4 ms·

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies,

The New Cabal of the Web: 1) CloudFlare, 2) Google, 3) Mozilla, 4) Let's Encrypt, 5) a smattering of contributing vendors, 6) internet-related standards bodies, and a few other orgs I'm forgetting or not familiar with. Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. The really insane thing to me is that a lot of this tech is being pushed with the argument that they need to get around "port blocking". Uh. These groups setting these new standards run the most critical parts of the WWW, which is the most critical part of the Internet outside of the routing of it. They could get everyone to open up a god damn firewall port if they wanted. I mean this is just ridiculous. There's 65,535 ports and we only get to use one of them (443) because people are too lazy to do anything else?

pitaj 8y ago
You forgot the media publishers and the government. The DMCA had and has a huge effect on the web.
- peterwwillis 8y ago
  Yes, but not on the architecture/design of it.
  - BTeam 8y ago
    That's forgetting the push for EME as a W3C standard.
beokop 8y ago
This is the world we live in. Why can’t I access websites over ipv6 even though they’re hosted on cloud providers with ipv6 support? Because just getting people to change their configuration without an immediate benefit to themselves is arguably the hardest problem for the Internet right now.
gcp 8y ago
Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. In reality, "they" couldn't even ship Array.prototype.flatten because a few sites won't update MooTools. What you describe couldn't be further removed from reality. https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/8R9-KS3aVls/0jhMp-RBCQAJ https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...
kensey 8y ago
This is different from how Internet standards have always developed how, again?
comex 8y ago
> They could get everyone to open up a god damn firewall port if they wanted. No. They couldn’t. That’s the paradox. Together they control the client software running on just about everyone’s computers and phones… but they have very little control or influence over your random IT administrator running a corporate firewall or middleware box, who’s decided to block everything but 80 and 443 for “security” reasons. They don’t even have much influence over the vendors of those devices. Witness Chrome having to roll back TLS 1.3 support after initially deploying it, because BlueCoat and other vendors’ proxies were dropping all TLS 1.3 connections [1], despite TLS 1.3 having been many years in the making, and theoretically bring fully backward-compatible due to making use of the TLS version negotiation mechanism. In that case the relevant vendors did eventually release software updates, but only after Chrome forced their hand by unintentionally breaking all SSL sites for users behind those proxies – including Chrome’s own self-update server, so those users couldn’t even receive the rollback update! I’m sure that’s not an experience Google (or anyone else) is eager to repeat. Besides, for the sake of privacy, it’s best to limit the information transmitted in cleartext over the Internet to the absolute minimum – and that includes what type of service is being accessed. Why should an adversary intercepting traffic get to learn that for free from the port number, when that information could be transmitted as part of the encrypted connection instead? (Yes, the adversary might be able to figure it out anyway through traffic analysis, but at least that has limits and potential countermeasures.) [1] http://web.archive.org/web/20170311013249/https://bugs.chromium.org/p/chromium/issues/detail?id=694593 http://web.archive.org/web/20170311013249/https://bugs.chrom...
- peterwwillis 8y ago
  I don't buy this line for one minute. The fact that these organizations are either too weak or incompetent to roll out difficult changes in no way means it can't be done. This is just the path of least resistance. Rather than design something good, we just slap a layer of crap on top of another layer of crap and call it an improvement. But dressing up a turd doesn't make it smell like roses. The fact is that half (if not more) of the world depends on Google, Mozilla and CloudFlare. If they actually committed to breaking networks with a new standard, the vendors and network admins would have no choice but to slowly but surely roll out fixes, because the users need it. Maybe they should actually roll out a product that would update networks to fit an application's needs, like Kubernetes for SDN. This feature is literally "Oh, we're having problems with DNS, but changing the protocol could be hard, so let's hide a new version of it inside some other protocol." They should stop screwing around and just release a Google Chrome VPN, which you just know they're going to release. AMP was just the amuse bouche. Let's be real here, an advertising company does not care about privacy. Chrome implemented DNS over HTTPS a long time ago because it was a technical fix for a browser issue, not for privacy. Mozilla was slow to adopt but it got on the bandwagon. And let's not pretend that "hiding" a port number is a security feature, security by obscurity is a joke.

pitaj 8y ago

You forgot the media publishers and the government. The DMCA had and has a huge effect on the web.

peterwwillis 8y ago
Yes, but not on the architecture/design of it.
- BTeam 8y ago
  That's forgetting the push for EME as a W3C standard.

beokop 8y ago

This is the world we live in. Why can’t I access websites over ipv6 even though they’re hosted on cloud providers with ipv6 support? Because just getting people to change their configuration without an immediate benefit to themselves is arguably the hardest problem for the Internet right now.

gcp 8y ago

Pretty much the entire WWW is being shaped and controlled by this group. "Open Web" my ass. In reality, "they" couldn't even ship Array.prototype.flatten because a few sites won't update MooTools. What you describe couldn't be further removed from reality. https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/8R9-KS3aVls/0jhMp-RBCQAJ https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...

kensey 8y ago

This is different from how Internet standards have always developed how, again?

comex 8y ago

> They could get everyone to open up a god damn firewall port if they wanted. No. They couldn’t. That’s the paradox. Together they control the client software running on just about everyone’s computers and phones… but they have very little control or influence over your random IT administrator running a corporate firewall or middleware box, who’s decided to block everything but 80 and 443 for “security” reasons. They don’t even have much influence over the vendors of those devices. Witness Chrome having to roll back TLS 1.3 support after initially deploying it, because BlueCoat and other vendors’ proxies were dropping all TLS 1.3 connections [1], despite TLS 1.3 having been many years in the making, and theoretically bring fully backward-compatible due to making use of the TLS version negotiation mechanism. In that case the relevant vendors did eventually release software updates, but only after Chrome forced their hand by unintentionally breaking all SSL sites for users behind those proxies – including Chrome’s own self-update server, so those users couldn’t even receive the rollback update! I’m sure that’s not an experience Google (or anyone else) is eager to repeat. Besides, for the sake of privacy, it’s best to limit the information transmitted in cleartext over the Internet to the absolute minimum – and that includes what type of service is being accessed. Why should an adversary intercepting traffic get to learn that for free from the port number, when that information could be transmitted as part of the encrypted connection instead? (Yes, the adversary might be able to figure it out anyway through traffic analysis, but at least that has limits and potential countermeasures.) [1] http://web.archive.org/web/20170311013249/https://bugs.chromium.org/p/chromium/issues/detail?id=694593 http://web.archive.org/web/20170311013249/https://bugs.chrom...

peterwwillis 8y ago
I don't buy this line for one minute. The fact that these organizations are either too weak or incompetent to roll out difficult changes in no way means it can't be done. This is just the path of least resistance. Rather than design something good, we just slap a layer of crap on top of another layer of crap and call it an improvement. But dressing up a turd doesn't make it smell like roses. The fact is that half (if not more) of the world depends on Google, Mozilla and CloudFlare. If they actually committed to breaking networks with a new standard, the vendors and network admins would have no choice but to slowly but surely roll out fixes, because the users need it. Maybe they should actually roll out a product that would update networks to fit an application's needs, like Kubernetes for SDN. This feature is literally "Oh, we're having problems with DNS, but changing the protocol could be hard, so let's hide a new version of it inside some other protocol." They should stop screwing around and just release a Google Chrome VPN, which you just know they're going to release. AMP was just the amuse bouche. Let's be real here, an advertising company does not care about privacy. Chrome implemented DNS over HTTPS a long time ago because it was a technical fix for a browser issue, not for privacy. Mozilla was slow to adopt but it got on the bandwagon. And let's not pretend that "hiding" a port number is a security feature, security by obscurity is a joke.