7 ms·

The title seems a bit misleading. If I read this right, Google didn't veto a privacy proposal- it veto'd giving an interest group within the WC3 "the ability t

The title seems a bit misleading. If I read this right, Google didn't veto a privacy proposal- it veto'd giving an interest group within the WC3 "the ability to block any new technical specification that it felt would have negative implications for web privacy." It's still probably bad, I'm quite prepared to believe the spirit of the headline (that google is anti-privacy), but it doesn't seem like this is a case of google directly hurting privacy in web standards.

ogre_codes 6y ago
It is preventing a privacy advocacy group in the W3C from gaining additional influence. I think that's a pretty clear hit to web privacy.
- Wowfunhappy 6y ago
  And also, everyone else voted in favor, so I'm inclined to believe it was a reasonable proposal.
  - TearsInTheRain 6y ago
    yikes, not a fan of that argument as a matter of principle.
    - ocdtrekkie 6y ago
      When it comes to privacy, you can safely assume whatever side Google is on is the wrong one, and the one everyone else is on is probably costly to Google's web domination plans.
      - 3np 6y ago
        Depends. When they were struggling with the CCP, eventually getting all their services blocked in Mainland China, I don't think so. There are more examples of situations were Google really does take the other side of the table. It's not helpful to reducing it to these extremes.
        deleted 6y ago
        [deleted]
        orestarod 6y ago
        If they really wanted to fight for freedoms instead of searching a viable way to have profits in China, they wouldn't secretly start Dragonfly, which was only halted after its employees demanded it. So, they really really did want to operate in China, no matter the human rights situation there, they just did not think it through to concede enough things back then. They were ready later, hence Dragonfly happened.
        3np 6y ago
        Sure, but that does not mean that their side is always the wrong one on every issue. They can do evil and good at the same time.
        ocdtrekkie 6y ago
        Not really. They're always evil, it's just occasional their evil coincides with interfering with another evil. Google's issue with China has never really been human rights. Google's issue with China is that it insists on access to data and algorithms, and while Google does not care about your privacy, Google cares a great deal about it's own privacy.
        ogre_codes 6y ago
        I think current Google would have made a significantly different decision than past Google. It's been a while since I've seen them make an altruistic choice that has cost them significantly the way losing China did.
      - bawolff 6y ago
        So you're opposed to TLS strengthening measures like certificate transparency? Because i think its pretty good for privacy. Blind google hate is just as bad as blind google fanboyism. Google does plenty for internet privacy, especially in the parts that don't affect its underlying business model, which is a big part of the privacy space.
        vaduz 6y ago
        > So you're opposed to TLS strengthening measures like certificate transparency? Because i think its pretty good for privacy. Considering that the cost of getting CT was the removal of RFC 7469 HTTP-based PKP "dynamic pins" (aka HPKP), I am not sure if there was a net benefit to privacy - without hate or love for Google. I can't fail to notice that intent to removal was to also remove "static pins" (i.e. pins harcoded into the browser) after CT requirement for all certificates was implemented [0], Chrome started checking CT for new certificates [1] and CA Forum has limited the maximum validity of certificates issued to 39 months (2016) -> 825 days (2018) -> 398 days (2020) [2] (which means pretty much all certs from 2017 would have been reissued by now!), yet static pins for certain "favoured" organisations remain in the Chromium code [3]. That list of favoured orgs? Google, Tor project, Twitter, Dropbox, Facebook, Spideroak, Yahoo and Swehack. CT is great for transparency and tracking rogue certs - but privacy could have used a stronger model than current blind trust in the CAs (and only acting afterwards if the trust proves misplaced). [0] https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr7p3rZ8/m/eNMwKPmUBAAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr... [1] https://chromium.googlesource.com/chromium/src/+/master/net/docs/certificate-transparency.md#Chrome-Policies https://chromium.googlesource.com/chromium/src/+/master/net/... [2] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... [3] https://raw.githubusercontent.com/chromium/chromium/master/net/http/transport_security_state_static.json https://raw.githubusercontent.com/chromium/chromium/master/n...
        bawolff 6y ago
        A standard used by nobody does nothing for privacy. I also dont really see the connection - we could have both if that was desired, they solve similar problems but they don't conflict with each other. HKPK wasn't removed to make way for CT, it was removed because it did not work in practise.
    - deleted 6y ago
      [deleted]
  - noizejoy 6y ago
    This is probably a more nuanced set of circumstances. Google is the big shark, and all the other fish have an economic interest to impede Google in addition to philosophical and other business model differences. So the situation isn’t quite the same as if you would have dozens of members of more similar size, power and influence. On the web in large parts of the world it’s increasingly becoming Google against everyone else in a war for survival.
    - tyingq 6y ago
      It's also possible others opposed the idea, but knew, for sure, Google would veto it. So they let Google take the hit.
      - noizejoy 6y ago
        Haha - I like your thinking!
  - fctorial 6y ago
    So the only argument we have against that proposals is that 96% people/pitchforks voted for it. That's the only argument I found in the post and the comments. Is there a well written article that describes what PING is and formal specification of this proposal?
- bawolff 6y ago
  Not neccesarily. Actions matter, not the name of the group. For example, usa is famous for naming bills the opposite of what they say. Not saying that's neccesarily happening here, but surely we could come up with a better argument than "it has privacy in the name therefore is good."
bigiain 6y ago
It vetoed giving a privacy interest group the same veto powers it hypocritically abuses itself... Welcome to 2021, the surveillance capitalism trashfire shows no signs of burning out...
underseacables 6y ago
Google’s business model is the antithesis of privacy. The less privacy the better for companies like Google. I don’t mean that as hyperbole, but I would be very curious to know when it comes to privacy, what’s in it for Google?
- refulgentis 6y ago
  Your continued use of their products - thats why Google remains as much of a theoretical concern as Apple, who will happily tell you they keep track of all of the articles you read, tap in their search results, and purchased in all of their virtual stores, among many many other things, for targeting. For some reason people treat Apple as if offering grouped ad targeting is the same as being private, but when Google does the same, it's treated as a fundamental sin The central error is only a first order analysis can lead to the conclusion that Google doesn't care about user privacy - it's probably it's most fundamental value
dang 6y ago
We've reverted the title to that of the article. The submitted title was "In a 24-1 vote, Google vetoes Web Privacy Working Group at the W3C (2019)". Submitters: please follow the site guidelines, which ask "Please use the original title, unless it is misleading or linkbait; don't editorialize." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

ogre_codes 6y ago

It is preventing a privacy advocacy group in the W3C from gaining additional influence. I think that's a pretty clear hit to web privacy.

Wowfunhappy 6y ago
And also, everyone else voted in favor, so I'm inclined to believe it was a reasonable proposal.
- TearsInTheRain 6y ago
  yikes, not a fan of that argument as a matter of principle.
  - ocdtrekkie 6y ago
    When it comes to privacy, you can safely assume whatever side Google is on is the wrong one, and the one everyone else is on is probably costly to Google's web domination plans.
    - 3np 6y ago
      Depends. When they were struggling with the CCP, eventually getting all their services blocked in Mainland China, I don't think so. There are more examples of situations were Google really does take the other side of the table. It's not helpful to reducing it to these extremes.
      - deleted 6y ago
        [deleted]
      - orestarod 6y ago
        If they really wanted to fight for freedoms instead of searching a viable way to have profits in China, they wouldn't secretly start Dragonfly, which was only halted after its employees demanded it. So, they really really did want to operate in China, no matter the human rights situation there, they just did not think it through to concede enough things back then. They were ready later, hence Dragonfly happened.
        3np 6y ago
        Sure, but that does not mean that their side is always the wrong one on every issue. They can do evil and good at the same time.
        ocdtrekkie 6y ago
        Not really. They're always evil, it's just occasional their evil coincides with interfering with another evil. Google's issue with China has never really been human rights. Google's issue with China is that it insists on access to data and algorithms, and while Google does not care about your privacy, Google cares a great deal about it's own privacy.
      - ogre_codes 6y ago
        I think current Google would have made a significantly different decision than past Google. It's been a while since I've seen them make an altruistic choice that has cost them significantly the way losing China did.
    - bawolff 6y ago
      So you're opposed to TLS strengthening measures like certificate transparency? Because i think its pretty good for privacy. Blind google hate is just as bad as blind google fanboyism. Google does plenty for internet privacy, especially in the parts that don't affect its underlying business model, which is a big part of the privacy space.
      - vaduz 6y ago
        > So you're opposed to TLS strengthening measures like certificate transparency? Because i think its pretty good for privacy. Considering that the cost of getting CT was the removal of RFC 7469 HTTP-based PKP "dynamic pins" (aka HPKP), I am not sure if there was a net benefit to privacy - without hate or love for Google. I can't fail to notice that intent to removal was to also remove "static pins" (i.e. pins harcoded into the browser) after CT requirement for all certificates was implemented [0], Chrome started checking CT for new certificates [1] and CA Forum has limited the maximum validity of certificates issued to 39 months (2016) -> 825 days (2018) -> 398 days (2020) [2] (which means pretty much all certs from 2017 would have been reissued by now!), yet static pins for certain "favoured" organisations remain in the Chromium code [3]. That list of favoured orgs? Google, Tor project, Twitter, Dropbox, Facebook, Spideroak, Yahoo and Swehack. CT is great for transparency and tracking rogue certs - but privacy could have used a stronger model than current blind trust in the CAs (and only acting afterwards if the trust proves misplaced). [0] https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr7p3rZ8/m/eNMwKPmUBAAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr... [1] https://chromium.googlesource.com/chromium/src/+/master/net/docs/certificate-transparency.md#Chrome-Policies https://chromium.googlesource.com/chromium/src/+/master/net/... [2] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... [3] https://raw.githubusercontent.com/chromium/chromium/master/net/http/transport_security_state_static.json https://raw.githubusercontent.com/chromium/chromium/master/n...
        bawolff 6y ago
        A standard used by nobody does nothing for privacy. I also dont really see the connection - we could have both if that was desired, they solve similar problems but they don't conflict with each other. HKPK wasn't removed to make way for CT, it was removed because it did not work in practise.
  - deleted 6y ago
    [deleted]
- noizejoy 6y ago
  This is probably a more nuanced set of circumstances. Google is the big shark, and all the other fish have an economic interest to impede Google in addition to philosophical and other business model differences. So the situation isn’t quite the same as if you would have dozens of members of more similar size, power and influence. On the web in large parts of the world it’s increasingly becoming Google against everyone else in a war for survival.
  - tyingq 6y ago
    It's also possible others opposed the idea, but knew, for sure, Google would veto it. So they let Google take the hit.
    - noizejoy 6y ago
      Haha - I like your thinking!
- fctorial 6y ago
  So the only argument we have against that proposals is that 96% people/pitchforks voted for it. That's the only argument I found in the post and the comments. Is there a well written article that describes what PING is and formal specification of this proposal?
bawolff 6y ago
Not neccesarily. Actions matter, not the name of the group. For example, usa is famous for naming bills the opposite of what they say. Not saying that's neccesarily happening here, but surely we could come up with a better argument than "it has privacy in the name therefore is good."

bigiain 6y ago

It vetoed giving a privacy interest group the same veto powers it hypocritically abuses itself... Welcome to 2021, the surveillance capitalism trashfire shows no signs of burning out...

underseacables 6y ago

Google’s business model is the antithesis of privacy. The less privacy the better for companies like Google. I don’t mean that as hyperbole, but I would be very curious to know when it comes to privacy, what’s in it for Google?

refulgentis 6y ago
Your continued use of their products - thats why Google remains as much of a theoretical concern as Apple, who will happily tell you they keep track of all of the articles you read, tap in their search results, and purchased in all of their virtual stores, among many many other things, for targeting. For some reason people treat Apple as if offering grouped ad targeting is the same as being private, but when Google does the same, it's treated as a fundamental sin The central error is only a first order analysis can lead to the conclusion that Google doesn't care about user privacy - it's probably it's most fundamental value

dang 6y ago

We've reverted the title to that of the article. The submitted title was "In a 24-1 vote, Google vetoes Web Privacy Working Group at the W3C (2019)". Submitters: please follow the site guidelines, which ask "Please use the original title, unless it is misleading or linkbait; don't editorialize." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html