Fighting for the open web [image]

https://www.davidrevoy.com/article982/fighting-for-the-open-web

by pabs3 • 3 years ago

187 96 3 years ago

If fingerprinting is so effective and reliable, as we have been told on HN countless times, then why is Google proposing WEI. Honest question.

pmlnr• 3 years ago

Because it's not just the ability of tracking in question but the ability to display the ads as well.

Santosh83• 3 years ago

WEI is for controlling what software runs in the stack, from the bootloader upwards. Traditional secure boot gives assurances up to the kernel. WEI will extend it up to the browser. So more layers of the stack are secured from unauthorized modifications.

realusername3• 3 years ago

You should not use the word "secure", it only checks the integrity, it doesn't guarantee any security, same as on Android. Same for "authorized" which is a bit misleading because only manufacturers can authorize modifications, not users.

agilob• 3 years ago

It's been my worry that at some point Google will force DRM on YouTube and I won't be able to backup interesting channels, but I didn't expect Google will put DRM on majority of websites. Last week Google granted itself rights to scrape all the internet for its AI, but doesn't us to do it.

https://www.theverge.com/2023/7/5/23784257/google-ai-bard-pr...

realusername3• 3 years ago

The genius marketing move behind Google nowadays is convincing people that indexing and scraping are two different things and they are the only entity allowed to do it.

gmerc• 3 years ago

because it’s not about fingerprinting or even identity, it’s about forcing the browser to not run code like adblock or code that scrapes their treasured data they amassed for AI use

Google knows well enough that their solution does not attest humans - it attests machines which may or may not be used by humans.

The web is already full of vietnamese click farms of physical android devices with real accounts, their narrative is about misdirection

realusername3• 3 years ago

Exactly, anybody who think this will solve any issue with bots needs to take a hard look on Android and how absolutely nothing changed with the play integrity api, the click farms are just as big as before.

It's effective against thirdparty roms and competitors though.

charcircuit• 3 years ago

Because it means that browsers can try to implement features that resist fingerprinting without hurting legitimate use cases of the web.

pkulak2• 3 years ago

My guess is that they want to stop bots from creating Google accounts once and for all. I don’t see them putting DRM on YouTube. That would break every app everywhere, and many of them can never be updated. Most could never be updated to this scheme.

peteforde• 3 years ago

I remember when it was common to release third-party Twitter clients and bots were considered first-class citizens.

Large companies are far less uptight about breaking ecosystems that you might think. I say this as a former VB6 developer.

jsnell• 3 years ago

Chrome wants to get rid of fingerprinting, and has for many years (see the entire Privacy Sandbox effort). But they cannot do it unilaterally, they need to identify the legit use cases and design + implement new privacy-preserving technologies to meet those use cases. (Yes, yes, we all know Apple and Firefox have been able to such things unilaterally. But as we've seen by the different reception from Apple having shipped remote integrity attestations in prod for a year to Chrome just proposing it, the rules aren't the same for all browsers.)

Fraud prevention/anti-abuse is both an extensive use case for fingerprinting and the most obviously legitimate one. If we demand that browsers close off all the fingerprinting loopholes (it's a great goal!) but don't allow a replacement, the web will be mostly dead as a platform in 10 years. All economic activity will move to native apps on walled garden platforms that are able to provide effective anti-fraud mechanisms.

throw_m2393393• 3 years ago

WEI is about installing some (closed source) spyware on your computer so that Google knows you're using the "right kind" of client.

npteljes• 3 years ago

Because it's about control, not safety. Or it's about safety, but not for the user, but for whomever publishes content, or software.

nuker2• 3 years ago

Why the fox? Safari (WebKit) was always first to implement major privacy features, not Firefox.

Keirmot• 3 years ago

Because Apple doesn’t support Windows nor Android

pkulak2• 3 years ago

Nor Linux.

jdsalaro2• 3 years ago

Why the fox?

Perhaps because Firefox, and the Mozilla foundation as a whole, are one of the few projects not trying to milk you for data nor money? Might be a good enough reason in my book.

PathfinderBot3• 3 years ago

The detachment from reality I see in some HN readers is really mind boggling sometimes.

I try to balance it out by flagging unconstructive comments, leaving it alone, and participating in more constructive threads instead. For reference, take the classic "don't feed the trolls" advice, in combination with Lobster's flag types:

For comments, these are: "Off-topic" for drifting into meta or topics that aren't related to the story; "Me-too" when a comment doesn't add new information, typically a single sentence of appreciation, agreement, or humor; "Troll" for derailing conversations into classic arguments, well-intentioned or not; "Unkind" when uncharitable, insulting, or dismissive; and "Spam" for promoting commercial services.

lrem• 3 years ago

Apple was also the first to ship attestations in Safari.

mananaysiempre• 3 years ago

Because Apple has already shipped[1] the (functional equivalent of) evil web-breaking thing that the author is depicting the fight against.

[1] https://httptoolkit.com/blog/apple-private-access-tokens-att..., discussed at https://news.ycombinator.com/item?id=36862494

Renaud• 3 years ago

Mmmm, maybe because the last version of Safari that could be installed on Windows was from 2012 and Windows is still the most used computer OS at home and at work?

And when was the last version of Safari on Linux?

And using Firefox on iOS or Android allows you to sync your settings and history etc and send tabs between devices (and you should be happy, it uses Webkit on iOS -at least for now- because Apple won't have it any other way).

tuyiown2• 3 years ago

Mozilla come back from the early 2000’ came with a strong narrative about standard compliance, during the peak of ie6.

They are the historical proponent of open web.

nuker2• 3 years ago

Firefox is not a player in this battle, too small. WebKit is.

If Apple one day stops forcing it on iOS, that would be the day the battle was lost, nothing would be stopping Google from taking it all.

nathias2• 3 years ago

The fight was already lost, we must now fight the consequences of our defeat. Every year google squeezes its hold and introduces new chrome 'features' to serve its purposes. Platform capitalism seems to have come to a new stage, consolidation of power, closing off borders. Maybe now people will come to realize why protocols matter, and you can't replace them with APIs.

CrzyLngPwd• 3 years ago

FWIW I was going to write practically the same thing.

nathias2• 3 years ago

there was lots of us, but far far too few to make a difference

flagrant_taco5• 3 years ago

Unfortunately protocols seem to have no chance as long as people just want convenience and immediate gratification. For companies there's no profit in protocols, we love talking about motes and with data that means owning users' data and clutching onto like Gollum with his precious ring.

malikNF3• 3 years ago

I have converted most of my family and friends to ff in the past month. I take my time and help them understand why the change is needed.

The biggest reason they were afraid to move was because they had stored years worth passwords and other setting on their browsers.

Take some time and help a few people out. If everyone convert a few people and explain why they need to and help them with their issues. We can do this.

Mr don't be evil has become too evil at this point.

PathfinderBot3• 3 years ago

This is great advice! Instead of expecting non-techies to handle the migration to more ethical platforms by themselves or leaving them in the control of large corporations, us techies have an obligation to help them with such tasks.

zelphirkalt• 3 years ago

How do I help my non-techy friends to not be in control of technical decisions large organizations (I don't really have those) or to make the right decisions, while there are 10 "techy people" recommending Chrome, for every 1 privacy aware techy person like me, if not more, and these non-techy friends are not able to judge who has their best interest at heart or who knows their stuff best? How do they know who is the most knowledgeable?

There is always a huge temptation to choose convenience over privacy or security. If then some technical person recommends that avenue ...

And then comes along some accidental change, that breaks YouTube or GMail or whatever on Firefox ...

ivolimmen• 3 years ago

I also do that. I even help people move away from windows to Linux. I don't force them I just explain how it works and what the differences are. And if they have issues they can always contact me. Not everyone goes for Linux some people require applications that don't work on Linux or have less good alternatives. But Firefox is an easy step.

crumpled• 3 years ago

I also had a lot of passwords in chrome. So, what I often do is open passwords.google.com in a Firefox tab. Just a tip for anyone who thinks they're in that situation.

While switching browsers, I also adopted an open source password manager that has a Firefox plugin. Because passwords are migrating, I opted to move to a cloud-free solution. (This tip might be too much to suggest, depending on who you're trying to convert)

azubinski• 3 years ago

I really liked it because it made me smile a little

SpacePortKnight• 3 years ago

I don't like copying my passwords to clipboard becase of https://developer.mozilla.org/en-US/docs/Web/API/Clipboard/r... and other clipboard hijacking techniques.

stunpix• 3 years ago

Ironically by killing Google you highly likely will put Mozilla into a surviving. I doubt they will figure out how to deliver any new “big” features without being able paying their talented devs without a such funding.

tjoff• 3 years ago

Just maybe, if over half of the browser market disappeared (chrome), there might be a dollar or two materializing for the remaining options.

deelly• 3 years ago

The same ff that tried to introduce their own IPA proposal year ago for tracking users across the Internet?

https://adtechexplained.com/interoperable-private-attributio... https://docs.google.com/document/d/1KpdSKD8-Rn0bWPTu4UtK54ks...

tomjen33• 3 years ago

Thats great. However in reality most sites don't care about Firefox compatibility so that is an uphill battle.

Personally I switched to Brave, which has basically worked perfectly for me, other than a few sites that didn't handle blocking 3rd party cookies.

tourmalinetaco2• 3 years ago

As a fellow Brave user I fear for the longterm viability of the browser. They are an ad company at the end of the day, not browser maintainers. They lack the capital and I fear technical ability to maintain a truly separate fork, which may be required in the near future. They were already railroaded into the “no JPEG-XL” decision Google made.

kilburn• 3 years ago

most sites don't care about Firefox compatibility

This is FUD. Can you please name specific sites that don't work in firefox? Even all of google's stuff works fine, particularly when seen thorugh the eyes of non-technical people.

rmuratov• 3 years ago

When something doesn't work, I think, "Let me guess, this only works on Chrome, right?". And too many times recently, I am right.

As a tech-savvy person, I can handle it, but my old parents can't. I do not now the right thing to do here.

voz_• 3 years ago

As long as FF takes Google money, it’s tarnished.

anonymous_sorry2• 3 years ago

So what alternative do you suggest?

bimblesticks2• 3 years ago

We don’t live in a perfect world, and the priority should be preventing Google from having complete control over the internet. If you have any better ideas for how to do that, please let us know.

toyg2• 3 years ago

Is a national park "tarnished", if funded with tax money coming from a highly-polluting industry...?

As long as FF takes Google money, it's less money going to fund anti-web activities.

throw_m2393393• 3 years ago

Is a national park "tarnished", if funded with tax money coming from a highly-polluting industry...?

The difference is the majority of national parks funding might not come from highly-pollting industry. Mozilla corp would not survive for long without Google's bribes.

flagrant_taco5• 3 years ago

What do you propose as the alternative? And do you have any reason to believe FF is making meaningful decisions based on coercion from Google?

Mozilla has to keep paying the bills. I expect most people would be upset if they starting charging for the browser or selling ads, and I frequently see complaints when they focus on any products other than FF and MDN. If private donations won't cut it and sponsorships tarnish their standing, what's left?

tkubacki• 3 years ago

Serous question: I don't get why so much steam goes towards Chrome which can be basically open source (Chromium) and the same folks accept Microsoft Windows perfectly well (which is closed source and has much bigger impact on our privacy IMHO) Edit: same with MacOs?

audunw• 3 years ago

I think you’re confusing two things. How open standards are developed/pushed vs open source.

In the context of web integrity API, what good does it do that chromium can be open source? Whether a browser is potentially fully open source has no impact on the bad google is doing by pushing evil we. standards through the mainline chrome browser.

Personally I’ve switched to just using Safari on MacOS simply because giving Apple some power against Google in adoption of web standards is beneficial in my view. Apple is one of the few companies not incentivised by maximising ad revenues which is really toxic to the web. Not that I like what Apple is doing in general.

On Windows I’ve used Firefox only for years. (Why not on MacOS? My laptop (only macOS machine I have) is a bit old, safari runs smoother, and I like the iOS integration futures)

userbinator2• 3 years ago

Whether the source is open doesn't matter, and in fact I think that's part of a distraction; it's orthogonal to the issue of whether the software respects the user's freedom or is a way for a third-party to control the user (turning it into a "used"). Both closed and open source user-hostile software exists, and the same goes for software that isn't user-hostile.

Also, I suspect many of those who are anti-WEI are also either not Windows users, or Windows users who are grudgingly doing so and have also killed off the spyware and customised the environment to their own liking, which can still be done even without requiring source code.

bimblesticks2• 3 years ago

Can’t speak for everyone else but I just think that getting people to change their OS is much harder than getting people to change their web browser, so it makes sense to start there.

Chromium is in that awkward position where it is technically an open-source community-driven project but in practice operates like a closed-source one. Google has complete control over decisions and can make changes that serve their profits (see: JPEGXL debacle).

Of course, you can make the same critique of Firefox, but at the very least they are a nonprofit foundation and don’t have enough market share to abuse their power.

foota• 3 years ago

I think the main issue is the concern over whether you can access other resources on the web. E.g., windows doesn't allow websites to refuse service to you based on, say, your physical address; but the web integrity (WEI) proposal might allow a website to refuse service to your new custom browser because it can't implement WEI.

Imagine instead that chrome refuses to start if WEI can't be guaranteed (but otherwise it doesn't do anything). Is it annoying and dumb? Sure, but it doesn't limit how you can connect to the internet.

I mentioned here (https://news.ycombinator.com/item?id=36886572) that I think a better aligned proposal might be to introduce some system for pluggable 3rd party attestations that could be used by websites to verify the that the user is in some sense real. I imagine a lot of people would still object to this, but to me it would remove a lot of the concerns about the open web, since anyone would be able to build a browser integrating with the attestation services (I imagine some sort of service like LetsEncrypt would exist for this, although it's not clear what websites would settle on as being trusted attesters, if it's only a small set of companies then there's still some issues I think).

This whole debate has been interesting to me, since in some sense even with WEI the web is still a thing, it's just that it would be sent back to the 90s. E.g., any website would still be able to allow you to visit without WEI, but large swaths of the internet as used today might be unavailable without it.

blackhaz• 3 years ago

Google, in all its products, is adopting aggressive architectural decisions that break interoperability, sacrifice user freedom and strongly favor their proprietary business models. They are not interested in building an open Internet. They're building a business where users have no ownership of their data, everything runs on their servers and they are getting a commission on each step and layer of service/application creation, delivery and consumption.

creata• 3 years ago

I'd get family to switch over to Linux, but it isn't ready.

As far as I know, there's no comprehensive substitute for Microsoft Office, or many other Windows-only apps.

In contrast, Firefox and Chrome are practically interchangeable for most people.

JacobSeated• 3 years ago

That's just inaccurate. Microsoft Office is one of the easiest things to replace; LibreOffice takes some getting used to, but it does what you need it to do.

What's going to be harder is Microsoft Exchange, but if people work in a company that uses Exchange, they need to push their Exchange admin to enable SMTP and IMAP.

You should not be using Exchange for calendar synchronization anyway, and I am sure there are better dedicated alternatives in the OSS world. Probably something like Nextcloud which comes with numerous useful apps.

For video editing I think Kdenlive does everything you need for basic editing.

arendtio2• 3 years ago

Most people use very little that is not available via a browser these days. MS Office, Spotify, Netflix, e-mail, banking, chats, everything is available. And for gaming there are solutions like Geforce Now. Sure if you want to find something which is not available, you will find something.

Yes, a switch to Linux comes with some change for the people, but what do you expect? Doing a switch without changing anything?

For my grandpa the switch to Linux was easier than the switch from Windows XP to Windows Vista...

Zardoz84• 3 years ago

Microsoft Office

Do you know Libre Office ? Also, don't have these horrible ribbon thing interface.

jruz• 3 years ago

I think this is actually great, users will finally have a reason to switch from Chrome to an open browser. Ofc they will fight back an allow only their browser on their services, which again will be a great push to use open and privacy conscious alternatives. So let them go as closed as they want

Sparkyte4• 3 years ago

I feel like the concept of Open Web runs hard against the institutions that fund the development and growth of the internet. I'm not saying I don't support the Open Web concept. I do but it seems more like a pipe dream than something that will just happen.

If a country sees the internet as a threat it will just create its own network and only allow its population to see what it deems alright. I would say most internet today is curated. The largest issue in addition to lack of openness networks is what the network contains, we have min maxed the internet for profitability and in the wake more tech debt which no one wants to own.

You are probably asking tech debt? Let me just say this tech debt comes in the shape of garbage data, false news articles and propaganda. Last one propaganda isn't necessarily something a government makes but business do it to for misdirection. This is usually done because there is no accountability for anyone utilizing the internet.

What I'm getting at is the fact there is a lack of accountability those who keep building up the internet keep piling garbage on garbage. One day the internet will cease because there will be so much unimportant information and misinformation on the internet that it will force governments to curate the internet. Which they sort of do already.

So before we can have truly an Open Web we need to help pick up the trash we've all created over the years. Set regulations that protect the internet from further garbage. If we don't hold someone accountable eventually we will be forced down the path of a Closed Web.

I strongly believe in Open Web from browsers to the freedom of starting your own webpage without restrictions. We just have to make progress.

libraryatnight• 3 years ago

waahh everything is pointless because if i do something positive someone else might do something negative. waaaaah

just go out and do something nice and refuse to be part of something shitty and maybe things will work out.

Dah00n• 3 years ago

Please add something to the discussion.

Sparkyte4• 3 years ago

I think you read the first paragraph and off ranted.

Firstly I am for Open Web, but the lack of regulation enforcing accountability prevents this from ever occurring. Tech debt in various forms also prevent this. We need to get passed those two large hurdles.

I don't see Open Web happening because the further decades of tech debt the further we get from the goal.

flagrant_taco5• 3 years ago

I also really hope to see the open web make a resurgence, but I have no faith in regulation as the answer. I'm not actually sure how regulating the open web would work, seeing as regulations require laws to be written by someone deciding what can and can't be done on the internet.

Bottom-up solutions are often the hardest, and a massive undertaking compared to top-down alternatives, but if the goal is am open web I can only see that working bottom up.

Not least of all, top-down regulations that actually improve the open web would be extremely difficult when companies like Google have nearly unlimited funds and most regulators and politicians are already well accustomed to being captured. Even on a good day I would expect well-meaning regulators to ask the "experts" at Google how it's supposed to work and what the regulations should be. The FAA allows Boeing to regulate itself as does the FDA with pharmaceutical companies, why would this be different?

Sparkyte4• 3 years ago

Self regulation only works in a top down solution that can be held accountable.

You can't hold anyone accountable with the Internet of Things and regulations that establish accountability allow self regulation.

villgax• 3 years ago

Private internet/VPNs with no government presence/censorship is the only way forward. Buy all your SDR transceivers while you can before they get outlawed lol

low_tech_punk• 3 years ago

Google, please read "Web Platform Design Principles - Priority of Constituencies":

The internet is for end users: any change made to the web platform has the potential to affect vast numbers of people, and may have a profound impact on any person’s life. [RFC8890]
User needs come before the needs of web page authors, which come before the needs of user agent implementors, which come before the needs of specification writers, which come before theoretical purity.

Ref: https://www.w3.org/TR/design-principles/#priority-of-constit...

samtho• 3 years ago

Google as a company just does not care. No amount of pointing out violations of web standards or norms is going to make them care and statements such as this only amount to indignation-fueled, self-congratulatory rhetoric.

throw_m2393393• 3 years ago

> The internet is for end users: any change made to the web platform has the potential to affect vast numbers of people, and may have a profound impact on any person’s life. [RFC8890]

That ship sailed when the W3C accepted EME. The internet ceased to be about the end users, but for media company and their DRM. They didn't have to accept it as a standard, if Google and Netflix wanted their own DRM system then their problem, not the web.

Vinnl2• 3 years ago

You can easily pretend you're respecting the priority of constituencies if you (i.e. Google) just say that the needs of web page authors are the needs of users ("otherwise the websites users want to visit would disappear").

the_lego• 3 years ago

I.e. home taping is killing music, VCRs should be illegal, etc.. Amazing how the same lie remains effective after being proven false so many times.

flangola7• 3 years ago

Yeah... executive stakeholders will fire you on the door spot if you come in with that sort of excuse. "How do you assure that our intellectual property, which is worth billions of dollars, is uncompromised?"

arendtio2• 3 years ago

I love that picture as it shows the difference in size and how chromium just sucks everything in, but somehow I miss the fallen Konqi (KDE mascot) in it. Konqueror (the KDE Browser) with KHTML was the origin of Webkit and therefore Chromium, but due to the vast improvements Apple (and later Google) made to the code base, KHTML and Konqueror became obsolete.

Nowadays, KDE users better use Firefox.

Gualdrapo2• 3 years ago

Nowadays, KDE users better use Firefox.

Meh, I've been just fine with Falkon. As I was with reKonq back in KDE SC4.

Gualdrapo2• 3 years ago

I thought I was gonna find some comment in here appreciating Revoy's artistry and dedication for his craft and his commitment to FOSS but it seems everyone just jumped on the web browser argument. It makes me realize how his work just goes unappreciated, like those beautiful snippets he did for a guide to Git.

Given_47• 3 years ago

I didn’t previously know of this guy, but I also hoped there would be more discussion of the artwork cuz I really like it. The uBO shield was such a nice touch as well. Thanks for adding some context to Revoy, I’ll definitely check out more of his stuff

news_hacker• 3 years ago

do you have a link to the git guide?

NylaTheWolf• 3 years ago

I saw this on Mastodon! Gorgeous art!!!

Fighting for the open web [image]

Related Stories