3 ms·
There are echoes of the net neutrality debate here, where one might argue that: beyond the OSI Application Layer (HTTP etc.) there is also the Layer Where The B
by btown 4y ago
There are echoes of the net neutrality debate here, where one might argue that: beyond the OSI Application Layer (HTTP etc.) there is also the Layer Where The Browser Decides What Pixels To Show, and that we would want that new layer to be every bit as neutral as, say, whether T-Mobile can shape lower-layer video traffic based on its business partnerships.
But there's also a lot of nuance here. Imagine there was a law or regulation that said that a browser manufacturer must only write code that is agnostic to the current URL; imagine it said, say, that Edge developers cannot deploy code that detects that Edge is on google.com/chrome and decide based on that information to execute certain code.
Unfortunately, a version of this per-site customization is arguably exactly what Chrome does for the HSTS preload list: https://hstspreload.org/ https://hstspreload.org/ - and disallowing this would not be good for security at all!
And imagine if there is an urgent Chrome security fix that, as a side effect, causes the Outlook login screen to bug out - or any other mission-critical login page on the web. The most reasonable hotfix might be to push a quick fix that whitelists certain domains for the legacy behavior. But this, too, would be disallowed.
We definitely don't want to throw the baby out with the bathwater just because Microsoft got a little cute - arguably too cute - here.
- Jasper_ 4y agoGo look at the amount of times IsGoogleHost or HasGoogleHost are called from within Chromium. For instance, autofill works differently for Google-owned services: https://source.chromium.org/chromium/chromium/src/+/main:components/autofill/core/browser/form_data_importer.cc;l=749-753;drc=e1591f7e48004bf610e6e53a4f213d032e221f23;bpv=0;bpt=1 https://source.chromium.org/chromium/chromium/src/+/main:com... Additional network telemetry is enabled when interacting with a Google-owned property ( this is known as "domain_reliability" -- https://source.chromium.org/chromium/chromium/src/+/main:components/domain_reliability/;bpv=0;bpt=0 https://source.chromium.org/chromium/chromium/src/+/main:com... ) Chromium is not a neutral browser already.
- attentive 4y agoIf I read this [1] right, brave has removed it. 1. https://github.com/brave/brave-browser/issues/1734 https://github.com/brave/brave-browser/issues/1734
- AlotOfReading 4y agoI don't think there's a realistic baby-bathwater trade-off here. This is just leveraging, using your power in one market (PC operating systems) to gain a competitive advantage in another market (browsers). It's not some deeply technical subject the courts and legislators are incapable of understanding, they just haven't cared since US v. Microsoft ended.
- userbinator 4y agoand disallowing this would not be good for security at all! Maybe once we can stop drinking the corporate "security" kool-aid, we'll realise that it was all just an excuse to take control away from us. Saying "security" should be like saying "terrorists" or "think of the children" at this point.
- btown 4y agoThere are many situations where this comment rings true - I've been vocally opposed to Google's so-called security-inspired restrictions to its extensions in Manifest V3, for instance. But the cross-browser initiative that is HSTS, allowing site operators to opt-in to protection against HTTPS downgrade attacks, is not one of those situations. Empowering businesses and creators to make their sites more secure for their users, in situations where there aren't side effects, is a good thing!
- neop1x 4y agoAnd then there is also CloudFlare which demands a lot from the browser before proxying traffic to many popular websites, forcing users to use one of the most common and unmodified browsers.