19 ms·

So, you don't like a web platform proposal

92 points by KoftaBob 3y ago

gymbeaux 3y ago
It’s passive-aggressive as hell and I can tell this guy and the idea as a whole are DOA… like even if this scheme didn’t give off strong Amp vibes, Google is the last company we want spearheading something like this. Stop trying to stay relevant, Google.
- superkuh 3y ago
  Google has already achieved this goal with their QUIC based HTTP/3. No implementation or use of HTTP/3 lib in any browser can connect to a webserver unless it gets the continued approval of a third party incorporated CA for TLS certs. With a 90 day renewal period that's basically just attestation of content every 90 days. If your site becomes illegal in an area (say, abortion information) then your CA TLS host can be pressured, cert revoked, and your site made unvisitable for all but uber geeks compiling their own HTTP/3 libs with special flags and linking them to $browser manually. There's no way to host a HTTP HTTP/3 site that's visitable. And no one minds. So... Google could have avoided all of this blowback over WEI by simply calling it "HTTPS+ Everywhere" and pretending it helped user privacy only. I'll grant there are a few more TLS CA options than possible WEI attestation options (if they really are to come from the OS vendors like the spec suggests). But not that many more and any legal pressure applicable to one is applicable to all. Both Google WEI and Google QUIC HTTP/3 are terrible and both need opposition or at least mitigation.
  - sgammon 3y ago
    Can't you sign your own certificates? Whether people trust those is a different story. WAI is different because it breaks abstraction by asserting based on details which are otherwise invisible to the server.
    - jiggawatts 3y ago
      > Can't you sign your own certificates? Self-signed certificates are banned in HTTP/2 onwards, which is really irritating when it is used for internal server-to-server communications. You have to set up a Root CA certificate and use that to sign a second certificate. It's the same thing but with extra steps.
      - charcircuit 3y ago
        I've never had an issue using HTTP/2 with a self signed cert.
      - creatonez 3y ago
        Huh? Self-signed certificates work with HTTP/2 in every browser I've tried it in, it just uses the usual trust-on-first-use system where you have to click past a warning.
      - sgammon 3y ago
        That's still self-signing. So the extra steps are immaterial to the point.
    - superkuh 3y ago
      You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website. And before anyone goes there, no, setting up your own root CA is not an option. Unless you get can Google/Apple/Mozilla/etc to include your root CA in their browser trust stores it doesn't help a random person visit your website at all.
      - sgammon 3y ago
        That's still self-signing. So the extra steps are immaterial to the point.
      - fruitreunion1 3y ago
        >You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website. So long as there's a way to bypass verification or configure the trust store I'm okay with it. Is there official policy stating that this won't be possible or is this prediction? As I understand it the primary reason for this push is that non-technical users too often skip security warnings, but I'm of the position there MUST at least be a way to bypass verification no matter what (through keyboard combos or a configurable trust store).
  - Vecr 3y ago
    Has one of the standard open ACME providers ever revoked a cert over content? Hellenic Academic and Research Institutions CA (HARICA) threatened to, but the renewal went through and everything is working fine on my end.
  - ahahahahah 3y ago
    > If your site becomes illegal in an area (say, abortion information) then your CA TLS host can be pressured, cert revoked oh please... scare monger more. Like great, let's attach your petty little gripe to something that people care about in order to maybe get them on your side. except you can't show any real examples of it truly applying, so you just have to hint like "oh, this is possible, just imagine".
tgma 3y ago
While I fully understand the feeling of the author being a Googler doing their job, being a cog in the machine and launching something to advance their promo case, would be visibly upset that people who actually care about the outcome are actively fighting their project, I also think from the users' perspective, dealing with a powerful corporation, it is the right thing to do to bury this type of danger as soon as possible. (The piece where the author suggests focusing on "technical arguments" when the issue at hand is fundamentally political is frankly laughable; can't really tell if it is naïveté or deception.)
- monkaiju 3y ago
  Couldnt agree more, the 'make technical arguments' nonsense when WEI, and many similar issues, arent problematic for technical reason is ridiculous.
- charcircuit 3y ago
  >The piece where the author suggests focusing on "technical arguments" when the issue at hand is fundamentally political is frankly laughable It is essentially just asking for constructive feedback. When people just say not to do it, insult the author, or make assumptions about the proposal that aren't true the comments are not actionable. Even if an issue is political you can still make a constructive argument on the risks that adopting the proposal has.
  - scrollaway 3y ago
    It’s asking for feedback the author knows how to deal with (and disregard). You know, if your government body of choice came up with a terrible idea in a draft bill and enraged the population, it would not be appropriate for them to go on TV and say “the population should offer constructive criticism in the form of legal arguments”. So what the fuck is this guy saying exactly, that you feel is a valid approach to handling public outcry?
    - charcircuit 3y ago
      >It’s asking for feedback the author knows how to deal with (and disregard). Yes, and you can see how many people are being ignored. The article is a guide on how you can avoid being ignored and actually contribute to the process of standardization. >So what the fuck is this guy saying exactly, that you feel is a valid approach to handling public outcry? For example, people may think coming up with legal arguments may be an effective way to engage in the proposal and try to shut it down. The article describes that legal arguments will not be productive.
agilob 3y ago
>That's great!! Getting involved in web platform discussions is essential to ensure it's built for and by everyone. Yes, because Google is known for listening to public and talking to non-organisations without posting conversation killers like "the decision has been made and we're going forward with it. Thanks for your valuable feedback."
- serial_dev 3y ago
  Yes, organizations love the mealy mouthed, weak feedback on their Github issue tracker because that's easy to ignore. Just say the issue is spammy, or hostile, then close it without addressing any of the issues. What's harder to ignore (though still not impossible) is top articles on Reddit, HN, and even mainstream tech news sites, and a constant coverage on YouTube, podcasts, etc.
  - Ygg2 3y ago
    Didn't Rust foundation went back and revised the stuff? As expected of a draft. Community: We want more openess. Foundation: Here is a draft... Community: But perfect and without errors.
    - serial_dev 3y ago
      Oh just edited my comment, wanted to remove the Rust bit as it could (and it did :)) divert attention. But to respond to your comment: I am not sure if they would have retreated if there wasn't a constant stream of negative coverage on platforms that they do not control (Twitter, YouTube, Twitch, podcasts, blogs). The issue with the draft was that it was extremely out of touch and some were afraid that it wasn't just a small mistake, rather than a direction that the foundation wanted to take, no matter the backlash. If my girlfriend came to me with a draft that she should be able to date the cute barista guy in our local coffee shop and staying in the relationship with me, the fact that it's just a draft would not make me any more confident in the future of our relationship.
  - mattlondon 3y ago
    [dead]
serial_dev 3y ago
I'm sorry, but Occams razor tells me that Google proposed this to further strengthen their monopoly on the web browser market and make sure their ads and tracking cannot be avoided.
- geocar 3y ago
  Seriously. When someone tells you that they don't have a hidden agenda, it means they absolutely have a hidden agenda. Normal people don't say that. > and make sure their ads and tracking cannot be avoided. Exactly. Their ads. They are totally fine with people applying content filters for other companies.
  - ahahahahah 3y ago
    Normal people who are constantly subject to conspiracy theorists accusing them of having hidden agendas will certainly tell you that they don't have a hidden agenda. It's up to you to choose to join the conspiracy nuts or not.
- dizhn 3y ago
  They recently added telemetry to the go tools. The main guy responsible for the change wrote two blog posts first. Then they kept referring to it in the GitHub issue. They were able to thus frame it as if it were an opt-in vs opt-out discussion where everyone agreed that it was obviously necessary. Real people (our peers) kept referring dissenters to the blog posts like it is the Holy Bible.
sgammon 3y ago
I agreed with you, Yoav, when you posted your rant about gRPC and Chrome (because of the trailers debacle). Here was a case where Google prevented innovation at Google for unclear and selfish reasons, to the detriment of the community. You weren't wrong about how that decision was made with too few voices in the room. That decision was made in a vacuum, and Google and the community suffered. WEI is a case where you should apply this same thinking. If the response is resoundingly negative, to the point where the conversation degrades, your counterparty may be trying to signal a deeper level of panic than you acknowledge. The point of people posting legalese-style threats is to get Google to disengage. I think the opponents of this proposal have little interest in talking through it. They see it as a mortal threat to the Open Web, and I'm inclined to agree with them; under this framework, is it not our shared moral obligation to delay, obstruct, or otherwise oppose it by any means possible? As a fan of your previous work, not a hater, I would respectfully implore you to think again.
- ishanjain28 3y ago
  I love your response!
deleted 3y ago
[deleted]
rtpg 3y ago
Since this is here and there is a point made about discussing the technical merits of [0]... can someone explain to me how the WEI stuff isn't easily "faked" by scrapers and the like? I could see this being used in a similar way to user agents (sometimes helpful when working on bugs and fixing them on minor platforms!), but I'm really struggling to see the overall value-add here. I get the politics aspect of it (I think...), but what's the new technical thing being added here? [0]: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/...
- mattlondon 3y ago
  I believe the idea is that an independent third party will cryptographically sign something to attest that the client is legit. So you can't fake that unless you have the third party's private key. If course the question is then, how does the attestation third party ensure you are sending it real information? I've not bothered to read the proposal because I don't care, but I suspect it will require client-side plugins/libraries etc snooping on what is going on kinda like an antivirus thing snoops on things going on.
  - charcircuit 3y ago
    Even if the client is legit someone can just use a web extention or the devtool protocol to navigate to pages and extract text.
    - mattlondon 3y ago
      I think the point is that the server won't send the content if attestation fails So the data isn't there at all - it's not just hidden away behind some JavaScript
      - charcircuit 3y ago
        I'm saying that extentions and developer tools still exist in browsers that will be attested.
ohgodplsno 3y ago
[flagged]
supriyo-biswas 3y ago
This is a terrible take. It is completely understandable from the perspective of Google contributors, as it is the least effort path for them to continue making profits, but shying away from criticism under the guise of “constructive discussion” is a really old tactic, and is well known by other names (such as “sealioning” when the strategy involves irritating the other party with excessive questions).
fantyoon 3y ago
The central issue seems to be that Yoav frames this as a technical discussion. That people are unhappy with how Google tries to achieve the goal. > Focusing on use cases would enable you to distill the essence of the proposal, and potentially propose alternatives that still address them without the bits you find harmful or risky. But I think its obvious from discourse around the proposal that the goal itself is the problem. People aren't "constructively involved", not because they don't know how, they aren't because they don't want to construct anything. They think your goal is bad. They want you to stop.
realusername 3y ago
That whole article sounds like a parody, you can't seriously say that Google is interested in debates and technical merits on web proposals... The Amp disaster being the best example of that. They do what they want according to their corporate goals and those proposals are just poorly made PR after the fact at best.
neilv 3y ago
This article's advice makes more sense to me if I take it as tips for diplomacy as a representative in a high-stakes industry standards forum, where you can't necessarily call it out when someone is trying to pull a fast one. However, when reporting back to your company, you can and must privately call out Machiavellian plots, sabotage, sloppiness, bad technical directions, business conflicts, arrogance, etc., to the people who need to know that's going on. If you're not representing a company, but rather, the public interest, then I guess what role you take might depend partly on the overall ethical temperature of the forum, and what influence you can have. Can you do more good by trying to join the cabal circles, with all the necessary diplomacy? Or can you do more good by speaking candidly in public?
c0l0 3y ago
I feel like I have to repeat this, since so much is at stake here, where it is about the preservation of the web as we know it today, at the peril of having it turned into yet another walled garden: The only way around the dystopia this will lead to is to constantly and relentlessly shame and even harass all those involved in helping create it. The scolding in the issue tracker of that wretched "project" shall flow like a river, until the spirit of those pursuing it breaks, and the effort is disbanded. And once the corporate hydra has regrown its head, repeat. Hopefully, enough practise makes those fighting the dystopia effective enough to one day topple over sponsoring and enabling organisations as a whole, instead of only their little initiatives leading down that path. Not a pretty thing, but necessary.
creatonez 3y ago
The section, "Don't assume a hidden agenda", is a rather irrelevant response to the outrage, because the agenda we don't like is written out in the proposal. It's not hidden, it's rather transparent and it's the dystopian nightmare we want to avoid. From the proposal: > Users often depend on websites trusting the client environment they run in. This trust may assume that the client environment is honest about certain aspects of itself, keeps user data and intellectual property secure, and is transparent about whether or not a human is using it. This trust is the backbone of the open internet, critical for the safety of user data and for the sustainability of the website’s business. > Some examples of scenarios where users depend on client trust include: > Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they're human, sometimes through tasks like challenges or logins. > Users want to know they are interacting with real people on social websites but bad actors often want to promote posts with fake engagement (for example, to promote products, or make a news story seem more important). Websites can only show users what content is popular with real people if websites are able to know the difference between a trusted and untrusted environment. > Users playing a game on a website want to know whether other players are using software that enforces the game's rules. > Users sometimes get tricked into installing malicious software that imitates software like their banking apps, to steal from those users. The bank's internet interface could protect those users if it could establish that the requests it's getting actually come from the bank's or other trustworthy software.
- wcerfgba 3y ago
  Exactly, the agenda is everything. It's very difficult to convince a megacorp to act against its profit motive. The proposal exists within a cultural and economic context, you can't just ignore that.
- realusername 3y ago
  The last one is especially hilarious since ads are the most common vector to install malware.
- 3y ago
Havoc 3y ago
> Don't assume a hidden agenda For google affiliated stuff that ship sailed a long time ago
Zandikar 3y ago
I take real issue with their occams razor comment under "Don't assume a hidden agenda" [0] > it's often safe to assume that Occam's razor is applicable and the reason it is being proposed is that the team proposing it is trying to tackle the use cases the proposal handles Just because something is initially conceived innocently and in response to a purely technical problem does not mean it wont be co-opted by the parent company that has a track record of establishing market hegemonies and anti-competitive practices. Humans didn't split the atom because we wanted to vaporize cities, we were merely curious about the "technical" fabric of reality as a natural pursuit of science. Furthermore, just because you're tasked with working on the technical problems, doesn't mean that technical problems are the only aspects that can or should be considered. It's plain as day how this will have non technical implications, and asserting those should be ignored for any reason - but especially in this context - is frankly insulting. In other words, this seems to be a textbook case of "they were too preoccupied with whether or not they could, they didn't stop to ask if they should." > To be more concrete and clear, personal attacks or threats addressed at the folks working on the platform are not OK We agree on that at least. [0]: https://blog.yoav.ws/posts/web_platform_change_you_do_not_like/#don't-assume-a-hidden-agenda https://blog.yoav.ws/posts/web_platform_change_you_do_not_li...
yoavweiss_ 3y ago
Blog post author here. A few clarifications: * I am not a contributor to the repo, and stepped in as chair on the repo after writing this, to help the engineers contributing to it deal with clear spam & abuse cases. I wrote this post with WEI in mind, but nothing about it is specific to this proposal, and could've been applied to multiple past proposals (and probably future ones), either from Google or from other standards participants. * Political/ecosystem arguments are technical arguments. See https://blog.yoav.ws/posts/web_platform_change_you_do_not_like/#risks https://blog.yoav.ws/posts/web_platform_change_you_do_not_li... * If you're objecting to the goals of the proposal [1], it'd serve you better to outline which goals are objectionable and why. Mozilla folks did a good job at articulating that in https://github.com/mozilla/standards-positions/issues/852#issuecomment-1648820747 https://github.com/mozilla/standards-positions/issues/852#is... A couple of things I should've included in that post and didn't: * It's important to actually read and understand the proposal before objecting to it. For example, WEI has nothing to do with ad-blockers or DRM (in the sense that the content itself is not restricted, unlike EME). It does have real eco-system risks that the proposal would need to address before moving forward. Objecting to the latter makes sense. Objecting to the former is easy to dismiss as a misunderstanding. * At the end of the day, in the case of Chromium, your goal is not necessarily to convince the proposal's proponents, but the API owners [2], many of whom are not Google employees. [1] https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#goals https://github.com/RupertBenWiser/Web-Environment-Integrity/... [2] https://blog.chromium.org/2019/11/intent-to-explain-demystifying-blink.html#:~:text=What%E2%80%99s%20an%20%E2%80%9CAPI%20owner%E2%80%9D%3F https://blog.chromium.org/2019/11/intent-to-explain-demystif... P.S. I'd love to discuss this with y'all like professional adults. Can we do that?
- ashley93 3y ago
  Your P.S. really shows that you are not really acting in good faith here. It might be good to take a step back and think about the reaction people are having. Consider the possibility that the problem might not be that the whole rest of the world is acting like toddlers, but rather that there is something fundamentally and objectively problematic with WEI and that the community is having a very strong negative reaction to it for some good reason.
sgammon 3y ago
I thought Google was going to re-open public commenting on the repo after the weekend. It's now Tues in many parts of the world. Is it going to be opened up again as promised?
ashley93 3y ago
This is an awful, completely non bona fide piece. But I hope that by my upvoting it, people will see it and get a better understanding of the mindset that the engineers behind WEI have, and why this is all so problematic.
FridgeSeal 3y ago
> Don't assume consensus nor finished state If someone presents me with an document proposing their right and ability to punch me in the throat whenever they desire, it’s either, and then when I protest state that it’s ”just a joke bro”, it’s either 1. a bad joke I’m not in on 2. A real and serious proposition Now, when the person making the proposal has a reputation for punching people in the throat, it’s very clearly not the former. > We're all humans No we’re not: one side is a massive corporation with a profit motive and no morals or personhood. They don’t get obfuscate their intent and escape criticism by foisting the actual submission onto some random dev. The devs in question are either implicit with this-in which case they deserve no sympathy, or they are not, and should realise they’re being used as sacrificial lambs. Neither case is reason to use kid-gloves. > Technical grounds This arguments is meaningless in this situation. The proposal is bad on fundamental intent grounds, technical arguments have nothing to do with it. > Considered alternatives Yeah here’s a considered alternative: Don’t do this. There we go, just as much justification and technical validity as the original proposal. Now, as I am reasonable, I will only accept counter arguments in the form of interpretive dance, performed in person, in 15 minutes time, in the sub-basement of my nearest Antarctic station. All other responses are rude and off topic.
- ahahahahah 3y ago
  [flagged]
  - wtfwhateven 3y ago
    https://en.wikipedia.org/wiki/Analogy https://en.wikipedia.org/wiki/Analogy hope this helps :)
difosfor 3y ago
For those like me unaware of the context here: https://www.theregister.com/2023/07/25/google_web_environment_integrity/ https://www.theregister.com/2023/07/25/google_web_environmen...
veave 3y ago
>We're all humans I'm just obeying orders please don't be mean to me :'( :'( :'( :'(
pornel 3y ago
I'm sorry for the Chrome devs to be on the receiving end of the shitstorm. I've met quite a few of them and I know they do care about the Web. But I'm not sure if they realize, being on the inside of Google, just how much goodwill this company has lost on numerous botched UA sniffs, AMP, EME, manifest V3. We've had "we're listening, but we're doing it anyway" before.
tentacleuno 3y ago
> It also doesn't mean that the proposal is "done" and the proposal authors won't appreciate constructive suggestions for improvement. Different proposals may be in different stages of their development, and early stage proposals are often extremely malleable. It's important to note that this is, as of now, much less "malleable" due to it being implemented in Chromium[0]. Personally, it looks like it's just been implemented and then someone has thrown together a standard later. The same person behind the specification has also published a testing suite[1] for the API, too. Pretty damning, if you ask me. [0]: https://source.chromium.org/search?q=getEnvironmentIntegrity&sq=&ss=chromium https://source.chromium.org/search?q=getEnvironmentIntegrity... [1]: https://rupertbenwiser.github.io/wei-wpt/ https://rupertbenwiser.github.io/wei-wpt/

92 points by KoftaBob 3y ago

It’s passive-aggressive as hell and I can tell this guy and the idea as a whole are DOA… like even if this scheme didn’t give off strong Amp vibes, Google is the last company we want spearheading something like this. Stop trying to stay relevant, Google.

superkuh 3y ago
Google has already achieved this goal with their QUIC based HTTP/3. No implementation or use of HTTP/3 lib in any browser can connect to a webserver unless it gets the continued approval of a third party incorporated CA for TLS certs. With a 90 day renewal period that's basically just attestation of content every 90 days. If your site becomes illegal in an area (say, abortion information) then your CA TLS host can be pressured, cert revoked, and your site made unvisitable for all but uber geeks compiling their own HTTP/3 libs with special flags and linking them to $browser manually. There's no way to host a HTTP HTTP/3 site that's visitable. And no one minds. So... Google could have avoided all of this blowback over WEI by simply calling it "HTTPS+ Everywhere" and pretending it helped user privacy only. I'll grant there are a few more TLS CA options than possible WEI attestation options (if they really are to come from the OS vendors like the spec suggests). But not that many more and any legal pressure applicable to one is applicable to all. Both Google WEI and Google QUIC HTTP/3 are terrible and both need opposition or at least mitigation.
- sgammon 3y ago
  Can't you sign your own certificates? Whether people trust those is a different story. WAI is different because it breaks abstraction by asserting based on details which are otherwise invisible to the server.
  - jiggawatts 3y ago
    > Can't you sign your own certificates? Self-signed certificates are banned in HTTP/2 onwards, which is really irritating when it is used for internal server-to-server communications. You have to set up a Root CA certificate and use that to sign a second certificate. It's the same thing but with extra steps.
    - charcircuit 3y ago
      I've never had an issue using HTTP/2 with a self signed cert.
    - creatonez 3y ago
      Huh? Self-signed certificates work with HTTP/2 in every browser I've tried it in, it just uses the usual trust-on-first-use system where you have to click past a warning.
    - sgammon 3y ago
      That's still self-signing. So the extra steps are immaterial to the point.
  - superkuh 3y ago
    You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website. And before anyone goes there, no, setting up your own root CA is not an option. Unless you get can Google/Apple/Mozilla/etc to include your root CA in their browser trust stores it doesn't help a random person visit your website at all.
    - sgammon 3y ago
      That's still self-signing. So the extra steps are immaterial to the point.
    - fruitreunion1 3y ago
      >You can. It's just that no browser that supports HTTP/3 will accept it as a legit endpoint with a valid root. So they won't connect to the HTTP/3 endpoint at all and you won't be able to access the HTTP/3 self-signed website. So long as there's a way to bypass verification or configure the trust store I'm okay with it. Is there official policy stating that this won't be possible or is this prediction? As I understand it the primary reason for this push is that non-technical users too often skip security warnings, but I'm of the position there MUST at least be a way to bypass verification no matter what (through keyboard combos or a configurable trust store).
- Vecr 3y ago
  Has one of the standard open ACME providers ever revoked a cert over content? Hellenic Academic and Research Institutions CA (HARICA) threatened to, but the renewal went through and everything is working fine on my end.
- ahahahahah 3y ago
  > If your site becomes illegal in an area (say, abortion information) then your CA TLS host can be pressured, cert revoked oh please... scare monger more. Like great, let's attach your petty little gripe to something that people care about in order to maybe get them on your side. except you can't show any real examples of it truly applying, so you just have to hint like "oh, this is possible, just imagine".

tgma 3y ago

While I fully understand the feeling of the author being a Googler doing their job, being a cog in the machine and launching something to advance their promo case, would be visibly upset that people who actually care about the outcome are actively fighting their project, I also think from the users' perspective, dealing with a powerful corporation, it is the right thing to do to bury this type of danger as soon as possible. (The piece where the author suggests focusing on "technical arguments" when the issue at hand is fundamentally political is frankly laughable; can't really tell if it is naïveté or deception.)

monkaiju 3y ago
Couldnt agree more, the 'make technical arguments' nonsense when WEI, and many similar issues, arent problematic for technical reason is ridiculous.
charcircuit 3y ago
>The piece where the author suggests focusing on "technical arguments" when the issue at hand is fundamentally political is frankly laughable It is essentially just asking for constructive feedback. When people just say not to do it, insult the author, or make assumptions about the proposal that aren't true the comments are not actionable. Even if an issue is political you can still make a constructive argument on the risks that adopting the proposal has.
- scrollaway 3y ago
  It’s asking for feedback the author knows how to deal with (and disregard). You know, if your government body of choice came up with a terrible idea in a draft bill and enraged the population, it would not be appropriate for them to go on TV and say “the population should offer constructive criticism in the form of legal arguments”. So what the fuck is this guy saying exactly, that you feel is a valid approach to handling public outcry?
  - charcircuit 3y ago
    >It’s asking for feedback the author knows how to deal with (and disregard). Yes, and you can see how many people are being ignored. The article is a guide on how you can avoid being ignored and actually contribute to the process of standardization. >So what the fuck is this guy saying exactly, that you feel is a valid approach to handling public outcry? For example, people may think coming up with legal arguments may be an effective way to engage in the proposal and try to shut it down. The article describes that legal arguments will not be productive.

agilob 3y ago

>That's great!! Getting involved in web platform discussions is essential to ensure it's built for and by everyone. Yes, because Google is known for listening to public and talking to non-organisations without posting conversation killers like "the decision has been made and we're going forward with it. Thanks for your valuable feedback."

serial_dev 3y ago
Yes, organizations love the mealy mouthed, weak feedback on their Github issue tracker because that's easy to ignore. Just say the issue is spammy, or hostile, then close it without addressing any of the issues. What's harder to ignore (though still not impossible) is top articles on Reddit, HN, and even mainstream tech news sites, and a constant coverage on YouTube, podcasts, etc.
- Ygg2 3y ago
  Didn't Rust foundation went back and revised the stuff? As expected of a draft. Community: We want more openess. Foundation: Here is a draft... Community: But perfect and without errors.
  - serial_dev 3y ago
    Oh just edited my comment, wanted to remove the Rust bit as it could (and it did :)) divert attention. But to respond to your comment: I am not sure if they would have retreated if there wasn't a constant stream of negative coverage on platforms that they do not control (Twitter, YouTube, Twitch, podcasts, blogs). The issue with the draft was that it was extremely out of touch and some were afraid that it wasn't just a small mistake, rather than a direction that the foundation wanted to take, no matter the backlash. If my girlfriend came to me with a draft that she should be able to date the cute barista guy in our local coffee shop and staying in the relationship with me, the fact that it's just a draft would not make me any more confident in the future of our relationship.
- mattlondon 3y ago
  [dead]

serial_dev 3y ago

I'm sorry, but Occams razor tells me that Google proposed this to further strengthen their monopoly on the web browser market and make sure their ads and tracking cannot be avoided.

geocar 3y ago
Seriously. When someone tells you that they don't have a hidden agenda, it means they absolutely have a hidden agenda. Normal people don't say that. > and make sure their ads and tracking cannot be avoided. Exactly. Their ads. They are totally fine with people applying content filters for other companies.
- ahahahahah 3y ago
  Normal people who are constantly subject to conspiracy theorists accusing them of having hidden agendas will certainly tell you that they don't have a hidden agenda. It's up to you to choose to join the conspiracy nuts or not.
dizhn 3y ago
They recently added telemetry to the go tools. The main guy responsible for the change wrote two blog posts first. Then they kept referring to it in the GitHub issue. They were able to thus frame it as if it were an opt-in vs opt-out discussion where everyone agreed that it was obviously necessary. Real people (our peers) kept referring dissenters to the blog posts like it is the Holy Bible.

sgammon 3y ago

I agreed with you, Yoav, when you posted your rant about gRPC and Chrome (because of the trailers debacle). Here was a case where Google prevented innovation at Google for unclear and selfish reasons, to the detriment of the community. You weren't wrong about how that decision was made with too few voices in the room. That decision was made in a vacuum, and Google and the community suffered. WEI is a case where you should apply this same thinking. If the response is resoundingly negative, to the point where the conversation degrades, your counterparty may be trying to signal a deeper level of panic than you acknowledge. The point of people posting legalese-style threats is to get Google to disengage. I think the opponents of this proposal have little interest in talking through it. They see it as a mortal threat to the Open Web, and I'm inclined to agree with them; under this framework, is it not our shared moral obligation to delay, obstruct, or otherwise oppose it by any means possible? As a fan of your previous work, not a hater, I would respectfully implore you to think again.

ishanjain28 3y ago
I love your response!

deleted 3y ago

[deleted]

rtpg 3y ago

Since this is here and there is a point made about discussing the technical merits of [0]... can someone explain to me how the WEI stuff isn't easily "faked" by scrapers and the like? I could see this being used in a similar way to user agents (sometimes helpful when working on bugs and fixing them on minor platforms!), but I'm really struggling to see the overall value-add here. I get the politics aspect of it (I think...), but what's the new technical thing being added here? [0]: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/...

mattlondon 3y ago
I believe the idea is that an independent third party will cryptographically sign something to attest that the client is legit. So you can't fake that unless you have the third party's private key. If course the question is then, how does the attestation third party ensure you are sending it real information? I've not bothered to read the proposal because I don't care, but I suspect it will require client-side plugins/libraries etc snooping on what is going on kinda like an antivirus thing snoops on things going on.
- charcircuit 3y ago
  Even if the client is legit someone can just use a web extention or the devtool protocol to navigate to pages and extract text.
  - mattlondon 3y ago
    I think the point is that the server won't send the content if attestation fails So the data isn't there at all - it's not just hidden away behind some JavaScript
    - charcircuit 3y ago
      I'm saying that extentions and developer tools still exist in browsers that will be attested.

ohgodplsno 3y ago

[flagged]

supriyo-biswas 3y ago

This is a terrible take. It is completely understandable from the perspective of Google contributors, as it is the least effort path for them to continue making profits, but shying away from criticism under the guise of “constructive discussion” is a really old tactic, and is well known by other names (such as “sealioning” when the strategy involves irritating the other party with excessive questions).

fantyoon 3y ago

The central issue seems to be that Yoav frames this as a technical discussion. That people are unhappy with how Google tries to achieve the goal. > Focusing on use cases would enable you to distill the essence of the proposal, and potentially propose alternatives that still address them without the bits you find harmful or risky. But I think its obvious from discourse around the proposal that the goal itself is the problem. People aren't "constructively involved", not because they don't know how, they aren't because they don't want to construct anything. They think your goal is bad. They want you to stop.

realusername 3y ago

That whole article sounds like a parody, you can't seriously say that Google is interested in debates and technical merits on web proposals... The Amp disaster being the best example of that. They do what they want according to their corporate goals and those proposals are just poorly made PR after the fact at best.

neilv 3y ago

This article's advice makes more sense to me if I take it as tips for diplomacy as a representative in a high-stakes industry standards forum, where you can't necessarily call it out when someone is trying to pull a fast one. However, when reporting back to your company, you can and must privately call out Machiavellian plots, sabotage, sloppiness, bad technical directions, business conflicts, arrogance, etc., to the people who need to know that's going on. If you're not representing a company, but rather, the public interest, then I guess what role you take might depend partly on the overall ethical temperature of the forum, and what influence you can have. Can you do more good by trying to join the cabal circles, with all the necessary diplomacy? Or can you do more good by speaking candidly in public?

c0l0 3y ago

I feel like I have to repeat this, since so much is at stake here, where it is about the preservation of the web as we know it today, at the peril of having it turned into yet another walled garden: The only way around the dystopia this will lead to is to constantly and relentlessly shame and even harass all those involved in helping create it. The scolding in the issue tracker of that wretched "project" shall flow like a river, until the spirit of those pursuing it breaks, and the effort is disbanded. And once the corporate hydra has regrown its head, repeat. Hopefully, enough practise makes those fighting the dystopia effective enough to one day topple over sponsoring and enabling organisations as a whole, instead of only their little initiatives leading down that path. Not a pretty thing, but necessary.

creatonez 3y ago

The section, "Don't assume a hidden agenda", is a rather irrelevant response to the outrage, because the agenda we don't like is written out in the proposal. It's not hidden, it's rather transparent and it's the dystopian nightmare we want to avoid. From the proposal: > Users often depend on websites trusting the client environment they run in. This trust may assume that the client environment is honest about certain aspects of itself, keeps user data and intellectual property secure, and is transparent about whether or not a human is using it. This trust is the backbone of the open internet, critical for the safety of user data and for the sustainability of the website’s business. > Some examples of scenarios where users depend on client trust include: > Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they're human, sometimes through tasks like challenges or logins. > Users want to know they are interacting with real people on social websites but bad actors often want to promote posts with fake engagement (for example, to promote products, or make a news story seem more important). Websites can only show users what content is popular with real people if websites are able to know the difference between a trusted and untrusted environment. > Users playing a game on a website want to know whether other players are using software that enforces the game's rules. > Users sometimes get tricked into installing malicious software that imitates software like their banking apps, to steal from those users. The bank's internet interface could protect those users if it could establish that the requests it's getting actually come from the bank's or other trustworthy software.

wcerfgba 3y ago
Exactly, the agenda is everything. It's very difficult to convince a megacorp to act against its profit motive. The proposal exists within a cultural and economic context, you can't just ignore that.
realusername 3y ago
The last one is especially hilarious since ads are the most common vector to install malware.
3y ago

Havoc 3y ago

> Don't assume a hidden agenda For google affiliated stuff that ship sailed a long time ago

Zandikar 3y ago

I take real issue with their occams razor comment under "Don't assume a hidden agenda" [0] > it's often safe to assume that Occam's razor is applicable and the reason it is being proposed is that the team proposing it is trying to tackle the use cases the proposal handles Just because something is initially conceived innocently and in response to a purely technical problem does not mean it wont be co-opted by the parent company that has a track record of establishing market hegemonies and anti-competitive practices. Humans didn't split the atom because we wanted to vaporize cities, we were merely curious about the "technical" fabric of reality as a natural pursuit of science. Furthermore, just because you're tasked with working on the technical problems, doesn't mean that technical problems are the only aspects that can or should be considered. It's plain as day how this will have non technical implications, and asserting those should be ignored for any reason - but especially in this context - is frankly insulting. In other words, this seems to be a textbook case of "they were too preoccupied with whether or not they could, they didn't stop to ask if they should." > To be more concrete and clear, personal attacks or threats addressed at the folks working on the platform are not OK We agree on that at least. [0]: https://blog.yoav.ws/posts/web_platform_change_you_do_not_like/#don't-assume-a-hidden-agenda https://blog.yoav.ws/posts/web_platform_change_you_do_not_li...

yoavweiss_ 3y ago

Blog post author here. A few clarifications: * I am not a contributor to the repo, and stepped in as chair on the repo after writing this, to help the engineers contributing to it deal with clear spam & abuse cases. I wrote this post with WEI in mind, but nothing about it is specific to this proposal, and could've been applied to multiple past proposals (and probably future ones), either from Google or from other standards participants. * Political/ecosystem arguments are technical arguments. See https://blog.yoav.ws/posts/web_platform_change_you_do_not_like/#risks https://blog.yoav.ws/posts/web_platform_change_you_do_not_li... * If you're objecting to the goals of the proposal [1], it'd serve you better to outline which goals are objectionable and why. Mozilla folks did a good job at articulating that in https://github.com/mozilla/standards-positions/issues/852#issuecomment-1648820747 https://github.com/mozilla/standards-positions/issues/852#is... A couple of things I should've included in that post and didn't: * It's important to actually read and understand the proposal before objecting to it. For example, WEI has nothing to do with ad-blockers or DRM (in the sense that the content itself is not restricted, unlike EME). It does have real eco-system risks that the proposal would need to address before moving forward. Objecting to the latter makes sense. Objecting to the former is easy to dismiss as a misunderstanding. * At the end of the day, in the case of Chromium, your goal is not necessarily to convince the proposal's proponents, but the API owners [2], many of whom are not Google employees. [1] https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md#goals https://github.com/RupertBenWiser/Web-Environment-Integrity/... [2] https://blog.chromium.org/2019/11/intent-to-explain-demystifying-blink.html#:~:text=What%E2%80%99s%20an%20%E2%80%9CAPI%20owner%E2%80%9D%3F https://blog.chromium.org/2019/11/intent-to-explain-demystif... P.S. I'd love to discuss this with y'all like professional adults. Can we do that?

ashley93 3y ago
Your P.S. really shows that you are not really acting in good faith here. It might be good to take a step back and think about the reaction people are having. Consider the possibility that the problem might not be that the whole rest of the world is acting like toddlers, but rather that there is something fundamentally and objectively problematic with WEI and that the community is having a very strong negative reaction to it for some good reason.

sgammon 3y ago

I thought Google was going to re-open public commenting on the repo after the weekend. It's now Tues in many parts of the world. Is it going to be opened up again as promised?

ashley93 3y ago

This is an awful, completely non bona fide piece. But I hope that by my upvoting it, people will see it and get a better understanding of the mindset that the engineers behind WEI have, and why this is all so problematic.

FridgeSeal 3y ago

> Don't assume consensus nor finished state If someone presents me with an document proposing their right and ability to punch me in the throat whenever they desire, it’s either, and then when I protest state that it’s ”just a joke bro”, it’s either 1. a bad joke I’m not in on 2. A real and serious proposition Now, when the person making the proposal has a reputation for punching people in the throat, it’s very clearly not the former. > We're all humans No we’re not: one side is a massive corporation with a profit motive and no morals or personhood. They don’t get obfuscate their intent and escape criticism by foisting the actual submission onto some random dev. The devs in question are either implicit with this-in which case they deserve no sympathy, or they are not, and should realise they’re being used as sacrificial lambs. Neither case is reason to use kid-gloves. > Technical grounds This arguments is meaningless in this situation. The proposal is bad on fundamental intent grounds, technical arguments have nothing to do with it. > Considered alternatives Yeah here’s a considered alternative: Don’t do this. There we go, just as much justification and technical validity as the original proposal. Now, as I am reasonable, I will only accept counter arguments in the form of interpretive dance, performed in person, in 15 minutes time, in the sub-basement of my nearest Antarctic station. All other responses are rude and off topic.

ahahahahah 3y ago
[flagged]
- wtfwhateven 3y ago
  https://en.wikipedia.org/wiki/Analogy https://en.wikipedia.org/wiki/Analogy hope this helps :)

difosfor 3y ago

For those like me unaware of the context here: https://www.theregister.com/2023/07/25/google_web_environment_integrity/ https://www.theregister.com/2023/07/25/google_web_environmen...

veave 3y ago

>We're all humans I'm just obeying orders please don't be mean to me :'( :'( :'( :'(

pornel 3y ago

I'm sorry for the Chrome devs to be on the receiving end of the shitstorm. I've met quite a few of them and I know they do care about the Web. But I'm not sure if they realize, being on the inside of Google, just how much goodwill this company has lost on numerous botched UA sniffs, AMP, EME, manifest V3. We've had "we're listening, but we're doing it anyway" before.

tentacleuno 3y ago

> It also doesn't mean that the proposal is "done" and the proposal authors won't appreciate constructive suggestions for improvement. Different proposals may be in different stages of their development, and early stage proposals are often extremely malleable. It's important to note that this is, as of now, much less "malleable" due to it being implemented in Chromium[0]. Personally, it looks like it's just been implemented and then someone has thrown together a standard later. The same person behind the specification has also published a testing suite[1] for the API, too. Pretty damning, if you ask me. [0]: https://source.chromium.org/search?q=getEnvironmentIntegrity&sq=&ss=chromium https://source.chromium.org/search?q=getEnvironmentIntegrity... [1]: https://rupertbenwiser.github.io/wei-wpt/ https://rupertbenwiser.github.io/wei-wpt/