5 ms·

It is preventing a privacy advocacy group in the W3C from gaining additional influence. I think that's a pretty clear hit to web privacy.

Wowfunhappy 6y ago
And also, everyone else voted in favor, so I'm inclined to believe it was a reasonable proposal.
- TearsInTheRain 6y ago
  yikes, not a fan of that argument as a matter of principle.
  - ocdtrekkie 6y ago
    When it comes to privacy, you can safely assume whatever side Google is on is the wrong one, and the one everyone else is on is probably costly to Google's web domination plans.
    - 3np 6y ago
      Depends. When they were struggling with the CCP, eventually getting all their services blocked in Mainland China, I don't think so. There are more examples of situations were Google really does take the other side of the table. It's not helpful to reducing it to these extremes.
      - deleted 6y ago
        [deleted]
      - orestarod 6y ago
        If they really wanted to fight for freedoms instead of searching a viable way to have profits in China, they wouldn't secretly start Dragonfly, which was only halted after its employees demanded it. So, they really really did want to operate in China, no matter the human rights situation there, they just did not think it through to concede enough things back then. They were ready later, hence Dragonfly happened.
        3np 6y ago
        Sure, but that does not mean that their side is always the wrong one on every issue. They can do evil and good at the same time.
        ocdtrekkie 6y ago
        Not really. They're always evil, it's just occasional their evil coincides with interfering with another evil. Google's issue with China has never really been human rights. Google's issue with China is that it insists on access to data and algorithms, and while Google does not care about your privacy, Google cares a great deal about it's own privacy.
      - ogre_codes 6y ago
        I think current Google would have made a significantly different decision than past Google. It's been a while since I've seen them make an altruistic choice that has cost them significantly the way losing China did.
    - bawolff 6y ago
      So you're opposed to TLS strengthening measures like certificate transparency? Because i think its pretty good for privacy. Blind google hate is just as bad as blind google fanboyism. Google does plenty for internet privacy, especially in the parts that don't affect its underlying business model, which is a big part of the privacy space.
      - vaduz 6y ago
        > So you're opposed to TLS strengthening measures like certificate transparency? Because i think its pretty good for privacy. Considering that the cost of getting CT was the removal of RFC 7469 HTTP-based PKP "dynamic pins" (aka HPKP), I am not sure if there was a net benefit to privacy - without hate or love for Google. I can't fail to notice that intent to removal was to also remove "static pins" (i.e. pins harcoded into the browser) after CT requirement for all certificates was implemented [0], Chrome started checking CT for new certificates [1] and CA Forum has limited the maximum validity of certificates issued to 39 months (2016) -> 825 days (2018) -> 398 days (2020) [2] (which means pretty much all certs from 2017 would have been reissued by now!), yet static pins for certain "favoured" organisations remain in the Chromium code [3]. That list of favoured orgs? Google, Tor project, Twitter, Dropbox, Facebook, Spideroak, Yahoo and Swehack. CT is great for transparency and tracking rogue certs - but privacy could have used a stronger model than current blind trust in the CAs (and only acting afterwards if the trust proves misplaced). [0] https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr7p3rZ8/m/eNMwKPmUBAAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr... [1] https://chromium.googlesource.com/chromium/src/+/master/net/docs/certificate-transparency.md#Chrome-Policies https://chromium.googlesource.com/chromium/src/+/master/net/... [2] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... [3] https://raw.githubusercontent.com/chromium/chromium/master/net/http/transport_security_state_static.json https://raw.githubusercontent.com/chromium/chromium/master/n...
        bawolff 6y ago
        A standard used by nobody does nothing for privacy. I also dont really see the connection - we could have both if that was desired, they solve similar problems but they don't conflict with each other. HKPK wasn't removed to make way for CT, it was removed because it did not work in practise.
  - deleted 6y ago
    [deleted]
- noizejoy 6y ago
  This is probably a more nuanced set of circumstances. Google is the big shark, and all the other fish have an economic interest to impede Google in addition to philosophical and other business model differences. So the situation isn’t quite the same as if you would have dozens of members of more similar size, power and influence. On the web in large parts of the world it’s increasingly becoming Google against everyone else in a war for survival.
  - tyingq 6y ago
    It's also possible others opposed the idea, but knew, for sure, Google would veto it. So they let Google take the hit.
    - noizejoy 6y ago
      Haha - I like your thinking!
- fctorial 6y ago
  So the only argument we have against that proposals is that 96% people/pitchforks voted for it. That's the only argument I found in the post and the comments. Is there a well written article that describes what PING is and formal specification of this proposal?
bawolff 6y ago
Not neccesarily. Actions matter, not the name of the group. For example, usa is famous for naming bills the opposite of what they say. Not saying that's neccesarily happening here, but surely we could come up with a better argument than "it has privacy in the name therefore is good."

Wowfunhappy 6y ago

And also, everyone else voted in favor, so I'm inclined to believe it was a reasonable proposal.

TearsInTheRain 6y ago
yikes, not a fan of that argument as a matter of principle.
- ocdtrekkie 6y ago
  When it comes to privacy, you can safely assume whatever side Google is on is the wrong one, and the one everyone else is on is probably costly to Google's web domination plans.
  - 3np 6y ago
    Depends. When they were struggling with the CCP, eventually getting all their services blocked in Mainland China, I don't think so. There are more examples of situations were Google really does take the other side of the table. It's not helpful to reducing it to these extremes.
    - deleted 6y ago
      [deleted]
    - orestarod 6y ago
      If they really wanted to fight for freedoms instead of searching a viable way to have profits in China, they wouldn't secretly start Dragonfly, which was only halted after its employees demanded it. So, they really really did want to operate in China, no matter the human rights situation there, they just did not think it through to concede enough things back then. They were ready later, hence Dragonfly happened.
      - 3np 6y ago
        Sure, but that does not mean that their side is always the wrong one on every issue. They can do evil and good at the same time.
        ocdtrekkie 6y ago
        Not really. They're always evil, it's just occasional their evil coincides with interfering with another evil. Google's issue with China has never really been human rights. Google's issue with China is that it insists on access to data and algorithms, and while Google does not care about your privacy, Google cares a great deal about it's own privacy.
    - ogre_codes 6y ago
      I think current Google would have made a significantly different decision than past Google. It's been a while since I've seen them make an altruistic choice that has cost them significantly the way losing China did.
  - bawolff 6y ago
    So you're opposed to TLS strengthening measures like certificate transparency? Because i think its pretty good for privacy. Blind google hate is just as bad as blind google fanboyism. Google does plenty for internet privacy, especially in the parts that don't affect its underlying business model, which is a big part of the privacy space.
    - vaduz 6y ago
      > So you're opposed to TLS strengthening measures like certificate transparency? Because i think its pretty good for privacy. Considering that the cost of getting CT was the removal of RFC 7469 HTTP-based PKP "dynamic pins" (aka HPKP), I am not sure if there was a net benefit to privacy - without hate or love for Google. I can't fail to notice that intent to removal was to also remove "static pins" (i.e. pins harcoded into the browser) after CT requirement for all certificates was implemented [0], Chrome started checking CT for new certificates [1] and CA Forum has limited the maximum validity of certificates issued to 39 months (2016) -> 825 days (2018) -> 398 days (2020) [2] (which means pretty much all certs from 2017 would have been reissued by now!), yet static pins for certain "favoured" organisations remain in the Chromium code [3]. That list of favoured orgs? Google, Tor project, Twitter, Dropbox, Facebook, Spideroak, Yahoo and Swehack. CT is great for transparency and tracking rogue certs - but privacy could have used a stronger model than current blind trust in the CAs (and only acting afterwards if the trust proves misplaced). [0] https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr7p3rZ8/m/eNMwKPmUBAAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr... [1] https://chromium.googlesource.com/chromium/src/+/master/net/docs/certificate-transparency.md#Chrome-Policies https://chromium.googlesource.com/chromium/src/+/master/net/... [2] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... [3] https://raw.githubusercontent.com/chromium/chromium/master/net/http/transport_security_state_static.json https://raw.githubusercontent.com/chromium/chromium/master/n...
      - bawolff 6y ago
        A standard used by nobody does nothing for privacy. I also dont really see the connection - we could have both if that was desired, they solve similar problems but they don't conflict with each other. HKPK wasn't removed to make way for CT, it was removed because it did not work in practise.
- deleted 6y ago
  [deleted]
noizejoy 6y ago
This is probably a more nuanced set of circumstances. Google is the big shark, and all the other fish have an economic interest to impede Google in addition to philosophical and other business model differences. So the situation isn’t quite the same as if you would have dozens of members of more similar size, power and influence. On the web in large parts of the world it’s increasingly becoming Google against everyone else in a war for survival.
- tyingq 6y ago
  It's also possible others opposed the idea, but knew, for sure, Google would veto it. So they let Google take the hit.
  - noizejoy 6y ago
    Haha - I like your thinking!
fctorial 6y ago
So the only argument we have against that proposals is that 96% people/pitchforks voted for it. That's the only argument I found in the post and the comments. Is there a well written article that describes what PING is and formal specification of this proposal?

bawolff 6y ago

Not neccesarily. Actions matter, not the name of the group. For example, usa is famous for naming bills the opposite of what they say. Not saying that's neccesarily happening here, but surely we could come up with a better argument than "it has privacy in the name therefore is good."