7 ms·

Google Tries to Defend Its Web Environment Integrity Critics Slam It as Danger

178 points by rolph 3y ago

alex7734 3y ago
I find the blatant gaslighting regarding this topic baffling. > Wisner insists that “WEI is not designed to single out browsers or extensions” and that it won’t block browsers that spoof their identity. WEI's sole purpose in life is to detect browsers that do things that Google does not like. If it does not block browsers that spoof their identity then what the hell does it do? Sure, sure, WEI won't block them: it will just tell the web server that you are not using an approved browser. It's not Google's fault if the web server then blocks you! How could they have known? I would find it slightly more respectable if Google just came out and said the quiet part out loud: "Our profits and the industry's profits are more important than your freedom, so shut up and take it, since you can do nothing about it." Sneaking around like this is just an insult to our intelligence.
- andrei_says_ 3y ago
  > Our profits and the industry's profits are more important than your freedom, so shut up and take it, since you can do nothing about it. I honestly think they are saying it, just in their weasel speak gaslighting way.
- devsda 3y ago
  It is not just gaslighting but there were attempts to malign those who are opposing this. From official proposal forum: https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/XCAIgPtxAQAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_... > Attacks and doxing make me personally MORE likely to support stronger safety features in chromium, as such acts increase my suspicion that there is significant intimidation from criminals who are afraid this feature will disrupt their illegal and/or unethical businesses, and I don't give in to criminals or bullies They have apologized for using the word criminals & bullies in a broader context and I appreciate that. However, the initial part of the comment is very telling of how they view those who oppose. This proposal will mainly disrupt ad-blockers, rooted devices and any one who is willing to maintain control of their own tech stack and they are considered illegal/unethical businesses. I can't ignore the parallels with the real world here. Authoritarian government introduces laws that restrict freedom and privacy. People oppose and protest. Government doubles down and proclaims only those who do illegal activities are protesting and they are the ones that have something to hide. Seeing how many there are, we urgently need these laws. Further down in the response: > the whole point of designing in the open and having public debate is to find reasonable compromises between stakeholders with very different perspectives You can either introduce a hostile feature in one go or through a series of "compromises" which is also known as "Boiling the frog" strategy. Unless the current one is abandoned and there's a radically different approach, I don't think there's any scope for compromise in the current proposal.
  - matheusmoreira 3y ago
    "Stakeholders" is just an euphemism for "the people with the money". The "stakeholders" want it this way, "finding compromises" just means figuring out how to get everyone else to accept it.
  - the_lego 3y ago
    > Attacks and doxing make me personally MORE likely to support stronger safety features in chromium, as such acts increase my suspicion that there is significant intimidation from criminals who are afraid this feature will disrupt their illegal and/or unethical businesses, and I don't give in to criminals or bullies > Kick a puppy > Get attacked for kicking a puppy > "These attacks make me MORE likely to keep kicking puppies, as I don't give in to intimidation from criminals and bullies that want healthy puppies for their nefarious ends."
    - Macha 3y ago
      This seems to be a growing corporate strategy 1. Take an action that will annoy a large group of people 2. Since it is a large group of people, there will be some that take criticism too far 3. Hold up those examples as being representative of all your critics 4. No longer debate your unpopular action, claim it's for harassment reasons.
      - licebmi__at__ 3y ago
        >growing I mean, you must be new to activism, but yeah, this is textbook deflection.
      - walterbell 3y ago
        > there will be some that take criticism too far If not, that can be remedied.
  - lucasyvas 3y ago
    Mr. Wisner should grow thicker skin - if this is the reaction now wait until the real roasting begins for what is probably the shittiest proposal of all time. In a just world anyone supporting this initiative would be imprisoned in my books. It's a time bombed crime against humanity waiting to happen. They know what they are doing and got called out on it.
- GhostWhisperer 3y ago
  > you can do nothing about it there is plenty we can do, but we have to give up some "comforts"
  - alex7734 3y ago
    Sure, you can convince people to use Firefox and drop Chrome just like IE was dropped back in the day but back then there wasn't a strong incentive to websites to prefer one browser over another (other than convenience). Here's what I think is gonna happen: - First the feature is added to Chrome as it is now. As they described they add it with some kind of hold-back or limiting constraint to reduce the outrage until everything is ready. - Then the media people (Netflix, Hulu, Disney, YouTube...), who have long been salivating for something like this, push the other browsers to implement this. You really only need to convince Safari, as Edge has such a low market share in comparison that they will be forced to fold or be irrelevant (and it's not like Microsoft hates this feature anyway). For reference, Chrome, Safari and Edge make up 89% of market share. Edge alone is only 4%. - Once the browsers are on board it's time to get the sites onboard. Really most people tend to visit social media sites more than anything else, so as long as you get them onboard you don't need to do anything else, and WEI serves their interests as well (for example it would stop you from scraping Reddit). - As for the rest of the sites you can just make Adsense not count views or clicks from untrusted users (after all that's the _stated goal_ of this project) and site owners _will_ find ways to get their users to switch to Chrome on their own. You can add a checkbox to Adsense to get it to block your site for untrusted users to make it extra easy if you're feeling lazy. - The final strike will be Cloudflare. Right now they rely on CAPTCHA to block bots but now they can just use WEI instead. Since most of the web uses Cloudflare now you have a gateway between the user and most sites that will tell you to go away or eternally give you endless CAPTCHAS if you are using a "bad browser". - At this point all that is left is getting Google to give Cloudflare an exemption to the hold-back feature "for the greater good" or just kill it off at this point because there's no need to play nice anymore. I'm not optimistic. It was easy to install Firefox and remove the IE icon on your mom's computer back in the day. It's not that easy to tell her to stop watching Netflix, Disney, Reddit, Facebook, her favorite cooking recipe site... The best that can happen is that the internet splits and the free portion of it stays large enough to be useful. (and it doesn't get DDOSed into the ground)
- genocidicbunny 3y ago
  > > Wisner insists that “WEI is not designed to single out browsers or extensions” and that it won’t block browsers that spoof their identity. Lets have Wisner, or Google, put their money where their mouth is. Lets have a serious financial penalty per instance where someone's browser is blocked due to WEI, regardless of who is doing the actual blocking. Because that is what you're promising us here. Or are you a bold-faced liar Mr. Wisner?
  - martin8412 3y ago
    100mio per instance sounds fair for Google, and 10k per instance for Wisner sounds fair. It's after all not something that will happen he claims.
    - paradox460 3y ago
      And a requirement that both personally apologize to those affected for every single instance
      - rolph 3y ago
        verbal repairations to damaged reputation, and statement of fault.
      - martin8412 3y ago
        Personally? Not needed. It just needs to be posted in <h1> on Google.com
        paradox460 3y ago
        No I want some executive to come out, buy me a nice meal, and explain why they fucked up and how they're going to make it right.
- pawelmurias 3y ago
  > If it does not block browsers that spoof their identity then what the hell does it do? They mentioned recognizing which ads where viewed and clicked by humans. Stood out as the thing they really want.
  - matheusmoreira 3y ago
    They want the browser to be their corporate agents rather than our user agents. They think the browser is just a vehicle for their ads.
  - danShumway 3y ago
    That's what we're getting at though: if you don't block browsers that spoof their identity, then you don't know that the browser isn't acting as a robot and clicking on ads in place of a human. The only way this proposal is valuable for reducing ad fraud is if it blocks browser automation.
    - pawelmurias 3y ago
      You can recognize a browser as suspicious and not pay for or flag the ad clicks it makes without blocking access.
      - danShumway 3y ago
        We might be talking past each other. I'm talking about what browsers Google blocks, ie what browsers don't get attestation tokens. If Google isn't blocking extensions, ad fraud can still happen and your ad server won't recognize the browser as suspicious because it will have an attestation token. If Google isn't blocking spoofed browsers from attestation, they won't look suspicious. They'll have normal attestation tokens. Allowing a browser to spoof their identity as Chrome means there isn't really any distinction between a trusted and untrusted browser. ---- To your specific point though, let's imagine that Google does block those browsers in the sense that it marks them as untrusted, but it's up to the individual ad networks to figure out if they want to block those requests or not. If the idea here is that ad networks will recognize that a browser is unapproved and will still serve it the content anyway but just auto-discard the data that's coming out of it, I would really strongly suggest that is not a very likely outcome. You're telling me if I use Firefox and it doesn't implement this API, every ad company will just stop tracking me and will discard any ad numbers they get from me? If Safari ends up not implementing this API ad-clicks on Safari will just get automatically flagged as spam? No ad network is going to want to do that, especially if automatic hold-backs get involved. A policy that guaranteed lowers your monetizable impressions/clicks by at least 5-15%, even though you know for a fact that many of those clicks are coming from real users? I have a really hard time believing any ad network would accept that.
- martin8412 3y ago
  Zyklon B was also not designed to kill people, but the people at Degesch sure as hell knew what NSDAP was going to use those large quantities for.
- danShumway 3y ago
  This is Google's general strategy for dealing with any controversy surrounding web standards, not just the big ones around ad blocking. The first thing that they will always say is, "critics don't understand what we're trying to do and they're unknowledgeable about the spec and there's a lot of misinformation floating around..." Literally any controversy about a standard that Chrome adopts, that will always be the first thing that Google says. It's just a standard pattern. Being able to say, "I understand people's concerns and I have concerns and we need to have a conversation and iterate but it's just hard with all this misinformation floating around" allows Google to position themselves as a reasonable party while also allowing them to completely ignore any criticism that is inconvenient because they just lump it into the misinformation category. If the gaslighting doesn't work, Google's next step will be to talk about how the debate has spiraled out of control and how everyone needs to "remember the human." If that doesn't work, they'll lock down and refuse to talk to critics and then plead with critics to be patient because "we're working on it." Then they'll make some minor changes to the spec and claim that everyone's criticisms are outdated and go back to the gaslighting again. That's already happened here, the original spec did not mandate hold-backs, in fact it suggested that hold-backs were not a desirable solution to pursue. Now all of a sudden it's, "why is everyone so mad, don't they know we have hold-backs?" If everything falls apart and Google has to backtrack, the closest thing that you'll get to an apology from Google is that "we need to be better about communicating with users/developers." It's not that anything was wrong, it was that the web standards teams just weren't able to communicate how right they were. And then we'll repeat the process with whatever the next controversy is. ---- I wrote a little bit about this process back in 2018 when web audio was the controversy (a comparatively minor browser change with very few privacy implications): https://danshumway.com/blog/chrome-autoplay https://danshumway.com/blog/chrome-autoplay and I keep paying attention to how Chrome approaches controversy, and it's pretty much always following this pattern, it's wild how consistently this has played out with Manifest V3, FLOC, Topics, etc, etc... Developers and users should get better at recognizing this stuff during debates about Google policy, and they should go into conversations with the Chromium team about web standard controversies expecting that they will play out this way.
  - barkingcat 3y ago
    What happens next is they implement it, and then cancel the entire project by shutting it down because the manager that championed it moved to a different department/product. when asked why would they shut down something they were fighting nail and tooth for, they would shrug and say it's not in the okr. (and gaslight everyone again, saying they never thought it was important to begin with)
brucethemoose2 3y ago
Oh, TechReport. Thats a name I haven't seen in awhile. This used to be a highly regarded PC hardware site, famous for (among other things) pioneering frametime consistency testing. AMD and Nvidia are better today because of TR's relentless benchmarking. Looks like they sold the domain to a generic tech news generator. Which circles right back around to the content of this article.
bagacrap 3y ago
Google has nearly 200k employees. What's the highest ranking one of them that has said anything about WEI publicly?
- deathbypenguin 3y ago
  People are making money, and in most cases not the kind of money the decision-makers are getting. Is it unethical? maybe it is. I think it is, and in the past I have had the gumption to just quit, but that also comes from privilege. I was in a position where quitting was not going to cripple my living... some people might not be in that situation.
- wildrhythms 3y ago
  Do you think high ranking people at FAANG even know what WEI is, or how web APIs work at all? Lol "Our biggest customers have told us this is important to them" is the only internal justification needed to push this through.
  - curt15 3y ago
    "99% of our users love the increased peace of mind from a tightly controlled browser environment."
dataflow 3y ago
WEI sounds awful. And it seems like yet another aspect of the ongoing war on general-purpose computing. > Wisner insists that [...] it won’t block browsers that spoof their identity. What exactly is holding anyone to this pinky promise? Even if you assume angels are running everything right now, why should anyone trust that that will remain the case perpetually?
- martin8412 3y ago
  [flagged]
  - blooalien 3y ago
    Guns don't kill people. Guns are a tool for killing at a distance, yes; however it's people who sometimes misuse the tool to kill other people. Other people use guns to kill food to feed their family, or to kill or deter bad people who mean them great physical harm. Most all tools can be misused in bad ways, or used in positive ways. That responsibility all falls back upon the user, as the tool itself will usually just sit there inert without a human involved.
    - chownie 3y ago
      Recent history has taught us that the upside to popular gun ownerships are vanishingly thin compared to the thick wedge of accidental deaths and mass shootings. The ability to ruin someone's life should be restricted behind more than a point and click interface.
      - deleted 3y ago
        [deleted]
    - wildrhythms 3y ago
      How much 'killing distance' do you think is involved when gun ownership is associated with 8x higher chance of suicide for men, and 35x higher chance of suicide for women? https://med.stanford.edu/news/all-news/2020/06/handgun-ownership-associated-with-much-higher-suicide-risk.html https://med.stanford.edu/news/all-news/2020/06/handgun-owner...
klipklop 3y ago
Let’s not dance around it like Google is doing. We should not tolerate WEI. We all know the end game with this tech. Google and all the people that work on chrome should be ashamed of themselves. They have taken a stand in the past, but right now it’s crickets…
potsandpans 3y ago
I checked today, and it looks like the proposal is still closed to contributions. it's been that way for a week. what's an open proposal that's closed to all discourse? I'm sure that this is done under the premise of "too charged of a topic to be productive." I wonder what happens next. Either they close it and say sorry, or they quietly open the proposal back up after the initial frenzy. Hate to assume malice here, but it seems somewhat obvious that the latter will happen.
- pornel 3y ago
  They'll write a blog post "you're angry, because you just don't understand how good it is" and do it anyway.
- thrown1212 3y ago
  They’ll consort with an inner circle of “industry” accomplices to “address concerns”, keeping everyone out while covering the “we consulted widely” angle. This will get pushed through under cover of darkness with enough of a fig leaf of due process to plausible deny anything other than good intent. If you’re working on this, shame on you.
user6723 3y ago
The purpose of wei is they want one of the handful of closed source OS to be a requirement to use any commercial website. Terry Davis wasn't far off when he said "they" want a world where you don't have access to a compiler. With wei "they" can sidestep open source entirely. "Why would I want open source encryption? I don't have anything to hide." "Why don't you have a normal phone?" "Why come you don't have a tattoo?!" Idiocracy is playing out in front of us. Anyone who accepts wei is a lower tier of human than those who reject it.
- flangola7 3y ago
  Tattoo?
  - nmeagent 3y ago
    IIRC the people in the world of Idiocracy were all tattooed with some kind of barcode, or were chipped, or something else along those lines.
    - deleted 3y ago
      [deleted]
  - user6723 3y ago
    Basically a vaxx pass to buy a hotdog.
- macic 3y ago
  Terry was right
freefaler 3y ago
No unhinged computers for the people as predicted years ago by Cory. Cory Doctorow has a great talk: "The coming war on general computation" from 2011 (12 years ago) in which he argues that all general computing platforms (OS, phone OS, browser) would face challenges by governments and corporations. This looks like another way to control content distribution and put more control in Google's hands. They've made a great strategic choice in building Chrome browser and effectively superseded Microsoft and Apple on desktops as a platform. The talk can be found here: https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg BTW, in the Soviet Union you couldn't have bought radios that were freely tunable to certain frequencies. The same was done in Warsaw where German occupation forces collected all radios from the people. Future doesn't look good for freedom ... When the tools exists, people that control them would find a use. Look what's happening in the UK cryptography battle, the same trend there ...
- matheusmoreira 3y ago
  Yeah, the future looks bleak. It just feels so hopeless. I understand the problem, I understand what needs to be done but I don't have the means or capital to do it. Free computers are a great thing and they will be destroyed by all these governments and corporations who want to control them.
matheusmoreira 3y ago
Remote attestation for the web: a way for websites to have cryptographic proof that you haven't "tampered" with the page by deleting ads.
qrios 3y ago
The implementation will be really interesting: can a VM, container, or RDP be compliant ever with WEI? To proof - or give at least a solid certainty, a runtime is direct connected to a GUI, and function calls triggered by this GUI are coming from event handler, triggered by human interactions with a keyboard or pointer device, WEI would need a separate channel to the cam. This means the only way to make this proof is to link the current environment and interactions with a history of interactions stored by a third party (i.e. Google). This only would make WEI to a new layer on top of todays fingerprinting.
- arianvanp 3y ago
  Yes. For example ChromeOS doesn't provide direct TPM access to the browser sandboxes but virtualizes a vTPM per application. Same technology is used for GCP where each server is attached a virtual TPM by the hypervisor.
Try1275 3y ago
Will Google enforce this by downrating a website's SEO scores if they it doesn't implement it? Is this the plan?
rpdillon 3y ago
The last paragraph is a bit surprising: > WEI can potentially be used to impose restrictions on unlawful activities on the internet, such as downloading YouTube videos and other content, ad blocking, web scraping, etc. Since when did archiving, ad blocking, and web scraping become unlawful? This sounds like a wishlist of activities Google wishes were unlawful.
- raxxorraxor 3y ago
  AI companies that scraped the net previously would like that too. They have their data and don't want others to have the same opportunities.
- Ekaros 3y ago
  So will the WEI block Google from web scraping? That might even be a good thing.
  - CaptainFever 3y ago
    Google is illegal now /s Or, more realistically, a way to prevent competitors from doing web scraping as well.
  - bpye 3y ago
    If they own the attestation for Chrome then presumably they could also allow their scrapers to attest?
    - martin8412 3y ago
      That sounds like an antitrust lawsuit.
- rolph 3y ago
  you are witnessing a corporation that is making extrajudicial laws, and a method of enforcing them. this is attempted parallel government, and is at least illegal, if not domestic terrorism.
not_enoch_wise 3y ago
Google: "Why is the market behaving as if we have no credibility??"
j0hnyl 3y ago
WEI seems like a nig nothing burger to me. I interpret it as just another anti bot verification service, but the incentive is simply not there for publishers to use it unless they want to lose out on every person who uses a browser other than the most up to date Chrome.
- thefurdrake 3y ago
  > other than the most up to date Chrome. Yes, I'm sure Google cares a great deal about losing 17% [1] of its market share, or even less considering how many people with weak spines will switch if they're denied access to something based on browser and never look back. I'm sure Google won't do something malicious like mandating anyone using google's adtech to implement this to ensure "integrity" of clickthroughs. I'm sure Google won't use its market dominance to require this feature for every one of its products and intentionally cripple other browsers, as that's definitely not something they've done before and would be totally unprecedented in the modern tech industry. F Google. [1] https://kinsta.com/browser-market-share/ https://kinsta.com/browser-market-share/
  - j0hnyl 3y ago
    WEI is a tool for publishers. Mandating that publishers use it to qualify for google ads will be completely suicidal for google. Most folks access google ad demand through resellers.
    - nullc 3y ago
      Mandate? How about just compensating them differential based on the assumed WEI vs non-WEI clickfraud rates?
      - j0hnyl 3y ago
        Then they will only implement for those impressions/clicks, the same way they switch around between a handful of anti-bot vendors today, because none of them have alignment. Edit: Also not sure if WEI spec only calls for a page level implementation, but if not then this will just be implemented inside ad frames and publishers won't need to touch it. I think HN is overthinking this the same way everyone freaked out about AMP, the impact of which is completely negligible a couple years later.
danShumway 3y ago
The last sentence of the article: > WEI can potentially be used to impose restrictions on unlawful activities on the internet, such as downloading YouTube videos and other content, ad blocking, web scraping, etc. Note that every single one of those activities is legal. It's legal to scrape websites. It's legal to download Youtube videos (copyright violation is the crime, not downloading videos, and there are plenty of videos on Youtube that can be legally downloaded). It is legal to block ads. This article isn't bad, but it really shouldn't be playing into these tropes. That sentence caught me off-guard because it's just straight up wrong, and wrong in a harmful way that suggests that there aren't court ruling showing that these activities are legal, and that people should be somehow ashamed for doing them or that they're doing something transgressive when they scrape a website.
- kahnclusions 3y ago
  "Copyright violation" is not a crime. The rights holder can sue you in civil court.
  - dragonwriter 3y ago
    > "Copyright violation" is not a crime. It is, in fact. (17 USC § 506) As with many things that are both crimes and torts, the crime is defined differently and somewhat more narrowly than the tort.
  - danShumway 3y ago
    What dragonwriter wrote, but also this is the difference between a meaningful distinction and a (mildly) pedantic distinction[0]. When I say "downloading a Youtube video isn't a crime" I'm indicating a category difference that means more than "specifically the government can't convict you over it." I mean that Youtube doesn't have a legal leg to stand on to make you stop; it's not a questionably legal activity that we ignore, it's not an illegal activity that's too hard to prosecute, it's not something you should feel bad about. It's not a (generic sense) "crime". It's not just "you won't face a specific kind of legal trouble" -- you're allowed to do it. Scraping websites is allowed, and if someone sues you over it and you fight the lawsuit with decent lawyers you will win. Copyright violation doesn't fall into that category -- you can end up facing legal consequences for violating copyright. But downloading videos from Youtube is not inherently copyright violation. It's possible I should have been used a more generic word than "crime" to avoid that confusion. ---- [0]: To be fair, I've also made the same distinction to people about lawsuits/crimes before, so I'm not sure I really have any grounds to call you out here :)
tamimio 3y ago
General rule of thumb: any proposal by one of the big tech companies should be considered bad and harmful for the FOSS communities or anyone who still values their privacy in the internet.
happytiger 3y ago
Ok, lets be completely honest about what this is. This enables Google to reliably control user-installed ad blockers, which is hurting their business. There is no reasonable defense for this “wolf-in-sheep’s clothing” control grab. It doesn’t benefit users to be constantly tracked and controlled and especially have one company in control of that, and this is another example of unnecessary and overly centralized meddling masquerading as security. Google needs to get behind freedom and privacy — they are strongly heading in the wrong direction — and right before GPI. :(
egberts1 3y ago
Google is already blocking Apple Safari (on a lockdown Apple iOS) from user being able to login. Had to use Firefox/Webkit/iOS to sign into Google. Enough said.
- egberts1 3y ago
  And on Apple iPad/iOS too, Google is blocking this user from logging into Google account. (sigh)
1MachineElf 3y ago
Google's WEI API is their answer to Microsoft's Pluton, which is Microsoft's answer to Apple's walled garden device attestation, is their answer to... How should we adapt to a world where this pattern never ends, in a way that preserves our human rights?

178 points by rolph 3y ago

I find the blatant gaslighting regarding this topic baffling. > Wisner insists that “WEI is not designed to single out browsers or extensions” and that it won’t block browsers that spoof their identity. WEI's sole purpose in life is to detect browsers that do things that Google does not like. If it does not block browsers that spoof their identity then what the hell does it do? Sure, sure, WEI won't block them: it will just tell the web server that you are not using an approved browser. It's not Google's fault if the web server then blocks you! How could they have known? I would find it slightly more respectable if Google just came out and said the quiet part out loud: "Our profits and the industry's profits are more important than your freedom, so shut up and take it, since you can do nothing about it." Sneaking around like this is just an insult to our intelligence.

andrei_says_ 3y ago
> Our profits and the industry's profits are more important than your freedom, so shut up and take it, since you can do nothing about it. I honestly think they are saying it, just in their weasel speak gaslighting way.
devsda 3y ago
It is not just gaslighting but there were attempts to malign those who are opposing this. From official proposal forum: https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/XCAIgPtxAQAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_... > Attacks and doxing make me personally MORE likely to support stronger safety features in chromium, as such acts increase my suspicion that there is significant intimidation from criminals who are afraid this feature will disrupt their illegal and/or unethical businesses, and I don't give in to criminals or bullies They have apologized for using the word criminals & bullies in a broader context and I appreciate that. However, the initial part of the comment is very telling of how they view those who oppose. This proposal will mainly disrupt ad-blockers, rooted devices and any one who is willing to maintain control of their own tech stack and they are considered illegal/unethical businesses. I can't ignore the parallels with the real world here. Authoritarian government introduces laws that restrict freedom and privacy. People oppose and protest. Government doubles down and proclaims only those who do illegal activities are protesting and they are the ones that have something to hide. Seeing how many there are, we urgently need these laws. Further down in the response: > the whole point of designing in the open and having public debate is to find reasonable compromises between stakeholders with very different perspectives You can either introduce a hostile feature in one go or through a series of "compromises" which is also known as "Boiling the frog" strategy. Unless the current one is abandoned and there's a radically different approach, I don't think there's any scope for compromise in the current proposal.
- matheusmoreira 3y ago
  "Stakeholders" is just an euphemism for "the people with the money". The "stakeholders" want it this way, "finding compromises" just means figuring out how to get everyone else to accept it.
- the_lego 3y ago
  > Attacks and doxing make me personally MORE likely to support stronger safety features in chromium, as such acts increase my suspicion that there is significant intimidation from criminals who are afraid this feature will disrupt their illegal and/or unethical businesses, and I don't give in to criminals or bullies > Kick a puppy > Get attacked for kicking a puppy > "These attacks make me MORE likely to keep kicking puppies, as I don't give in to intimidation from criminals and bullies that want healthy puppies for their nefarious ends."
  - Macha 3y ago
    This seems to be a growing corporate strategy 1. Take an action that will annoy a large group of people 2. Since it is a large group of people, there will be some that take criticism too far 3. Hold up those examples as being representative of all your critics 4. No longer debate your unpopular action, claim it's for harassment reasons.
    - licebmi__at__ 3y ago
      >growing I mean, you must be new to activism, but yeah, this is textbook deflection.
    - walterbell 3y ago
      > there will be some that take criticism too far If not, that can be remedied.
- lucasyvas 3y ago
  Mr. Wisner should grow thicker skin - if this is the reaction now wait until the real roasting begins for what is probably the shittiest proposal of all time. In a just world anyone supporting this initiative would be imprisoned in my books. It's a time bombed crime against humanity waiting to happen. They know what they are doing and got called out on it.
GhostWhisperer 3y ago
> you can do nothing about it there is plenty we can do, but we have to give up some "comforts"
- alex7734 3y ago
  Sure, you can convince people to use Firefox and drop Chrome just like IE was dropped back in the day but back then there wasn't a strong incentive to websites to prefer one browser over another (other than convenience). Here's what I think is gonna happen: - First the feature is added to Chrome as it is now. As they described they add it with some kind of hold-back or limiting constraint to reduce the outrage until everything is ready. - Then the media people (Netflix, Hulu, Disney, YouTube...), who have long been salivating for something like this, push the other browsers to implement this. You really only need to convince Safari, as Edge has such a low market share in comparison that they will be forced to fold or be irrelevant (and it's not like Microsoft hates this feature anyway). For reference, Chrome, Safari and Edge make up 89% of market share. Edge alone is only 4%. - Once the browsers are on board it's time to get the sites onboard. Really most people tend to visit social media sites more than anything else, so as long as you get them onboard you don't need to do anything else, and WEI serves their interests as well (for example it would stop you from scraping Reddit). - As for the rest of the sites you can just make Adsense not count views or clicks from untrusted users (after all that's the _stated goal_ of this project) and site owners _will_ find ways to get their users to switch to Chrome on their own. You can add a checkbox to Adsense to get it to block your site for untrusted users to make it extra easy if you're feeling lazy. - The final strike will be Cloudflare. Right now they rely on CAPTCHA to block bots but now they can just use WEI instead. Since most of the web uses Cloudflare now you have a gateway between the user and most sites that will tell you to go away or eternally give you endless CAPTCHAS if you are using a "bad browser". - At this point all that is left is getting Google to give Cloudflare an exemption to the hold-back feature "for the greater good" or just kill it off at this point because there's no need to play nice anymore. I'm not optimistic. It was easy to install Firefox and remove the IE icon on your mom's computer back in the day. It's not that easy to tell her to stop watching Netflix, Disney, Reddit, Facebook, her favorite cooking recipe site... The best that can happen is that the internet splits and the free portion of it stays large enough to be useful. (and it doesn't get DDOSed into the ground)
genocidicbunny 3y ago
> > Wisner insists that “WEI is not designed to single out browsers or extensions” and that it won’t block browsers that spoof their identity. Lets have Wisner, or Google, put their money where their mouth is. Lets have a serious financial penalty per instance where someone's browser is blocked due to WEI, regardless of who is doing the actual blocking. Because that is what you're promising us here. Or are you a bold-faced liar Mr. Wisner?
- martin8412 3y ago
  100mio per instance sounds fair for Google, and 10k per instance for Wisner sounds fair. It's after all not something that will happen he claims.
  - paradox460 3y ago
    And a requirement that both personally apologize to those affected for every single instance
    - rolph 3y ago
      verbal repairations to damaged reputation, and statement of fault.
    - martin8412 3y ago
      Personally? Not needed. It just needs to be posted in <h1> on Google.com
      - paradox460 3y ago
        No I want some executive to come out, buy me a nice meal, and explain why they fucked up and how they're going to make it right.
pawelmurias 3y ago
> If it does not block browsers that spoof their identity then what the hell does it do? They mentioned recognizing which ads where viewed and clicked by humans. Stood out as the thing they really want.
- matheusmoreira 3y ago
  They want the browser to be their corporate agents rather than our user agents. They think the browser is just a vehicle for their ads.
- danShumway 3y ago
  That's what we're getting at though: if you don't block browsers that spoof their identity, then you don't know that the browser isn't acting as a robot and clicking on ads in place of a human. The only way this proposal is valuable for reducing ad fraud is if it blocks browser automation.
  - pawelmurias 3y ago
    You can recognize a browser as suspicious and not pay for or flag the ad clicks it makes without blocking access.
    - danShumway 3y ago
      We might be talking past each other. I'm talking about what browsers Google blocks, ie what browsers don't get attestation tokens. If Google isn't blocking extensions, ad fraud can still happen and your ad server won't recognize the browser as suspicious because it will have an attestation token. If Google isn't blocking spoofed browsers from attestation, they won't look suspicious. They'll have normal attestation tokens. Allowing a browser to spoof their identity as Chrome means there isn't really any distinction between a trusted and untrusted browser. ---- To your specific point though, let's imagine that Google does block those browsers in the sense that it marks them as untrusted, but it's up to the individual ad networks to figure out if they want to block those requests or not. If the idea here is that ad networks will recognize that a browser is unapproved and will still serve it the content anyway but just auto-discard the data that's coming out of it, I would really strongly suggest that is not a very likely outcome. You're telling me if I use Firefox and it doesn't implement this API, every ad company will just stop tracking me and will discard any ad numbers they get from me? If Safari ends up not implementing this API ad-clicks on Safari will just get automatically flagged as spam? No ad network is going to want to do that, especially if automatic hold-backs get involved. A policy that guaranteed lowers your monetizable impressions/clicks by at least 5-15%, even though you know for a fact that many of those clicks are coming from real users? I have a really hard time believing any ad network would accept that.
martin8412 3y ago
Zyklon B was also not designed to kill people, but the people at Degesch sure as hell knew what NSDAP was going to use those large quantities for.
danShumway 3y ago
This is Google's general strategy for dealing with any controversy surrounding web standards, not just the big ones around ad blocking. The first thing that they will always say is, "critics don't understand what we're trying to do and they're unknowledgeable about the spec and there's a lot of misinformation floating around..." Literally any controversy about a standard that Chrome adopts, that will always be the first thing that Google says. It's just a standard pattern. Being able to say, "I understand people's concerns and I have concerns and we need to have a conversation and iterate but it's just hard with all this misinformation floating around" allows Google to position themselves as a reasonable party while also allowing them to completely ignore any criticism that is inconvenient because they just lump it into the misinformation category. If the gaslighting doesn't work, Google's next step will be to talk about how the debate has spiraled out of control and how everyone needs to "remember the human." If that doesn't work, they'll lock down and refuse to talk to critics and then plead with critics to be patient because "we're working on it." Then they'll make some minor changes to the spec and claim that everyone's criticisms are outdated and go back to the gaslighting again. That's already happened here, the original spec did not mandate hold-backs, in fact it suggested that hold-backs were not a desirable solution to pursue. Now all of a sudden it's, "why is everyone so mad, don't they know we have hold-backs?" If everything falls apart and Google has to backtrack, the closest thing that you'll get to an apology from Google is that "we need to be better about communicating with users/developers." It's not that anything was wrong, it was that the web standards teams just weren't able to communicate how right they were. And then we'll repeat the process with whatever the next controversy is. ---- I wrote a little bit about this process back in 2018 when web audio was the controversy (a comparatively minor browser change with very few privacy implications): https://danshumway.com/blog/chrome-autoplay https://danshumway.com/blog/chrome-autoplay and I keep paying attention to how Chrome approaches controversy, and it's pretty much always following this pattern, it's wild how consistently this has played out with Manifest V3, FLOC, Topics, etc, etc... Developers and users should get better at recognizing this stuff during debates about Google policy, and they should go into conversations with the Chromium team about web standard controversies expecting that they will play out this way.
- barkingcat 3y ago
  What happens next is they implement it, and then cancel the entire project by shutting it down because the manager that championed it moved to a different department/product. when asked why would they shut down something they were fighting nail and tooth for, they would shrug and say it's not in the okr. (and gaslight everyone again, saying they never thought it was important to begin with)

brucethemoose2 3y ago

Oh, TechReport. Thats a name I haven't seen in awhile. This used to be a highly regarded PC hardware site, famous for (among other things) pioneering frametime consistency testing. AMD and Nvidia are better today because of TR's relentless benchmarking. Looks like they sold the domain to a generic tech news generator. Which circles right back around to the content of this article.

bagacrap 3y ago

Google has nearly 200k employees. What's the highest ranking one of them that has said anything about WEI publicly?

deathbypenguin 3y ago
People are making money, and in most cases not the kind of money the decision-makers are getting. Is it unethical? maybe it is. I think it is, and in the past I have had the gumption to just quit, but that also comes from privilege. I was in a position where quitting was not going to cripple my living... some people might not be in that situation.
wildrhythms 3y ago
Do you think high ranking people at FAANG even know what WEI is, or how web APIs work at all? Lol "Our biggest customers have told us this is important to them" is the only internal justification needed to push this through.
- curt15 3y ago
  "99% of our users love the increased peace of mind from a tightly controlled browser environment."

dataflow 3y ago

WEI sounds awful. And it seems like yet another aspect of the ongoing war on general-purpose computing. > Wisner insists that [...] it won’t block browsers that spoof their identity. What exactly is holding anyone to this pinky promise? Even if you assume angels are running everything right now, why should anyone trust that that will remain the case perpetually?

martin8412 3y ago
[flagged]
- blooalien 3y ago
  Guns don't kill people. Guns are a tool for killing at a distance, yes; however it's people who sometimes misuse the tool to kill other people. Other people use guns to kill food to feed their family, or to kill or deter bad people who mean them great physical harm. Most all tools can be misused in bad ways, or used in positive ways. That responsibility all falls back upon the user, as the tool itself will usually just sit there inert without a human involved.
  - chownie 3y ago
    Recent history has taught us that the upside to popular gun ownerships are vanishingly thin compared to the thick wedge of accidental deaths and mass shootings. The ability to ruin someone's life should be restricted behind more than a point and click interface.
    - deleted 3y ago
      [deleted]
  - wildrhythms 3y ago
    How much 'killing distance' do you think is involved when gun ownership is associated with 8x higher chance of suicide for men, and 35x higher chance of suicide for women? https://med.stanford.edu/news/all-news/2020/06/handgun-ownership-associated-with-much-higher-suicide-risk.html https://med.stanford.edu/news/all-news/2020/06/handgun-owner...

klipklop 3y ago

Let’s not dance around it like Google is doing. We should not tolerate WEI. We all know the end game with this tech. Google and all the people that work on chrome should be ashamed of themselves. They have taken a stand in the past, but right now it’s crickets…

potsandpans 3y ago

I checked today, and it looks like the proposal is still closed to contributions. it's been that way for a week. what's an open proposal that's closed to all discourse? I'm sure that this is done under the premise of "too charged of a topic to be productive." I wonder what happens next. Either they close it and say sorry, or they quietly open the proposal back up after the initial frenzy. Hate to assume malice here, but it seems somewhat obvious that the latter will happen.

pornel 3y ago
They'll write a blog post "you're angry, because you just don't understand how good it is" and do it anyway.
thrown1212 3y ago
They’ll consort with an inner circle of “industry” accomplices to “address concerns”, keeping everyone out while covering the “we consulted widely” angle. This will get pushed through under cover of darkness with enough of a fig leaf of due process to plausible deny anything other than good intent. If you’re working on this, shame on you.

user6723 3y ago

The purpose of wei is they want one of the handful of closed source OS to be a requirement to use any commercial website. Terry Davis wasn't far off when he said "they" want a world where you don't have access to a compiler. With wei "they" can sidestep open source entirely. "Why would I want open source encryption? I don't have anything to hide." "Why don't you have a normal phone?" "Why come you don't have a tattoo?!" Idiocracy is playing out in front of us. Anyone who accepts wei is a lower tier of human than those who reject it.

flangola7 3y ago
Tattoo?
- nmeagent 3y ago
  IIRC the people in the world of Idiocracy were all tattooed with some kind of barcode, or were chipped, or something else along those lines.
  - deleted 3y ago
    [deleted]
- user6723 3y ago
  Basically a vaxx pass to buy a hotdog.
macic 3y ago
Terry was right

freefaler 3y ago

No unhinged computers for the people as predicted years ago by Cory. Cory Doctorow has a great talk: "The coming war on general computation" from 2011 (12 years ago) in which he argues that all general computing platforms (OS, phone OS, browser) would face challenges by governments and corporations. This looks like another way to control content distribution and put more control in Google's hands. They've made a great strategic choice in building Chrome browser and effectively superseded Microsoft and Apple on desktops as a platform. The talk can be found here: https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg BTW, in the Soviet Union you couldn't have bought radios that were freely tunable to certain frequencies. The same was done in Warsaw where German occupation forces collected all radios from the people. Future doesn't look good for freedom ... When the tools exists, people that control them would find a use. Look what's happening in the UK cryptography battle, the same trend there ...

matheusmoreira 3y ago
Yeah, the future looks bleak. It just feels so hopeless. I understand the problem, I understand what needs to be done but I don't have the means or capital to do it. Free computers are a great thing and they will be destroyed by all these governments and corporations who want to control them.

matheusmoreira 3y ago

Remote attestation for the web: a way for websites to have cryptographic proof that you haven't "tampered" with the page by deleting ads.

qrios 3y ago

The implementation will be really interesting: can a VM, container, or RDP be compliant ever with WEI? To proof - or give at least a solid certainty, a runtime is direct connected to a GUI, and function calls triggered by this GUI are coming from event handler, triggered by human interactions with a keyboard or pointer device, WEI would need a separate channel to the cam. This means the only way to make this proof is to link the current environment and interactions with a history of interactions stored by a third party (i.e. Google). This only would make WEI to a new layer on top of todays fingerprinting.

arianvanp 3y ago
Yes. For example ChromeOS doesn't provide direct TPM access to the browser sandboxes but virtualizes a vTPM per application. Same technology is used for GCP where each server is attached a virtual TPM by the hypervisor.

Try1275 3y ago

Will Google enforce this by downrating a website's SEO scores if they it doesn't implement it? Is this the plan?

rpdillon 3y ago

The last paragraph is a bit surprising: > WEI can potentially be used to impose restrictions on unlawful activities on the internet, such as downloading YouTube videos and other content, ad blocking, web scraping, etc. Since when did archiving, ad blocking, and web scraping become unlawful? This sounds like a wishlist of activities Google wishes were unlawful.

raxxorraxor 3y ago
AI companies that scraped the net previously would like that too. They have their data and don't want others to have the same opportunities.
Ekaros 3y ago
So will the WEI block Google from web scraping? That might even be a good thing.
- CaptainFever 3y ago
  Google is illegal now /s Or, more realistically, a way to prevent competitors from doing web scraping as well.
- bpye 3y ago
  If they own the attestation for Chrome then presumably they could also allow their scrapers to attest?
  - martin8412 3y ago
    That sounds like an antitrust lawsuit.
rolph 3y ago
you are witnessing a corporation that is making extrajudicial laws, and a method of enforcing them. this is attempted parallel government, and is at least illegal, if not domestic terrorism.

not_enoch_wise 3y ago

Google: "Why is the market behaving as if we have no credibility??"

j0hnyl 3y ago

WEI seems like a nig nothing burger to me. I interpret it as just another anti bot verification service, but the incentive is simply not there for publishers to use it unless they want to lose out on every person who uses a browser other than the most up to date Chrome.

thefurdrake 3y ago
> other than the most up to date Chrome. Yes, I'm sure Google cares a great deal about losing 17% [1] of its market share, or even less considering how many people with weak spines will switch if they're denied access to something based on browser and never look back. I'm sure Google won't do something malicious like mandating anyone using google's adtech to implement this to ensure "integrity" of clickthroughs. I'm sure Google won't use its market dominance to require this feature for every one of its products and intentionally cripple other browsers, as that's definitely not something they've done before and would be totally unprecedented in the modern tech industry. F Google. [1] https://kinsta.com/browser-market-share/ https://kinsta.com/browser-market-share/
- j0hnyl 3y ago
  WEI is a tool for publishers. Mandating that publishers use it to qualify for google ads will be completely suicidal for google. Most folks access google ad demand through resellers.
  - nullc 3y ago
    Mandate? How about just compensating them differential based on the assumed WEI vs non-WEI clickfraud rates?
    - j0hnyl 3y ago
      Then they will only implement for those impressions/clicks, the same way they switch around between a handful of anti-bot vendors today, because none of them have alignment. Edit: Also not sure if WEI spec only calls for a page level implementation, but if not then this will just be implemented inside ad frames and publishers won't need to touch it. I think HN is overthinking this the same way everyone freaked out about AMP, the impact of which is completely negligible a couple years later.

danShumway 3y ago

The last sentence of the article: > WEI can potentially be used to impose restrictions on unlawful activities on the internet, such as downloading YouTube videos and other content, ad blocking, web scraping, etc. Note that every single one of those activities is legal. It's legal to scrape websites. It's legal to download Youtube videos (copyright violation is the crime, not downloading videos, and there are plenty of videos on Youtube that can be legally downloaded). It is legal to block ads. This article isn't bad, but it really shouldn't be playing into these tropes. That sentence caught me off-guard because it's just straight up wrong, and wrong in a harmful way that suggests that there aren't court ruling showing that these activities are legal, and that people should be somehow ashamed for doing them or that they're doing something transgressive when they scrape a website.

kahnclusions 3y ago
"Copyright violation" is not a crime. The rights holder can sue you in civil court.
- dragonwriter 3y ago
  > "Copyright violation" is not a crime. It is, in fact. (17 USC § 506) As with many things that are both crimes and torts, the crime is defined differently and somewhat more narrowly than the tort.
- danShumway 3y ago
  What dragonwriter wrote, but also this is the difference between a meaningful distinction and a (mildly) pedantic distinction[0]. When I say "downloading a Youtube video isn't a crime" I'm indicating a category difference that means more than "specifically the government can't convict you over it." I mean that Youtube doesn't have a legal leg to stand on to make you stop; it's not a questionably legal activity that we ignore, it's not an illegal activity that's too hard to prosecute, it's not something you should feel bad about. It's not a (generic sense) "crime". It's not just "you won't face a specific kind of legal trouble" -- you're allowed to do it. Scraping websites is allowed, and if someone sues you over it and you fight the lawsuit with decent lawyers you will win. Copyright violation doesn't fall into that category -- you can end up facing legal consequences for violating copyright. But downloading videos from Youtube is not inherently copyright violation. It's possible I should have been used a more generic word than "crime" to avoid that confusion. ---- [0]: To be fair, I've also made the same distinction to people about lawsuits/crimes before, so I'm not sure I really have any grounds to call you out here :)

tamimio 3y ago

General rule of thumb: any proposal by one of the big tech companies should be considered bad and harmful for the FOSS communities or anyone who still values their privacy in the internet.

happytiger 3y ago

Ok, lets be completely honest about what this is. This enables Google to reliably control user-installed ad blockers, which is hurting their business. There is no reasonable defense for this “wolf-in-sheep’s clothing” control grab. It doesn’t benefit users to be constantly tracked and controlled and especially have one company in control of that, and this is another example of unnecessary and overly centralized meddling masquerading as security. Google needs to get behind freedom and privacy — they are strongly heading in the wrong direction — and right before GPI. :(

egberts1 3y ago

Google is already blocking Apple Safari (on a lockdown Apple iOS) from user being able to login. Had to use Firefox/Webkit/iOS to sign into Google. Enough said.

egberts1 3y ago
And on Apple iPad/iOS too, Google is blocking this user from logging into Google account. (sigh)

1MachineElf 3y ago

Google's WEI API is their answer to Microsoft's Pluton, which is Microsoft's answer to Apple's walled garden device attestation, is their answer to... How should we adapt to a world where this pattern never ends, in a way that preserves our human rights?