popular search engine or other ways to constantly tell people to use your browser, no matter how good or privacy conscious or whatever your own is.

TremendousJudge2• 3 years ago

Most web developers don't use Firefox. Changing that would be a huge step. Many things are developed for Chrome first by inertia at this point.

toyg9• 3 years ago

"We" already waged a grassroot browser-war campaign in the late '90s-early '00s, when Mozilla was born and eventually birthed Firefox. It was successful enough to seriously dent the Microsoft monopoly, creating the political conditions for antitrust authorities to deliver significant hits to their power.

It can be done again. Just drop the fucking Chromium bullshit now.

gdtfmaster• 3 years ago

Good suggestion, did that, thank you.

0JzW• 3 years ago

i find this comment a bit funny given that you use googletagmanager on your website :)

encody4• 3 years ago

Sorry, comes default with Hugo (sort of). Set it up when I was playing around with the website configuration and never bothered to remove it. I don't use the analytics, so I will delete. Thanks for pointing out.

note to self: hn is a great place to debug & review your site

dcchambers• 3 years ago

It only appears on Chromium-based browsers.

Small anecdote: I am not sure how you're detecting the browser, but this note still appears in Orion (webkit-based browser) while it does not in Safari. Persists even when I change user agent explicitly to Firefox or Safari.

encody4• 3 years ago

I check for the existence of `window.chrome`. I've never heard of Orion browser before, but based on a brief glance at their website, my guess is that because they allow running of Chrome extensions, they are also replicating at least some functionality provided by Chromium-based browsers, including `window.chrome`.

Thanks for pointing this out, but I won't fix this.

varispeed4• 3 years ago

I don't think most people know the difference between Chrome or Firefox and if they can still use websites they use with that change, they just won't bother.

Even if you explain what is the difference, 99% they'll forget the next day.

It's just pointless. With this kind of overreach, only government intervention and regulation can help. Google is not something you can go against with your proverbial wallet - they are too big.

JohnFen8• 3 years ago

As Gandhi said, "Whatever you do will be insignificant, but it is very important that you do it."

Historically, many people making "insignificant" actions over time is the primary way that things have been improved.

toyg9• 3 years ago

Microsoft was the same, and still they were humbled into opening the space for others (with the browser-choosing screen at first boot). If people are noisy enough, lawmakers can be distracted from their payola.

freedomben3• 3 years ago

I like this idea, but has Mozilla said anything about their position in all of this? I'm a Firefox user, but I haven't felt great about Mozilla in quite a while. I'd love to know they are on the right side of this issue before I start promoting them like this.

cpeterso3• 3 years ago

Mozilla posted its position on Google’s Web Environment Integrity API here:

Mozilla opposes this proposal because it contradicts our principles and vision for the Web. Any browser, server, or publisher that implements common standards is automatically part of the Web. ... Mechanisms that attempt to restrict these choices are harmful to the openness of the Web ecosystem and are not good for users.

The full response is here:

https://github.com/mozilla/standards-positions/issues/852#is...

mo_42• 3 years ago

I think this is a somewhat natural consequence of Google being a powerful corporation.

And, I don’t think we (somewhat loosely defined group of people who like free software and information and have a user-friendly computing environment) can and should work against this. Probably, we should give the corporate web some sandbox where they can play their games, while we develop alternatives.

For example, Gemini is becoming more popular. People are talking about search engines that exclude the corporate web and favor personal websites. IPFS or just switching to FF again.

supriyo-biswas• 3 years ago

Instead of simply flailing our collective arms around complaining about an evil corporation, has anyone written to the respective competition authorities (such as the FTC in the US or CCI in India) about the potential anticompetitive effects of this proposal?

tolmasky2• 3 years ago

Mozilla should call for Google's removal from the W3C over this implementation of Web Environment Integrity. "But Chrome has 65% market share, what good is the W3C without them?” If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw this implementation.

It is unbelievable that over the course of 3 days, the potential future of the web has been put in such dire straits. There's already an existing, far less troubling (while still bad), proposal in the form of Private Access Tokens going through a standards committee that Google chose to ignore. They presented this proposal in the shadiest way possible through a personal GitHub account. They immediately shut down outside contribution and comments. And despite the blowback they are already shoving a full implementation into Chromium.

What we need is real action, and this is the role Mozilla has always presented itself as serving. A "true" disinterested defender of the ideals of the web. Now is the time to prove it. Simply opposing this proposal isn't enough. This is about as clear and basic an attack on what fundamentally differentiates the web from every walled garden as possible. If someone drafted a proposal to the W3C that stated that only existing browsers should be allowed to render web pages, the correct response would not be to "take the stance that you oppose that proposal," it would be to seriously question whether the submitting party should even participate in the group. Make no mistake, that is what is happening now.

MildRant3• 3 years ago

There is no chance Mozilla does anything that actually matters here. They may do some virtue signaling and put out a statement about how they support the open web but nothing more.

easyThrowaway2• 3 years ago

Quite frankly, the W3C stopped having any say on the matter when the WHATWG supplanted the XHTML standard with the HTML5 committee.

They had enough weight at the time to say "The Web is XHTML2, you can make your own internet if you want " compared to what they can bargain for these days.

Maybe at the time it was a somewhat reasonable decision to abdicate their responsibility over to big internet companies, but that's what brought us to the current state where we're basically going back to original version of The Microsoft Network[1].

[1]http://www.codersnotes.com/notes/the-microsoft-network/

tzs4• 3 years ago

If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw this implementation.

It's pretty generally accepted that the correct way to do web standardization is for proponents of some new thing to implement that thing and deploy it and then once it has been shown to actually work bring a spec to the the standards folks for standardization.

That usually works fairly well, although sometimes if that first pre-standard implementation does too well the original implementor may have trouble replacing theirs with something that follows whatever standard is eventually approved, because there are often significant changes made during the standardization process.

An example of that would be CSS grid layout. That was a Microsoft addition to IE 10, behind a vendor prefix of -ms-. Nearly everyone else liked it and it was standardized but with enough differences from Microsoft's original that you couldn't just remove the -ms- prefixes from your CSS and have it work great with the now standard CSS grid.

It was 4.5 years between the time Microsoft first deployed it in IE 10 and it appearing in other browsers by default (Chrome had it within a year of Microsoft, and Firefox had it about two years after that, but both as an experimental feature the user had the specifically enable). In that 4.5 years enough sites that only cared about IE were using the -ms- form that Microsoft ended up stuck with that on IE 10 and 11 instead of the standard.

deelowe2• 3 years ago

Basically, the ask for forgiveness approach. It's common in large, dysfunctional organizations as well. Sometimes the easiest way to get attention is to break things. Then once enough pain is felt, everyone starts taking interest. Trying to follow a proper change control based process only works when everyone is invested in the process.

troupo8• 3 years ago

It's pretty generally accepted that the correct way to do web standardization is for proponents of some new thing to implement that thing and deploy it and then once it has been shown to actually work bring a spec to the the standards folks for standardization.

- Behind dev flags

- And then wait for consensus

- And then there have to be at least two independent implementations

And only then does this become a standard.

Chrome doesn't care. They create a semblance of the spec, create a semblance of a discussion, and then enable it APIs in Chrome. And then pretend it's a standard.

izacus• 3 years ago

It didn't happen when Apple did it with Safari (and you all were quiet as a mouse as well, with HN actively defending Apple Safari monopoly with this feature enabled)... so why would NOW be any different?

tolmasky2• 3 years ago

I am not HN, you'll find no comment of mine defending that (despite, for the record, Apple's system being less bad than this one, while still bad).

NOW would be different because, again, this system is worse than Apple's, and because Chrome has a larger influence on the web than Safari (on Desktop, on mobile its a foregone conclusion since you're not allowed a different engine other than Safari anyways, so the real fight there is allowing third party engines).

Does this answer your concerns? I can't tell if you are defending Apple and Google, or are against both but are using this what-about-ist accusation as a way to vent general frustration.

kykeonaut• 3 years ago

I think the main difference is that Apple already controlled what operating systems can run Safari via other mediums. Adding this to Safari effectively changes nothing regarding the web ecosystem on Apple devices.

toyg9• 3 years ago

Apple don't have enough web properties to force this sort of change.

Google can turn around tomorrow and say that no browser without WEI can access GMail, GMaps, GSheets, Photos etc; people will have to comply, effectively killing any browser that does not support the feature.

This is the problem with the Chromium monoculture. "We", as generic IT people and developers on HN, definitely have a responsibility for not deprecating this monoculture earlier. If you use Brave, you're guilty; if you use Ungoogled Chromium, you're guilty; if you use Safari, you're guilty. It's high time people start taking responsibility.

danShumway• 3 years ago

and you all were quiet as a mouse as well, with HN actively defending Apple Safari monopoly with this feature enabled

Citation? To be sure, there was not universal outrage over Safari's attestation implementation, but out of curiosity I looked up the only thread I was aware of, in part because I couldn't remember what my reaction was at the time. That thread was a year ago and the overwhelming sentiment of the comments section is critical: https://news.ycombinator.com/item?id=31751203

Here were my comments at the time:

- https://news.ycombinator.com/item?id=31752980

- https://news.ycombinator.com/item?id=31753257

- https://news.ycombinator.com/item?id=31752431

They're less forceful than they are now with Google, partially because I know more now about how attestation works than I did over a year ago, and partially because (as some people have also pointed out) Chrome's implementation is straightforwardly more dangerous than Apple's is.

But HN "actively defending" Safari? That's not the impression I get from the overall comment section and it's definitely not what I personally was doing. There are a lot of people in these comments calling Apple's implementation DRM. So I'm a little skeptical of the "nobody on HN cared about this with Safari" narrative that has sprung up; from what I can see media coverage was fairly positive, but people on HN were rightly critical. I'm not sure the facts match the narrative: Safari was criticized for this.

It's a fair critique that there wasn't a coordinated attempt to outright stop Apple, but I would once again remind everyone that attestation in Chrome is way more dangerous than attestation in iOS. The market matters, that's not context that can be ignored. So it's not really all that weird to me that people are more willing to react more strongly to abusive behavior in Chrome.

rabite• 3 years ago

Good luck getting anything from Mozilla, Google is their largest source of revenue by far. Over half.

creatonez2• 3 years ago

Mozilla publicly opposes Google's actions all the time, especially when it comes to web specifications. One time they publicly endorsed an ad blocker intended to DoS google's ad servers with nonsense data, an extension that the Chrome Web Store considered to be malware.

solardev8• 3 years ago

It's far, far too late for this. The W3C is already irrelevant, not that it ever mattered much.

The internet is made by big companies. Not standards bodies. The WHATWG has the actual living standards, and Google, Apple, Cloudflare and Amazon make the actual software. Nobody cares about the W3C. And Mozilla is long past dead.

matkoniecz3• 3 years ago

And Mozilla is long past dead.

Mozilla is far from healthy but calling it dead is overstating things.

sdeframond• 3 years ago

The internet is made by big companies. Not standards bodies.

Yes. However said companies may want to avoid too much scrutiny from governments.

As long as they can pretend the web is an open standard, they are good. If Google were to leave the w3c, it would expose them to antitrust laws and so on.

Eduard• 3 years ago

The W3C is already irrelevant, not that it ever mattered much.

This sounds myopic, or what do you mean? W3C is not only about HTML and CSS innovation, but is responsible for and/or involved in a diverse set of relevant standards — many of which "big companies" don't show as much interest in contributing to.

https://en.m.wikipedia.org/wiki/World_Wide_Web_Consortium#St...

rekabis2• 3 years ago

And Mozilla is long past dead.

I have been using Netscape/Mozilla, in terms of heritage, ideology, and codebase, for almost a third of a century now.

I was there 30 years ago using NCSA Mosaic when it was first released for the VMS Vax system. The only break of any kind I had was with Opera as a secondary browser in the few short years between Netscape 4 and Phoenix (original Firefox). And I was still using Netscape 6, just not exclusively.

They can tear Mozilla (or any one of its forked variants) out of my cold, dead hands.

SoftTalker3• 3 years ago

It is unbelievable that over the course of 3 days, the potential future of the web has been put in such dire straits.

"Move fast and break things." How many here used to cheer this approach?

Xorakios• 3 years ago

I. And still do.

pornel3• 3 years ago

When Google announced the EME DRM in the semi-public W3C HTML working group, it created a massive backlash. So W3C moved the EME spec under a new, closed, invite-only working group, and then announced that there is a consensus among everyone (there), and it can move forward to become a recommendation. They didn't even fix known bugs in the spec written by Google (e.g. architecture diagram in the EME spec is factually incorrect).

So I don't think this rubber-stamping W3C will do anything. They have no power over Google, and they know it.

jacooper• 3 years ago

Mozilla doing something instead of just talking ? Doubtful

mble• 3 years ago

Stop

supernikio22• 3 years ago

I've heard time and time again how this is "the end of the free web". Can someone succinctly explain how this is the case, for somebody not familiar with web browser architecture? What does WEI provide that wasn't previously possible?

Ygg2• 3 years ago

Future web will require you to have certified browser - Chrome ™, to access the web. It will require certified OS Windows™, running on trusted Hardware TPM™, running trusted firmware CIA™.

You'll have no choice and your love will be mandatory.

This won't stop malware of course. However a skull clamp will be installed to monitor your thoughts and you will be zapped if undesirable thoughts are detected.

Note: it's a hyperbole but if you want another OS, Browser or hardware you'll be forced to Homebrew it. Or use a compromised app.

supernikio22• 3 years ago

Can Google really do this? What if I'm using Safari on OS X, or Firefox on Linux?

nfw27• 3 years ago

Actually the free web ended with net neutrality. Didn't you notice when that happened?

Pannoniae2• 3 years ago

This proposal is just so throughly user-hostile that it's impossible to criticise it based on technical grounds. It's not a bad proposal, it's a dangerous, evil and malicious one, so criticising it in details is futile. The whole thing in itself is evil, and it needs to be thrown out. Quietly protesting won't work this time, the goal is to kick up a huge fuss which gets the attention of governments, regulatory bodies and start antitrust proceedings.

Excuse my french but Google can fuck off with their censorship and "reminder to be civil". They have truly gone mask off, with the Code of Conducts not reinforcing good practice and a welcoming environment, but just a tool used to suppress dissent.

I've switched to Firefox and I'd recommend everyone else to do so.

strix_varius4• 3 years ago

Agreed - if anyone else is curious to see Google's "side" (motivations, technical or otherwise), here's the explainer:

https://github.com/RupertBenWiser/Web-Environment-Integrity/...

It's nakedly user-hostile. A blatant attempt to invert the "user agent" relationship such that the agent works for the advertiser/corporation/government to spy on the human behind the screen. The way the intro paragraph tries to disguise this as something users need or want is frankly disgusting:

Users often depend on websites trusting the client environment they run in. This trust may assume that the client environment is honest about certain aspects of itself, keeps user data and intellectual property secure, and is transparent about whether or not a human is using it. This trust is the backbone of the open internet, critical for the safety of user data and for the sustainability of the website’s business.

Ugh. Here's a fixed, honest version:

Corporations like Google often depend on advertisers knowing as much as possible about their users. Their revenue may depend on fingerprinting the client environment, tracking their behavior and history, and attesting that a human with sufficient disposable income is behind the keyboard. This personal data mining is the backbone of Google's business model, critical for their continued dominance of the web and for the sustainability of their enormous margins.

tristor• 3 years ago

This proposal is just so throughly user-hostile that it's impossible to criticise it based on technical grounds. It's not a bad proposal, it's a dangerous, evil and malicious one, so criticising it in details is futile.

I can't agree more strongly. I sat down to write a letter to the FTC, and I can't even articulate my objections because after reading this spec my only response is encompassed in "WTF is this shit?". I've worked in my past with members of the Chromium team and I've generally found them competent and well-meaning, and I can't see any amount of well-meaning (and some lack of competence) in this spec proposal. This feels like a shift in the behavior for Google far beyond their existing slow drive to consume everything, to something far more draconian and direct.

TheCoelacanth2• 3 years ago

The whole thing in itself is evil, and it needs to be thrown out.

Not only the proposal, but Google itself. Google desperately needs to be broken up.

hanniabu• 3 years ago

As someone that isn't up-to-date on WEI, can someone provide a TLDR of what it does and why it's bad?

hightrix• 3 years ago

TL;DR: It is DRM for the web where Google (or others) can only allow specific OS/Browser combination to access a website.

If you want to know more, others have written novels in these comments.

stronglikedan• 3 years ago

Not exactly a nutshell, but here's an explainer:

https://github.com/RupertBenWiser/Web-Environment-Integrity/...

And here's why it may be bad:

https://vivaldi.com/blog/googles-new-dangerous-web-environme...

And the HN discussion on the latter:

https://news.ycombinator.com/item?id=36875940

pptr2• 3 years ago

How is this feature hostile to Googles users? There is genuine benefit from websites allowing you to do more things via their website (vs their app). Also: fewer/no Captchas, fewer bots on social media

The platforms most people use will see benefits. Apple users apparently already do.

I understand the argument that the open source experience will get worse. But frankly, google.com will still work for you. It will be other websites that make your experience worse.

PebblesHD• 3 years ago

The above user has spent the past few days doing nothing but astroturfing on this topic while failing to declare that they are or were employed by the company proposing the standard.

Your personal opinion may well be that ‘this is fine’ but by failing to declare that bias and having never posted much of anything else it is difficult to interpret your actions as a good faith contribution.

Pannoniae2• 3 years ago

"Googler here." (you, previously) - I don't particularly appreciate astroturfing, and others don't either.

washadjeffmad• 3 years ago

I vote that this happens, but happens completely, definitely, and thoroughly to its logical conclusion.

If you want a penny from Google adtech, you're subject to their stringently filtered portal, you're inaccessible from non-WEI enabled browsing, and circumventing WEI policies gets you demonetized. It'll be the Great Firewall of Adtech, gated access via an app to a filtered corporate paradise - a bit like Facebook tried in India, unsuccessfully.

If you want to be part of the free, non-commercial web, WEI doesn't apply, access is open. You are able to be indexed as such. The healing can begin.

This will provide a true choice: commercial xor non-commercial. Confine all the SEO garbage to ghettos that think they're kibbutzim, forcing the big commercial entities to either fight over the noise or exert their influence, and leaving the rest of us out.

KingOfCoders2• 3 years ago

I wonder how many of the 210 comments were written in Chrome.

lagrange775• 3 years ago

SSLKEYLOGFILE still works for Chrome, right?

One way i could imagine to circumvent WEI would be to let WEI enabled Chrome do it's thing, while proxying the decrypted HTTP traffic to a free browser with plugins activated, potentially on another machine.

whelchel• 3 years ago

Could a core common library that Chromium depends on update its license to block use in software that supports attestation, roughly?

If Google wants more control and closure of the web, they shouldn’t benefit as easily from its current openness.

xyzal2• 3 years ago

I hope someone from the Pirate Party in the European Parliament brings this threat into discussion there as soon as possible to spread awareness.

idlewords2• 3 years ago

I'm surprised to see so many people in this thread saying "write a strongly worded letter!" (or something along those lines), and so few saying we need to build a better browser without this crap in it, which has been the traditionally successful answer to attempts to privatize the Web.

Tao33002• 3 years ago

We already have one, and building a browser is a nightmare.

strix_varius4• 3 years ago

Before doing this, Google was careful to make it as difficult as possible to build a replacement for Chrome. Apple struggles to make Safari capable. Mozilla struggles to make Chrome-first websites work in Firefox. Building a new browser is a Herculean task.

Pragmatically, I'm hoping that a Chromium spinoff like Brave (or Edge!? Could MS be the hero we need?) will turn the privacy switches on, WEI off, and get enough market share to make WEI infeasible.

meindnoch• 3 years ago

Would any of the usual enthusiastic Google employees ("Googler here...") chime in and defend this please?

A4ET8a8uTh02• 3 years ago

Can you give me an idea as to why WEI is a bad idea for the web? Granted, it is morning, but as I am going through the notes linked ( https://googlechrome.github.io/OriginTrials/developer-guide.... ), I am not sure I understand why it is that bad.

shadowgovt5• 3 years ago

As a general rule of thumb, web technology has traditionally separated the content and protocol from the browser ("user agent") in terms of concerns. By which I mean, a user agent needs to be able to handle any possible input without breaking, and a web server needs to be able to handle any possible request without breaking.

WEI tries to shortcut that process by creating a secured sign-off system that would allow the server to only respond to queries from a blessed hardware and software configuration. This wildly constrains the user agents that would be possible. The pro for web developers is that they wouldn't have to concern themselves with whether their server or the HTML they are. Emitting is broadly standards compliant and compatible; they can just make sure it works with the target platforms they care about and rest easy knowing no other platforms can touch their system. But this is bad for anybody who, for whatever reason, can't use the blessed platforms (user agent and hardware combinations).

Immediate practical consequences are that a lot of the screen reader solutions people use would probably break (because the screen readers wouldn't be certified user agents), a lot of clever hacks would be far less feasible (the website somebody hacked together to track whether the ice cream machine was broken at McDonald's restaurants relied upon being able to pretend it was the McDonald's smartphone app well enough to attempt to put ice cream in the shopping bag), and it would basically become impossible to build a new browser or operating system from scratch compatible with the web (they wouldn't work with the websites people wanted to use because they wouldn't be certified as authentic on any of those sites).

This proposal grossly changes the balance of power on how the web works and places most of it in the hands of the incumbent browser and computer hardware vendors.

A4ET8a8uTh02• 3 years ago

Thank you. I can see why there is a pushback for it and also why Google would want to make it a standard. It has a feel of systemd to it ( making things easy enough that if it does manage to become a standard, people will likely accept it en masse )

hot_gril8• 3 years ago

Basically aims to make desktop browsers work like non-jailbroken iPhones: locked down and outside the user's control, for better and worse. You could also compare it to client-side anticheat in PC games.

easyThrowaway2• 3 years ago

Get the Wikipedia Foundation on board and make sure the wikipedia or other big mediawiki hosts refuse to show any kind of content if such feature is detected in the browser.

Also, if you're a distro mantainer, configure apache and nginx defaults to make this is the default behaviour.

Even better: instead of redirecting to any wall of text with a long explanation of the political and technical reasons of this choice, just display a big, loud "ERROR" message stating that their browser is unsupported due to the presence of this module, and a small tutorial on how to deactivate it from the about:config page, if available.

zzo38computer2• 3 years ago

I do not agree with configuring apache and nginx to do that by default, unless WEI would somehow prevent a server that doesn't understand it from working properly (as far as I can tell, that is not the case). (A system administrator could still change the configuration; this is only about the default setting.)

However, I think the other stuff that you had mentioned would be OK.

Furthermore, a distro maintainer could configure clients by default to disable WEI (or to not include client programs that have WEI).

userbinator3• 3 years ago

For those who still aren't sure why this is a bad thing, read Stallman's "Right to Read" story --- that's the direction WEI is going to take the Internet and probably other things too, if the opposition isn't strong enough.

Ironically, WEI is one letter off from WEF... but I doubt that was intentional.

ColinHayhurst• 3 years ago

Google depends on Adwords. Other revenue streams are minor in comparison. Chromium is the main moat. Android too, of course. ~$15 billion to Apple is another, so protecting all on mobile. With the demise of AICOA, we cannot hope or expect the EU to deliver. In a sense it's simple; folks have to stop using Google search in order to preserve the web, and support those who are trying to preserve it. But I would say that. We are doing what we can.

jonnycomputer• 3 years ago

Break it up. Break them all up. We need more disruption, not this codswallop.

PhilipRoman• 3 years ago

One thing about this that I don't understand is how they intend to validate memory without controlling the entire stack (which we aren't even 1% close to achieving on the desktop). If I poke /dev/mem, does that mean Chrome will have to validate every single byte of it's ram? Or does it rely on having a fully locked down environment (maybe feasible on phones).

TillE• 3 years ago

Even on Windows, you can do practically anything with a signed driver.

There's just no such thing as verifying a "secure environment" outside of extremely narrow, controlled scenarios.

A37N• 3 years ago

Can't we make a intranet of our own? yes im being stupid right now but i dont want wei or anything like that, if we power users can create something like the internet where there are multiple websites and stuff like it was in the old days i don't know what im talking clearly but i think y'all understand me

pcdoodle• 3 years ago

Alright folks, time to cancel that Youtube Premium, Google Domain, Google Compute Engine, Ad campaign, PPC, Etc.

My business is off any paid Google crap.

I will never prepare a computer without uBlock Orgin for any customer of colleague.

lolinder• 3 years ago

As wonderful as it has been to have a platform that the entire world is on at once, I'm beginning to conclude that the only way to get back to the web as we knew it is to go back to the days when only a small, geeky subset of the population spent time on here. Back then it wasn't worth it to create massive amounts of garbage content in order to serve ads to unwary search engine users—there weren't enough of us to make money off of!

I think it's time to establish a successor to the web that we can once again call home. This doesn't mean we need to give up on the web or stop using it—it can run in parallel to the mainstream, a niche home for hackers and techies and people who care about freedom. It needs to be simple, like Gemini [0], but also have enough interactive features to enable old-school social apps like HN or the old Reddit. It should have a spec and a governance process that discourages rapid changes—we've learned from hard experience that more features does not mean better.

I realize this sounds like a cop out, and that getting people to use such a thing in sufficient numbers would be extremely difficult. But I'm pretty convinced at this point that the web as we knew it will never come back unless there's a reset—unless we create a new niche tech that isn't big enough for corporations to want to take over.

[0] https://gemini.circumlunar.space/

nehal3m2• 3 years ago

I realize this sounds like a cop out, and that getting people to use such a thing in sufficient numbers would be extremely difficult.

In the last few days browsing Fediverse platforms I prefer the smaller communities for that old internet spirit anyway.

TheCaptain4815• 3 years ago

Biden really needs to fire/replace Lina Khan and Congress start exerting pressure on big tech for actual monopolistic issues, not just political targeting. Although to be honest, I don't really trust the GOP/Dem house to bring up non-partisan issues which makes the role of FTC head even more important.

suslik2• 3 years ago

In the end, I feel like there is a silver lining to all this. As the world wide web becomes more sanitised with their codes of conduct, corporate censorship, ads, witch hunts, all these limitations - more and more, I hope, would the valuable, interesting bits of it drift to alternative locations.

The internets of old were just that - a place where nerds, freaks, outcasts, and other antisocial personalities congregated. Everything was permitted and everything was possible. Many, myself included, hoped that it would change the world. It didn't - the world is winning again, as everyone can clearly see. Still, I hope that the normalisation of the web might as well create a critical mass of those who just want something more than just a corporate safe space.

I sincerely wish that there is a future where protocols like gemini - stripped from all the visual noise and 'dynamic' features - get a critical mass of useres. If that doesn't happen - as someone who doesn't use any mainstream social media, google and microsoft services, llms and other modern (and some might add - dystopian) stuff - I don't really loose much. There are enough great books for a hundred lifetimes, enough hikes to walk and friends to get blasted with. Maybe it'd even be for the better.

OfSanguineFire2• 3 years ago

That colourful internet of yore coexisted with doing your banking at a bank. Now, banking has largely moved online and banks have eliminated a lot of their physical locations. Ditto for accessing government services in many countries. The concern here is no longer being able to do important everyday things without using a supported browser, even if a small hobbyist internet for nerds, freaks, and outcasts survived out there.

ricardo81• 3 years ago

fwiw I found Vivaldi's overview a good primer on the situation.

https://vivaldi.com/blog/googles-new-dangerous-web-environme...

dang10• 3 years ago

Thanks. Let's discuss that article here: https://news.ycombinator.com/item?id=36875940.

propogandist• 3 years ago

why have you shadow banned my account?

TastyAmphibian• 3 years ago

Sounds interesting

pg_1234• 3 years ago

As pointed out, EU law may prohibit this ... even if they are slow to act.

There is another possibility; EU countries may decide that this amounts to tacit admission by Google that the revenue generating event in ad sales happens on the browser, and ad revenue is therefore always taxable in the country where the browser (and viewer) are located. No more laundering international revenue through tax havens.

And since Google just demonstrated such an effective verification mechanism ... well they can just repurpose it to track all such taxable revenue for the countries in question ... otherwise they might be deemed a criminal enterprise and have to be blocked nation-wide.

No need to block the useful parts, just the illegal tax-evading ad empire.

... and countries can move fast when there is a lot of money to be had ...

Dah00n• 3 years ago

Interesting and it made me try out Vivaldi. Ten minutes later I had lost trust in their claim of privacy.

It uses Microsoft Edge while installing to open links - like the link to their privacy policy - while the OS is set to use Firefox (and every other app use this). Then I found out that it has zero containerization features at all. Don't want Google cookies from one tab read in another tab? Use a new Private Window. No thanks. Uninstall, and then it used Edge to open a page asking why...

danlindley• 3 years ago

The web is not dying, it is being killed. And the people that are killing it have names and addresses.

Shame on Rayan Kanso <rayankans@chromium.org>

Shame on Peter Pakkenberg <pbirk@chromium.org>

Shame on Dmitry Gozman <dgozman@chromium.org>

Shame on Richard Coles <torne@chromium.org>

Shame on Kinuko Yasuda <kinuko@chromium.org>

Shame on Rupert Ben Wiser: https://github.com/RupertBenWiser/Web-Environment-Integrity

Google needs to be broken up.

SquareWheel• 3 years ago

Currently development and standardization occurs in the open, on GitHub and elsewhere. When it's decided that's no longer possible, I hope you realize that this kind of targeted harassment is what led to its demise.

sph• 3 years ago

Shame on all knowledgeable people that happily keep using Chrome and giving Google money. That make the web more centralized by giving more and more power to entities that benefit from this like CloudFlare.

HN is full of people that are indirectly helping to push these changes forward. You're preaching to the choir, and the choir is too lazy to switch browsers or learn how to configure a web server, so they just shrug and carry on.

dang10• 3 years ago

No personal attacks, please. It's not what this site is for, and destroys what it is for.

You can make your substantive points without that, as most other users in this thread have been doing.

You may not owe web-destroying $MegaCorp better, but you owe this community better if you're participating in it.

https://news.ycombinator.com/newsguidelines.html

h0p3• 3 years ago

Thank you.

twleo• 3 years ago

That's why we should isolate Chromium from Google. Chromium should be lead by third-party like W3C.

renegat0x0• 3 years ago

Because we are only 'recipients' of their actions we can only watch, shame, scream, screech.

It is, as always, for your protection. They will shake hands, implement whatever they like.

The road is clear. Chat control, Earn IT act, TPMs, Secure Boots, Cyber Resilience act, Online Safety Bill, Crypto Wars.

Most of the users decide what can happen. Most of the users are blind. The network effect will eventually force everybody to follow.

nfw27• 3 years ago

I don't see how this will end the "free web." No publisher will be forced to use DRM. Anyone can still create a website and make it accessible to anyone for free with an internet connection.

If certain publishers want to require ads to view their content, that seems like their prerogative.

alex_suzuki• 3 years ago

Until Google Search starts punishing sites that don’t require a trusted execution environment…

alex77342• 3 years ago

I've seen people open up all of their users' "private" content to Googlebot IPs just to get rid of errors in Google's search/Adsense console "in case it helps revenue" (as in they didn't even know for sure if it would help, only that it shows up as an "error" in Google's console and red=bad)

All you need to do is to jingle some real, if small SEO/ad advantage and people will bend over themselves to lick Google's boots.

stainablesteel• 3 years ago

so in the case of a forced implementation of this, websites don't actually need to adapt.

i think if people see websites constantly being broken in chrome, instead they'll pick another browser, that's most people's first instincts when a site doesn't work.

just a take i guess, will it divide the web in 2?

andrecarini• 3 years ago

What's stopping a non-complying browser from sending forged attestation tokens? Honest question.

helen___keller3• 3 years ago

There’s a saying, on the internet nobody knows you’re a dog.

WEI is part of a broader movement to make this false - more generally to make an internet where we know you are a human staring at a screen

It turns out having dogs (or more commonly programs and scripts) on the internet is not profitable and not good for business, so corporations want to take dogs off their websites by finding clever ways to attest that a real human with eyeballs is clicking with hands and staring at ads.

Support dog rights. Don’t allow for a WEI-dominated web.

EvanAnderson2• 3 years ago

The whole narrative about WEI "proving" you're a human is completely false (and I'd argue a ruse). It only proves you're using a sanctioned OS and browser binary. It does nothing to stop robots being wired-up to devices w/ emulated inputs.

In fact, WEI will make it easier to use a robot w/ a sanctioned software stack since, hey, it's a "human" per WEI.

helen___keller3• 3 years ago

WEI proposal leaves open the functionality of the attester, so it’s neither correct to say this will prove requests are humans nor that it simply proves a sanctioned OS/browser.

The attester will attest whatever they want. They can evolve to match the further degradation of user freedoms.

BizarroLand3• 3 years ago

WEI is about proving you're a human the way the Kid's Online Safety Act is about protecting kids.

devsda3• 3 years ago

There are many arguments against this but not many brought the implications for search engines.

If websites implement this, it will effectively make building a web search engine impossible for new entrants. The current players can whitelist/attest their own clients while categorizing every other scraping clients as bots.

If not for other reasons, I can't see how Google a search company can be allowed to push something that can kill competition using its market dominance in other areas like browsers.

justcool3932• 3 years ago

If not for other reasons, I can't see how Google a search company can be allowed to push something that can kill competition using its market dominance in other areas like browsers.

Because antitrust has been dead for a while. Chrome is a tool to drive people to Google and Google ads and nothing more.

I will say, I did appreciate Microsoft having a browser engine with IE and Edge, even if the former was notoriously a pain, it gave competition in the space. Unfortunately, that's not the case anymore and everything is either Chrome (Blink), Firefox (Gecko), or Safari (WebKit). And it's pretty clear what Chrome has done once that have amassed a dominant market share.

I'm sure there are Googlers who think they're legitimately making the web a safer place, but I think the real reason is pretty clear if you take a birds eye view.

retrac• 3 years ago

Unfortunately it seems that nearly all software platforms with a dominant market share, end up degenerating to serve only one purpose: to shove advertisements and subscriptions onto you.

My mother's new Windows 11 laptop's out-of-the-box configuration had me clicking through half a dozen things attempting to manipulate me or her into spending more money. There are (I can only assume paid-placement) news and adfotainment in the start menu! Repeat pop-up reminders from Lenovo to subscribe to their protection package. Emotionally-manipulative reminders to subscribe to virus protection services. To Microsoft Office. Etc. etc.

It's been the same thing in the mobile market, where the move to "apps" means you are running their software on your device all the time, so they can optimally surveil you, and target the advertisements and behaviourally-modifying nudges. Quite a few messaging services now actively mess with delivery of notifications, spacing them out, delaying them, according to research that shows what maximizes engagement.

I saw the trend 20 years ago and switched to free software around that time -- I liked Linux anyway, but it was partly on principle. Still, the new laptop was eye-opening. The degree of intrusion, the degree to which even desktop computers have turned into user-hostile advertising terminals serving the purposes of their manufacturer, rather than a computer for the user to accomplish their work, is quite shocking.

Everything networked is becoming like that - twisting the user's hardware, turning it into nothing more than a terminal, an extension of the corporation, serving their interests at all times. Even smart TVs now have ads built-in to their menus and such.

dontreact2• 3 years ago

Is it possible for them to implement this API in such a way that it will fail 5% of the time or so, making it impossible for websites to deny individuals based on failing attestation?

https://github.com/RupertBenWiser/Web-Environment-Integrity/...

FireBeyond• 3 years ago

... until Google decides to dial that down to zero for "experience", or Hulu / Netflix makes you disable/whitelist/whatever to access their site.

lxgr5• 3 years ago

Why would they?

smarx0072• 3 years ago

Have you seen bank "login redirects" when the system redirects you for ca. 5-10 times before actually letting you in? This proposal could be defeated in the same way: after successful authn, the user is redirected to the page '/wei_chk_1', then '/wei_chk_2' and so on until '/wei_chk_$n', e.g. 10 or WEI check success. If the WEI Javascript check succeeded on at least one page, you are logged in. Otherwise, get lost.

devsda3• 3 years ago

I cannot trust a known thief and let them into my house based on their promise not to steal.

I have no way of knowing if they are honest or not and even if they are there's no guarantee that they won't change their mind later.I cannot take the risk and be on guard forever.

I would much prefer not to allow them into the house in the first place.

Google should not have brought this proposal but they did.So, I will not place my trust in Google doing the right thing irrespective of their claims and promises.

JohnFen8• 3 years ago

I don't see how that fixes the problem.

acrispino• 3 years ago

From the explainer:

However, a holdback also has significant drawbacks. In our use cases and capabilities survey, we have identified a number of critical use cases for deterministic platform integrity attestation. These use cases currently rely on client fingerprinting. A deterministic but limited-entropy attestation would obviate the need for invasive fingerprinting here, and has the potential to usher in more privacy-positive practices in the long-term.

I think any holdback will eventually go away because of the "critical use cases for deterministic platform integrity attestation"

bilekas• 3 years ago

The current players can whitelist/attest their own clients while categorizing every other scraping clients as bots.

I hadn't really considered this. In a roundabout way, is there a process for this to be rejected on grounds of "fair use" limitations?

ivanstojic• 3 years ago

How would this work against scrapers that are based on driven anpproved browser instances, eg. something like Selenium?

therein• 3 years ago

The browser instance knows it is being driven by an automation agent. If you so wanted, you can actually comment out the code that does that in the browser's code but since this new setup will enable the page to check if you compiled your own browser, they'll be able to incorporate the "isUnderAutomation" flag under the attestation data and that's sealed because you can't build your own browser and have it attest.

derefr8• 3 years ago

The current players can whitelist/attest their own clients while categorizing every other scraping clients as bots.

Can't they already do this by having scrapers send plain-old client certificates? Or even just a request header that contains an HMAC of the URL with a shared secret?

Actually, taking a step further back: why does anyone need to scrape their own properties? They can make up an arbitrary backchannel to access that data — just like the one Google uses to populate YouTube results into SERPs. No need to provide a usefully-scrapeable website at all.

cmrdporcupine7• 3 years ago

Google is clearly being evil here, but the original sin was having user-agent strings in browsers at all.

Public information on the 'world wide web' should by nature be open and accessible to any agent in a neutral way. (Of course this is implied in Google's (bullshit, cough) mission statement.) Making information about what the agent is invisible as a principle from the start would have helped with that.

In reality, that vision was lost in the early 90s when the web went from being a proposed hypertext/document/information retrieval system to being mostly a presentation system for what started as magazine/leaflet/poster analogues ("websites") to which were added dynamic client/server web applications.

The difference in model is stark: in the former, the browser, even the user, makes decisions about the presentation of the content based on mostly structural information declared in the document. In the latter, the 'document' is not a document, but a program executed on the users computer.

And once you've made that transition, the "developer" of the "program" now expects more and more of the kinds of controls they get when they truly control the platform.

And it doesn't help that in the midst of this, mobile applications came on the scene, undermined the web completely, and changed expectations of how content should be made available. From that point on it became even more expected by companies and product managers that they control the whole sandbox. e.g. Meta couldn't even be bothered to launch Threads on web, probably precisely because they don't like the restrictions there, and having full control is so much more profitable to them, and they're not the first.

In any case, this all sucks. I've already personally switched to Firefox in most places, but the very fact that Google feels emboldened to push this tact says a lot about the state of the web and how this 30 year trajectory has gone.

In a way, I just hope the "www" dies and all of us who helped create this thing in the first place birth something new and better. But this is also hopelessly naive.

coding123• 3 years ago

Remember when everyone and their brother helped everyone and their mother get on Chrome about meh, maybe 15 years ago?

Time to get everyone and their brother help everyone and their mother get on Firefox.

philipwhiuk• 3 years ago

It's notable that the proposal was put on a personal GitHub rather than a Google corporate GitHub. Someone is trying to avoid Google's obvious presence being too visible and throw their engineer under the bus instead.

For shame.

pabs32• 3 years ago

I wonder if any web servers or web apps have started to block Chrome users yet.

nfw27• 3 years ago

No serious business is going to block the majority of their traffic

pabs32• 3 years ago

I was talking about web servers and web apps, not about businesses. They can patch the software if they want to allow Chrome users.

bryanrasmussen2• 3 years ago

Can attestation of the browser be used as personally identifying information? It obviously must be one more data point in identifying the user?

SergeAx• 3 years ago

Is there a technical explanation of what exactly is being pushed here?

Web is an open protocol. It is okay for both browser and server to support some third party extension, and Google owns 95% of browsers. But how can it be forced onto all the servers?

guy98238710• 3 years ago

We are in post-efficiency era. Power is driving profits and that's what companies compete for. Efficiency (value-to-cost ratio) is now a technical detail, soon to be automated away by AIs. The same is happening in politics - efficiency is a technical detail delegated to civil servants while politicians focus on power. The world is a small pond full of sharks so hungry they eat each other.

krabmagnet• 3 years ago

Appologies if this was asked already, but what do people think are the most effective way to combat this? We are a website full of people who understand tech, surely we can find a way to push back

exceptione• 3 years ago

Wondering what you can do?

First:

- ban Google all together in your personal life. No chrome and no excuses. Stop your bullshit or leave this profession.

- develop with and for firefox and friends only, introduce usability problems for chrome

- employ the same tactics as google.

  -> Bundle firefox with the software you are distributing. 

  -> Like google did, remove the competition altogether from the users device.

  -> make your npm-module or your website slower in chrome

  -> show a popup urging users to download firefox, provide a link.
 Refer to their current chrome as malware.

  -> use as many tricks as you can think of to spoil the well for google. 
     Destroy search results, fill their storage with /dev/random, whatever your imagination leads you too. You keep telling us you are so smart. Show it.

- remember, Google's capital is data. Hit that and the beast will die.

If you are not ready to do this, you are part of the problem. "Maybe later". No, people have warned for years. I wrote that using chrome is "less than smart" years ago, and some people took real offense when I wrote that. If you don't act now and update your projects like I wrote above, you will never do it.

Secondly, tweet, write to tech journalists. But only after you did the above.

Thirdly, Google is evil and they know it. They care only about money and they trust you to find excuses. There are already some people who talk to themselves "Well, I see both sides really". Don't be that one.

Fourthly, I am very worried that the window of opportunity is closing now rapidly. It is late to defend our values, rights and future all by ourselves while all political parties gladly take donations by the millions. I am not an anarchist (nor a libertarian), and I would rather sit on my lazy ass like you. However, the amalgamation of tech oligarchs and ruthless political factions is accelerating. They are happy to trade civil rights for something more tangible. Your legal rights are being eroded one after the other and you might lose the right (or means) to stand up for them.

If things go really wrong, keep in mind that while in theory one could burn the whole thing down, well, yes, a statement in public life would help for publicity. But PR is a hard thing if you don't have money. The easiest steps are outlined above.

krzyk• 3 years ago

Could someone explain what WEI is? Searching for it returns quite a bit of acronyms.

Paianni• 3 years ago

Looks like this has been inserted into release 117, which won't hit the stable channel for several months yet. Chromium is still the most secure GUI browser out there so I'm not in a rush to leave, especially as OpenBSD 7.4 will probably ship with 116.

If the devs/Google's intentions are truly limited largely to trying to prevent bots, then I hope they realise their folly.

contravariant• 3 years ago

Since this is basically just obfuscation shouldn't it be possible to break it? Heck it's not even DRM so it doesn't fall under the protection of the DMCA.

mindslight5• 3 years ago

No, not at all. Search "remote attestation" and "safetynet".

Gud2• 3 years ago

How do we kill Google? They were great for 10 years - so so for another 10 - but now they’re outright hostile towards the free internet and must be put down. So how do we do it?

intrasight• 3 years ago

Isn't this easily "defeated" by the use of a web proxy? Won't corporate web proxy software just replace the token with a generic company token?

mordae6• 3 years ago

Requiring remote attestation of devices not owned by the relying party should be illegal unless it is a revocable opt-in and only used to protect interests of the user, not service provider.

_elf• 3 years ago

I hope this is something that non-Chrome Chromium-based browsers can omit from their builds.

thunkshift1• 3 years ago

Can someone pls explain what is happening and why this is bad

rdevsrex• 3 years ago

I wish Google would solve real developer pain points like having secure client side storage. That would be useful to developers. But heaven forbid they take a break for a moment from trying to squeeze every ounce of profit out of their users.

nfw27• 3 years ago

In order to have secure client-side storage, it seems like you would need to be able to verify that the client-side application that is accessing it is unmodified -- which is what WEI would allow for.

pzo4• 3 years ago

Not sure how exactly ad fraud works but why this WEI supposed to even prevent it? There are many tools that allow to control your mouse and keyboard programatically like pyautogui [0].

Will OS check if such python lib is installed or script running in the background? Then those that doing ad fraud will move to programmable board as BLE keyboard/mouse/hid. Even microbit can can be programmed as BLE HID device [1]. Add external camera on unattested device that will stare at attested device screen and you can automate lots of thing. Sure this is more complicated to pull off but will probably eventually happen anyway if this is a lucrative business.

In the end WEI wouldn't prevent ad fraud / fakes but would end up used for restricting other things.

[0] https://github.com/asweigart/pyautogui

[1] https://github.com/bsiever/microbit-pxt-blehid

tantalor• 3 years ago

The term for this is "cat and mouse"

awesomeMilou3• 3 years ago

Will OS check if such python lib is installed

Most computers come with a trusted platform module which increasingly runs more and more services related to media handling. On modern Macs the T2 chip is an A8 or A9, meaning it has the same power of a modern iPhone and handles everything from device input (mouse & keyboard), to webcam decoding to media decoding. When you watch netflix on a modern macbook, the video buffer that is displayed is actually a shared memory buffer from the T2 chip, which the main SoC can't actually see. If you take a screenshot you will see that the screen stays black, since audio and video come purely from the chip.

You could run a Browsers Renderer in there and you would never notice.

insanitybit5• 3 years ago

I don't think that that's surprising. Isn't this how all proposed features work? They can sit behind a flag for years, but the goal during a proposal is to ship first.

Arch-TK2• 3 years ago

I predict that hardware attestation will in 10-30 years become a requirement to maintain an internet connection.

Given Microsoft's push to make their OS support hardware attestation as well as Google's push for technologies which use hardware attestation in broader and broader scopes (Android and iOS has supported this for apps for a long time), the technology to make this possible is increasingly becoming widespread.

Hardware which supports hardware attestation is expensive and some people who can't afford it would therefore be excluded. But I don't think this matters.

If Google forces you to see all their ads then they can sell the ad space for more money. This can make it increasingly profitable to sell devices at an ever increasing loss. Likewise for Microsoft.

As a side note, this will make it incredibly difficult for anyone to compete in the hardware space. Why would someone spend even £500 on a phone or computer from a non adtech company when the adtech company can sell the same device for £100 or £50 or maybe even give it away for free?

By making hardware attestation more mainstream, it will become increasingly difficult to argue that enabling it for things would cut off customers.

I think it's easy to argue in favor of requiring hardware attestation for internet connections from the point of view of a government or an ISP. After all, if your customers can only use a limited set of hardware which is known and tested for security, it decreases the chance of security problems. For a police state like the UK it also seems even easier to justify too.

Even if things don't go that far, in a few years you will become a second class citizen for refusing to allow this on your devices. I can easily imagine banks requiring WEI for their online banking portals (they already do it for all their apps). Likewise I can also imagine my water, gas and electricity companies, or really any company which handles payments, considering this technology.

The worst part is, I don't think most people will care as long as it keeps working seamlessly on their devices. Likewise I don't think governments or the EU will do anything about it. I am not even sure what I can do about it.

JohnFen8• 3 years ago

I predict that hardware attestation will in 10-30 years become a requirement to maintain an internet connection.

I fear you're right. But if the current trends keep up, I'll have abandoned the internet entirely before that happens.

I mourn for what we have already lost, and we are poised to lose even more.

derefr8• 3 years ago

I predict that hardware attestation will in 10-30 years become a requirement to maintain an internet connection.

What you fail to take into account, is that geeks like being able to freely goof around with stuff; and that new disruptive tech evolves precisely in the ecosystems where geeks are goofing around with stuff.

Consider the dichotomy between iPadOS and macOS. macOS still exists — and still has things like the ability to disable Gatekeeper, enable arbitrary kernel-extension installation, etc. — because the geeks inside Apple could never be productive developing an OS on a workstation that is itself a sealed appliance. They need freely-modifiable systems to hack on. And they may as well sell other people those free systems they've developed — with defaults that make the tool appliance-esque, sure, but also with clear paths to turning those safeties off.

The same thing was true in the 90s with the rise of walled-garden ISPs. The average consumer might be happy with just having access to e.g. AOL, but the people who work with computers (including the programmers at AOL!) won't be happy unless they can write a program that opens a raw IP socket and speaks to another copy of that program on their friend's computer halfway around the world. And so, despite not really mentioning as a feature, every walled-garden ISP did implicitly connect you to the "raw" Internet over PPP, rather than just speaking to the walled-garden backend BBS-style — because that's what the engineers at each ISP wanted to happen when they used their own ISP, and they weren't going to tolerate anything less.

And then, gradually, all the most interesting stuff for consumers on the Internet — all the "killer apps" — started being things you could only find the "raw" web, rather than in these walled gardens — precisely because the geeks that knew how to build this stuff, had enthusiasm for building it as part of the open web, and no enthusiasm for building it as part of a walled-garden experience. (I would bet money that many a walled-garden developer had ideas for Internet services that they wrote down at work, but then implemented at home — maybe under a pseudonym, to get out from under noncompetes.)

Even if there comes about an "attested Internet", and big companies shift over to using it, all the cool new stuff will always be occurring off to the side, on the "non-attested Internet." You can't eliminate the "non-attested Internet" for the same reason that you can't develop an Operating System purely using kiosk computing appliances.

The next big killer app, after the "attested Internet" becomes a thing, will be built on the "non-attested Internet." And then what'll happen? Everyone will demand an Internet plan that includes access to the "non-attested Internet", if that had been something eliminated in the interrim. (Which it wouldn't have been, since all the engineers at the ISPs would never have stood for having their own Internet connections broken like that.)

Arch-TK2• 3 years ago

You have opened up my eyes to an important aspect. I hope you're right.

BizarroLand3• 3 years ago

Hell, as soon as the federated systems started getting traction, Meta's Threads got set up to interface with them.

The companies have an imperative, since I guess calling it a vested interest would be an understatement, to not let you escape from their clutches.

They can't force you to come inside, and they can't force you to stay, but they can make it so that it's almost impossible to go anywhere where they are not already there. It's creepy and predatory vulpine super stalker behavior, but unless we establish a system of government that puts our desires above theirs there is not much we can do about it other than stay away to the best of our abilities.

AlfeG• 3 years ago

Just don't use and especially pay to sites that will enforce this.

4oo43• 3 years ago

Don't just comment and complain, contact your antitrust authority today:

US:

- https://www.ftc.gov/enforcement/report-antitrust-violation

- antitrust@ftc.gov

EU:

- https://competition-policy.ec.europa.eu/antitrust/contact_en

- comp-greffe-antitrust@ec.europa.eu

UK:

- https://www.gov.uk/guidance/tell-the-cma-about-a-competition...

- general.enquiries@cma.gov.uk

India:

- https://www.cci.gov.in/antitrust/

- https://www.cci.gov.in/filing/atd

hooverd• 3 years ago

A customizable form letter would be nice to have, if anyone wants to jump on that. I'm not a great writer in that respect.

4oo43• 3 years ago

This is what I sent, feel free to use and customize:

    I would like to bring your attention to Google’s recent proposal to add a feature to its Chrome (Chromium family) of browsers called Web Environment Integrity. This provides a mechanism to reinforce Google’s already dominant browser market position by creating a technological control that can be used to nullify a user’s choice of browser, device and operating system. This technology also has the potential for abuse by preventing users from using browser extensions that can enhance security by blocking unwanted and potentially malicious content, as well as browser extensions that help vulnerable users with enhanced accessibility needs, such as color blindness and visual impairment.

    Google’s dominant, near-monopoly position in the browser market already harms me as a consumer by reducing browser choices and preventing a competitive market for developing new browsers. Allowing Google to include this feature will reduce my browser choices and consolidate the browser market even further, and it is incumbent on [INSERT AUTHORITY HERE] to take action against this abusive behavior.

burkaman4• 3 years ago

My email:

Google has proposed a new Web Environment Integrity standard, outlined here: https://github.com/RupertBenWiser/Web-Environment-Integrity/....

This standard would allow Google applications to block users who are not using Google products like Chrome or Android, and encourages other web developers to do the same, with the goal of eliminating ad blockers and competing web browsers.

Google has already begun implementing this in their browser here: https://github.com/chromium/chromium/commit/6f47a22906b28994....

Basic facts:

1. Google is a developer of popular websites such as google.com and youtube.com (currently the two most popular websites in the world according to SimilarWeb)

2. Google is the developer of the most popular browser in the world, Chrome, with around 65% of market share. Most other popular browsers are based on Chromium, also developed primarily by Google.

3. Google is the developer of the most popular mobile operating system in the world, Android, with around 70% of market share.

Currently, Google's websites can be viewed on any web-standards-compliant browser on a device made by any manufacturer. This WEI proposal would allow Google websites to reject users that are not running a Google-approved browser on a Google-approved device. For example, Google could require that Youtube or Google Search can only be viewed using an official Android app or the Chrome browser, thereby noncompetitively locking consumers into using Google products while providing no benefit to those consumers.

Google is also primarily an ad company, with the majority of its revenue coming from ads. Google's business model is challenged by browsers that do not show ads the way Google intends. This proposal would encourage any web developer using Google's ad services to reject users that are not running a verified Google-approved version of Chrome, to ensure ads are viewed the way the advertiser wishes. This is not a hypothetical hidden agenda, it is explicitly stated in the proposal:

"Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they're human, sometimes through tasks like challenges or logins."

The proposed solution here is to allow web developers to reject any user that cannot prove they have viewed Google-served ads with their own human eyes.

It is essential to combat this proposal now, while it is still in an early stage. Once this is rolled out into Chrome and deployed around the world, it will be extremely difficult to rollback. It may be impossible to prevent this proposal if Google is allowed to continue owning the entire stack of website, browser, operating system, and hardware.

Thank you for your consideration of this important issue.

varispeed4• 3 years ago

I admire your optimism. Don't know about the others, but I'll be surprised if UK one would lift a finger. They are beyond useless.

4oo43• 3 years ago

I'm not extremely optimistic either but at least in the US Lina Kahn is already on the right track with antitrust and the FTC already has two antitrust cases against Google in process. However, it's still an uphill because antitrust enforcement was either asleep at the wheel (or corrupted, depending on your perspective), which is partially why Google is in such a dominant position to begin with.

IANAL, the EU is also on the right track with antitrust but unfortunately seems very weak in terms of penalties and enforcement.

At this point, anything we can do to slow them down in any jurisdiction in a win. Even if antitrust enforcement is weak making Google at least have to defend this in a pro-forma way I think helps.

burkaman4• 3 years ago

Thanks, just emailed the FTC. It was a bit cathartic and now I don't have to be angry about this for the rest of the day, I'd encourage everyone else to do the same.

DanHulton• 3 years ago

Canada: - https://www.competitionbureau.gc.ca/eic/site/cb-bc.nsf/frm-e...

ethanjstark• 3 years ago

Thank you so much for your call to action; just emailed antitrust@ftc.gov.

For any experiencing barriers for writing the email, my method is below; Bing Chat generated an excellent email that only needed a bit of editing.

1. Open https://vivaldi.com/blog/googles-new-dangerous-web-environme... page in (ugh) Edge.

2. Open Bing Chat sidebar (top right corner); it auto-summarizes the article.

3: My prompt: Using the that webpage summary, please write a letter reporting Alphabet for antitrust violation. Please include the following [this language is from the ftc.gov site]:

Q: What companies or organizations are engaging in conduct you believe violates the antitrust laws? A: Alphabet

Q: Why do you believe this conduct may have harmed competition in violation of the antitrust laws? A: [use the article]

Q:What is your role in the situation? A: I'm a user of the Firefox browser

[edit: line breaks for readability]

bfelbo• 3 years ago

I think https://competition-policy.ec.europa.eu/antitrust/procedures... would be better for contacting EU antitrust.

Here you can specifically create new antitrust complaints.

Theory42• 3 years ago

Great suggestion, I did so just now.

Havoc• 3 years ago

And yet people keep saying it’s an independent project that is definitely not google controlled.

__MatrixMan__2• 3 years ago

Is anyone else working on alternatives to this web? We're going to want something working before this one becomes a telescreen.

I'm thinking:

- content addressing, not server addressing (to better distribute the hosting load)

- looser coupling between data itself and apps for viewing data (to prevent aesthetics from being used as a heuristic for trustworthiness)

- a native permissionless annotation protocol (p2p trust governs whether annotations appear: if you see an ad, just revoke trust in its author)

- no code execution needed for browsing, fancy features (i.e. the kind of thing you actually need js for) stay optional

I'm curious what design goals other people think are relevant.

supazek• 3 years ago

I’ve put barely any thought into it but I think a “localnet” would be better. Your usage is entirely based on calculated geoposition and the userbase is segmented into regions based on user count. More than X0,000 users in any one region and it splits to keep things small. This would be a limitation for hosting content. If you want to send a message out to another person in a different region you’d have to make a deliberate effort to do so and it will be private such as a letter would be.

Idk if that would achieve my goals and honestly I can’t plainly state what my goals are. All I know is I get tired of privileged California snobs telling me how things should be in my back 40

__MatrixMan__2• 3 years ago

I've had similar thoughts. I've been sketching out a design where you can tag data with a location (a restaurant menu, say, which is only needed near the restaurant). Suppose the data is being gossiped between mobile devices. Some process which understands the user's past (and estimated future) movements can decide when the data can be forgotten.

Plus--as I imagine it--users would be able to trust each other in certain domains, so which fragments your device hangs on to is going to depend on who you trust and what you're interested in.

Hopefully, these combined would mean that whatever part of the web is relevant to your location is also the part of it that's already cached on your device or on a nearby one.

hot_gril8• 3 years ago

This war was already settled long ago on smartphones, which are globally the most used personal tech. There are already lots of things like banks and messaging apps that require full or partial use of an unrooted smartphone for security purposes. Now they're bringing it to the more niche area of PCs.

rolph3• 3 years ago

https://www.ftc.gov/about-ftc/contact

sspiff• 3 years ago

Publishing an implementation of a proposed web specification is how all web standards are created or evolve. The same thing happens with WebGPU, WASM, and many before them. Usually with a prefix (ms-, moz-, webkit-,...) and/or locked behind a config setting before standardization.

What is different this time other than it being a feature that is considered user-hostile?

That's not to say we shouldn't oppose this feature, I just wouldn't be up in arms about an implementation existing.

drewbug01• 3 years ago

That's not to say we shouldn't oppose this feature, I just wouldn't be up in arms about an implementation existing.

People aren’t up in arms about the process by which web standards become accepted; they are up in arms about this standard moving forward at all because of its dangerous implications for the web and it’s outright user-hostility.

samcat116• 3 years ago

Can someone explain how its technically impossible to conform to this spec using, for example some desktop linux distro and say firefox? Is there really no OSS way to implement this? Secure boot works today on linux (might not be the default happy path, but that seems fixable). TPM apis are there no?

GenericDev• 3 years ago

So fudging sick and tired of having to defend free and open information.

thrawa8387336• 3 years ago

How to turn it off? For real

aaronclong• 3 years ago

I'm curious what Brave says to my issue: https://github.com/brave/brave-browser/issues/31897

topshelf2• 3 years ago

@dang Would we be able to update the title please?

To clarify the acronym, _Google is already pushing Web Environment Integrity (WEI) into Chromium_

_cenw• 3 years ago

A good way to measure how annoying this would get is to look at the handful of applications demanding SafetyNet on Android. It is not quite as much as one would assume, since adding friction of any kind is a retention killer. On the open web this would likely be worse, since you are locking out more than jailbreakers and emulator users.

mrguyorama2• 3 years ago

If you STILL use chrome after this, you were never willing to give an alternative even a little bit of a chance anyway. Surely not supporting this and the power it gives Google over the web is worth a "slower" (I've never experienced that) browser or one with a stupid pocket logo in the corner that you NEVER HAVE TO INTERACT WITH EVER

rekabis2• 3 years ago

Will there be any way to disable it within Chrome?

rolph3• 3 years ago

How to Email to the President and Members of Congress

https://www.einvestigator.com/government-email-addresses/ [2022]

this abuse of tech, potentially goes beyond antitrust, and damages global economic wellbeing, as well as impoverishing information systems on global scale, generating isolation, ignorance, division, and radicalization.

nightshadetrie• 3 years ago

bruh

esafak• 3 years ago

WEI stands for Web Environment Integrity:

https://en.wikipedia.org/wiki/Web_Environment_Integrity

croes• 3 years ago

Hey Google, how about removing that "feature" because of lack of interest as with Jpeg XL?

funOtter• 3 years ago

How does this affect people using Pi-hole to block ads?

prozacchiwawa• 3 years ago

It's such a lazy, bad proposal that even if one wanted what it promises to deliver, you'd be hard pressed to choose a better way of getting it used for malicious purposes. Handing the token back to the web script means successful cross site scripting attacks can farm, exfiltrate and repurpose the tokens, as well as bypass attempts to limit which domains are allowed to receive their contents.

esbeeb• 3 years ago

There should be a "United Guild of Noble GentleNerds", which Google, and all it's employees, could be formally kicked out of.

IYasha• 3 years ago

Is it possible for web server software developers to oppose this? I mean, if Apache and Nginx join in protest and refuse to suport it, Goolag will lose!

animex• 3 years ago

If it's possible to detect the feature and reject delivering to a browser that has this feature enabled.

Fight.

greatgib• 3 years ago

In my opinion, I think that it is good to remember the name of these developers that have not enough moral ethic to not betray the internet and users:

- Peter Bork Pakkenberg - Rayan Kanso - Dmitry Gozman - Richard Coles - Kinuko Yasuda

Let's not forget that it is not Google in itself, but persons being the keyboard that are pushing that. People that have the power to say no but did not.

I don't know you, but at the next Google mass layoff, I will certainly not offer to give an employment to someone with so little morality like them...

Google is already pushing WEI into Chromium

Related Stories