4 ms·

Or Firefox, or Safari, or Edge, I believe.

Wowfunhappy 6y ago
Sorry, I meant for that to be implied, but should have been explicit. This requirement locks you in to using one of the major players until the end of time.
- kbenson 6y ago
  Or unless there's a petition process to get another browser added. I think the criteria is "not a webview, not embedded", so if your browser isn't usable for that, or at least not without it being obvious, then maybe that browser can ask to be added? There are reasons why Google doesn't just want to allow any curl request to authenticate a user, and those are valid reasons I agree with. Do those apply to a browser like Epiphany? Probably not, but there's a spectrum along which things will fall, and people will not always agree on where those things belong on that spectrum, and some things may be initially excluded purely on popularity, but that might be an easy problem to fix. Asking is pretty low effort.
  - Wowfunhappy 6y ago
    I do wonder if Michael Catanzaro has tried reaching out to Google. Epiphany's user base is microscopic compared to Chrome's, I'm sure, but they're also very far from a fly-by-night project. Then again, I'm not sure how he would reach out. Google is infamously hard to contact, particularly in these sorts of situations where you're a victim of the AI.
    - kbenson 6y ago
      Probably to a dev on the team that implemented this, which might be harder to find, but is also likely to be a more fruitful conversation than some front-line support rep, as technical cases and reasons can be explained dev-to-dev.
  - Arnavion 6y ago
    >then maybe that browser can ask to be added? So as soon as one such webview-based browser gets added via this hypothetical petition process, what's to stop the Evil Nasty Malware (tm) from using the same webview library? The email's author worries about needing their webview-based browser to maintain JS engine and TLS ciphersuite equivalence with an approved browser, but that becomes trivial if the exact same webview library can be used by an approved browser and the Evil Nasty Malware. It seems to me that allowing even a single webview-based browser would go against what Google is trying to do.
    - kbenson 6y ago
      If it's a webview based browser, I think it shouldn't be added. Sorry, that's just the price they pay for using a webview as a shortcut to providing a full browser. > It seems to me that allowing even a single webview-based browser would go against what Google is trying to do. I agree. Other than it being weird to ask/need the system to use a different browser than you are using, and possibly a different browser than what you've set as default if you've set it to one Google doesn't trust for auth, nothing prevents any webview browser from acting like any other webview, and outsourcing to Chrome or Firefox for the authentication to get a good token, as long as you can use a token for full Google account login (which I don't know if you can).
      - Arnavion 6y ago
        >If it's a webview based browser, I think it shouldn't be added. Sorry, that's just the price they pay for using a webview as a shortcut to providing a full browser. Okay. So using a browser library for building a browser is a shortcut, and that disqualifies it from being a "full" browser. Of course one of the fundamental tenets of software is to not reuse other people's work. Silly me. brb writing my own browser called Chremium and petitioning Google to allow it. Apart from that I'll also publish a library that uses the guts of Chremium, called the Chremium Ombodded Framework, which can be embedded in other applications. Of course any application that uses the COF is indistinguishable from Chremium itself, but Google won't then distrust Chremium because it can't distinguish it from COF any more, right?
  - 1_player 6y ago
    > unless there's a petition process to get another browser added Ah yes, once there were standards and committees, now you have to beg the power that be to let you in. Brilliant.
    - kbenson 6y ago
      Yes, now you ask the company you are trying to use the services of to allow your application to be a valid authentication agent of. Since when doesn't it make sense to ask to tie in your app when it's to be used with a different service when you care about that? This is for login to a Google account, just plain searching on google.com or viewing a video on Youtube. We can complain about web standards all we want, but this isn't access to the open web we're talking about here, it's access to Google's service ecosystem that requires a Google account, and them gating that however they want is their prerogative.

Sorry, I meant for that to be implied, but should have been explicit. This requirement locks you in to using one of the major players until the end of time.

kbenson 6y ago
Or unless there's a petition process to get another browser added. I think the criteria is "not a webview, not embedded", so if your browser isn't usable for that, or at least not without it being obvious, then maybe that browser can ask to be added? There are reasons why Google doesn't just want to allow any curl request to authenticate a user, and those are valid reasons I agree with. Do those apply to a browser like Epiphany? Probably not, but there's a spectrum along which things will fall, and people will not always agree on where those things belong on that spectrum, and some things may be initially excluded purely on popularity, but that might be an easy problem to fix. Asking is pretty low effort.
- Wowfunhappy 6y ago
  I do wonder if Michael Catanzaro has tried reaching out to Google. Epiphany's user base is microscopic compared to Chrome's, I'm sure, but they're also very far from a fly-by-night project. Then again, I'm not sure how he would reach out. Google is infamously hard to contact, particularly in these sorts of situations where you're a victim of the AI.
  - kbenson 6y ago
    Probably to a dev on the team that implemented this, which might be harder to find, but is also likely to be a more fruitful conversation than some front-line support rep, as technical cases and reasons can be explained dev-to-dev.
- Arnavion 6y ago
  >then maybe that browser can ask to be added? So as soon as one such webview-based browser gets added via this hypothetical petition process, what's to stop the Evil Nasty Malware (tm) from using the same webview library? The email's author worries about needing their webview-based browser to maintain JS engine and TLS ciphersuite equivalence with an approved browser, but that becomes trivial if the exact same webview library can be used by an approved browser and the Evil Nasty Malware. It seems to me that allowing even a single webview-based browser would go against what Google is trying to do.
  - kbenson 6y ago
    If it's a webview based browser, I think it shouldn't be added. Sorry, that's just the price they pay for using a webview as a shortcut to providing a full browser. > It seems to me that allowing even a single webview-based browser would go against what Google is trying to do. I agree. Other than it being weird to ask/need the system to use a different browser than you are using, and possibly a different browser than what you've set as default if you've set it to one Google doesn't trust for auth, nothing prevents any webview browser from acting like any other webview, and outsourcing to Chrome or Firefox for the authentication to get a good token, as long as you can use a token for full Google account login (which I don't know if you can).
    - Arnavion 6y ago
      >If it's a webview based browser, I think it shouldn't be added. Sorry, that's just the price they pay for using a webview as a shortcut to providing a full browser. Okay. So using a browser library for building a browser is a shortcut, and that disqualifies it from being a "full" browser. Of course one of the fundamental tenets of software is to not reuse other people's work. Silly me. brb writing my own browser called Chremium and petitioning Google to allow it. Apart from that I'll also publish a library that uses the guts of Chremium, called the Chremium Ombodded Framework, which can be embedded in other applications. Of course any application that uses the COF is indistinguishable from Chremium itself, but Google won't then distrust Chremium because it can't distinguish it from COF any more, right?
- 1_player 6y ago
  > unless there's a petition process to get another browser added Ah yes, once there were standards and committees, now you have to beg the power that be to let you in. Brilliant.
  - kbenson 6y ago
    Yes, now you ask the company you are trying to use the services of to allow your application to be a valid authentication agent of. Since when doesn't it make sense to ask to tie in your app when it's to be used with a different service when you care about that? This is for login to a Google account, just plain searching on google.com or viewing a video on Youtube. We can complain about web standards all we want, but this isn't access to the open web we're talking about here, it's access to Google's service ecosystem that requires a Google account, and them gating that however they want is their prerogative.