Blink WEI “will not ship in current form”

https://toot.cafe/@slightlyoff/110841065888292567

by tbeseda • 3 years ago

40 14 3 years ago

gary_0• 3 years ago

Whether it was a shadowy executive cabal or a couple of overzealous minions who proposed WEI is kind of immaterial. Google has too much power to decide the fate of the Web, and no incentive not to exploit that power, and something must be done to stop it before it's too late.

jauntywundrkind3• 3 years ago

How is that the story here? Alex literally just said he - a Microsoft employee - had the power to block this. And would have.

There were tons of other w3c entities which could have blocked this specification. TAG & Security groups would both have had says.

M2Ys4U2• 3 years ago

What makes you think they'd listen to the W3C if they said "don't do it"?

They'd likely just spin up an "independent" body to manage the specification and publish it outside of the auspices of the W3C. That's what the did with AMP, after all, which sits under the OpenJS Foundation now.

jauntywundrkind3• 3 years ago

Chrome has one of the most transparent, pre-declared software delivery models on the planet.

This does sort of seem like the system is working as intended here. Give people enormous power, but do so in a transparent clear way with lots of review. Rather than a top down organization, this bottom up engineering allows in a lot more potential.

And some of the potential is bad. Do we the technical masses trust in the process, in the various discussions & checks built in to the w3c system? How much is our hunger for attention & excitement & drama fueling a mania, a craziness? 0? Maybe a tiny bit? Or is there real harm to the media cycle blow up beyond proportions to every potentially salacious idea that shows up on radar?

Like Alex, this was a huge deal. A huge issue. But it seemed unlikely to get far as a standard, and had barely begun review cycles, just getting some standards positions, not even getting TAG or security review requests started.

I really like Chrome's model, how proactive & transparent they are, so early. In contrast, most web vendors just ship stuff. Safari just shipped Private Access Tokens, which are Web Environment Integrity, in different name. https://news.ycombinator.com/item?id=36866355 https://www.snellman.net/blog/archive/2023-07-25-web-integri...

freitzkriesler2• 3 years ago

Honestly: good.

The fact that it was even proposed means there elements out there pushing for this stuff. Who knows whether it was a shadowy executive team or just some out of touch developers and PMs.

I wish there was more to say, but the backlash was swift, fierce, and to the point.

Good work.

M2Ys4U2• 3 years ago

"in current form" means our work on opposing Google here is not over.

We need to salt the ground this was grown in and make sure it never comes back.

martin8412• 3 years ago

Scorched earth. Forcibly dissolve Alphabet.

veave• 3 years ago

is very much worth worrying about as a direction of travel, but not without context

What's the context where WEI could be seen as a positive?

flangola72• 3 years ago

Verification that online communication is a human and not a bot. In short order it will not be possible to know if the person on the other side even exists unless there is a highly reliable "humanness" indicator. We are almost there for live text and audio communication, and video is advancing swiftly.

The FBI has already put out alerts about scammers and other evildoers calling people using the voice of their family members.

3LazTjBv-f2• 3 years ago

How exactly does it stop bots? At best it stops everything, but full blown browsers, from communicating with web servers (that includes `curl` and web security scanners). Even if it kills stuff like Selenium, bots can just use mouse/keyboard input. Unless we go all the way, and require DRM in every piece of hardware, so for example "Rubber Ducky" no longer can claim to be a keyboard. That would be more restricting than current MacOS.

3LazTjBv-f2• 3 years ago

Well, enterprise VPN clients have build in similar attestation[0]. So probably there are cases when it could be useful in browsers. The question is not if there are use cases, it is "can we stop all websites from requiring it?" and the answer is no.

[0] The Linux support for that goes from "bad" (check `uname` for version kernel) to none. At least with one client I had to use copy of "system report" file from Windows machine and it worked. Makes me wonder how much of it is just security theater.

appleflaxen• 3 years ago

As if four Google engineers advanced a proposal to make sure ads on the page get served because of their own, non Google, interests.

"They just love ads!"

Blink WEI “will not ship in current form”

Related Stories