14 ms·

WebBundles harmful to content blocking, security tools, and the open web

175 points by alokrai 6y ago

lachlan-sneff 6y ago
WebBundles would be great for distributing applications to users as a single, well, bundle.
- fluidcruft 6y ago
  Also interesting that the combination of bundling and signing would seem to make the GPL relevant to the web in a far more toothful way.
- est31 6y ago
  Yes, especially you currently can't run .wasm based apps without a server on either Chrome or Firefox, but WebBundles will make this possible (I hope).
saurik 6y ago
I can already give everyone a unique URL to the same resource at the cost of it not being cached (which is a cost this mechanism doesn't avoid). The article admits this, but then simultaneously tries to claim that the loss of caching would prevent that from being common... but this loses caching. I can already give everyone unique resources for the same URL by keying the response on the Referer (which I would also add to the Vary header). The article also admits this, but then tries to claim problems that are out of scope... the "first visit" will never be to a subresource of a page. The article further tries to claim that this is difficult or defeats caching, but adding Referer to Vary is trivial and works with all CDNs and caches. Meanwhile, if we believe this kind of argument about "people won't bother to do it because it is slightly hard" (I don't), then we need to be consistent. It will take work to generate the multiple obfuscated copies of this bundle and be maximally disadvantageous to caching to do so for each visitor. Ad blockers that work using URLs are fundamentally only possible because they aren't common: if you make them common, they will break. I mean, ad blockers are so uncommon right now that you can often get away with blocking hosts at the DNS level... that is so trivially defeated! If you want to do something useful, work on post-download ad "view" blocking by having an AI classify regions of the page as ads and then erase them. This is also an arms war, but it is one that will more than likely at least result in subtle ads that you don't mind (as the AI "lets them slide") ;P.
- saagarjha 6y ago
  One of the problems with ad "view" blocking is that the problematic code still downloads and loads, so you lose much of the benefits of content blocking making your page lighter and only get the benefit of removing mental overhead/distractions (I say "only", but I'm not trying to say it's not a huge gain). Ideally this AI would work at the network level, but the fundamental problem is that a URL doesn't have to tell you anything about what is on the other end, and we haven't tried "browser antivirus" software yet that blocks JavaScript by matching it against (say) an ad network's "fingerprint"…
  - saurik 6y ago
    Yeah. For various article-context reasons I am concentrating on the blocking of "ads" here rather than on "malicious code". The latter is a much more complex problem to solve in the first place, though: like, it relies on a specific model of opponent that is also extremely dumb; amazingly, this opponent exists in the wild, but I swear it is only because people who go out of their way to block them with simple techniques are so rare as to not be worth investing into including in your un-targeted resource utilization attack. (And FWIW, the ad pages I run into that are maximally bad -- ones that abuse the browser using history state tricks, popping up notification boxes and printer dialogs, sometimes even managing to lock up the entire rendering engine on purpose in an attempt to get the user to agree to the terms of the scam -- all have URLs that are constantly being randomized so often that I have a hard time showing them to other people.)
- pes10k 6y ago
  Its definitely true that you can key responses to request information beyond the URLs, but I think theres more to it than this: - Lots of tools don't allow you to block requests off those additional keys (Google's Manifest v3 for one, Apple's iOS content blocking too) - In many cases, making consistent replies based off those keys requires additional information privacy tools also try to limit (referrer fields, cookies, etc) - There is practical, real world value in making things more difficult for trackers / folks sending you stuff you don't want; decisions are made at the margins! - Ad blockers are common on the web (estimates 10-30% of users!); they're effective bc they work with the grain of the web, and circumvention is deterred (though not prevented) bc there are costs to circumventing adblockers; WebBundles push those costs to zero. Again, decisions are made at the margins
cblconfederate 6y ago
Signed HTtp Exchanges are harmful as well
spankalee 6y ago
Disclaimer: I work at Google, though not on this, and I very much want to see WebBundles succeed to solve many problems with asset distribution right now and reduce the gymnastics that bundlers have to go through. So, this is a super unfortunate analysis that seems to be founded on a major logical inconsistently. The post claims that: 1) It's costly to vary URLs per-user without WebBundlers because it harms caching. By caching I presume here they mean edge caching. 2) It's cheap to vary URLs per-user with WebBundles. The costs are not any different: * If you vary the bundle per-user then you also harm edge caching. * If you build a bundle per-deployment, like current bundlers do, then you're not varying URLs per-user * If you build bundles on the fly per request, say in an edge worker, then you could also just as easily and cheaply vary URLs per user the same way, with the same or less impact on caching. The whole thing just doesn't make sense, and undermines one of the most important proposals for fixing not only resource loading but also much of the tooling ecosystem.
- toupeira 6y ago
  So what do you think about the privacy concerns raised in the article, which seem like the more important point?
  - jefftk 6y ago
    The privacy concerns raised in the article are, as spankalee explains, based on a misunderstanding of what WebBundles make easier. (Disclosure: I also work for Google)
    - edoceo 6y ago
      No, the tech claims were wrong but since remaking bundles is proven cheap and easy then the bundles can quickly be modified to have malicious payload (for some definition of malicious)
  - designium 6y ago
    Interestingly, most comments are talking about the cache/tech capabilities and not the privacy concerns. I mean the way it was shown is that WebBundles allow the author of that content to arbitrary hide and package content in such a way where you cannot filter specific content; so either you view a page with ads and trackers or you don't see anything at all.
jefftk 6y ago
This post is very confused. If one entity generates the page and the ads, then they can already reasonably easily randomize URLs and circumvent ad blockers. Facebook does this. On the other hand, if one entity generates the page and another handles the ads (the typical situation where a publisher uses an ad network to put ads on their page) then web bundles don't do anything to resolve any of the coordination problems that make url randomization and ad blocker circumvention difficult. I'm currently exploring using WebBundles to serve multiple ads in response to a single ad request, because it allows ads to be served more efficiently while keeping them secure and private, but ad blockers would still prevent the ad js from loading before the ad request was ever sent. (Disclosure: I work on ads at Google)
- jakelazaroff 6y ago
  > I'm currently exploring using WebBundles to serve multiple ads in response to a single ad request, because it allows ads to be served more efficiently while keeping them secure and private, but ad blockers would still prevent the ad js from loading before the ad request was ever sent. Why is this a use-case that I as a web user should care about? Frankly, I don't find it very comforting that an article raises privacy concerns, and an engineer working on ads at Google responds with "these concerns are misguided; I'm exploring this technology to make ads better."
  - jefftk 6y ago
    > Why is this a use-case that I as a web user should care about? If you block ads, then my work will have no effect on you. If you do not block ads, then my work decreases bandwidth usage and makes it harder for ads to deface each other. > I don't find it very comforting that an article raises privacy concerns, and an engineer working on ads at Google responds with... The article describes privacy concerns, but those concerns are based on a misunderstanding of what WebBundles make easier. Specifically, they're concerned about URL randomization, which is no easier with bundles.
    - pes10k 6y ago
      This is just super wrong. With WebBundles I can call 2 different things, in two different WebBundles https://example.org/good.js https://example.org/good.js, and that can be different from what the wider web sees as https://example.org/good.js https://example.org/good.js. Random URLs are just an example of the capability they are not the fundamental problem
jakelazaroff 6y ago
Yet another case study in why allowing a privacy-hostile advertising company to control the most popular web browser and influence web standards is bad for the web.
philips 6y ago
> So-called "Binary Transparency" may eventually allow users to verify that a program they've been delivered is one that's available to the public, and not a specially-built version intended to attack just them. Binary transparency systems don't exist yet, but they're likely to work similarly to the successful Certificate Transparency logs via https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#uc-transparency https://wicg.github.io/webpackage/draft-yasskin-http-origin-... We are building a binary transparency system here: https://transparencylog.com https://transparencylog.com Having HTTP signed requests would be nice to prove that the origin server presented the contents.
- tialaramex 6y ago
  The circumstances that enabled Certificate Transparency to succeed were pretty narrow, but people seem to keep proposing more of these X Transparency systems so maybe I should actually properly write down why I think that's largely futile, not because I expect it will stop anyone but because at least then I can just paste the link. For now, let me highlight a really big consideration: - Most of the effectiveness of CT logs stems from the logging mandate not the cryptography. The publicly trusted CAs proactively log either everything they issue or all but some relatively small controlled subset of issued certificates which purposefully fall outside the mandate. Will your X transparency be mandatory? Who will enforce that? Won't it be more practical to reject systems that try to mandate X transparency than to implement it?
sloshnmosh 6y ago
Until the entire advertising community gets their st together I will block every ad and script that I can. It has gotten to where there the line between advertising and malware is blurred or nonexistent. It seems to me that every new API or web standard that Google creates is an attempt to stop ad blockers disguised as meaningful useful features.
- ssss11 6y ago
  There is a need for ethics in the technology industry. Without it, capitalism causes ordinary people to do unethical things for profit.
pes10k 6y ago
Disclaimer: I wrote the article. I'm not sure where the claimed confusion is above. The argument is: I want to include something like fingerprint2.js in my page. I know filter lists block it, bc users don't like it. W/o web bundles, you have to either inline it (bad for perf), copy it to a new URL (which could later also be added to a list), or add some URL generation logic to the page, and have some server side logic somewhere to know how to understand the programmatically generated URLs. With WebBundles. I call it https://example.org/1.js https://example.org/1.js (which is a diff than what https://example.org/1.js https://example.org/1.js points to in a different bundle) or even just call it https://example.org/looks-to-be-benign-to-the-web.js https://example.org/looks-to-be-benign-to-the-web.js. The claim is not that bundles are coming from random URLs, its that the bundles create private namespaces for URLs, and that breaks any privacy tools that rely on URLs.
- pes10k 6y ago
  Will also add that all the other benefits (a single application package is great! signing things is great!) are true! But those do not hang on this aspect of WebBundles
  - hundchenkatze 6y ago
    Just like url remapping/obfuscation isn't a unique aspect of WebBundles?
- jefftk 6y ago
  Understanding your situation: you're imagining running a website that wants to include fingerprinting JS? So the site today looks like: <html> ... <script src=/fingerprint2.js> ... The blocker sees ".*/fingerprint2.js" and excludes it. So far so good. But your site could, with minimal effort, do: <script src=/asdf23f23g.js> randomizing the URL on every deploy. This would circumvent url-based blocking today, with the downside of preventing the JS library from being cached between deploys. Web bundles change none of this. Just as you can generate an HTML file that references either /fingerprint2.js or /asdf23f23g.js, so can you generate a bundle. Unlike your claim in the article, this does not turn "circumvention techniques that are expensive, fragile and difficult" into ones that are "cheap or even free". (Disclosure: I work for Google)
deleted 6y ago
[deleted]
kmeisthax 6y ago
Many of these complaints seem... odd. The primary complaint with Web Bundles is "they make the web like SWFs" - last I remember, people LIKED the fact that Flash content could be bundled that way. You actually were able to distribute Flash content like a normal web application, broken up into multiple SWFs, images, and so on. The vast majority of Flash content was a single file, because it's easier to distribute that way. With WebBundles, if you want to deny specific subresources, you can still have the browser block them by identifier or hash, which is the same as you can do with a regular web request. The reason why there are no content blocking tools for PDFs is because nobody's bothered to write a PDF reader with that capability. Furthermore, I don't see how putting the resource identifier in the content of a bundle makes it easier than changing the URL. Both of those will either defeat or be defeated by caching. If you have a CDN that generates random URLs for a single cached resource and serves them on the same domain as user websites, then identifier-based blocking won't work with or without WebBundles. You can do this today with Apache rewrite rules and PHP, which are about as economical as you can get. If your threat model is "people who just know how to SFTP a handful of JavaScript files" then yes, WebBundles makes things "easier". But I'd argue your threat model is laughably unworkable if that's the case. The state-of-the-art in adtech is to smuggle your fingerprinting platform as a randomized subdomain of the client site - how do you even begin to block that with identifiers alone?
- jiggawatts 6y ago
  > The reason why there are no content blocking tools for PDFs is because nobody's bothered to write a PDF reader with that capability. The reason why nobody has bothered is because PDFs contain the desired content only. Generally, when viewing a PDF, you're not bombarded by five concurrent video ads competing with the text for your attention. There's no clickjacking, or overriding of scrolling behaviour to force a full-page popup down your throat the instant you scroll up, scroll down, or interact with the page in any way. The latest insanity that has suddenly become popular in the HTML world is the ad-forward page. When you first visit a site, it forwards you to the content page, but if you try to click "back", you end up going to a full-page advertisement instead of the referrer page. I'm sure someone thought this up to defeat ad-blockers: You can't get to the content without being forwarded through the ad page, and then the browser history is polluted, so it's too late to simply block content. Pretty soon, uBlock will have to rewrite the browser history to stop ads. This is bordering on insanity. It's the same behaviour as when I walk into a whitegoods shop and a pushy sales guy steps into my way and demands to "help" me. Or when on holidays in a third world country, where being white means being endlessly harassed by hawkers. Doesn't it make you people feel dirty to have to write the code to do these things? Why, for the love of God, can't we have some sort of model where browsers pay for content with microtransactions? I know it has been talked about a lot in the past, and rejected for various reasons, but seriously: It has to be better than this. Mark my words: The inevitable outcome of funding content only with ads will be all such pages eventually evolving into DRM-protected video with the ads overlaying the text. It's just a matter of time.
Sephr 6y ago
> WebBundles Allow Sites to Evade Privacy and Security Tools I completely disagree. Browser-level code can still effectively apply user-defined privacy and security policies onto WebBundles. Didn't Firefox originally solve the issue of deep-linking into opaque bundles with it's jar: URI scheme idea? For example, this URI could be used to reference specific files in a zip archive in Firefox. iirc this scheme might not be supported by Firefox anymore. jar://https://site.example/archive.zip!/file%201.txt The same concept could be applied for WebBundles with another similar URI scheme so that content blockers and security tools can effectively introspect the bundle before initializing resources from the bundle. For example, something like: bundle://[optional hash, origin, or regex?]![uri or regex] // e.g. bundle://https://site.example/!https://site.example/regulated-sub-bundle-file.html
- anhner 6y ago
  So what does that solve? It will still load the whole bundle before it can do anything
TylerE 6y ago
Sounds like Brave is sore someone might keep them from skimming ad revenue off legitimate creators.
- Ensorceled 6y ago
  Do you have a rebuttal that's NOT an ad hominem?
  - TylerE 6y ago
    Do I need one? They're clearly speaking as a neutral source when to anyone with an ounce of knowledge they have a biased agenda. Would you take an article from 1990's Microsoft about how Apple is evil seriously? Also, pointing out a conflict of interest isn't ad hominem. I didn't call them nazis or morons.
    - BrendanEich 6y ago
      We don't make revenue from ads in pages, or lose revenue if Google smuggles ads into SWF-like WebBundles via AMP imposed on publishers under pain of search rank loss. Brave user ads fill user inventory, not in-page ad slots (perhaps you heard misinformation claiming otherwise). So even as an ad hominem rhetorical ploy, what you wrote doesn't work.
      - Akkuma 6y ago
        I'm not here to agree with the who you responded to, but Google smuggling unblockable ads does 100% harm Brave. If part of Brave's selling point is the built-in ad blocking and in a hypothetical dystopian scenario the web were overrun with unblockable ads from WebBundles Brave would inevitably be harmed to some degree. I say that as someone who runs Brave on my phone primarily. I know I'd probably switch browsers if one of the primary reasons to use it were largely killed off.
        BrendanEich 6y ago
pes10k 6y ago
Again I wrote the piece but… Folks "who are well actually, you can already make URLs meaningless"'ing are missing the point of how practical web privacy tools work, including the ones you all have installed right now. There is an enormous, important difference between: i) circumventions that are possible but are fragile and cost more, and ii) circumventions that are effortless for the attacker / tracker Every practical privacy / blocking tool leverages that difference now, the proposal collapses it.
- lukevp 6y ago
  I am not in any way pro-Google and I feel what they are doing with AMP is a perilous path, but your article was not convincing. It’s trivially easy to rotate a JS name and serve it from the same cached edge file (eg with cloudflare workers) and not incurring any major additional cost. It’s not hard to imagine advertisers doing something similar with their own CDNs. This could even be done at the DNS level with random sub domains. Unless we are ok blocking (star).facebook.com/(star), every other part of the URL is trivially easy to randomize.
devit 6y ago
Seems completely baseless. There is no difference between an URL without web bundles, and an URL that refers to a "web bundle" and a path within in. All the things that they claim can be done with Web Bundles can be done without just as easily by putting all dependent resources in a versioned subdirectory.
_qulr 6y ago
2 things bother me about this proposal: https://web.dev/web-bundles/ https://web.dev/web-bundles/ 1) The use cases discussed by Google are largely offline. So how is this a "web" standard when it doesn't involve the web? If Google wants to implement an offline app format, that's their prerogative, but it's not clear to me why it should be enshrined as a web standard, just because it happens to use HTML/CSS/JS. 2) Google keeps talking about it as a tool for you and your "friend". I'm suspicious that this is the real motivation. Is the Google Chrome team really very concerned about in-flight entertainment? (Especially now when hardly anyone is flying anymore.) A number of people have suggested that the real motivation here is AMP. The "spin" in Google's proposal is too "friendly".
- xg15 6y ago
  Not a long time ago, the understanding was that browsers were mostly simple renderers for HTML with a HTTP client built in. You could serve HTML from a local file system or from a server without much difference. It's only recently that due to security reasons, the ability to load HTML from local files was greatly restricted - so I personally would be pretty happy if loading pages from non-web sources is on the table again.
- _qulr 6y ago
  To me the key part is this: "Loads in the context of its origin when cryptographically signed by its publisher" Then it feels like a bit of misdirection to immediately pivot to "easy to share and usable without an internet connection". What if you do have an internet connection? What if the real goal is actually to republish entire web sites on google.com, i.e., AMP?
  - AgentME 6y ago
    >What if the real goal is actually to republish entire web sites on google.com, i.e., AMP? Why would Google have hosting everything on their domain be an end goal? WebBundles address the technical limitation that causes AMP to serve everything from Google's own domain.
    - 6y ago
deleted 6y ago
[deleted]
justsee 6y ago
Things like AMP and WebBundles clearly appear like a self-interested attack on the open web by Google, all the while making reasonable-sounding noises about efficiency and speed. With the inexorable rise of ad-blockers, allowing 'User Agents' to be true agents of the user is a threat to Google's business model, and any significant engineering and standards efforts by that company can and should be evaluated by assuming the driver is not web altruism, but ferocious defence of their business model. Interesting to see Google accounts drop in to misdirect on the essence of the argument outlined in the article: the essence being that bundles create private namespaces for URLS, which is an attack on the agency of a user in consuming content. It should be unsurprising that Google wants to blackbox websites. If these kinds of initiatives succeed the philosophical debate around whether a user has the right to filter content running on their machine becomes moot, because technically they won't be able to. The bottom line is: Google's business model is threatened by users being able to control the content they consume. Splitting hairs on how bad WebBundles will be in practice wilfully or otherwise misses this larger, more important point. Operating in an Australian context, it's exasperating arguing forcefully for Google and Facebook [1] in regards to the new shakedown laws outlined brilliantly by Stratechery [2], all the while knowing there are very real criticisms that should be discussed, such as AMP and WebBundles. [1] https://news.ycombinator.com/item?id=24186376 https://news.ycombinator.com/item?id=24186376 [2] https://stratechery.com/2020/australias-news-media-bargaining-code-breaking-down-the-code-australias-fake-news/ https://stratechery.com/2020/australias-news-media-bargainin...
- apostacy 6y ago
  They have wanted to kill the URL for a long time. The mask often slips. There have been so many half baked attempts trotted out, and nobody liked them. every browser has tried de-emphasizing the URL, and Chrome even tried completely eliminating it.[1] They hate that people can deep link into their platforms and share these links with each other, untracked. They want to have complete control of the experience. They are slowly migrating us to a network of crummy walled gardens. If it was up to them, they would just have you download a giant .exe file and require that you run with admin privileges. The only protections that the likes of Google would offer you is that the different pieces of opaque adware clogging up your device not interfere with each other, and not to so destabilize your device that you can't be advertised to. In other words, Android. And they will use every bit of leverage they have to continue to corral us from the open pastures of the web into their nightmarish silos. A powerful bulwark against this was Mozilla. But their #1 priority now is to validate and amplify Google's vision of the web. Rest assured, now matter how awful and user-hostile webundles turn out to be, Mozilla will be there, offering an inferior implementation. Firefox got popular because they completely rejected Microsoft's vision of the web. They didn't try to implement Microsoft's terrible ideas, because they were user hostile and not worth implementing. [1]: https://www.pcworld.com/article/2362123/google-chromes-origin-chip-experimental-feature-appears-to-be-on-hold.html https://www.pcworld.com/article/2362123/google-chromes-origi... [2]: https://villing.com/articles/facebook-is-the-new-aol/ https://villing.com/articles/facebook-is-the-new-aol/
Santosh83 6y ago
What is Mozilla's stand on WebBundles, SGX and Loading?

175 points by alokrai 6y ago

lachlan-sneff 6y ago

WebBundles would be great for distributing applications to users as a single, well, bundle.

fluidcruft 6y ago
Also interesting that the combination of bundling and signing would seem to make the GPL relevant to the web in a far more toothful way.
est31 6y ago
Yes, especially you currently can't run .wasm based apps without a server on either Chrome or Firefox, but WebBundles will make this possible (I hope).

saurik 6y ago

I can already give everyone a unique URL to the same resource at the cost of it not being cached (which is a cost this mechanism doesn't avoid). The article admits this, but then simultaneously tries to claim that the loss of caching would prevent that from being common... but this loses caching. I can already give everyone unique resources for the same URL by keying the response on the Referer (which I would also add to the Vary header). The article also admits this, but then tries to claim problems that are out of scope... the "first visit" will never be to a subresource of a page. The article further tries to claim that this is difficult or defeats caching, but adding Referer to Vary is trivial and works with all CDNs and caches. Meanwhile, if we believe this kind of argument about "people won't bother to do it because it is slightly hard" (I don't), then we need to be consistent. It will take work to generate the multiple obfuscated copies of this bundle and be maximally disadvantageous to caching to do so for each visitor. Ad blockers that work using URLs are fundamentally only possible because they aren't common: if you make them common, they will break. I mean, ad blockers are so uncommon right now that you can often get away with blocking hosts at the DNS level... that is so trivially defeated! If you want to do something useful, work on post-download ad "view" blocking by having an AI classify regions of the page as ads and then erase them. This is also an arms war, but it is one that will more than likely at least result in subtle ads that you don't mind (as the AI "lets them slide") ;P.

saagarjha 6y ago
One of the problems with ad "view" blocking is that the problematic code still downloads and loads, so you lose much of the benefits of content blocking making your page lighter and only get the benefit of removing mental overhead/distractions (I say "only", but I'm not trying to say it's not a huge gain). Ideally this AI would work at the network level, but the fundamental problem is that a URL doesn't have to tell you anything about what is on the other end, and we haven't tried "browser antivirus" software yet that blocks JavaScript by matching it against (say) an ad network's "fingerprint"…
- saurik 6y ago
  Yeah. For various article-context reasons I am concentrating on the blocking of "ads" here rather than on "malicious code". The latter is a much more complex problem to solve in the first place, though: like, it relies on a specific model of opponent that is also extremely dumb; amazingly, this opponent exists in the wild, but I swear it is only because people who go out of their way to block them with simple techniques are so rare as to not be worth investing into including in your un-targeted resource utilization attack. (And FWIW, the ad pages I run into that are maximally bad -- ones that abuse the browser using history state tricks, popping up notification boxes and printer dialogs, sometimes even managing to lock up the entire rendering engine on purpose in an attempt to get the user to agree to the terms of the scam -- all have URLs that are constantly being randomized so often that I have a hard time showing them to other people.)
pes10k 6y ago
Its definitely true that you can key responses to request information beyond the URLs, but I think theres more to it than this: - Lots of tools don't allow you to block requests off those additional keys (Google's Manifest v3 for one, Apple's iOS content blocking too) - In many cases, making consistent replies based off those keys requires additional information privacy tools also try to limit (referrer fields, cookies, etc) - There is practical, real world value in making things more difficult for trackers / folks sending you stuff you don't want; decisions are made at the margins! - Ad blockers are common on the web (estimates 10-30% of users!); they're effective bc they work with the grain of the web, and circumvention is deterred (though not prevented) bc there are costs to circumventing adblockers; WebBundles push those costs to zero. Again, decisions are made at the margins

cblconfederate 6y ago

Signed HTtp Exchanges are harmful as well

spankalee 6y ago

Disclaimer: I work at Google, though not on this, and I very much want to see WebBundles succeed to solve many problems with asset distribution right now and reduce the gymnastics that bundlers have to go through. So, this is a super unfortunate analysis that seems to be founded on a major logical inconsistently. The post claims that: 1) It's costly to vary URLs per-user without WebBundlers because it harms caching. By caching I presume here they mean edge caching. 2) It's cheap to vary URLs per-user with WebBundles. The costs are not any different: * If you vary the bundle per-user then you also harm edge caching. * If you build a bundle per-deployment, like current bundlers do, then you're not varying URLs per-user * If you build bundles on the fly per request, say in an edge worker, then you could also just as easily and cheaply vary URLs per user the same way, with the same or less impact on caching. The whole thing just doesn't make sense, and undermines one of the most important proposals for fixing not only resource loading but also much of the tooling ecosystem.

toupeira 6y ago
So what do you think about the privacy concerns raised in the article, which seem like the more important point?
- jefftk 6y ago
  The privacy concerns raised in the article are, as spankalee explains, based on a misunderstanding of what WebBundles make easier. (Disclosure: I also work for Google)
  - edoceo 6y ago
    No, the tech claims were wrong but since remaking bundles is proven cheap and easy then the bundles can quickly be modified to have malicious payload (for some definition of malicious)
- designium 6y ago
  Interestingly, most comments are talking about the cache/tech capabilities and not the privacy concerns. I mean the way it was shown is that WebBundles allow the author of that content to arbitrary hide and package content in such a way where you cannot filter specific content; so either you view a page with ads and trackers or you don't see anything at all.

jefftk 6y ago

This post is very confused. If one entity generates the page and the ads, then they can already reasonably easily randomize URLs and circumvent ad blockers. Facebook does this. On the other hand, if one entity generates the page and another handles the ads (the typical situation where a publisher uses an ad network to put ads on their page) then web bundles don't do anything to resolve any of the coordination problems that make url randomization and ad blocker circumvention difficult. I'm currently exploring using WebBundles to serve multiple ads in response to a single ad request, because it allows ads to be served more efficiently while keeping them secure and private, but ad blockers would still prevent the ad js from loading before the ad request was ever sent. (Disclosure: I work on ads at Google)

jakelazaroff 6y ago
> I'm currently exploring using WebBundles to serve multiple ads in response to a single ad request, because it allows ads to be served more efficiently while keeping them secure and private, but ad blockers would still prevent the ad js from loading before the ad request was ever sent. Why is this a use-case that I as a web user should care about? Frankly, I don't find it very comforting that an article raises privacy concerns, and an engineer working on ads at Google responds with "these concerns are misguided; I'm exploring this technology to make ads better."
- jefftk 6y ago
  > Why is this a use-case that I as a web user should care about? If you block ads, then my work will have no effect on you. If you do not block ads, then my work decreases bandwidth usage and makes it harder for ads to deface each other. > I don't find it very comforting that an article raises privacy concerns, and an engineer working on ads at Google responds with... The article describes privacy concerns, but those concerns are based on a misunderstanding of what WebBundles make easier. Specifically, they're concerned about URL randomization, which is no easier with bundles.
  - pes10k 6y ago
    This is just super wrong. With WebBundles I can call 2 different things, in two different WebBundles https://example.org/good.js https://example.org/good.js, and that can be different from what the wider web sees as https://example.org/good.js https://example.org/good.js. Random URLs are just an example of the capability they are not the fundamental problem

jakelazaroff 6y ago

Yet another case study in why allowing a privacy-hostile advertising company to control the most popular web browser and influence web standards is bad for the web.

philips 6y ago

> So-called "Binary Transparency" may eventually allow users to verify that a program they've been delivered is one that's available to the public, and not a specially-built version intended to attack just them. Binary transparency systems don't exist yet, but they're likely to work similarly to the successful Certificate Transparency logs via https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#uc-transparency https://wicg.github.io/webpackage/draft-yasskin-http-origin-... We are building a binary transparency system here: https://transparencylog.com https://transparencylog.com Having HTTP signed requests would be nice to prove that the origin server presented the contents.

tialaramex 6y ago
The circumstances that enabled Certificate Transparency to succeed were pretty narrow, but people seem to keep proposing more of these X Transparency systems so maybe I should actually properly write down why I think that's largely futile, not because I expect it will stop anyone but because at least then I can just paste the link. For now, let me highlight a really big consideration: - Most of the effectiveness of CT logs stems from the logging mandate not the cryptography. The publicly trusted CAs proactively log either everything they issue or all but some relatively small controlled subset of issued certificates which purposefully fall outside the mandate. Will your X transparency be mandatory? Who will enforce that? Won't it be more practical to reject systems that try to mandate X transparency than to implement it?

sloshnmosh 6y ago

Until the entire advertising community gets their st together I will block every ad and script that I can. It has gotten to where there the line between advertising and malware is blurred or nonexistent. It seems to me that every new API or web standard that Google creates is an attempt to stop ad blockers disguised as meaningful useful features.

ssss11 6y ago
There is a need for ethics in the technology industry. Without it, capitalism causes ordinary people to do unethical things for profit.

pes10k 6y ago

Disclaimer: I wrote the article. I'm not sure where the claimed confusion is above. The argument is: I want to include something like fingerprint2.js in my page. I know filter lists block it, bc users don't like it. W/o web bundles, you have to either inline it (bad for perf), copy it to a new URL (which could later also be added to a list), or add some URL generation logic to the page, and have some server side logic somewhere to know how to understand the programmatically generated URLs. With WebBundles. I call it https://example.org/1.js https://example.org/1.js (which is a diff than what https://example.org/1.js https://example.org/1.js points to in a different bundle) or even just call it https://example.org/looks-to-be-benign-to-the-web.js https://example.org/looks-to-be-benign-to-the-web.js. The claim is not that bundles are coming from random URLs, its that the bundles create private namespaces for URLs, and that breaks any privacy tools that rely on URLs.

pes10k 6y ago
Will also add that all the other benefits (a single application package is great! signing things is great!) are true! But those do not hang on this aspect of WebBundles
- hundchenkatze 6y ago
  Just like url remapping/obfuscation isn't a unique aspect of WebBundles?
jefftk 6y ago
Understanding your situation: you're imagining running a website that wants to include fingerprinting JS? So the site today looks like: <html> ... <script src=/fingerprint2.js> ... The blocker sees ".*/fingerprint2.js" and excludes it. So far so good. But your site could, with minimal effort, do: <script src=/asdf23f23g.js> randomizing the URL on every deploy. This would circumvent url-based blocking today, with the downside of preventing the JS library from being cached between deploys. Web bundles change none of this. Just as you can generate an HTML file that references either /fingerprint2.js or /asdf23f23g.js, so can you generate a bundle. Unlike your claim in the article, this does not turn "circumvention techniques that are expensive, fragile and difficult" into ones that are "cheap or even free". (Disclosure: I work for Google)

deleted 6y ago

[deleted]

kmeisthax 6y ago

Many of these complaints seem... odd. The primary complaint with Web Bundles is "they make the web like SWFs" - last I remember, people LIKED the fact that Flash content could be bundled that way. You actually were able to distribute Flash content like a normal web application, broken up into multiple SWFs, images, and so on. The vast majority of Flash content was a single file, because it's easier to distribute that way. With WebBundles, if you want to deny specific subresources, you can still have the browser block them by identifier or hash, which is the same as you can do with a regular web request. The reason why there are no content blocking tools for PDFs is because nobody's bothered to write a PDF reader with that capability. Furthermore, I don't see how putting the resource identifier in the content of a bundle makes it easier than changing the URL. Both of those will either defeat or be defeated by caching. If you have a CDN that generates random URLs for a single cached resource and serves them on the same domain as user websites, then identifier-based blocking won't work with or without WebBundles. You can do this today with Apache rewrite rules and PHP, which are about as economical as you can get. If your threat model is "people who just know how to SFTP a handful of JavaScript files" then yes, WebBundles makes things "easier". But I'd argue your threat model is laughably unworkable if that's the case. The state-of-the-art in adtech is to smuggle your fingerprinting platform as a randomized subdomain of the client site - how do you even begin to block that with identifiers alone?

jiggawatts 6y ago
> The reason why there are no content blocking tools for PDFs is because nobody's bothered to write a PDF reader with that capability. The reason why nobody has bothered is because PDFs contain the desired content only. Generally, when viewing a PDF, you're not bombarded by five concurrent video ads competing with the text for your attention. There's no clickjacking, or overriding of scrolling behaviour to force a full-page popup down your throat the instant you scroll up, scroll down, or interact with the page in any way. The latest insanity that has suddenly become popular in the HTML world is the ad-forward page. When you first visit a site, it forwards you to the content page, but if you try to click "back", you end up going to a full-page advertisement instead of the referrer page. I'm sure someone thought this up to defeat ad-blockers: You can't get to the content without being forwarded through the ad page, and then the browser history is polluted, so it's too late to simply block content. Pretty soon, uBlock will have to rewrite the browser history to stop ads. This is bordering on insanity. It's the same behaviour as when I walk into a whitegoods shop and a pushy sales guy steps into my way and demands to "help" me. Or when on holidays in a third world country, where being white means being endlessly harassed by hawkers. Doesn't it make you people feel dirty to have to write the code to do these things? Why, for the love of God, can't we have some sort of model where browsers pay for content with microtransactions? I know it has been talked about a lot in the past, and rejected for various reasons, but seriously: It has to be better than this. Mark my words: The inevitable outcome of funding content only with ads will be all such pages eventually evolving into DRM-protected video with the ads overlaying the text. It's just a matter of time.

Sephr 6y ago

> WebBundles Allow Sites to Evade Privacy and Security Tools I completely disagree. Browser-level code can still effectively apply user-defined privacy and security policies onto WebBundles. Didn't Firefox originally solve the issue of deep-linking into opaque bundles with it's jar: URI scheme idea? For example, this URI could be used to reference specific files in a zip archive in Firefox. iirc this scheme might not be supported by Firefox anymore. jar://https://site.example/archive.zip!/file%201.txt The same concept could be applied for WebBundles with another similar URI scheme so that content blockers and security tools can effectively introspect the bundle before initializing resources from the bundle. For example, something like: bundle://[optional hash, origin, or regex?]![uri or regex] // e.g. bundle://https://site.example/!https://site.example/regulated-sub-bundle-file.html

anhner 6y ago
So what does that solve? It will still load the whole bundle before it can do anything

TylerE 6y ago

Sounds like Brave is sore someone might keep them from skimming ad revenue off legitimate creators.

Ensorceled 6y ago
Do you have a rebuttal that's NOT an ad hominem?
- TylerE 6y ago
  Do I need one? They're clearly speaking as a neutral source when to anyone with an ounce of knowledge they have a biased agenda. Would you take an article from 1990's Microsoft about how Apple is evil seriously? Also, pointing out a conflict of interest isn't ad hominem. I didn't call them nazis or morons.
  - BrendanEich 6y ago
    We don't make revenue from ads in pages, or lose revenue if Google smuggles ads into SWF-like WebBundles via AMP imposed on publishers under pain of search rank loss. Brave user ads fill user inventory, not in-page ad slots (perhaps you heard misinformation claiming otherwise). So even as an ad hominem rhetorical ploy, what you wrote doesn't work.
    - Akkuma 6y ago
      I'm not here to agree with the who you responded to, but Google smuggling unblockable ads does 100% harm Brave. If part of Brave's selling point is the built-in ad blocking and in a hypothetical dystopian scenario the web were overrun with unblockable ads from WebBundles Brave would inevitably be harmed to some degree. I say that as someone who runs Brave on my phone primarily. I know I'd probably switch browsers if one of the primary reasons to use it were largely killed off.
      - BrendanEich 6y ago

pes10k 6y ago

Again I wrote the piece but… Folks "who are well actually, you can already make URLs meaningless"'ing are missing the point of how practical web privacy tools work, including the ones you all have installed right now. There is an enormous, important difference between: i) circumventions that are possible but are fragile and cost more, and ii) circumventions that are effortless for the attacker / tracker Every practical privacy / blocking tool leverages that difference now, the proposal collapses it.

lukevp 6y ago
I am not in any way pro-Google and I feel what they are doing with AMP is a perilous path, but your article was not convincing. It’s trivially easy to rotate a JS name and serve it from the same cached edge file (eg with cloudflare workers) and not incurring any major additional cost. It’s not hard to imagine advertisers doing something similar with their own CDNs. This could even be done at the DNS level with random sub domains. Unless we are ok blocking (star).facebook.com/(star), every other part of the URL is trivially easy to randomize.

devit 6y ago

Seems completely baseless. There is no difference between an URL without web bundles, and an URL that refers to a "web bundle" and a path within in. All the things that they claim can be done with Web Bundles can be done without just as easily by putting all dependent resources in a versioned subdirectory.

_qulr 6y ago

2 things bother me about this proposal: https://web.dev/web-bundles/ https://web.dev/web-bundles/ 1) The use cases discussed by Google are largely offline. So how is this a "web" standard when it doesn't involve the web? If Google wants to implement an offline app format, that's their prerogative, but it's not clear to me why it should be enshrined as a web standard, just because it happens to use HTML/CSS/JS. 2) Google keeps talking about it as a tool for you and your "friend". I'm suspicious that this is the real motivation. Is the Google Chrome team really very concerned about in-flight entertainment? (Especially now when hardly anyone is flying anymore.) A number of people have suggested that the real motivation here is AMP. The "spin" in Google's proposal is too "friendly".

xg15 6y ago
Not a long time ago, the understanding was that browsers were mostly simple renderers for HTML with a HTTP client built in. You could serve HTML from a local file system or from a server without much difference. It's only recently that due to security reasons, the ability to load HTML from local files was greatly restricted - so I personally would be pretty happy if loading pages from non-web sources is on the table again.
_qulr 6y ago
To me the key part is this: "Loads in the context of its origin when cryptographically signed by its publisher" Then it feels like a bit of misdirection to immediately pivot to "easy to share and usable without an internet connection". What if you do have an internet connection? What if the real goal is actually to republish entire web sites on google.com, i.e., AMP?
- AgentME 6y ago
  >What if the real goal is actually to republish entire web sites on google.com, i.e., AMP? Why would Google have hosting everything on their domain be an end goal? WebBundles address the technical limitation that causes AMP to serve everything from Google's own domain.
  - 6y ago

deleted 6y ago

[deleted]

justsee 6y ago

Things like AMP and WebBundles clearly appear like a self-interested attack on the open web by Google, all the while making reasonable-sounding noises about efficiency and speed. With the inexorable rise of ad-blockers, allowing 'User Agents' to be true agents of the user is a threat to Google's business model, and any significant engineering and standards efforts by that company can and should be evaluated by assuming the driver is not web altruism, but ferocious defence of their business model. Interesting to see Google accounts drop in to misdirect on the essence of the argument outlined in the article: the essence being that bundles create private namespaces for URLS, which is an attack on the agency of a user in consuming content. It should be unsurprising that Google wants to blackbox websites. If these kinds of initiatives succeed the philosophical debate around whether a user has the right to filter content running on their machine becomes moot, because technically they won't be able to. The bottom line is: Google's business model is threatened by users being able to control the content they consume. Splitting hairs on how bad WebBundles will be in practice wilfully or otherwise misses this larger, more important point. Operating in an Australian context, it's exasperating arguing forcefully for Google and Facebook [1] in regards to the new shakedown laws outlined brilliantly by Stratechery [2], all the while knowing there are very real criticisms that should be discussed, such as AMP and WebBundles. [1] https://news.ycombinator.com/item?id=24186376 https://news.ycombinator.com/item?id=24186376 [2] https://stratechery.com/2020/australias-news-media-bargaining-code-breaking-down-the-code-australias-fake-news/ https://stratechery.com/2020/australias-news-media-bargainin...

apostacy 6y ago
They have wanted to kill the URL for a long time. The mask often slips. There have been so many half baked attempts trotted out, and nobody liked them. every browser has tried de-emphasizing the URL, and Chrome even tried completely eliminating it.[1] They hate that people can deep link into their platforms and share these links with each other, untracked. They want to have complete control of the experience. They are slowly migrating us to a network of crummy walled gardens. If it was up to them, they would just have you download a giant .exe file and require that you run with admin privileges. The only protections that the likes of Google would offer you is that the different pieces of opaque adware clogging up your device not interfere with each other, and not to so destabilize your device that you can't be advertised to. In other words, Android. And they will use every bit of leverage they have to continue to corral us from the open pastures of the web into their nightmarish silos. A powerful bulwark against this was Mozilla. But their #1 priority now is to validate and amplify Google's vision of the web. Rest assured, now matter how awful and user-hostile webundles turn out to be, Mozilla will be there, offering an inferior implementation. Firefox got popular because they completely rejected Microsoft's vision of the web. They didn't try to implement Microsoft's terrible ideas, because they were user hostile and not worth implementing. [1]: https://www.pcworld.com/article/2362123/google-chromes-origin-chip-experimental-feature-appears-to-be-on-hold.html https://www.pcworld.com/article/2362123/google-chromes-origi... [2]: https://villing.com/articles/facebook-is-the-new-aol/ https://villing.com/articles/facebook-is-the-new-aol/

Santosh83 6y ago

What is Mozilla's stand on WebBundles, SGX and Loading?