8 ms·

> "large scale blocking of cookies undermine people’s privacy by encouraging opaque techniques such as fingerprinting" "If y'all had just handed over your wall

> "large scale blocking of cookies undermine people’s privacy by encouraging opaque techniques such as fingerprinting" "If y'all had just handed over your wallet when we asked, we wouldn't have had to hurt you. So really, this is your fault." More seriously, what Google is saying here is that privacy can't be mainstream. It's no different from the arguments that advertisers gave when they rejected DNT. They're willing to let a few privacy-minded people avoid being tracked, as long as that group never becomes a majority. But it was never their plan to get rid of tracking, every compromise they ever offered had the catch, "as long as it doesn't affect our bottom line." It's just another Equifax settlement. "Yeah we offered it, but we never assumed that so many of you would take it. Be reasonable." Heck that. If you genuinely believe that people should have a choice about privacy, then you have to accept that maybe the majority of people will decide they don't want cookies. You have to take a step back and consider that browsers that block cookies by default are just reflecting what their users already widely want; people want their browsers to protect them from tracking by default, without configuration.You're not offering users a choice, you're just mad that you can't use dark patterns to make users unsafe-by-default. This entire article is just insulting.

Ajedi32 7y ago
> "If y'all had just handed over your wallet when we asked, we wouldn't have had to hurt you. So really, this is your fault." Seeing as Google doesn't engage in fingerprinting and are actively taking steps to block it[1], I don't think this is a fair characterization of Google's position. [1]: https://blog.chromium.org/2019/05/improving-privacy-and-security-on-web.html https://blog.chromium.org/2019/05/improving-privacy-and-secu...
- nerdponx 7y ago
  Where does it say they don't engage in it? Naturally, blocking other companies' fingerprinting is important to their business model.
- Fellshard 7y ago
  Doesn't reCaptcha alone rely extensively on fingerprinting?
  - rbritton 7y ago
    It does. The more anti-fingerprinting measures you enact, the harder it is to pass to the point that it becomes nearly impossible to do.
    - ignoramous 7y ago
      Unless of course you're state-of-the-art neural net. Oh the irony...
- gruez 7y ago
  >This is why Chrome plans to more aggressively restrict fingerprinting across the web. One way in which we’ll be doing this is reducing the ways in which browsers can be passively fingerprinted, so that we can detect and intervene against active fingerprinting efforts as they happen. That seems like a 180 from their stance 2 years ago[1]. Their statement is low on details so I'll believe it when I see it. Right now the only browser with meaningful fingerprinting protection is tor browser/firefox. [1] https://bugs.chromium.org/p/chromium/issues/detail?id=49075 https://bugs.chromium.org/p/chromium/issues/detail?id=49075
  - Ajedi32 7y ago
    The initial statement was low on details because it was just an statement of intention. Specific steps they're taking to combat fingerprinting are visible in their public bug tracker[1]. Also, let's not forget the privacy budget[2] system they just announced in the OP. That seems rather promising. [1]: https://bugs.chromium.org/p/chromium/issues/list?q=component%3APrivacy%3EFingerprinting%20&can=2 https://bugs.chromium.org/p/chromium/issues/list?q=component... [2]: https://github.com/bslassey/privacy-budget https://github.com/bslassey/privacy-budget
    - Drdrdrq 7y ago
      The cynic in me is 100% sure they calculated the impact of these changes to their ability to track users and found the impact negligible. Still, it probably does make tracking more difficult for other advertisers, so there's that.
      - cpeterso 7y ago
        Since Google has cookies dropped by google.com properties that they can use for user tracking, I'm surprised they haven't worked harder to reduce the effectiveness of fingerprinting in Chrome. They could make user tracking more difficult for ad companies that don't have cookies dropped by sites as popular as google.com while accurately marketing the Chrome changes as improving user privacy.
- danShumway 7y ago
  Google does engage in fingerprinting in multiple of its products, but even if it didn't I don't think I would change my analogy. Google's position here is, "obviously you're going to have to let us track you some way, and our way (cookies) is better than fingerprinting." It's still blaming privacy-conscious users for the actions that advertisers have taken, because those unreasonable privacy-conscious people couldn't be content with just blocking some of the trackers. There's an underlying tone to this article that reads as, "you all messed this up because you didn't just leave well enough alone. Now we'll come in and fix it, but you're gonna have to compromise with us when we do." From my perspective -- no, users didn't break anything. This isn't our fault, and we should be allowed to broadly block cookies without being tracked in more pervasive ways. But, if it makes you feel better you can change a word in my characterization to read: > "If y'all had just handed over your wallet when we asked, they wouldn't have had to hurt you. So really, this is your fault."
- driverdan 7y ago
  I've downvoted you because, as others have pointed out, your statement that Google doesn't fingerprint is factually incorrect.
  - Ajedi32 7y ago
    I disagree. No one has posted any evidence that Google engages in fingerprinting users beyond simple user-controllable mechanisms like cookies. (Though several have indeed made that assertion with no evidence.)
    - driverdan 7y ago
      ReCaptcha and Analytics both fingerprint.
      - lmkg 7y ago
        Google Analytics does not fingerprint. Hits are identified with a user either by a first-party cookie (called the Client ID), or with a user-id value provided by the site owner. The site owner could provide their own fingerprinting value as a user-id, but the fingerprinting is not done by analytics itself. (There are some cases where identifiers are pulled in from other systems, but none of them can be used as the basis for unifying users.)
        driverdan 7y ago
        GA records a lot of data about the user such as screen resolution and browser version. It doesn't do full fingerprinting to identify unique users but it uses many common fingerprinting techniques.
        Spivak 7y ago
        Like collecting any data at all? I mean “what browsers and what versions do I need to support” and “what resolutions do I need to design for” are pretty benign questions.
- usefulcat 7y ago
  Considering that we're talking about a company which owes probably nearly all of its not inconsiderable fortune to predicting people's behavior via mass surveillance, this comment seems to miss the forest for the trees a bit.
lwansbrough 7y ago
> maybe the majority of people will decide they don't want cookies At the same time, a lot of people don't understand what cookies actually do (the good things they do, I mean) and thus having them disabled by default will deepen their belief that they're only bad. I'm not sure what I'd do if cookies were blocked by default. What an absolutely inconvenient reality that would be as a web developer. You'd have to embed a token in the page on each request, like WebForms, or something.
- Someone1234 7y ago
  Nobody has suggest nor enacted blocking all cookies by default. I'm not sure what you're referring to here. This is mostly about third party cookies and or Safari/Firefox's default privacy blocklists.
- _underfl0w_ 7y ago
  You seem to be conflating first-party cookies with third-party ones. The originating party of the cookie, with respect to the site the user get the cookie from, is the crucial point on that subject in this context.
colinclerk 7y ago
Interesting to me is that Google's Privacy Model suggestions of "Identity is partitioned by First Party Site" and "Third Parties can be allowed access to a first-party identity"[1] come off as more coherent and effective than Apple's ML based Tracking Prevention policies[2]. Issue is Google's third suggestion, "A per-first-party identity can only be associated with small amounts of cross-site information", is clearly advertiser-focused, not privacy-focused. I hope all can rally around the partitioning concepts and leave the others behind. [1]https://github.com/michaelkleber/privacy-model https://github.com/michaelkleber/privacy-model [2]https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ https://webkit.org/blog/8828/intelligent-tracking-prevention...
- om2 7y ago
  Google’s proposal sounds simple because it is vague, does not address all the ways websites can track you, and does not address all the possible compatibility problems with partitioning. WebKit’s policy (and more importantly our code) are what things look like when you actually try to ship tracking protection. Easy to be simple if you don’t have to spell out details or actually ship.
  - colinclerk 7y ago
    I don't believe it's very vague. This sentence in particular was succinct and represents a 90% solution to the problem: The identity "Me while I'm visiting nytimes.com" is distinct from the identity "Me while visiting cnn.com". To me, this means all client-triggered requests while my address bar ends in "nytimes.com" will have a distinct set of cookies that is only drawn from while I'm on nytimes.com. I prefer a rules-based solution to an ML-based solution. ML is more opaque and it's harder for developers to know when their solution will run afoul of the classifier. Are there significant compatibility problems this would cause?
    - om2 7y ago
      It says “identity”, not cookies. Maybe it means cookies are partitioned. Maybe it means some new form of identity token is created (Googles have proposed them at various times) and is partitioned, but cookies are blocked. Maybe it means new token plus cookies remain as they are based on the “fingerprinting is even worse” argument. Maybe there are different settings. Who knows? Anyway, the reason we moved away from cookie partitioning is that many third party embeds got confused when presented with non-empty cookies, but ones that weren’t the user’s canonical cookie for that site. Bugs were reported to us by embed providers, including Google web properties. This is a bummer because partitioning is elegant and has been WebKit’s go to approach since 2013, when we partitioned all storage besides cookies (LocalStorage, the HTTP cache, etc). A move that, incidentally was opposed by Chrime Engineers back when we shared an engine code base, though they are coming around now. (I should mention also that partitioning cookies made many social embeds stop working at all until we provided Storage Access API and got embed providers to adopt them, which is why ITP originally had a 24 hour user interaction exception. Fortunately the web has adapted now.) I should also mention, WebKit ML solution is deterministic. It’s trained offline. And it doesn’t substitute for enforcement actions, it substitutes for a block list of known trackers, which other tracking prevention systems use. One downside of strict rule based systems is that it may allow malicious players to game the system. So there has to be an out for changing the rules or ratcheting up enforcement.
olyjohn 7y ago
My favorite part is... "First, large scale blocking of cookies undermine people’s privacy..." Oh yeah, users and their privacy first! "Second, blocking cookies without another way to deliver relevant ads significantly reduces publishers’ primary means of funding..." Also we make less money when you do this... But users, privacy and synergy first! I think the second point is the real issue for Google. But of course they care about users first! I feel cynical as hell, but the whole thing reads so slimy to me. Like a used-car salesman twisting an obvious negative into a positive. "That's not a giant rust hole, that's just to reduce weight for efficiency!"
- nextos 7y ago
  I think a great setup for privacy are temporary containers. In fact, using the Temporary Containers Firefox addon and domain level isolation works virtually everywhere except on Google / Gmail / Youtube... That's because when you try to log into one of those, it tries to simultaneously log you into the other domains/Google products linked to your account and per-domain sandboxing prevents that. My setup against tracking is as follows: - Temporary Containers: Prevent cookie-based tracking - ClearURLs: Prevent URL-based tracking, which Google and Amazon use everywhere - VPN: Prevent IP-based tracking, to some degree - uBlock Origin: Block adds and some nasty JavaScript I find it quite hard to prevent fingerprinting. The privacy.resistFingerprinting in Firefox breaks tons of things. So does blocking JavaScript. And uMatrix is a bit time consuming to use, and not suited for inexperienced users. Any alternatives considering aside from Tor Browser?
  - CapacitorSet 7y ago
    Your setup will marginally benefit from the addition of [Decentraleyes](https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/ https://addons.mozilla.org/en-US/firefox/addon/decentraleyes...), an add-on which prevents requests to CDNs by serving some content locally.
  - kingo55 7y ago
    DNS filtering like pihole may be useful on your network for Ad blocking on Android/iOS. Not much more useful than ublock origin on your desktop though. Blocking at the DNS level is very effective.
3xblah 7y ago
Fingerprinting is mostly dependent on Javascript and presence of browser numerous detectable "features". What would happen to fingerprinting in the case of "large scale disabling of Javascript"? Even more, what would happen if there was large scale movement away from Chrome and other browsers with "features" that make fingerpinting possible?
- danShumway 7y ago
  It would greatly reduce the amount of fingerprinting, but not completely eliminate it. I've written about this before, but there's more than just Javascript we need to worry about -- we'd want to strip down CSS a bit, rethink how asset caching works, and potentially send less information in request headers. But it would certainly be a lot easier to do all of that without Javascript. The problem is that one of two things would happen: A) the majority of web apps would move to native platforms, where fingerprinting resistance is even worse. That would include a good many news sites, even though most news sites aren't really web-apps, and don't need Javascript to operate. They'd still do it. B) the majority of users would not use those browsers. We're playing a kind of weird game with fingerprinting right now -- we want to block it without breaking most websites. This is why adblocking is fantastic: it observably makes the web better to even an average user, so there's an incentive for users to adblock en-mass, and publishers can't really leave the web. Adblocking is a way to fight surveillance apparatuses without making sacrifices. It's a tricky situation to be in, and there's a lot more that could be said about the merits of different strategies. That being said, if you don't care about an en-mass policy, and you're just looking to increase your own privacy, it would definitely be a good idea right now to use something like UMatrix to disable at least 3rd-party Javascript by default. You'll have to do a lot of per-website tweaking, but if you're at all technical it's honestly not that bad.
deleted 7y ago
[deleted]
abdullahkhalids 7y ago
Nobody in the comments sections has identified the most nefarious part of their plan. Their goal to develop an "open set of standards" is an attempt to control how other browsers protect user privacy. This is Google saying, "oh looks like everyone else is doing things that hurt our business, so let's get everyone to work together on open standards, where we can block or delay attempts that run counter to our business model".

Ajedi32 7y ago

> "If y'all had just handed over your wallet when we asked, we wouldn't have had to hurt you. So really, this is your fault." Seeing as Google doesn't engage in fingerprinting and are actively taking steps to block it[1], I don't think this is a fair characterization of Google's position. [1]: https://blog.chromium.org/2019/05/improving-privacy-and-security-on-web.html https://blog.chromium.org/2019/05/improving-privacy-and-secu...

nerdponx 7y ago
Where does it say they don't engage in it? Naturally, blocking other companies' fingerprinting is important to their business model.
Fellshard 7y ago
Doesn't reCaptcha alone rely extensively on fingerprinting?
- rbritton 7y ago
  It does. The more anti-fingerprinting measures you enact, the harder it is to pass to the point that it becomes nearly impossible to do.
  - ignoramous 7y ago
    Unless of course you're state-of-the-art neural net. Oh the irony...
gruez 7y ago
>This is why Chrome plans to more aggressively restrict fingerprinting across the web. One way in which we’ll be doing this is reducing the ways in which browsers can be passively fingerprinted, so that we can detect and intervene against active fingerprinting efforts as they happen. That seems like a 180 from their stance 2 years ago[1]. Their statement is low on details so I'll believe it when I see it. Right now the only browser with meaningful fingerprinting protection is tor browser/firefox. [1] https://bugs.chromium.org/p/chromium/issues/detail?id=49075 https://bugs.chromium.org/p/chromium/issues/detail?id=49075
- Ajedi32 7y ago
  The initial statement was low on details because it was just an statement of intention. Specific steps they're taking to combat fingerprinting are visible in their public bug tracker[1]. Also, let's not forget the privacy budget[2] system they just announced in the OP. That seems rather promising. [1]: https://bugs.chromium.org/p/chromium/issues/list?q=component%3APrivacy%3EFingerprinting%20&can=2 https://bugs.chromium.org/p/chromium/issues/list?q=component... [2]: https://github.com/bslassey/privacy-budget https://github.com/bslassey/privacy-budget
  - Drdrdrq 7y ago
    The cynic in me is 100% sure they calculated the impact of these changes to their ability to track users and found the impact negligible. Still, it probably does make tracking more difficult for other advertisers, so there's that.
    - cpeterso 7y ago
      Since Google has cookies dropped by google.com properties that they can use for user tracking, I'm surprised they haven't worked harder to reduce the effectiveness of fingerprinting in Chrome. They could make user tracking more difficult for ad companies that don't have cookies dropped by sites as popular as google.com while accurately marketing the Chrome changes as improving user privacy.
danShumway 7y ago
Google does engage in fingerprinting in multiple of its products, but even if it didn't I don't think I would change my analogy. Google's position here is, "obviously you're going to have to let us track you some way, and our way (cookies) is better than fingerprinting." It's still blaming privacy-conscious users for the actions that advertisers have taken, because those unreasonable privacy-conscious people couldn't be content with just blocking some of the trackers. There's an underlying tone to this article that reads as, "you all messed this up because you didn't just leave well enough alone. Now we'll come in and fix it, but you're gonna have to compromise with us when we do." From my perspective -- no, users didn't break anything. This isn't our fault, and we should be allowed to broadly block cookies without being tracked in more pervasive ways. But, if it makes you feel better you can change a word in my characterization to read: > "If y'all had just handed over your wallet when we asked, they wouldn't have had to hurt you. So really, this is your fault."
driverdan 7y ago
I've downvoted you because, as others have pointed out, your statement that Google doesn't fingerprint is factually incorrect.
- Ajedi32 7y ago
  I disagree. No one has posted any evidence that Google engages in fingerprinting users beyond simple user-controllable mechanisms like cookies. (Though several have indeed made that assertion with no evidence.)
  - driverdan 7y ago
    ReCaptcha and Analytics both fingerprint.
    - lmkg 7y ago
      Google Analytics does not fingerprint. Hits are identified with a user either by a first-party cookie (called the Client ID), or with a user-id value provided by the site owner. The site owner could provide their own fingerprinting value as a user-id, but the fingerprinting is not done by analytics itself. (There are some cases where identifiers are pulled in from other systems, but none of them can be used as the basis for unifying users.)
      - driverdan 7y ago
        GA records a lot of data about the user such as screen resolution and browser version. It doesn't do full fingerprinting to identify unique users but it uses many common fingerprinting techniques.
        Spivak 7y ago
        Like collecting any data at all? I mean “what browsers and what versions do I need to support” and “what resolutions do I need to design for” are pretty benign questions.
usefulcat 7y ago
Considering that we're talking about a company which owes probably nearly all of its not inconsiderable fortune to predicting people's behavior via mass surveillance, this comment seems to miss the forest for the trees a bit.

lwansbrough 7y ago

> maybe the majority of people will decide they don't want cookies At the same time, a lot of people don't understand what cookies actually do (the good things they do, I mean) and thus having them disabled by default will deepen their belief that they're only bad. I'm not sure what I'd do if cookies were blocked by default. What an absolutely inconvenient reality that would be as a web developer. You'd have to embed a token in the page on each request, like WebForms, or something.

Someone1234 7y ago
Nobody has suggest nor enacted blocking all cookies by default. I'm not sure what you're referring to here. This is mostly about third party cookies and or Safari/Firefox's default privacy blocklists.
_underfl0w_ 7y ago
You seem to be conflating first-party cookies with third-party ones. The originating party of the cookie, with respect to the site the user get the cookie from, is the crucial point on that subject in this context.

colinclerk 7y ago

Interesting to me is that Google's Privacy Model suggestions of "Identity is partitioned by First Party Site" and "Third Parties can be allowed access to a first-party identity"[1] come off as more coherent and effective than Apple's ML based Tracking Prevention policies[2]. Issue is Google's third suggestion, "A per-first-party identity can only be associated with small amounts of cross-site information", is clearly advertiser-focused, not privacy-focused. I hope all can rally around the partitioning concepts and leave the others behind. [1]https://github.com/michaelkleber/privacy-model https://github.com/michaelkleber/privacy-model [2]https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ https://webkit.org/blog/8828/intelligent-tracking-prevention...

om2 7y ago
Google’s proposal sounds simple because it is vague, does not address all the ways websites can track you, and does not address all the possible compatibility problems with partitioning. WebKit’s policy (and more importantly our code) are what things look like when you actually try to ship tracking protection. Easy to be simple if you don’t have to spell out details or actually ship.
- colinclerk 7y ago
  I don't believe it's very vague. This sentence in particular was succinct and represents a 90% solution to the problem: The identity "Me while I'm visiting nytimes.com" is distinct from the identity "Me while visiting cnn.com". To me, this means all client-triggered requests while my address bar ends in "nytimes.com" will have a distinct set of cookies that is only drawn from while I'm on nytimes.com. I prefer a rules-based solution to an ML-based solution. ML is more opaque and it's harder for developers to know when their solution will run afoul of the classifier. Are there significant compatibility problems this would cause?
  - om2 7y ago
    It says “identity”, not cookies. Maybe it means cookies are partitioned. Maybe it means some new form of identity token is created (Googles have proposed them at various times) and is partitioned, but cookies are blocked. Maybe it means new token plus cookies remain as they are based on the “fingerprinting is even worse” argument. Maybe there are different settings. Who knows? Anyway, the reason we moved away from cookie partitioning is that many third party embeds got confused when presented with non-empty cookies, but ones that weren’t the user’s canonical cookie for that site. Bugs were reported to us by embed providers, including Google web properties. This is a bummer because partitioning is elegant and has been WebKit’s go to approach since 2013, when we partitioned all storage besides cookies (LocalStorage, the HTTP cache, etc). A move that, incidentally was opposed by Chrime Engineers back when we shared an engine code base, though they are coming around now. (I should mention also that partitioning cookies made many social embeds stop working at all until we provided Storage Access API and got embed providers to adopt them, which is why ITP originally had a 24 hour user interaction exception. Fortunately the web has adapted now.) I should also mention, WebKit ML solution is deterministic. It’s trained offline. And it doesn’t substitute for enforcement actions, it substitutes for a block list of known trackers, which other tracking prevention systems use. One downside of strict rule based systems is that it may allow malicious players to game the system. So there has to be an out for changing the rules or ratcheting up enforcement.

olyjohn 7y ago

My favorite part is... "First, large scale blocking of cookies undermine people’s privacy..." Oh yeah, users and their privacy first! "Second, blocking cookies without another way to deliver relevant ads significantly reduces publishers’ primary means of funding..." Also we make less money when you do this... But users, privacy and synergy first! I think the second point is the real issue for Google. But of course they care about users first! I feel cynical as hell, but the whole thing reads so slimy to me. Like a used-car salesman twisting an obvious negative into a positive. "That's not a giant rust hole, that's just to reduce weight for efficiency!"

nextos 7y ago
I think a great setup for privacy are temporary containers. In fact, using the Temporary Containers Firefox addon and domain level isolation works virtually everywhere except on Google / Gmail / Youtube... That's because when you try to log into one of those, it tries to simultaneously log you into the other domains/Google products linked to your account and per-domain sandboxing prevents that. My setup against tracking is as follows: - Temporary Containers: Prevent cookie-based tracking - ClearURLs: Prevent URL-based tracking, which Google and Amazon use everywhere - VPN: Prevent IP-based tracking, to some degree - uBlock Origin: Block adds and some nasty JavaScript I find it quite hard to prevent fingerprinting. The privacy.resistFingerprinting in Firefox breaks tons of things. So does blocking JavaScript. And uMatrix is a bit time consuming to use, and not suited for inexperienced users. Any alternatives considering aside from Tor Browser?
- CapacitorSet 7y ago
  Your setup will marginally benefit from the addition of [Decentraleyes](https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/ https://addons.mozilla.org/en-US/firefox/addon/decentraleyes...), an add-on which prevents requests to CDNs by serving some content locally.
- kingo55 7y ago
  DNS filtering like pihole may be useful on your network for Ad blocking on Android/iOS. Not much more useful than ublock origin on your desktop though. Blocking at the DNS level is very effective.

3xblah 7y ago

Fingerprinting is mostly dependent on Javascript and presence of browser numerous detectable "features". What would happen to fingerprinting in the case of "large scale disabling of Javascript"? Even more, what would happen if there was large scale movement away from Chrome and other browsers with "features" that make fingerpinting possible?

danShumway 7y ago
It would greatly reduce the amount of fingerprinting, but not completely eliminate it. I've written about this before, but there's more than just Javascript we need to worry about -- we'd want to strip down CSS a bit, rethink how asset caching works, and potentially send less information in request headers. But it would certainly be a lot easier to do all of that without Javascript. The problem is that one of two things would happen: A) the majority of web apps would move to native platforms, where fingerprinting resistance is even worse. That would include a good many news sites, even though most news sites aren't really web-apps, and don't need Javascript to operate. They'd still do it. B) the majority of users would not use those browsers. We're playing a kind of weird game with fingerprinting right now -- we want to block it without breaking most websites. This is why adblocking is fantastic: it observably makes the web better to even an average user, so there's an incentive for users to adblock en-mass, and publishers can't really leave the web. Adblocking is a way to fight surveillance apparatuses without making sacrifices. It's a tricky situation to be in, and there's a lot more that could be said about the merits of different strategies. That being said, if you don't care about an en-mass policy, and you're just looking to increase your own privacy, it would definitely be a good idea right now to use something like UMatrix to disable at least 3rd-party Javascript by default. You'll have to do a lot of per-website tweaking, but if you're at all technical it's honestly not that bad.

deleted 7y ago

[deleted]

abdullahkhalids 7y ago

Nobody in the comments sections has identified the most nefarious part of their plan. Their goal to develop an "open set of standards" is an attempt to control how other browsers protect user privacy. This is Google saying, "oh looks like everyone else is doing things that hurt our business, so let's get everyone to work together on open standards, where we can block or delay attempts that run counter to our business model".