37 ms·

Google is already pushing WEI into Chromium

• siquick 3y ago
  Is Brave browser safe from this considering it uses Chromium?
  • lagrange77 3y ago
    I guess they could un-cherrypick this 'feature', but that doesn't mitigate google or publishers requiring a response from this API, in order to serve a request.
• topshelf 3y ago
  Disappointing to see such a 180 on 'don't be evil'. I'm recommending Mozilla Firefox to all friends and family.
  • fps_doug 3y ago
    I do, and I keep having those tiring conversations, but it's really hard to get the point across in layman's terms. I have enough friends in tech who stick with Chrome out of convenience instead of just falling back on it in case something actually doesn't work in Firefox. how do I convince tech illiterate people of doing this?
    • erklik 3y ago
      It's faster. The same old justification that was used to switch to Chrome can now be used for Firefox.
    • AdamN 3y ago
      For the tech illiterate recommend Safari. For tech people, appeal to their privileged position and the importance of defending the web by choosing any other browser (or Safari). Both users can keep Chrome installed as a fallback - that will help with convincing too.
      • suslik 3y ago
        And drop my Ublock origin, bypass paywall clean, etc? Hell no.
        • timeon 3y ago
          > Ublock origin At least there is Adguard.
      • JohnFen 3y ago
        > For the tech illiterate recommend Safari. That's only applicable to Apple users, though.
        • AdamN 3y ago
          Tech illiterate people should be using MacOS anyway. Windows just gets worse every year. MacOS is actually more like classic Windows than Windows 11 is so it's actually easier to use for tech illiterate people.
      • freedomben 3y ago
        Didn't Apple implement this same type of thing in Safari a year or so ago?
    • jckahn 3y ago
      You can’t, realistically. I don’t think there’s any repeatable or effective way to make non-nerds (AKA most people) care about this sort of thing.
    • Buttons840 3y ago
      Start referring to them as "Chrome developers" -- what's this "web" thing you keep talking about?
    • _urvc 3y ago
      Whenever a new device needs to be setup for my parents, I just install whatever I use (Firefox in this case). Then I show them the things they need on a day by day basis. The problem are people who did grow up with tech. They will say things like it will take too long. In cases like this you need to manipulate them based on their personality.
  • baybal2 3y ago
    [dead]
  • maxloh 3y ago
    Unfortunately Firefox doesn't have a good UI/UX after all. The last time I checked, multiple profiles support is somehow half-baked.
    • wsgeorge 3y ago
      Not sure why you're getting downvoted, but this is a big deal IMO. We're here because Chrome has been the better product for a long time. Firefox not doing things people want well enough will hurt its adoption, which will impact its capacity to influence the Web. Add to Mozilla's perceived not-very-good management and you have a death spiral on your hands, and more power to Google and Apple to shape the Web towards their interests. FWIW, first-class profiles support matters a lot: https://medium.com/sort-of-like-a-tech-diary/profiles-the-one-thing-firefox-needs-to-get-right-a769dcfb124f https://medium.com/sort-of-like-a-tech-diary/profiles-the-on...
      • pndy 3y ago
        Mozilla in the past ignored the criticism users had regarding UI/UX changes and went with deploying this bulky mobile-oriented interface for desktops. And here we are. This itself is one issue; there are also all sorts of adventures they decide to go for little to not at all related to the browser development, and which are conducted to convince people all around the world that they're a good humane corporation that cares. Igh.
    • mozball 3y ago
      Multiple profiles is fully supported. It's just hidden behind a clunky UX. Also check out firefox containers which is to profiles what docker is to virtual machines.
      • luuurker 3y ago
        Containers are useful, but it's like having a few similar terminal windows open. Eventually you'll type something on the wrong window... at least I found myself searching for personal stuff on my work Google container. With profiles I can have different bookmarks, extensions, and even a different theme so I'm aware I'm on my personal profile, not on a work profile. Since switching profiles on Firefox + macOS is a pain in the butt, I use 2 different Firefox channels (stable + dev). Anyway, containers are nice, but they're not a replacement for profiles.
  • slowmovintarget 3y ago
    I was just able to finally move my wife back to Firefox. Chrome just stopped working on her Mac. Wouldn't pull up a page. Everything else worked. She's now happily using Firefox with a non-hobbled version of uBlock Origin.
    • smolyeet 3y ago
      I don’t think this indicative of chrome being bad on Mac. What did you try to resolve the issue? Because I could say chrome always works for me (which would be true in my experience), but that doesn’t mean it always does.
      • slowmovintarget 3y ago
        Clearing all state (all saved data and cookies), Incognito mode, disabling the few extensions she was running. When it got to the point where the only thing left to do was reinstall Chrome, we installed Firefox instead.
• lemper 3y ago
  this is where you should vote with your wallet and feet. and I think it's not really a stretch to ask Google's engineers who work on chrome/ium to get a job somewhere else.
  • djaychela 3y ago
    I think it would be interesting to get their views on it. I wouldn't be surprised if a lot think this is a good idea. Not that I agree, but I think it's unlikely that everyone sees it the same way as those outside the organisation.
    • fps_doug 3y ago
      Obviously, if you get paid to implement this you don't want the cognitive dissonance of knowingly doing something bad, so I'm sure those folks have already laid out their justification for this technology. I wish Google could and would make Chrome closed source. It would at least give all those rebranded Chromiums (Opera, Vivaldi, Brave) a strong reason to reconsider their choice of engine, or at least maybe work together on a more divergent fork of it that stays away from Google's evil stuff.
    • serial_dev 3y ago
      "It is difficult to get a man to understand something, when his salary depends upon his not understanding it". I imagine it's hard to push back against it even internally. Not to be jaded, but one or two people raising a stink about it will only achieve them screwing up their career prospects within Google.
      • Silhouette 3y ago
        A cynic might observe that the tech sector - and US big tech in particular - has just seen the biggest round of layoffs that many of the developers in that market will remember. Many of those same developers might have been thinking even 18 months ago that their extremely high compensation was guaranteed because finding another extremely well compensated job was easy. Now they know better and I'm sure a lot of people are scared. Seems like a good time for management to push bad ideas that their remaining employees might not like.
• ailef 3y ago
  Can somebody explain what are the practical implications of this?
  • gostsamo 3y ago
    If adopted by publishers, the web will be closed to everyone but allowed browsers on allowed OSes on allowed hardware. No ad blockers, no extensions, no customizations beyond what the few chosen browsers allow explicitly.
    • criddell 3y ago
      I have a website so I guess that makes me a publisher. Say I wanted to block Chrome on Windows and Firefox on Debian? How would I use this?
      • gostsamo 3y ago
        The browser would provide an api which returns a signed token which will be confirmed by an atestation authority.
  • jedisct1 3y ago
    [flagged]
  • csomar 3y ago
    You'll need an "approved" browser and potentially "approved" hardware to access the web. Since Cloudflare is on this too, most of the web will be locked for anyone who doesn't use mainstream hardware.
    • leesalminen 3y ago
      But why do they care so much about this? Is it only for DRM on media playback?
      • Aaargh20318 3y ago
• c0l0 3y ago
  I feel like I have to repeat this, since so much is at stake here, where it is about the preservation of the web as we know it today, at the peril of having it turned into yet another walled garden: The only way around the dystopia this will lead to is to constantly and relentlessly shame and even harass all those involved in helping create it. The scolding in the issue tracker of that wretched "project" shall flow like a river, until the spirit of those pursuing it breaks, and the effort is disbanded. And once the corporate hydra has regrown its head, repeat. Hopefully, enough practise makes those fighting the dystopia effective enough to one day topple over sponsoring and enabling organisations as a whole, instead of only their little initiatives leading down that path. Not a pretty thing, but necessary.
  • em1sar 3y ago
    [dead]
  • doliveira 3y ago
    Yeah, financial and social pressure is basically the only weapons we have against corporations when regulations don't exist. And honestly, financial pressure doesn't work at this scale or in this case.
    • mwint 3y ago
      Regulation is just social pressure enforced by guns.
    • jjoonathan 3y ago
      Yes, but this will be an uphill battle. Every campaign must be financed, so every politician must effectively be vetted by monied interests. The same monied interests that we see here on a strategic offensive against the rest of us. Regulators will tend to be sympathetic to them, not us, until things get really bad. Is EFF still the place to send money?
      • Brian_K_White 3y ago
        I think so. I don't know of any better.
• cmrdporcupine 3y ago
  Is adding a feature-flag really the same as pushing the feature into the browser immediately? It can easily just be part of a SWE needing the flag in place in order to continue work without impacting anything else, even if that thing never ever launches. In general Google engineers don't tend to work on branches, especially long-running ones. Incremental small code reviews are the expectation. The general process would be to stick things securely behind flags and continue development without turning it on, even if it never ever launches. Not saying this work should be done -- it shouldn't -- but code being pushed is not the same as "we're going to make this happen tomorrow, no matter what."
  • orlp 3y ago
    > Is adding a feature-flag really the same as pushing the feature into the browser immediately? "Don't mind me guys, I'm barely boiling the frog."
  • knaik94 3y ago
    Yes, because a feature flag shows intent to implement it before any real discussion have taken place with privacy and non-corporate security advocates.
  • BlargMcLarg 3y ago
    When was the last time you heard Google or anything Google-related backing down from getting their paws in deeper? It's no longer a fallacy when there's a sign next to the slippery slope.
    • jvolkman 3y ago
      https://killedbygoogle.com/ https://killedbygoogle.com/
      • gmerc 3y ago
        That’s backing down from responsibility not from doing the wrong thing. We can add www to the list.
    • 3y ago
• wasmy 3y ago
  Another tame article in The Register: https://www.theregister.com/2023/07/25/google_web_environment_integrity/ https://www.theregister.com/2023/07/25/google_web_environmen... Despite the spec's half-baked state, the blowback last week was swift – in the form of a flood of largely critical comments posted to the WEI GitHub repository, and abuse directed at the authors of the proposal. The Google devs' response was to limit comment posting to those who had previously contributed to the repo and to post a Code of Conduct document as a reminder to be civil. The usual way to deal with opposition these days.
  • ben_w 3y ago
    Limiting posting and asking for civility is the only way for individuals to meaningfully engage with even a mere thousand others. Nothing about the human mind was meant for social internet at the scale of the internet, where there are more distinct voices than you have heartbeats in a lifetime.
    • notpachet 3y ago
      > more distinct voices than you have heartbeats in a lifetime Quotable!
    • ynniv 3y ago
      Yes, and the response should be to make the repo private. Only allowing interactions from previous contributors to a public repo is disingenuous.
      • ben_w 3y ago
        My expectation is that private is worse for any public involvement in any discussion because nobody else can see it, and also likely to get them yelled at more via other channels, and also lead to the assumption that they "have something to hide".
  • btown 3y ago
    Also worth noting that this locks reactions (thumbs up, hearts, etc.) - providing plausible deniability that "only a small number of people raised concerns about specificTopicX." Journalists should be more aware of this! On a separate note, for journalists and others who wish to communicate with the spec's author directly, his public website (which lists a personal email) is one of the other repos on the Github profile under which the specification was published. It's painfully absurd that he wrote this sentence in 2022 [0]: > I decided to make this an app in the end. This is where my costs started wracking up. I had to pay for a second hand macbook pro to build an iOS app. Apple’s strategy with this is obvious, and it clearly works, but it still greatly upsets me that I couldn’t just build an app with my linux laptop. If I want the app to persist for longer than a month, and to make it easy for friends to install, I had to pay $99 for a developer account. Come on Apple, I know you want people to use the app story but this is just a little cruel. I basically have to pay $99 a year now just to keep using my little app. [0] https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-own-app-on-my-iPhone.html https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-...
• deleted 3y ago
  [deleted]
• mozball 3y ago
  If this isn't the straw that breaks the camel's back, there is never going to be one. Google needs to be broken up. They own the browser market. They own the web (through Adwords). They own Search. They own mobile. They own most of the video sharing market with 2.5 billion monthly annual users. They own a good chunk of email with 1.2 billion monthly annual users. They have amassed an incomprehensible amount of power and influence over humanity and they have proven repeatedly that they are willing to use that power to the detriment of humanity and to entrench themselves further. Google needs to be broken up.
  • px43 3y ago
    Google broke itself up in 2015. What are you even asking for here? Chrome and Android are open source, and there are several forks of both thriving in the ecosystem. Yeah it would be cool if there was a decent open source alternative to GMail and Drive, but no one else seems to have figured out how to get the incentives right for something like that.
    • troupo 3y ago
      That "incentive" for Google is "80% of our revenue comes from ads". Google's open source projects are open in name only.
      • px43 3y ago
        > Google's open source projects are open in name only. The link at the top of the page is pointing to the GitHub repo, where you can see literally over a million contributions from thousands of people working at hundreds of companies: https://github.com/chromium/chromium/commits/main https://github.com/chromium/chromium/commits/main I've worked on both Chrome and Android (Chromium and AOSP) professionally, and never worked at Google.
        • jsjohnst 3y ago
          You and GP both can be right depending on definition used for “open source”.
• ep103 3y ago
  And also, to switch back to Firefox
  • PedroBatista 3y ago
    Who has been mismanaged for at least a decade and depends on Google to pay their bills.. I'm a FF user since the early 00's and Firefox will mostly not go away because Google has an interest in using it against monopoly accusations but the reality is bleak.. And the reality is these people ( Google in this case ) are so far removed from any moral compass about the Web ( at least what most people here think of "the Web" ) that it's near impossible to do anything about it. These companies are huge and from top to bottom there are certain groups that are hired guns to do a job, no matter what "job" it is, they'll do it, achieve those KPIs, get promoted, get paid. Even for their own detriment in the future, it doesn't matter. Big money now, screw the rest. Btw, this is how every big company operated since forever, the only "news" here is the disproportionate impact their acts do to the World due to their huge size and influence.
    • bee_rider 3y ago
      I hear Firefox is mismanaged all the time, but it seems to be a perfectly fine browser for the most part. I hear all about sites that won’t render in comments on this website, but they must all be internal tools or something because I never encounter them.
      • MildRant 3y ago
        I sparingly run into sites that don't render properly on Firefox but they do exist. As an example, Ticketmaster's account page has problems on Firefox that I don't get on Chromium.
        • bee_rider 3y ago
          Firefox is helping you, Ticketmaster is evil.
• makingstuffs 3y ago
  Is it just me or does this sound a lot like the DPOS solutions offered by many scammy ponzis under the name of a blockchain/cryptocurrency?
• pluc 3y ago
  This is a crisis of our own making. You don't want Google taking decisions for the web at large? Then don't let them own 85% of the browser market share. When that's the case they don't need W3C or anything to implement whatever they want, they effectively control the client-side internet.
  • j1elo 3y ago
    It's proven that mass marketing works. Tell me how a minority of informed and caring users can avoid on their own that a single large scale bad actor pours millions over millions of dollars to convince the uninformed masses about whatever they want. It even happens in actual elections when some factions use misinformation campaigns to alter the average voter's perception! So not an easy task to solve without help.
    • pluc 3y ago
      Totally. In most things, you need to have the ability to trust that users will make (or at least see) the right choice even over multi-million marketing initiatives. Given today's people and today's marketing, I'd say we're properly fucked.
    • Dalewyn 3y ago
      >Tell me how a minority of informed and caring users can avoid on their own that a single large scale bad actor pours millions over millions of dollars to convince the uninformed masses about whatever they want. Firefox. No, not Firefox of today; I'm talking about Firefox 20 years ago that defeated IE6 by sheer force of nerds alone. Of course, the landscape is vastly different now and Firefox today is about the most not-nerd thing next to Chrome. If there's a a browser here to save us anywhere, I'm not seeing it.
      • arp242 3y ago
        > Firefox 20 years ago that defeated IE6 by sheer force of nerds alone. Firefox was significantly better than IE though: it was faster, had more features, and things like that. This is what made Firefox popular, not "sheer force of nerds". Chrome, when released, also had some significant improvements to Firefox. In particular, it was loads faster. This changed with "Firefox Quantum" (59 IIRC), but "too little, too late" I guess.
• knaik94 3y ago
  Since Google controls the implementation and the featureset of this API, they are effectively controlling the entire chain of access. Having open source implementions does not make a difference, because a Google, or implementing website, server will control whether the content is served. Having the mechanism of access open sourced makes no difference in this situation. It is the same situation with the "latent" passkey attestation mechanism. Apple and Google have general guidelines that the feature will not be used, but that only true currently. This should not be part of the browser for the same as with passkeys, it gives corporations final say in what you are allowed to use.
• doliveira 3y ago
  I was watching a video about nesting in CSS and how it's just in Chrome and comments were all about how cool it is and how they can't wait to use it, and so on, and so forth. I think it's quite a representative example: we can do that much better with SASS today, but I guess Google needs to keep features pushing at full speed so no one else can keep up. We developers are so gullible. Just give us some shiny things and we don't even realize they're heating up the pan.
  • JimDabell 3y ago
    > I was watching a video about nesting in CSS and how it's just in Chrome Nested CSS is supported in the latest version of all major browsers. https://caniuse.com/css-nesting https://caniuse.com/css-nesting
    • Izkata 3y ago
      It will be supported in Firefox 117, the latest release is 115 and needs you to manually enable a feature flag. The center row of versions with the gold border is how caniuse indicates the current release.
      • JimDabell 3y ago
        Thanks for the correction! I hovered over the green box for Firefox 117 and it said “Released”. I see now that for browser versions that have actually been released, it says “Released <release date>” and it’s just a very misleading bug because all unreleased browser versions will just say “Released”.
    • doliveira 3y ago
      That's not the point...
• londons_explore 3y ago
  One of the proposals for WEI is to make it probabilistically fail. Ie. on a given device, for 10% of websites, WEI pretends to be unsupported. That means websites can't deny service where WEI is unsupported. Yet it still allows statistical analysis across bulk user accounts. If WEI was implemented like this, I would support it as being good for the web ecosystem.
  • phpnode 3y ago
    This is the bait to make it sound reasonable. Of course this hold-back feature will be quietly disabled at some point in the future. The whole proposal is full of weaselly half truths and misrepresentation about their real plans
    • londons_explore 3y ago
      > this hold-back feature will be quietly disabled at some point in the future. Will it though? Googles main reason for WEI I assume is to combat ad-fraud. Ie. to prevent someone making a bot farm to click ads to earn money from advertising or exhaust competitors ad budgets or manipulate search engine user ranking signals. With WEI, all ad clicks without WEI could just be ignored (ie. not billed to advertisers, ignored when calculating statistics and signals). If 10% of clients have WEI 'cloaking', you just inflate the final advertising bill by 10% to account for those users - the end result is the same as billing for all real users and no bots. WEI still achieves all of Googles goals even with cloaking.
      • phpnode 3y ago
        As the middle man Google benefits from ad-fraud and has few incentives to really stop it. Ad-blocking is a real problem for them however, and they have huge incentives to prevent that. Ignore what they say - that's what WEI is actually about.
        • londons_explore 3y ago
          Googles main business is ads on google search. Here they aren't a middle man. Companies give google $X, and hopefully sell Y extra products. X/Y is the cost per sale. Google competes with other advert forms (eg. TV/radio/newspaper ads) on that X/Y number. If there is ad fraud, that Y number gets decreased (budget is used up on fraud that doesn't translate to sales), and their revenue decreases as advertisers spend their ad budget on other mediums.
• _fat_santa 3y ago
  Not a lawyer but this seems ripe for antitrust action. Microsoft got sued back in the 2000's for simply bundling IE with their operating system. The behavior of Google (and quite frankly Microsoft with Edge) seems way way worse than whatever MS was doing when they got sued.
  • hot_gril 3y ago
    But MS still bundles IE, and they've gotten more pushy about it lately.
• andy99 3y ago
  Has anyone come across a good nontechnical summary that could be shared more broadly? Edit: the Register article linked elsewhere looks as good as it gets for now https://www.theregister.com/2023/07/25/google_web_environment_integrity/ https://www.theregister.com/2023/07/25/google_web_environmen...
• deleted 3y ago
  [deleted]
• blacklight 3y ago
  I'm sick of these guys trying to break the web. From now on it's personal. We need to make sure that Google gets very hurt, and ideally they are wiped out from our industry.
• lagrange77 3y ago
  Apple would be in the position to fight this.
  • luuurker 3y ago
    "Apple already shipped attestation on the web, and we barely noticed" https://news.ycombinator.com/item?id=36862494 https://news.ycombinator.com/item?id=36862494
    • lagrange77 3y ago
      D'oh!
    • progbits 3y ago
      And somehow this barely registers on HN, there have been over thousand comments on WEI this week, this was mentioned maybe in 5 (few of them mine - yes I'm repeating this point because it is important). Attestation bad. Chrome is just catching up to what Safari is already doing, with in fairness more open standard. We need to kill both.
  • andersa 3y ago
    All of the major tech companies are in on this. Google and Apple already deployed it for their phone and desktop platforms (iOS, Android, macOS, ChromeOS, all support attestation already). Microsoft is getting there with Windows 11, and all new devices shipping since ~2015 have the hardware support. Google is now closing the gap on desktop browsers. Soon the percentage of people supporting it will be high enough to make it mandatory - the last 5% can just get a new device or something like that. They'll do it when their bank website tells them so. The day Cloudflare flips the switch to require it for all connections is the day the open web dies.
    • lagrange77 3y ago
      Thanks for the info, i wasn't aware of that at all. > They'll do it when their bank website tells them so. Right. > The day Cloudflare flips the switch to require it for all connections is the day the open web dies. Makes sense and unfortunately seems realistic.
• fnordpiglet 3y ago
  This is googles answer to the threat LLM pose to their search engine - cement their ad business into the core protocols.
• adontz 3y ago
  Is there no EU regulation against this?
  • andersa 3y ago
    Careful, with the right arguments from Google the EU might just make this mandatory in the name of "security".
    • sgjohnson 3y ago
      And if they prohibit it, Google will just pay a several billion dollar fine. At the end of the day, it's just a cost of doing business. Something like an extra 2% tax raise or something. Whatever. Dividend time.
  • mardifoufs 3y ago
    The EU is at the forefront of wanting only "real people" online. So no, if anything digital identity is squarely within what would appease the EU
• itissid 3y ago
  I am a bit confused. This sounds a bit stupid. If this is DRM for web content, then what would non chrome browsers like FF for web pages that ask for such authentication? Refusing to work with other browsers than chrome seems like a lawsuit waiting to happen. [1]https://arstechnica.com/gadgets/2023/07/googles-web-integrity-api-sounds-like-drm-for-the-web/ https://arstechnica.com/gadgets/2023/07/googles-web-integrit...
• thesuperbigfrog 3y ago
  It looks like they do not care if they have consensus or approval for WEI, they are implementing it regardless. Wherever you live, you should contact your government representatives and regulators and put a spotlight on this issue for what it is--monopoly abuse of power. Grassroots efforts are great and it is good to let your friends, family, and associates know what they are doing and why it is wrong. However, government regulation of this abuse is needed to stop it by force of law.
  • andersa 3y ago
    Why do you think they don't have consensus or approval from all the people that matter? This is far too big for that. Google, Apple, Microsoft, Cloudflare, etc, are all working together on this. Governments will like it for "security", and 99% of users won't care.
    • jmvoodoo 3y ago
      That looks an awful lot like a cartel.
      • derefr 3y ago
        No, this is how industries work. The slaughterhouse industry body does not ask the cows for their opinion.
    • calgarymicro 3y ago
      > Google, Apple, Microsoft, Cloudflare, etc, are all working together on this. Are they? Is there any evidence those companies support the proposal? I haven't seen any statements to that effect, but I might have missed something.
      • andersa 3y ago
        Perhaps this specific proposal is only Google's doing, but the concept in general, absolutely. For example, these provide essentially the same attestation service for native apps consuming APIs, validating that the phone is not rooted, and the OS and app are unmodified: https://developer.android.com/google/play/integrity https://developer.android.com/google/play/integrity https://developer.apple.com/documentation/devicecheck/ https://developer.apple.com/documentation/devicecheck/ Apple and Cloudflare combined to take it to the browser last year and basically no one noticed: https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ https://blog.cloudflare.com/eliminating-captchas-on-iphones-... Of course that will be hooked up to Google's new thing as soon as possible! Microsoft has also been preparing it with the whole TPM integration in Windows 11 and mandatory inclusion of such hardware in all prebuilt PCs since ~2015. That's what the Chromium integration builds on - Google can't actually do the foundation for this themselves on Windows. You can absolutely bet that all of these companies are on board with whatever Google is doing.
• throw_m239339 3y ago
  The web stopped being open when W3C accepted EME. Now that effectively Google IS the web, they don't even have fake attempting to convince anybody and will just turn the web into another proprietary technology.
  • tzs 3y ago
    > The web stopped being open when W3C accepted EME The web was more open when to play those videos you had to use a proprietary Flash or Silverlight plugin?
    • throw_m239339 3y ago
      > The web was more open when to play those videos you had to use a proprietary Flash or Silverlight plugin? That's what you are claiming with your sarcasm hidden behind a rhetorical question, I've never said anything about Flash or Silverlight in the comment you've answered to. There is absolutely no difference from a conceptual perspective between EME implementation and proprietary plugins, EME is necessarily based on a proprietary spyware, but you can't fathom that fact apparently.
      • asadotzler 3y ago
        Flash wasn't just DRM though. Incorporating video and animations into the web proper through browser was a win for the web despite the bitter pill of not ridding ourselves of DRM.
        • throw_m239339 3y ago
          > Flash wasn't just DRM though. Incorporating video and animations into the web proper through browser was a win for the web despite the bitter pill of not ridding ourselves of DRM. DRM as implemented by EME is necessarily a closed source, proprietary plugin just like Flash, I never said that Flash was just a DRM. Flash could be used as DRM system, in fact its video format FLV supported DRM.
      • 3y ago
• cosmaioan 3y ago
  maybe it's their IE6 moment.
• gmerc 3y ago
  Stop contributing to chromium. Fork it.
  • guerrilla 3y ago
    Stop using it altogether. Use Firefox and contribute to it.
• mmastrac 3y ago
  I've been holding on to my Firefox installation after switching back around ~2016 or so. I was on the Chrome bandwagon when they were the upstart (still have the comic from the launch!) but it didn't take long to see how dangerous things were getting with monoculture. If you want to help, push back on all the anti-Firefox rhetoric that amplifies every little misstep that they take. Firefox is so much better from a user-respect perspective and the vitriol over little things (a couple of anonymous, tracking-free sponsored links on a new tab page?) are losing the plot.
  • hot_gril 3y ago
    Maybe they shouldn't have added the Pocket links if they didn't want the vitriol. Tracking or not (I'm still not 100% convinced that they're not), it doesn't look good when your browser greets you with that stuff. It's like entering a neighborhood and seeing a "checks cashed" store.
    • mmastrac 3y ago
      Thank you for providing an excellent example of what sort of comments contributed to our current situation.
      • hot_gril 3y ago
        Sure, instead of blaming the people who added the feature, blame the people who don't like it.
        • mmastrac 3y ago
          And now we have WEI, thanks to the constant nitpicking and anti-evangelism from people like you.
          • hot_gril 3y ago
            If those people seriously switched to Chrome just cause of Pocket, which I doubt, then sure. Otherwise, we're allowed to complain about a bad feature in the browser we use. Maybe the problem is people treating Firefox like a religion instead of just a better alternative to Chrome.
• varelse 3y ago
  [dead]
• BLKNSLVR 3y ago
  Could be an epic troll on Google's part
• codedokode 3y ago
  What you can do: - stop using Chrome - do not implement web DRM on your personal site - do not use providers like Cloudflare if they will support web DRM - maybe add a warning on your personal site for Chrome users Maybe something else?
  • goku12 3y ago
    One problem I find is that all that we do is in a bubble. I can convince a dozen like-minded people about the dangers and actions to take. However, the vast majority of the population is completely oblivious to all this and are negligently complicit in enabling bad behavior. This sort of things need to be discussed on the streets and in mainstream media (not tech media) for regular people to become aware. Remember that during the previous browser wars (IE vs Netscape), it was much more in the open and a lot more people knew.
    • baal80spam 3y ago
      I'd go even further and say that vast majority of population equates google with "the internet". "IT people" live in a bubble and HN crowd even more so. There is nothing to stop this.
• anshumankmr 3y ago
  As someone who is a somewhat new to web technologies, can someone really explain why this is bad? I saw the techical discussions in the PRs made to the WEI repo but it was all super technical that I was not able to understand the arguments made for and against it.
  • mplewis 3y ago
    WEI turns non-compliant browsers into second-class citizens. You’re perfectly free to use whatever compliant browser engine and OS combo you like today – but in a world with WEI, you’ll have to use Approved Chrome on an Approved OS on Approved Hardware with Approved Signing Keys, or you won’t be able to sign into your bank.
    • netdur 3y ago
      isn't this good? banks can raise security while we can still use any browser to check hackers news! or this 3 cows story?
      • thesuperbigfrog 3y ago
        >> isn't this good? banks can raise security while we can still use any browser to check hackers news! Are you okay with buying a new computer running the operating system and browser someone else wants to access your bank's web site? You can still use you current computer and bowser to access HN.
        • icoder 3y ago
          Like many others in this thread you stack so many assumptions on top of each other. Why? I don't think that helps. Will this person's bank implement WEI in such a way that none of this person's devices (computer, phone) are supported and will this person not be willing or able to switch banks, only then buying a new computer comes into view. Without knowing anything about this person, assuming average, the chances for this must be low or the bank will have no happy customers left. I fully agree with the underlying worries you and others in this thread have, but to extrapolate that without any nuance into a world where we all become privacy-less, ad consuming, eye tracked zombies on newly bought computers is not helping the case (in my view).
• btown 3y ago
  From the spec author, in 2022 [0]: > I decided to make this an app in the end. This is where my costs started wracking up. I had to pay for a second hand macbook pro to build an iOS app. Apple’s strategy with this is obvious, and it clearly works, but it still greatly upsets me that I couldn’t just build an app with my linux laptop. If I want the app to persist for longer than a month, and to make it easy for friends to install, I had to pay $99 for a developer account. Come on Apple, I know you want people to use the app story but this is just a little cruel. I basically have to pay $99 a year now just to keep using my little app. The double-think is absolutely astounding. [0] https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-own-app-on-my-iPhone.html https://benwiser.com/blog/I-just-spent-%C2%A3700-to-have-my-...
  • Waterluvian 3y ago
    My understanding is that Ben gets his paycheque from Google.
    • toyg 3y ago
      It's hard to get someone to understand if his salary depends on not understanding.
  • freeAgent 3y ago
    This is especially surprising coming from a Linux user who presumably understands the desire to have a device that runs code one can read, write, compile, execute, and share freely and without needing to receive approval from a Big Tech gatekeeper.
    • caskstrength 3y ago
      Maybe desire for great performance review is much greater in the author than being able to access the Web from his Linux laptop?
  • kalleboo 3y ago
    I don't think it's double-think, it's just a lack of consequential thinking. I believe the writers of the spec when they say that they just want to be able to see which ad views are real or not. They even lay out some (far too weak) ideas to keep the system from being mandatory and abusable. But they don't realize just how quickly things will go out of hand once the rest of the organization realizes what they have created. The road to hell is paved with good intentions.
• jgaa 3y ago
  Just say no. Ignore Google and educate your friends and family about the alternatives. Make it your mission to save the Internet.
• chris_wot 3y ago
  Firefox accepted EME. Why are we all suddenly so surprised this is the ultimate outcome?
• scott_joe 3y ago
  Can someone please explain what this actually is. Without the poetry.
  • Alifatisk 3y ago
    This is about WEI, Web environment integrity. The article below sums it up pretty good. "The proposal suggests that websites should be able to request an attestation from the browser about its “integrity”. Such attestations are to be provided by external agents, which – presumably – examine the browser and its plugins, and issue an approval only if those checks pass. The attestation is sent back to the website, which can now decide to deny service if the agent did not give approval." [1] 1. https://interpeer.io/blog/2023/07/google-vs-the-open-web https://interpeer.io/blog/2023/07/google-vs-the-open-web In other words, websites can now force you to comply with their shitty behaviour in order to allow you access, otherwise you get denided access.
    • icoder 3y ago
      The way you put it, it's like a captcha (but stronger, and with a high risk of unwanted side effects)?
      • Alifatisk 3y ago
        Yeah, I think that’s a good explanation. It’s like a captcha for your device and it’s the underlying OS that handles the attestation. The downside with this is that there will be a walled garden where custom devices are not allowed access too.
  • papruapap 3y ago
    ELI5: Server: Are you a real user capable of viewing ads? Client: Hmmm, not sure. Server: 404
• rchaud 3y ago
  Are there forks or earlier versions of Chromium browsers that can be maintained separately without folding in these changes?
• Roark66 3y ago
  I realise all the negative effects if this starts becoming a thing, but could someone explain how is it they propose to technically enforce this "signed browser binary" requirement? What's stopping me from writing my browser to submit false info? Any encryption keys or hashes present in the "certified" binaries can be extracted (the binary after all needs access to it to use it, right?). The only way this has a slightest chance of working is in connection with trusted hardware. Microsoft has been trying hard to push tpm on everyone and failed. What makes them think they'll succeed?
  • eganist 3y ago
    Edge is based on Chromium now, has been for years. Wouldn't be a leap to have TPM enforcement here too.
• encody 3y ago
  It's small, but here's a real actionable item that you can do to help: Put a gentle "Use Firefox" (or any other non-Chromium-based browser) message on your website. It doesn't have to be in-your-face, just something small. I've taken my own advice and added it to my own website: https://geeklaunch.io/ https://geeklaunch.io/ (It only appears on Chromium-based browsers.) We can slowly turn the tide, little by little.
  • idlewords 3y ago
    This advice has strong 1998 vibes.
    • encody 3y ago
      to be fair, WEI has strong 1984 vibes
      • deleted 3y ago
        [deleted]
    • ChatGTP 3y ago
      Yes, put it right near the "Under Construction" gif.
    • Tao3300 3y ago
      That's high praise.
    • empty_banana 3y ago
      I don't think seeing something like "Works best on Chrome" is rare. Also blocking websites at all for other browsers than Chrome.
    • afandian 3y ago
      It makes up for all of the "your browser is outdated" banners I see when using Firefox.
  • mdibaiee 3y ago
• mo_42 3y ago
  I think this is a somewhat natural consequence of Google being a powerful corporation. And, I don’t think we (somewhat loosely defined group of people who like free software and information and have a user-friendly computing environment) can and should work against this. Probably, we should give the corporate web some sandbox where they can play their games, while we develop alternatives. For example, Gemini is becoming more popular. People are talking about search engines that exclude the corporate web and favor personal websites. IPFS or just switching to FF again.
• supriyo-biswas 3y ago
  Instead of simply flailing our collective arms around complaining about an evil corporation, has anyone written to the respective competition authorities (such as the FTC in the US or CCI in India) about the potential anticompetitive effects of this proposal?
• tolmasky 3y ago
  Mozilla should call for Google's removal from the W3C over this implementation of Web Environment Integrity. "But Chrome has 65% market share, what good is the W3C without them?” If Google can take unilateral action to fundamentally change the basic principles of the web, then the W3C is already useless. This will give Google a clear choice: if they want to maintain the idea that the W3C matters, they should withdraw this implementation. It is unbelievable that over the course of 3 days, the potential future of the web has been put in such dire straits. There's already an existing, far less troubling (while still bad), proposal in the form of Private Access Tokens going through a standards committee that Google chose to ignore. They presented this proposal in the shadiest way possible through a personal GitHub account. They immediately shut down outside contribution and comments. And despite the blowback they are already shoving a full implementation into Chromium. What we need is real action, and this is the role Mozilla has always presented itself as serving. A "true" disinterested defender of the ideals of the web. Now is the time to prove it. Simply opposing this proposal isn't enough. This is about as clear and basic an attack on what fundamentally differentiates the web from every walled garden as possible. If someone drafted a proposal to the W3C that stated that only existing browsers should be allowed to render web pages, the correct response would not be to "take the stance that you oppose that proposal," it would be to seriously question whether the submitting party should even participate in the group. Make no mistake, that is what is happening now.
  • MildRant 3y ago
    There is no chance Mozilla does anything that actually matters here. They may do some virtue signaling and put out a statement about how they support the open web but nothing more.
    • deleted 3y ago
      [deleted]
  • easyThrowaway 3y ago
    Quite frankly, the W3C stopped having any say on the matter when the WHATWG supplanted the XHTML standard with the HTML5 committee. They had enough weight at the time to say "The Web is XHTML2, you can make your own internet if you want " compared to what they can bargain for these days. Maybe at the time it was a somewhat reasonable decision to abdicate their responsibility over to big internet companies, but that's what brought us to the current state where we're basically going back to original version of The Microsoft Network[1]. [1]http://www.codersnotes.com/notes/the-microsoft-network/ http://www.codersnotes.com/notes/the-microsoft-network/
• mble 3y ago
  Stop
• supernikio2 3y ago
  I've heard time and time again how this is "the end of the free web". Can someone succinctly explain how this is the case, for somebody not familiar with web browser architecture? What does WEI provide that wasn't previously possible?
  • Ygg2 3y ago
    Future web will require you to have certified browser - Chrome ™, to access the web. It will require certified OS Windows™, running on trusted Hardware TPM™, running trusted firmware CIA™. You'll have no choice and your love will be mandatory. This won't stop malware of course. However a skull clamp will be installed to monitor your thoughts and you will be zapped if undesirable thoughts are detected. Note: it's a hyperbole but if you want another OS, Browser or hardware you'll be forced to Homebrew it. Or use a compromised app.
    • supernikio2 3y ago
      Can Google really do this? What if I'm using Safari on OS X, or Firefox on Linux?
      • probably_wrong 3y ago
        Well, who's going to stop them? As for other browsers: I guess that you'd still be able to access my website, but YouTube and GMail will just show you a generic "This browser is not supported" or, at best, "Your browser had been deemed insecure. Please use a secure browser". If we go full Nostradamus the most likely result is that Safari will play ball (because they are already doing something similar), Firefox will play ball (because they no longer have a spine), they'll implement whatever Google says, and yet another portion of the web will be closed to those who don't dance to Google's tune. I hope you're not too attached to youtube-dl or your adblocker.
      • devsda 3y ago
        This not only requires Google but websites also need to implement. The problem is given the number of Google's services, it can easily "nudge" site owners into implementing it. They can make it mandatory for adwords or analytics or any other service that they have for webmasters and everyone will have to jump in while it is still technically voluntary. If your $bank choses to implement it, then it can very well mandate only windows or osx clients. Then you can't use firefox on linux. This may sound like conspiracy theory but we already have examples of similar restrictions on android apps with safetynet. Bank apps already refuse to run on custom roms. It will not be limited to banks. Someone mentioned that McDonald's app doesn't work unless you pass safetynet. That is how ridiculous it can become. Edit: fixed typos
• Pannoniae 3y ago
  This proposal is just so throughly user-hostile that it's impossible to criticise it based on technical grounds. It's not a bad proposal, it's a dangerous, evil and malicious one, so criticising it in details is futile. The whole thing in itself is evil, and it needs to be thrown out. Quietly protesting won't work this time, the goal is to kick up a huge fuss which gets the attention of governments, regulatory bodies and start antitrust proceedings. Excuse my french but Google can fuck off with their censorship and "reminder to be civil". They have truly gone mask off, with the Code of Conducts not reinforcing good practice and a welcoming environment, but just a tool used to suppress dissent. I've switched to Firefox and I'd recommend everyone else to do so.
  • strix_varius 3y ago
    Agreed - if anyone else is curious to see Google's "side" (motivations, technical or otherwise), here's the explainer: https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/... It's nakedly user-hostile. A blatant attempt to invert the "user agent" relationship such that the agent works for the advertiser/corporation/government to spy on the human behind the screen. The way the intro paragraph tries to disguise this as something users need or want is frankly disgusting: > Users often depend on websites trusting the client environment they run in. This trust may assume that the client environment is honest about certain aspects of itself, keeps user data and intellectual property secure, and is transparent about whether or not a human is using it. This trust is the backbone of the open internet, critical for the safety of user data and for the sustainability of the website’s business. Ugh. Here's a fixed, honest version: Corporations like Google often depend on advertisers knowing as much as possible about their users. Their revenue may depend on fingerprinting the client environment, tracking their behavior and history, and attesting that a human with sufficient disposable income is behind the keyboard. This personal data mining is the backbone of Google's business model, critical for their continued dominance of the web and for the sustainability of their enormous margins.
  • tristor 3y ago
    > This proposal is just so throughly user-hostile that it's impossible to criticise it based on technical grounds. It's not a bad proposal, it's a dangerous, evil and malicious one, so criticising it in details is futile. I can't agree more strongly. I sat down to write a letter to the FTC, and I can't even articulate my objections because after reading this spec my only response is encompassed in "WTF is this shit?". I've worked in my past with members of the Chromium team and I've generally found them competent and well-meaning, and I can't see any amount of well-meaning (and some lack of competence) in this spec proposal. This feels like a shift in the behavior for Google far beyond their existing slow drive to consume everything, to something far more draconian and direct.
• washadjeffmad 3y ago
  I vote that this happens, but happens completely, definitely, and thoroughly to its logical conclusion. If you want a penny from Google adtech, you're subject to their stringently filtered portal, you're inaccessible from non-WEI enabled browsing, and circumventing WEI policies gets you demonetized. It'll be the Great Firewall of Adtech, gated access via an app to a filtered corporate paradise - a bit like Facebook tried in India, unsuccessfully. If you want to be part of the free, non-commercial web, WEI doesn't apply, access is open. You are able to be indexed as such. The healing can begin. This will provide a true choice: commercial xor non-commercial. Confine all the SEO garbage to ghettos that think they're kibbutzim, forcing the big commercial entities to either fight over the noise or exert their influence, and leaving the rest of us out.
• KingOfCoders 3y ago
  I wonder how many of the 210 comments were written in Chrome.
• lagrange77 3y ago
  SSLKEYLOGFILE still works for Chrome, right? One way i could imagine to circumvent WEI would be to let WEI enabled Chrome do it's thing, while proxying the decrypted HTTP traffic to a free browser with plugins activated, potentially on another machine.
• whelchel 3y ago
  Could a core common library that Chromium depends on update its license to block use in software that supports attestation, roughly? If Google wants more control and closure of the web, they shouldn’t benefit as easily from its current openness.
• xyzal 3y ago
  I hope someone from the Pirate Party in the European Parliament brings this threat into discussion there as soon as possible to spread awareness.
• idlewords 3y ago
  I'm surprised to see so many people in this thread saying "write a strongly worded letter!" (or something along those lines), and so few saying we need to build a better browser without this crap in it, which has been the traditionally successful answer to attempts to privatize the Web.
  • Tao3300 3y ago
    We already have one, and building a browser is a nightmare.
  • strix_varius 3y ago
    Before doing this, Google was careful to make it as difficult as possible to build a replacement for Chrome. Apple struggles to make Safari capable. Mozilla struggles to make Chrome-first websites work in Firefox. Building a new browser is a Herculean task. Pragmatically, I'm hoping that a Chromium spinoff like Brave (or Edge!? Could MS be the hero we need?) will turn the privacy switches on, WEI off, and get enough market share to make WEI infeasible.
• meindnoch 3y ago
  Would any of the usual enthusiastic Google employees ("Googler here...") chime in and defend this please?
• A4ET8a8uTh0 3y ago
  Can you give me an idea as to why WEI is a bad idea for the web? Granted, it is morning, but as I am going through the notes linked ( https://googlechrome.github.io/OriginTrials/developer-guide.html https://googlechrome.github.io/OriginTrials/developer-guide.... ), I am not sure I understand why it is that bad.
  • shadowgovt 3y ago
    As a general rule of thumb, web technology has traditionally separated the content and protocol from the browser ("user agent") in terms of concerns. By which I mean, a user agent needs to be able to handle any possible input without breaking, and a web server needs to be able to handle any possible request without breaking. WEI tries to shortcut that process by creating a secured sign-off system that would allow the server to only respond to queries from a blessed hardware and software configuration. This wildly constrains the user agents that would be possible. The pro for web developers is that they wouldn't have to concern themselves with whether their server or the HTML they are. Emitting is broadly standards compliant and compatible; they can just make sure it works with the target platforms they care about and rest easy knowing no other platforms can touch their system. But this is bad for anybody who, for whatever reason, can't use the blessed platforms (user agent and hardware combinations). Immediate practical consequences are that a lot of the screen reader solutions people use would probably break (because the screen readers wouldn't be certified user agents), a lot of clever hacks would be far less feasible (the website somebody hacked together to track whether the ice cream machine was broken at McDonald's restaurants relied upon being able to pretend it was the McDonald's smartphone app well enough to attempt to put ice cream in the shopping bag), and it would basically become impossible to build a new browser or operating system from scratch compatible with the web (they wouldn't work with the websites people wanted to use because they wouldn't be certified as authentic on any of those sites). This proposal grossly changes the balance of power on how the web works and places most of it in the hands of the incumbent browser and computer hardware vendors.
    • A4ET8a8uTh0 3y ago
      Thank you. I can see why there is a pushback for it and also why Google would want to make it a standard. It has a feel of systemd to it ( making things easy enough that if it does manage to become a standard, people will likely accept it en masse )
• easyThrowaway 3y ago
  Get the Wikipedia Foundation on board and make sure the wikipedia or other big mediawiki hosts refuse to show any kind of content if such feature is detected in the browser. Also, if you're a distro mantainer, configure apache and nginx defaults to make this is the default behaviour. Even better: instead of redirecting to any wall of text with a long explanation of the political and technical reasons of this choice, just display a big, loud "ERROR" message stating that their browser is unsupported due to the presence of this module, and a small tutorial on how to deactivate it from the about:config page, if available.
  • zzo38computer 3y ago
    I do not agree with configuring apache and nginx to do that by default, unless WEI would somehow prevent a server that doesn't understand it from working properly (as far as I can tell, that is not the case). (A system administrator could still change the configuration; this is only about the default setting.) However, I think the other stuff that you had mentioned would be OK. Furthermore, a distro maintainer could configure clients by default to disable WEI (or to not include client programs that have WEI).
• deleted 3y ago
  [deleted]
• userbinator 3y ago
  For those who still aren't sure why this is a bad thing, read Stallman's "Right to Read" story --- that's the direction WEI is going to take the Internet and probably other things too, if the opposition isn't strong enough. Ironically, WEI is one letter off from WEF... but I doubt that was intentional.
• ColinHayhurst 3y ago
  Google depends on Adwords. Other revenue streams are minor in comparison. Chromium is the main moat. Android too, of course. ~$15 billion to Apple is another, so protecting all on mobile. With the demise of AICOA, we cannot hope or expect the EU to deliver. In a sense it's simple; folks have to stop using Google search in order to preserve the web, and support those who are trying to preserve it. But I would say that. We are doing what we can.
  • jonnycomputer 3y ago
    Break it up. Break them all up. We need more disruption, not this codswallop.
• PhilipRoman 3y ago
  One thing about this that I don't understand is how they intend to validate memory without controlling the entire stack (which we aren't even 1% close to achieving on the desktop). If I poke /dev/mem, does that mean Chrome will have to validate every single byte of it's ram? Or does it rely on having a fully locked down environment (maybe feasible on phones).
  • TillE 3y ago
    Even on Windows, you can do practically anything with a signed driver. There's just no such thing as verifying a "secure environment" outside of extremely narrow, controlled scenarios.
• A37N 3y ago
  Can't we make a intranet of our own? yes im being stupid right now but i dont want wei or anything like that, if we power users can create something like the internet where there are multiple websites and stuff like it was in the old days i don't know what im talking clearly but i think y'all understand me
• pcdoodle 3y ago
  Alright folks, time to cancel that Youtube Premium, Google Domain, Google Compute Engine, Ad campaign, PPC, Etc. My business is off any paid Google crap. I will never prepare a computer without uBlock Orgin for any customer of colleague.
• lolinder 3y ago
  As wonderful as it has been to have a platform that the entire world is on at once, I'm beginning to conclude that the only way to get back to the web as we knew it is to go back to the days when only a small, geeky subset of the population spent time on here. Back then it wasn't worth it to create massive amounts of garbage content in order to serve ads to unwary search engine users—there weren't enough of us to make money off of! I think it's time to establish a successor to the web that we can once again call home. This doesn't mean we need to give up on the web or stop using it—it can run in parallel to the mainstream, a niche home for hackers and techies and people who care about freedom. It needs to be simple, like Gemini [0], but also have enough interactive features to enable old-school social apps like HN or the old Reddit. It should have a spec and a governance process that discourages rapid changes—we've learned from hard experience that more features does not mean better. I realize this sounds like a cop out, and that getting people to use such a thing in sufficient numbers would be extremely difficult. But I'm pretty convinced at this point that the web as we knew it will never come back unless there's a reset—unless we create a new niche tech that isn't big enough for corporations to want to take over. [0] https://gemini.circumlunar.space/ https://gemini.circumlunar.space/
  • nehal3m 3y ago
    >I realize this sounds like a cop out, and that getting people to use such a thing in sufficient numbers would be extremely difficult. In the last few days browsing Fediverse platforms I prefer the smaller communities for that old internet spirit anyway.
• TheCaptain4815 3y ago
  Biden really needs to fire/replace Lina Khan and Congress start exerting pressure on big tech for actual monopolistic issues, not just political targeting. Although to be honest, I don't really trust the GOP/Dem house to bring up non-partisan issues which makes the role of FTC head even more important.
• suslik 3y ago
  In the end, I feel like there is a silver lining to all this. As the world wide web becomes more sanitised with their codes of conduct, corporate censorship, ads, witch hunts, all these limitations - more and more, I hope, would the valuable, interesting bits of it drift to alternative locations. The internets of old were just that - a place where nerds, freaks, outcasts, and other antisocial personalities congregated. Everything was permitted and everything was possible. Many, myself included, hoped that it would change the world. It didn't - the world is winning again, as everyone can clearly see. Still, I hope that the normalisation of the web might as well create a critical mass of those who just want something more than just a corporate safe space. I sincerely wish that there is a future where protocols like gemini - stripped from all the visual noise and 'dynamic' features - get a critical mass of useres. If that doesn't happen - as someone who doesn't use any mainstream social media, google and microsoft services, llms and other modern (and some might add - dystopian) stuff - I don't really loose much. There are enough great books for a hundred lifetimes, enough hikes to walk and friends to get blasted with. Maybe it'd even be for the better.
  • OfSanguineFire 3y ago
    That colourful internet of yore coexisted with doing your banking at a bank. Now, banking has largely moved online and banks have eliminated a lot of their physical locations. Ditto for accessing government services in many countries. The concern here is no longer being able to do important everyday things without using a supported browser, even if a small hobbyist internet for nerds, freaks, and outcasts survived out there.
• deleted 3y ago
  [deleted]
• ricardo81 3y ago
  fwiw I found Vivaldi's overview a good primer on the situation. https://vivaldi.com/blog/googles-new-dangerous-web-environment-integrity-spec/ https://vivaldi.com/blog/googles-new-dangerous-web-environme...
  • dang 3y ago
    Thanks. Let's discuss that article here: https://news.ycombinator.com/item?id=36875940 https://news.ycombinator.com/item?id=36875940.
    • propogandist 3y ago
      why have you shadow banned my account?
      • dang 3y ago
        We didn't shadowban it. We told you we were banning it and why: https://news.ycombinator.com/item?id=36134639 https://news.ycombinator.com/item?id=36134639.
  • TastyAmphibian 3y ago
    Sounds interesting
    • pg_1234 3y ago
      As pointed out, EU law may prohibit this ... even if they are slow to act. There is another possibility; EU countries may decide that this amounts to tacit admission by Google that the revenue generating event in ad sales happens on the browser, and ad revenue is therefore always taxable in the country where the browser (and viewer) are located. No more laundering international revenue through tax havens. And since Google just demonstrated such an effective verification mechanism ... well they can just repurpose it to track all such taxable revenue for the countries in question ... otherwise they might be deemed a criminal enterprise and have to be blocked nation-wide. No need to block the useful parts, just the illegal tax-evading ad empire. ... and countries can move fast when there is a lot of money to be had ...
• danlindley 3y ago
  The web is not dying, it is being killed. And the people that are killing it have names and addresses. Shame on Rayan Kanso <rayankans@chromium.org> Shame on Peter Pakkenberg <pbirk@chromium.org> Shame on Dmitry Gozman <dgozman@chromium.org> Shame on Richard Coles <torne@chromium.org> Shame on Kinuko Yasuda <kinuko@chromium.org> Shame on Rupert Ben Wiser: https://github.com/RupertBenWiser/Web-Environment-Integrity https://github.com/RupertBenWiser/Web-Environment-Integrity Google needs to be broken up.
  • SquareWheel 3y ago
    Currently development and standardization occurs in the open, on GitHub and elsewhere. When it's decided that's no longer possible, I hope you realize that this kind of targeted harassment is what led to its demise.
  • sph 3y ago
    Shame on all knowledgeable people that happily keep using Chrome and giving Google money. That make the web more centralized by giving more and more power to entities that benefit from this like CloudFlare. HN is full of people that are indirectly helping to push these changes forward. You're preaching to the choir, and the choir is too lazy to switch browsers or learn how to configure a web server, so they just shrug and carry on.
  • dang 3y ago
    No personal attacks, please. It's not what this site is for, and destroys what it is for. You can make your substantive points without that, as most other users in this thread have been doing. You may not owe web-destroying $MegaCorp better, but you owe this community better if you're participating in it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  • h0p3 3y ago
    Thank you.
• twleo 3y ago
  That's why we should isolate Chromium from Google. Chromium should be lead by third-party like W3C.
• renegat0x0 3y ago
  Because we are only 'recipients' of their actions we can only watch, shame, scream, screech. It is, as always, for your protection. They will shake hands, implement whatever they like. The road is clear. Chat control, Earn IT act, TPMs, Secure Boots, Cyber Resilience act, Online Safety Bill, Crypto Wars. Most of the users decide what can happen. Most of the users are blind. The network effect will eventually force everybody to follow.
• nfw2 3y ago
  I don't see how this will end the "free web." No publisher will be forced to use DRM. Anyone can still create a website and make it accessible to anyone for free with an internet connection. If certain publishers want to require ads to view their content, that seems like their prerogative.
  • alex_suzuki 3y ago
    Until Google Search starts punishing sites that don’t require a trusted execution environment…
    • alex7734 3y ago
      I've seen people open up all of their users' "private" content to Googlebot IPs just to get rid of errors in Google's search/Adsense console "in case it helps revenue" (as in they didn't even know for sure if it would help, only that it shows up as an "error" in Google's console and red=bad) All you need to do is to jingle some real, if small SEO/ad advantage and people will bend over themselves to lick Google's boots.
• stainablesteel 3y ago
  so in the case of a forced implementation of this, websites don't actually need to adapt. i think if people see websites constantly being broken in chrome, instead they'll pick another browser, that's most people's first instincts when a site doesn't work. just a take i guess, will it divide the web in 2?
• andrecarini 3y ago
  What's stopping a non-complying browser from sending forged attestation tokens? Honest question.
• helen___keller 3y ago
  There’s a saying, on the internet nobody knows you’re a dog. WEI is part of a broader movement to make this false - more generally to make an internet where we know you are a human staring at a screen It turns out having dogs (or more commonly programs and scripts) on the internet is not profitable and not good for business, so corporations want to take dogs off their websites by finding clever ways to attest that a real human with eyeballs is clicking with hands and staring at ads. Support dog rights. Don’t allow for a WEI-dominated web.
  • EvanAnderson 3y ago
    The whole narrative about WEI "proving" you're a human is completely false (and I'd argue a ruse). It only proves you're using a sanctioned OS and browser binary. It does nothing to stop robots being wired-up to devices w/ emulated inputs. In fact, WEI will make it easier to use a robot w/ a sanctioned software stack since, hey, it's a "human" per WEI.
    • helen___keller 3y ago
      WEI proposal leaves open the functionality of the attester, so it’s neither correct to say this will prove requests are humans nor that it simply proves a sanctioned OS/browser. The attester will attest whatever they want. They can evolve to match the further degradation of user freedoms.
      • EvanAnderson 3y ago
        > The attester will attest whatever they want. They can evolve to match the further degradation of user freedoms. Agreed. Eventually the attestor will be measuring “proof of life” with the camera, for example. “Please drink verification can” isn’t too far down that road either.
        • derefr 3y ago
          > Agreed. Eventually the attestor will be measuring “proof of life” with the camera, for example. Ultimately, it's all just instructions being sent to your computer to be executed, and "your computer" is whatever you say it is. Everything (e.g. Intel SGX et al) can be emulated in a sandbox. That's how modern DRM is defeated.
• devsda 3y ago
  There are many arguments against this but not many brought the implications for search engines. If websites implement this, it will effectively make building a web search engine impossible for new entrants. The current players can whitelist/attest their own clients while categorizing every other scraping clients as bots. If not for other reasons, I can't see how Google a search company can be allowed to push something that can kill competition using its market dominance in other areas like browsers.
  • justcool393 3y ago
    > If not for other reasons, I can't see how Google a search company can be allowed to push something that can kill competition using its market dominance in other areas like browsers. Because antitrust has been dead for a while. Chrome is a tool to drive people to Google and Google ads and nothing more. I will say, I did appreciate Microsoft having a browser engine with IE and Edge, even if the former was notoriously a pain, it gave competition in the space. Unfortunately, that's not the case anymore and everything is either Chrome (Blink), Firefox (Gecko), or Safari (WebKit). And it's pretty clear what Chrome has done once that have amassed a dominant market share. I'm sure there are Googlers who think they're legitimately making the web a safer place, but I think the real reason is pretty clear if you take a birds eye view.
    • deleted 3y ago
      [deleted]
    • retrac 3y ago
      Unfortunately it seems that nearly all software platforms with a dominant market share, end up degenerating to serve only one purpose: to shove advertisements and subscriptions onto you. My mother's new Windows 11 laptop's out-of-the-box configuration had me clicking through half a dozen things attempting to manipulate me or her into spending more money. There are (I can only assume paid-placement) news and adfotainment in the start menu! Repeat pop-up reminders from Lenovo to subscribe to their protection package. Emotionally-manipulative reminders to subscribe to virus protection services. To Microsoft Office. Etc. etc. It's been the same thing in the mobile market, where the move to "apps" means you are running their software on your device all the time, so they can optimally surveil you, and target the advertisements and behaviourally-modifying nudges. Quite a few messaging services now actively mess with delivery of notifications, spacing them out, delaying them, according to research that shows what maximizes engagement. I saw the trend 20 years ago and switched to free software around that time -- I liked Linux anyway, but it was partly on principle. Still, the new laptop was eye-opening. The degree of intrusion, the degree to which even desktop computers have turned into user-hostile advertising terminals serving the purposes of their manufacturer, rather than a computer for the user to accomplish their work, is quite shocking. Everything networked is becoming like that - twisting the user's hardware, turning it into nothing more than a terminal, an extension of the corporation, serving their interests at all times. Even smart TVs now have ads built-in to their menus and such.
• coding123 3y ago
  Remember when everyone and their brother helped everyone and their mother get on Chrome about meh, maybe 15 years ago? Time to get everyone and their brother help everyone and their mother get on Firefox.
• philipwhiuk 3y ago
  It's notable that the proposal was put on a personal GitHub rather than a Google corporate GitHub. Someone is trying to avoid Google's obvious presence being too visible and throw their engineer under the bus instead. For shame.
• pabs3 3y ago
  I wonder if any web servers or web apps have started to block Chrome users yet.
  • nfw2 3y ago
    No serious business is going to block the majority of their traffic
    • pabs3 3y ago
      I was talking about web servers and web apps, not about businesses. They can patch the software if they want to allow Chrome users.
• cmrdporcupine 3y ago
  Google is clearly being evil here, but the original sin was having user-agent strings in browsers at all. Public information on the 'world wide web' should by nature be open and accessible to any agent in a neutral way. (Of course this is implied in Google's (bullshit, cough) mission statement.) Making information about what the agent is invisible as a principle from the start would have helped with that. In reality, that vision was lost in the early 90s when the web went from being a proposed hypertext/document/information retrieval system to being mostly a presentation system for what started as magazine/leaflet/poster analogues ("websites") to which were added dynamic client/server web applications. The difference in model is stark: in the former, the browser, even the user, makes decisions about the presentation of the content based on mostly structural information declared in the document. In the latter, the 'document' is not a document, but a program executed on the users computer. And once you've made that transition, the "developer" of the "program" now expects more and more of the kinds of controls they get when they truly control the platform. And it doesn't help that in the midst of this, mobile applications came on the scene, undermined the web completely, and changed expectations of how content should be made available. From that point on it became even more expected by companies and product managers that they control the whole sandbox. e.g. Meta couldn't even be bothered to launch Threads on web, probably precisely because they don't like the restrictions there, and having full control is so much more profitable to them, and they're not the first. In any case, this all sucks. I've already personally switched to Firefox in most places, but the very fact that Google feels emboldened to push this tact says a lot about the state of the web and how this 30 year trajectory has gone. In a way, I just hope the "www" dies and all of us who helped create this thing in the first place birth something new and better. But this is also hopelessly naive.
• bryanrasmussen 3y ago
  Can attestation of the browser be used as personally identifying information? It obviously must be one more data point in identifying the user?
• SergeAx 3y ago
  Is there a technical explanation of what exactly is being pushed here? Web is an open protocol. It is okay for both browser and server to support some third party extension, and Google owns 95% of browsers. But how can it be forced onto all the servers?
• guy98238710 3y ago
  We are in post-efficiency era. Power is driving profits and that's what companies compete for. Efficiency (value-to-cost ratio) is now a technical detail, soon to be automated away by AIs. The same is happening in politics - efficiency is a technical detail delegated to civil servants while politicians focus on power. The world is a small pond full of sharks so hungry they eat each other.
• krabmagnet 3y ago
  Appologies if this was asked already, but what do people think are the most effective way to combat this? We are a website full of people who understand tech, surely we can find a way to push back
• exceptione 3y ago
  Wondering what you can do? First: - ban Google all together in your personal life. No chrome and no excuses. Stop your bullshit or leave this profession. - develop with and for firefox and friends only, introduce usability problems for chrome - employ the same tactics as google. -> Bundle firefox with the software you are distributing. -> Like google did, remove the competition altogether from the users device. -> make your npm-module or your website slower in chrome -> show a popup urging users to download firefox, provide a link. Refer to their current chrome as malware. -> use as many tricks as you can think of to spoil the well for google. Destroy search results, fill their storage with /dev/random, whatever your imagination leads you too. You keep telling us you are so smart. Show it. - remember, Google's capital is data. Hit that and the beast will die. If you are not ready to do this, you are part of the problem. "Maybe later". No, people have warned for years. I wrote that using chrome is "less than smart" years ago, and some people took real offense when I wrote that. If you don't act now and update your projects like I wrote above, you will never do it. Secondly, tweet, write to tech journalists. But only after you did the above. Thirdly, Google is evil and they know it. They care only about money and they trust you to find excuses. There are already some people who talk to themselves "Well, I see both sides really". Don't be that one. Fourthly, I am very worried that the window of opportunity is closing now rapidly. It is late to defend our values, rights and future all by ourselves while all political parties gladly take donations by the millions. I am not an anarchist (nor a libertarian), and I would rather sit on my lazy ass like you. However, the amalgamation of tech oligarchs and ruthless political factions is accelerating. They are happy to trade civil rights for something more tangible. Your legal rights are being eroded one after the other and you might lose the right (or means) to stand up for them. If things go really wrong, keep in mind that while in theory one could burn the whole thing down, well, yes, a statement in public life would help for publicity. But PR is a hard thing if you don't have money. The easiest steps are outlined above.
• krzyk 3y ago
  Could someone explain what WEI is? Searching for it returns quite a bit of acronyms.
• Paianni 3y ago
  Looks like this has been inserted into release 117, which won't hit the stable channel for several months yet. Chromium is still the most secure GUI browser out there so I'm not in a rush to leave, especially as OpenBSD 7.4 will probably ship with 116. If the devs/Google's intentions are truly limited largely to trying to prevent bots, then I hope they realise their folly.
• contravariant 3y ago
  Since this is basically just obfuscation shouldn't it be possible to break it? Heck it's not even DRM so it doesn't fall under the protection of the DMCA.
  • mindslight 3y ago
    No, not at all. Search "remote attestation" and "safetynet".
• Gud 3y ago
  How do we kill Google? They were great for 10 years - so so for another 10 - but now they’re outright hostile towards the free internet and must be put down. So how do we do it?
• intrasight 3y ago
  Isn't this easily "defeated" by the use of a web proxy? Won't corporate web proxy software just replace the token with a generic company token?
• mordae 3y ago
  Requiring remote attestation of devices not owned by the relying party should be illegal unless it is a revocable opt-in and only used to protect interests of the user, not service provider.
• _elf 3y ago
  I hope this is something that non-Chrome Chromium-based browsers can omit from their builds.
• thunkshift1 3y ago
  Can someone pls explain what is happening and why this is bad
• rdevsrex 3y ago
  I wish Google would solve real developer pain points like having secure client side storage. That would be useful to developers. But heaven forbid they take a break for a moment from trying to squeeze every ounce of profit out of their users.
  • nfw2 3y ago
    In order to have secure client-side storage, it seems like you would need to be able to verify that the client-side application that is accessing it is unmodified -- which is what WEI would allow for.
• pzo 3y ago
  Not sure how exactly ad fraud works but why this WEI supposed to even prevent it? There are many tools that allow to control your mouse and keyboard programatically like pyautogui [0]. Will OS check if such python lib is installed or script running in the background? Then those that doing ad fraud will move to programmable board as BLE keyboard/mouse/hid. Even microbit can can be programmed as BLE HID device [1]. Add external camera on unattested device that will stare at attested device screen and you can automate lots of thing. Sure this is more complicated to pull off but will probably eventually happen anyway if this is a lucrative business. In the end WEI wouldn't prevent ad fraud / fakes but would end up used for restricting other things. [0] https://github.com/asweigart/pyautogui https://github.com/asweigart/pyautogui [1] https://github.com/bsiever/microbit-pxt-blehid https://github.com/bsiever/microbit-pxt-blehid
  • tantalor 3y ago
    The term for this is "cat and mouse"
  • awesomeMilou 3y ago
    > Will OS check if such python lib is installed Most computers come with a trusted platform module which increasingly runs more and more services related to media handling. On modern Macs the T2 chip is an A8 or A9, meaning it has the same power of a modern iPhone and handles everything from device input (mouse & keyboard), to webcam decoding to media decoding. When you watch netflix on a modern macbook, the video buffer that is displayed is actually a shared memory buffer from the T2 chip, which the main SoC can't actually see. If you take a screenshot you will see that the screen stays black, since audio and video come purely from the chip. You could run a Browsers Renderer in there and you would never notice.
• insanitybit 3y ago
  I don't think that that's surprising. Isn't this how all proposed features work? They can sit behind a flag for years, but the goal during a proposal is to ship first.
• Arch-TK 3y ago
  I predict that hardware attestation will in 10-30 years become a requirement to maintain an internet connection. Given Microsoft's push to make their OS support hardware attestation as well as Google's push for technologies which use hardware attestation in broader and broader scopes (Android and iOS has supported this for apps for a long time), the technology to make this possible is increasingly becoming widespread. Hardware which supports hardware attestation is expensive and some people who can't afford it would therefore be excluded. But I don't think this matters. If Google forces you to see all their ads then they can sell the ad space for more money. This can make it increasingly profitable to sell devices at an ever increasing loss. Likewise for Microsoft. As a side note, this will make it incredibly difficult for anyone to compete in the hardware space. Why would someone spend even £500 on a phone or computer from a non adtech company when the adtech company can sell the same device for £100 or £50 or maybe even give it away for free? By making hardware attestation more mainstream, it will become increasingly difficult to argue that enabling it for things would cut off customers. I think it's easy to argue in favor of requiring hardware attestation for internet connections from the point of view of a government or an ISP. After all, if your customers can only use a limited set of hardware which is known and tested for security, it decreases the chance of security problems. For a police state like the UK it also seems even easier to justify too. Even if things don't go that far, in a few years you will become a second class citizen for refusing to allow this on your devices. I can easily imagine banks requiring WEI for their online banking portals (they already do it for all their apps). Likewise I can also imagine my water, gas and electricity companies, or really any company which handles payments, considering this technology. The worst part is, I don't think most people will care as long as it keeps working seamlessly on their devices. Likewise I don't think governments or the EU will do anything about it. I am not even sure what I can do about it.
  • JohnFen 3y ago
    > I predict that hardware attestation will in 10-30 years become a requirement to maintain an internet connection. I fear you're right. But if the current trends keep up, I'll have abandoned the internet entirely before that happens. I mourn for what we have already lost, and we are poised to lose even more.
  • 3y ago
• AlfeG 3y ago
  Just don't use and especially pay to sites that will enforce this.
• 4oo4 3y ago
  Don't just comment and complain, contact your antitrust authority today: US: - https://www.ftc.gov/enforcement/report-antitrust-violation https://www.ftc.gov/enforcement/report-antitrust-violation - antitrust@ftc.gov EU: - https://competition-policy.ec.europa.eu/antitrust/contact_en https://competition-policy.ec.europa.eu/antitrust/contact_en - comp-greffe-antitrust@ec.europa.eu UK: - https://www.gov.uk/guidance/tell-the-cma-about-a-competition-or-market-problem https://www.gov.uk/guidance/tell-the-cma-about-a-competition... - general.enquiries@cma.gov.uk India: - https://www.cci.gov.in/antitrust/ https://www.cci.gov.in/antitrust/ - https://www.cci.gov.in/filing/atd https://www.cci.gov.in/filing/atd
  • hooverd 3y ago
    A customizable form letter would be nice to have, if anyone wants to jump on that. I'm not a great writer in that respect.
    • 4oo4 3y ago
      This is what I sent, feel free to use and customize: I would like to bring your attention to Google’s recent proposal to add a feature to its Chrome (Chromium family) of browsers called Web Environment Integrity. This provides a mechanism to reinforce Google’s already dominant browser market position by creating a technological control that can be used to nullify a user’s choice of browser, device and operating system. This technology also has the potential for abuse by preventing users from using browser extensions that can enhance security by blocking unwanted and potentially malicious content, as well as browser extensions that help vulnerable users with enhanced accessibility needs, such as color blindness and visual impairment. Google’s dominant, near-monopoly position in the browser market already harms me as a consumer by reducing browser choices and preventing a competitive market for developing new browsers. Allowing Google to include this feature will reduce my browser choices and consolidate the browser market even further, and it is incumbent on [INSERT AUTHORITY HERE] to take action against this abusive behavior.
      • liendolucas 3y ago
        Should I submit my complaint right away or only after this disease starts spreading out without control? I'm in the EU.
• deleted 3y ago
  [deleted]
• Havoc 3y ago
  And yet people keep saying it’s an independent project that is definitely not google controlled.
• __MatrixMan__ 3y ago
  Is anyone else working on alternatives to this web? We're going to want something working before this one becomes a telescreen. I'm thinking: - content addressing, not server addressing (to better distribute the hosting load) - looser coupling between data itself and apps for viewing data (to prevent aesthetics from being used as a heuristic for trustworthiness) - a native permissionless annotation protocol (p2p trust governs whether annotations appear: if you see an ad, just revoke trust in its author) - no code execution needed for browsing, fancy features (i.e. the kind of thing you actually need js for) stay optional I'm curious what design goals other people think are relevant.
  • supazek 3y ago
    I’ve put barely any thought into it but I think a “localnet” would be better. Your usage is entirely based on calculated geoposition and the userbase is segmented into regions based on user count. More than X0,000 users in any one region and it splits to keep things small. This would be a limitation for hosting content. If you want to send a message out to another person in a different region you’d have to make a deliberate effort to do so and it will be private such as a letter would be. Idk if that would achieve my goals and honestly I can’t plainly state what my goals are. All I know is I get tired of privileged California snobs telling me how things should be in my back 40
    • __MatrixMan__ 3y ago
      I've had similar thoughts. I've been sketching out a design where you can tag data with a location (a restaurant menu, say, which is only needed near the restaurant). Suppose the data is being gossiped between mobile devices. Some process which understands the user's past (and estimated future) movements can decide when the data can be forgotten. Plus--as I imagine it--users would be able to trust each other in certain domains, so which fragments your device hangs on to is going to depend on who you trust and what you're interested in. Hopefully, these combined would mean that whatever part of the web is relevant to your location is also the part of it that's already cached on your device or on a nearby one.
• hot_gril 3y ago
  This war was already settled long ago on smartphones, which are globally the most used personal tech. There are already lots of things like banks and messaging apps that require full or partial use of an unrooted smartphone for security purposes. Now they're bringing it to the more niche area of PCs.
• rolph 3y ago
  https://www.ftc.gov/about-ftc/contact https://www.ftc.gov/about-ftc/contact
• sspiff 3y ago
  Publishing an implementation of a proposed web specification is how all web standards are created or evolve. The same thing happens with WebGPU, WASM, and many before them. Usually with a prefix (ms-, moz-, webkit-,...) and/or locked behind a config setting before standardization. What is different this time other than it being a feature that is considered user-hostile? That's not to say we shouldn't oppose this feature, I just wouldn't be up in arms about an implementation existing.
  • drewbug01 3y ago
    > That's not to say we shouldn't oppose this feature, I just wouldn't be up in arms about an implementation existing. People aren’t up in arms about the process by which web standards become accepted; they are up in arms about this standard moving forward at all because of its dangerous implications for the web and it’s outright user-hostility.
• samcat116 3y ago
  Can someone explain how its technically impossible to conform to this spec using, for example some desktop linux distro and say firefox? Is there really no OSS way to implement this? Secure boot works today on linux (might not be the default happy path, but that seems fixable). TPM apis are there no?
• GenericDev 3y ago
  So fudging sick and tired of having to defend free and open information.
• thrawa8387336 3y ago
  How to turn it off? For real
• aaronclong 3y ago
  I'm curious what Brave says to my issue: https://github.com/brave/brave-browser/issues/31897 https://github.com/brave/brave-browser/issues/31897
• topshelf 3y ago
  @dang Would we be able to update the title please? To clarify the acronym, _Google is already pushing Web Environment Integrity (WEI) into Chromium_
• _cenw 3y ago
  A good way to measure how annoying this would get is to look at the handful of applications demanding SafetyNet on Android. It is not quite as much as one would assume, since adding friction of any kind is a retention killer. On the open web this would likely be worse, since you are locking out more than jailbreakers and emulator users.
• mrguyorama 3y ago
  If you STILL use chrome after this, you were never willing to give an alternative even a little bit of a chance anyway. Surely not supporting this and the power it gives Google over the web is worth a "slower" (I've never experienced that) browser or one with a stupid pocket logo in the corner that you NEVER HAVE TO INTERACT WITH EVER
• rekabis 3y ago
  Will there be any way to disable it within Chrome?
• rolph 3y ago
  How to Email to the President and Members of Congress https://www.einvestigator.com/government-email-addresses/ https://www.einvestigator.com/government-email-addresses/ [2022] this abuse of tech, potentially goes beyond antitrust, and damages global economic wellbeing, as well as impoverishing information systems on global scale, generating isolation, ignorance, division, and radicalization.
• nightshadetrie 3y ago
  bruh
• esafak 3y ago
  WEI stands for Web Environment Integrity: https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity
• croes 3y ago
  Hey Google, how about removing that "feature" because of lack of interest as with Jpeg XL?
• funOtter 3y ago
  How does this affect people using Pi-hole to block ads?
• sproketboy 3y ago
  [dead]
• prozacchiwawa 3y ago
  It's such a lazy, bad proposal that even if one wanted what it promises to deliver, you'd be hard pressed to choose a better way of getting it used for malicious purposes. Handing the token back to the web script means successful cross site scripting attacks can farm, exfiltrate and repurpose the tokens, as well as bypass attempts to limit which domains are allowed to receive their contents.
• esbeeb 3y ago
  There should be a "United Guild of Noble GentleNerds", which Google, and all it's employees, could be formally kicked out of.
• IYasha 3y ago
  Is it possible for web server software developers to oppose this? I mean, if Apache and Nginx join in protest and refuse to suport it, Goolag will lose!
• animex 3y ago
  If it's possible to detect the feature and reject delivering to a browser that has this feature enabled. Fight.
• greatgib 3y ago
  In my opinion, I think that it is good to remember the name of these developers that have not enough moral ethic to not betray the internet and users: - Peter Bork Pakkenberg - Rayan Kanso - Dmitry Gozman - Richard Coles - Kinuko Yasuda Let's not forget that it is not Google in itself, but persons being the keyboard that are pushing that. People that have the power to say no but did not. I don't know you, but at the next Google mass layoff, I will certainly not offer to give an employment to someone with so little morality like them...