4 ms·

A good and measured article marred only by a silly, clickbait title. Unless there is a plan to allow attesters that are independent bodies then this is absolut

A good and measured article marred only by a silly, clickbait title. Unless there is a plan to allow attesters that are independent bodies then this is absolutely a threat to the open internet, or what's left of it. The biggest dead canary for me is the lack of calling this out explicitly by Google or Apple. We're left to assume that Google is hand-wavingly saying "don't worry we can take care of that" when the private companies already monopolizing parts of the Internet are the absolute last people we want handling attestation.

jackdaniel 3y ago
even assuming unbiased and objective attesters, the issue lies with the "baseline criteria" of attestation and who defines them. There are two risks here (examples follow): 1. hostile requirements - "the agent won't feature adblockers", or "scraping without explicit website permission must be forbidden" 2. prohibitive requirements - "the agent implements protocols X, Y and Z and adheres to standards A, B and C" - all of these may be reasonable things, but en masse they may be too much work to carry by anyone but a reasonably big vendor Additionally these criteria must be verifiable, so user can't basically modify the agent, because then the attestation is practically void.
- KnobbleMcKnees 3y ago
  Absolutely. Independent bodies don't solve the other myriad issues with attestation, but they don't add the ones that corporate interests do either.
heisenbit 3y ago
What is wrong when walking into a web shop with disclosing how much money you earn and may be able to part with?
- smeej 3y ago
  It terrifies me that I'm actually unsure whether this comment is sarcastic.
  - civilitty 3y ago
    On HN Poe’s Law can always be assumed in the affirmative.
  - heisenbit 3y ago
    Rest assured it is sarcastic. It is terrifying because you start sensing what power shift that is. And it is not theoretical in the slightest, my wife starts complaining about dynamic pricing in web shops where she used to find deals at seasons end. Or what is wrong with meeting politicians what have always a very good brief in their hands telling them what words have maximum impact on the small group before them? It seems to work looking at the increasing number of spineless chameleons.
    - smeej 3y ago
      I think for me it's terrifying because it sounds like the same line of reasoning as, "Why should I care about encryption? I don't have anything to hide," and people say (and mean) that a LOT. So many people genuinely don't understand what would be wrong with this scenario, and that's why I'm afraid.
- bloopernova 3y ago
  Obviously this is awful, but I wanted to share some organizations could use that as a bad pattern: "Oh, this area of $hot_social_media_site is for people earning ($user_salary * 1.4). But you can get access for just $10/month paid monthly or $9/month paid a year in advance! You don't want to be left out and lose the chance to network with higher earners, do you?!?"
px43 3y ago
[flagged]
- RajT88 3y ago
  > A simple example would be just rejecting ad-blocking extensions from their Chrome store. They've never done anything close to that (including all the manifest v3 hullabaloo where they explicitly worked with ad-blocking teams to help them migrate) so who in their right mind would think that they would try to sneak it in via some fancy new web standard that wouldn't even be able to effectively block ad-blocking if it wanted to. Like, perhaps like if they didn't allow any extensions on their mobile browsers? (Note: You can't use extensions on Chrome on mobile devices)
  - px43 3y ago
    Brave is on the Play store (it's what I use on Mobile), as are several other browsing options with built in ad-blocking support. Chrome Mobile is very stripped down, but the idea that they disabled all extensions just to get at ad-blockers is completely unfounded.
    - RajT88 3y ago
      "Brave is on the play store" is a very similar argument to "You do not have to use IE, you can install Netscape". And subject to the same logical holes.
      - px43 3y ago
        Why? If it were a browser extension, you would still have to install that manually too. Are you mad that Google doesn't ship ad-blocking functionality by default in their standard build?
        RajT88 3y ago
        Google - a company that makes most of its money on ads - removed the ability to install ad blocking extensions on the default mobile browser for over 2 billion devices. If that does not seem shady to you, then I will be unable to make you understand the point.
fooyc 3y ago
Consider this scenario: - Content sites implement Web Integrity API to block bots - But they still allow Google crawlers, because Google is their source of traffic - Google competitors are locked out How do attesters solve this problem?

jackdaniel 3y ago

even assuming unbiased and objective attesters, the issue lies with the "baseline criteria" of attestation and who defines them. There are two risks here (examples follow): 1. hostile requirements - "the agent won't feature adblockers", or "scraping without explicit website permission must be forbidden" 2. prohibitive requirements - "the agent implements protocols X, Y and Z and adheres to standards A, B and C" - all of these may be reasonable things, but en masse they may be too much work to carry by anyone but a reasonably big vendor Additionally these criteria must be verifiable, so user can't basically modify the agent, because then the attestation is practically void.

KnobbleMcKnees 3y ago
Absolutely. Independent bodies don't solve the other myriad issues with attestation, but they don't add the ones that corporate interests do either.

heisenbit 3y ago

What is wrong when walking into a web shop with disclosing how much money you earn and may be able to part with?

smeej 3y ago
It terrifies me that I'm actually unsure whether this comment is sarcastic.
- civilitty 3y ago
  On HN Poe’s Law can always be assumed in the affirmative.
- heisenbit 3y ago
  Rest assured it is sarcastic. It is terrifying because you start sensing what power shift that is. And it is not theoretical in the slightest, my wife starts complaining about dynamic pricing in web shops where she used to find deals at seasons end. Or what is wrong with meeting politicians what have always a very good brief in their hands telling them what words have maximum impact on the small group before them? It seems to work looking at the increasing number of spineless chameleons.
  - smeej 3y ago
    I think for me it's terrifying because it sounds like the same line of reasoning as, "Why should I care about encryption? I don't have anything to hide," and people say (and mean) that a LOT. So many people genuinely don't understand what would be wrong with this scenario, and that's why I'm afraid.
bloopernova 3y ago
Obviously this is awful, but I wanted to share some organizations could use that as a bad pattern: "Oh, this area of $hot_social_media_site is for people earning ($user_salary * 1.4). But you can get access for just $10/month paid monthly or $9/month paid a year in advance! You don't want to be left out and lose the chance to network with higher earners, do you?!?"

px43 3y ago

[flagged]

RajT88 3y ago
> A simple example would be just rejecting ad-blocking extensions from their Chrome store. They've never done anything close to that (including all the manifest v3 hullabaloo where they explicitly worked with ad-blocking teams to help them migrate) so who in their right mind would think that they would try to sneak it in via some fancy new web standard that wouldn't even be able to effectively block ad-blocking if it wanted to. Like, perhaps like if they didn't allow any extensions on their mobile browsers? (Note: You can't use extensions on Chrome on mobile devices)
- px43 3y ago
  Brave is on the Play store (it's what I use on Mobile), as are several other browsing options with built in ad-blocking support. Chrome Mobile is very stripped down, but the idea that they disabled all extensions just to get at ad-blockers is completely unfounded.
  - RajT88 3y ago
    "Brave is on the play store" is a very similar argument to "You do not have to use IE, you can install Netscape". And subject to the same logical holes.
    - px43 3y ago
      Why? If it were a browser extension, you would still have to install that manually too. Are you mad that Google doesn't ship ad-blocking functionality by default in their standard build?
      - RajT88 3y ago
        Google - a company that makes most of its money on ads - removed the ability to install ad blocking extensions on the default mobile browser for over 2 billion devices. If that does not seem shady to you, then I will be unable to make you understand the point.

fooyc 3y ago

Consider this scenario: - Content sites implement Web Integrity API to block bots - But they still allow Google crawlers, because Google is their source of traffic - Google competitors are locked out How do attesters solve this problem?