5 ms·

Terrible idea. No matter how much time it would save me, I do not want “my” computer doing any work designed to snitch on me.

by kgwxd 4y ago

theshrike79 4y ago
It already does. That's what browser profiling is for.
- xtanx 4y ago
  So lets start by NOT adding more things that snitch.
  - Spivak 4y ago
    Reframe it and it’s not so bad. It’s presenting a tamper evident ID card to a website that’s minted by the manufacturer of your device. Your fake drivers license isn’t snitching on you when the bouncer looks at it. It’s only snitching if you’re trying to get away with something and pretend you’re running unmodified Windows/macOS when you’re not.
    - userbinator 4y ago
      Reframe it again, I'm running a modified OS that is free of spyware and respects my freedom, but the corporate bastards don't want that.
simonh 4y ago
>The server doesn't know anything about the device or the person accessing it. What sort of snitching?
- Zak 4y ago
  It snitches regarding what kind of device and operating system you're using. It currently seems to be limited to Apple devices, but this is the sort of thing I could see Microsoft and Google going for. Put another way, if everyone running unmodified corporate operating systems proves it as a matter of course, it effectively snitches on anyone who isn't. Running Linux? Rooted Android? Anything else weird? If this gets popular, you might not be able to access most of the web with it, at least not without constantly filling in CAPTCHAs.
  - nojito 4y ago
    None of this is true. Cloudflare does not know what device you're using.
    - Zak 4y ago
      Cloudflare knows you're using a device that supports this feature. If a majority of internet users are eventually using devices that support it, some sites will probably deny service to those that do not just as some Android apps refuse to run on devices not using a factory OS.
      - nojito 4y ago
        Which is a good thing. Besides it's an open standard. https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...
        danShumway 4y ago
        Remember back to EME, an Open standard doesn't necessarily mean Open implementation. The actual workflow here is an open standard, but I'm having a hard time understanding why sites won't just require that you use Mediators/Issuers that were written by one of the big tech companies and then block everything else. Not saying that will absolutely be the case, I'm just saying that I don't understand why I shouldn't be concerned -- I've seen these exact arguments get used in the past for systems that absolutely shut out independent browser/hardware/OS/ROM development. I mean... CAPTCHA is effectively an Open Standard, even if it doesn't have a draft that I'm aware of. But that doesn't mean much when so much of how it works is rolled up in an unstandardized implementation and when website operators are ultimately in charge of choosing CAPTCHA providers, not users. Is the same thing going to happen with PATs?
        Zak 4y ago
        You appear to be writing that it would be a good thing if browsing most of the web was not possible from Linux. If that's not what you meant, please clarify. If it is what you meant, I don't quite know how to respond except that I disagree vehemently.
- scoopertrooper 4y ago
  OP is mad into scalping.
  - stjohnswarts 4y ago
    I doubt anyone is saying that this is bad if you're using a web app for financial transactions like buying tickets. This proposal however is to basically force everyone on the web to use an ID that can be traced back to them for all usage. This is great for advertisers and even better for government spying
    - nybble41 4y ago
      > I doubt anyone is saying that this is bad if you're using a web app for financial transactions like buying tickets. I for one am certainly saying that this is bad if it means that you need approval from one of Apple, Google, or Microsoft to participate in financial transactions. That would be a giant step backward compared to the status quo.
deweller 4y ago
This protocol is designed to not send any data that can be used to identify you directly or fingerprint your identity.
- wewxjfq 4y ago
  It's designed to gatekeep access to the Internet. This is a company's solution to a problem caused by the same company and we are all forced to participate.
  - lotsofpulp 4y ago
    As far as I understand, the problem is caused by massive networks of malware ridden computers and bots.
    - kgwxd 4y ago
      The problem is caused by other peoples reactions to computers and bots. Bots are the servers problem, not mine, my machine should not be involved in solving it. Same reason I block ad/tracking scripts, it's no my responsibility to ensure other peoples advertising contracts are upheld, that's their problem, if they can't solve it without involving me, too bad.
      - lotsofpulp 4y ago
        My comment was to point out what I think was an incorrect characterization in these words: > company's solution to a problem caused by the same company The “company” needed a solution to a problem caused by bad actors in the network. Whether or not a company’s solution causes someone else to have a problem is a different matter.
      - hombre_fatal 4y ago
        That seems like saying that DDoS is the server's problem and that it doesn't affect you and that the issue is the server's response to bad actors, not the bad actors. Like DDoS, bots become the problem of all users when they slip through. Fair enough to disagree with the mitigation strategy. I suppose most web services wouldn't care to differentiate you from a bot.
quantified 4y ago
Will you forego acquiring an Apple if you don't want it, or acquiring a smartphone at all if they all have it? If not, well, your voice doesn't matter. Sorry. Not trying to be depressing or annoying, just that your/our levers aren't big enough to shift things.
stuu99 4y ago

Terrible idea. No matter how much time it would save me, I do not want “my” computer doing any work designed to snitch on me.

by kgwxd 4y ago

Terrible idea. No matter how much time it would save me, I do not want “my” computer doing any work designed to snitch on me.

theshrike79 4y ago

It already does. That's what browser profiling is for.

xtanx 4y ago
So lets start by NOT adding more things that snitch.
- Spivak 4y ago
  Reframe it and it’s not so bad. It’s presenting a tamper evident ID card to a website that’s minted by the manufacturer of your device. Your fake drivers license isn’t snitching on you when the bouncer looks at it. It’s only snitching if you’re trying to get away with something and pretend you’re running unmodified Windows/macOS when you’re not.
  - userbinator 4y ago
    Reframe it again, I'm running a modified OS that is free of spyware and respects my freedom, but the corporate bastards don't want that.

simonh 4y ago

>The server doesn't know anything about the device or the person accessing it. What sort of snitching?

Zak 4y ago
It snitches regarding what kind of device and operating system you're using. It currently seems to be limited to Apple devices, but this is the sort of thing I could see Microsoft and Google going for. Put another way, if everyone running unmodified corporate operating systems proves it as a matter of course, it effectively snitches on anyone who isn't. Running Linux? Rooted Android? Anything else weird? If this gets popular, you might not be able to access most of the web with it, at least not without constantly filling in CAPTCHAs.
- nojito 4y ago
  None of this is true. Cloudflare does not know what device you're using.
  - Zak 4y ago
    Cloudflare knows you're using a device that supports this feature. If a majority of internet users are eventually using devices that support it, some sites will probably deny service to those that do not just as some Android apps refuse to run on devices not using a factory OS.
    - nojito 4y ago
      Which is a good thing. Besides it's an open standard. https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...
      - danShumway 4y ago
        Remember back to EME, an Open standard doesn't necessarily mean Open implementation. The actual workflow here is an open standard, but I'm having a hard time understanding why sites won't just require that you use Mediators/Issuers that were written by one of the big tech companies and then block everything else. Not saying that will absolutely be the case, I'm just saying that I don't understand why I shouldn't be concerned -- I've seen these exact arguments get used in the past for systems that absolutely shut out independent browser/hardware/OS/ROM development. I mean... CAPTCHA is effectively an Open Standard, even if it doesn't have a draft that I'm aware of. But that doesn't mean much when so much of how it works is rolled up in an unstandardized implementation and when website operators are ultimately in charge of choosing CAPTCHA providers, not users. Is the same thing going to happen with PATs?
      - Zak 4y ago
        You appear to be writing that it would be a good thing if browsing most of the web was not possible from Linux. If that's not what you meant, please clarify. If it is what you meant, I don't quite know how to respond except that I disagree vehemently.
scoopertrooper 4y ago
OP is mad into scalping.
- stjohnswarts 4y ago
  I doubt anyone is saying that this is bad if you're using a web app for financial transactions like buying tickets. This proposal however is to basically force everyone on the web to use an ID that can be traced back to them for all usage. This is great for advertisers and even better for government spying
  - nybble41 4y ago
    > I doubt anyone is saying that this is bad if you're using a web app for financial transactions like buying tickets. I for one am certainly saying that this is bad if it means that you need approval from one of Apple, Google, or Microsoft to participate in financial transactions. That would be a giant step backward compared to the status quo.

deweller 4y ago

This protocol is designed to not send any data that can be used to identify you directly or fingerprint your identity.

wewxjfq 4y ago
It's designed to gatekeep access to the Internet. This is a company's solution to a problem caused by the same company and we are all forced to participate.
- lotsofpulp 4y ago
  As far as I understand, the problem is caused by massive networks of malware ridden computers and bots.
  - kgwxd 4y ago
    The problem is caused by other peoples reactions to computers and bots. Bots are the servers problem, not mine, my machine should not be involved in solving it. Same reason I block ad/tracking scripts, it's no my responsibility to ensure other peoples advertising contracts are upheld, that's their problem, if they can't solve it without involving me, too bad.
    - lotsofpulp 4y ago
      My comment was to point out what I think was an incorrect characterization in these words: > company's solution to a problem caused by the same company The “company” needed a solution to a problem caused by bad actors in the network. Whether or not a company’s solution causes someone else to have a problem is a different matter.
    - hombre_fatal 4y ago
      That seems like saying that DDoS is the server's problem and that it doesn't affect you and that the issue is the server's response to bad actors, not the bad actors. Like DDoS, bots become the problem of all users when they slip through. Fair enough to disagree with the mitigation strategy. I suppose most web services wouldn't care to differentiate you from a bot.

quantified 4y ago

Will you forego acquiring an Apple if you don't want it, or acquiring a smartphone at all if they all have it? If not, well, your voice doesn't matter. Sorry. Not trying to be depressing or annoying, just that your/our levers aren't big enough to shift things.

stuu99 4y ago