13 ms·

The Right to Lie and Google’s “Web Environment Integrity”

202 points by boramalper 3y ago

jacknews 3y ago
I'm not sure the title is helpful, or the analogy. It's more like, if you want to borrow a book from the library, you have to bring an FBI agent home with you too, so they can certify that you don't have a photocopier or scanner (or even a pen and paper), that only you can read the book, and not another family member, that if you want to read aloud, your windows can't open and let anyone else listen in, that you read it from cover to cover including the back-page ads for other books in the series, that you can't leave home with the book, to re-lend it out, and so on. NO. Not on my machines.
Georgelemental 3y ago
There is no right to lie. There is a right to remain silent. That is what "Web Environment Integrity" threatens.
- reaperducer 3y ago
  There is a right to remain silent. That is what "Web Environment Integrity" threatens. Google's WEI doesn't threaten your right to be silent. Based on Google's previous behavior, if your web site doesn't go along with its plan, it will be more than happy to silence/delist/derank it.
  - Georgelemental 3y ago
    It threatens the right to not disclose certain information in your user agent.
  - belthesar 3y ago
    That's the thing though. Even though Google's search quality has diminished, and they attempt to enforce things like WEI or other abjectly terrible things, they remain the market leader in search, and this threat still holds a lot of weight. The amount of inertia to go against this change feels Herculean, and I'm honestly not sure how we would go about educating the vast majority of the Internet's user base to care about it. Sure, as the technologists we are, we can see just how dangerous this can be, and why it's offensive to even consider. Without getting the masses on board though, we're pretty outmatched and outgunned.
  - pravus 3y ago
    You need to include the first phrase. It is the right to lie that is being threatened.
- quailfarmer 3y ago
  I disagree, you have the right to set your user-agent to anything you’d like, or nothing at all.
  - rolph 3y ago
    i found a page with some helpful suggestions for user-agent strings that could be adopted by default , ideally at ^scale^. Google Crawlers and User Agent Strings – 2023 List https://www.stanventures.com/blog/googlebot-user-agent-string/ https://www.stanventures.com/blog/googlebot-user-agent-strin...
  - rileymat2 3y ago
    I am not sure where you are getting this as a right, because things like fraud are illegal. It might be good policy but where is the right?
    - emacsen2 3y ago
      [dead]
    - quailfarmer 3y ago
      Agreed there is no explicitly enumerated right, but in the context of computing, it is not illegal for a computer to transmit “untrue” information. Fraud is a significantly higher bar. I am not a cyber-lawyer.
      - aionaiodfgnio 3y ago
        In the U.S., most rights are not explicitly enumerated. People are assumed to have all conceivable rights, and the restrictions must be explicitly enumerated. There is no law against lying in general. There is, however, an explicitly enumerated right to freedom of speech. There are only a handful of recognized categories of non-protected speech. Lying isn't one of them.
    - aionaiodfgnio 3y ago
      In American law, the right to speak is assumed. It is the lack of a right to speech that is the exception. There are only a handful of categories of unprotected speech, which can be easily enumerated, and lies aren't one of them. Fraud, defamation, perjury, and obstruction of justice are illegal. That's a much narrower restriction than a ban on lies.
- aionaiodfgnio 3y ago
  [dead]
- jtbayly 3y ago
  Actually, it’s not a right to remain silent that is threatened. It’s a threat to refuse to let anybody else speak to you or you to anybody else unless you first give Google enough info that they can silence you.
- greyface- 3y ago
  There is no right to remain silent in the United States. Courts can compel testimony.
- throw7 3y ago
  > There is no right to lie. Tell that to the police.
gochi 3y ago
Is there a link to an article that actually goes into WEI on a technical level that isn't the proposal itself? So many things posted to HN about it have been the grand overview, which is a perspective worth diving into but also has drowned out every other perspective to the point where it's very difficult to figure out what's really happening with the proposal here.
- tedunangst 3y ago
  Not really. Every explainer assumes the proposal is lying, and explains how half of it means the opposite of what it says.
  - daurentius523 3y ago
    Because any other option is not sensible: 1. Authors don't understand what tech they use. (I will leave it to your belief - but that would be even worse for Internet) 2. Authors don't understand that something unrealistic is unrealistic. Idea that you can give companies or corporations tools to check "did user modify his environment" and they would not use it to exclude users is stupid or disingenuous because advocates for this did exactly comment in such way: We want this proposal to do precisely that. Again Google tries to defend it by saying "we will return invalid 'false' for some of the users/times of Chrome users" [to make sure that website will not do that] which for me is not only bad because it then creates "when google revokes this policy we are in even worse situation" but then leaves the issue how google decides "who" to give back this 'false': I will reject times immediately not only because this can be easily circumvented by website [check n-times] to detriment of user but it would also contradict official documentation of WEI (same token for same input from user). And this leads us to another point - if Google wants to return false negatives it would need to either keep information that is supposed to return 'false' - EU will not be very happy with that (also it does contradict this "chrome users"); or more likely it will be implemented in chrome. Now when we established that implementation in chrome is most probable - we can also establish that: A) Implement this on profile basis - companies will ask you to reset profile if you are this false negative. B) Implement on connection basis - companies will ask you to refresh. C) Implement on device age / os version / type - Google can even make the manufacturers happy with this one. … as you can see at most this will be nuisance and if by some weird way: Z) Implement on Super-complicated basis - this will be still possible because… 3. Google plays disingenuous word game with us here by saying - We won't destroy open web Other Chromium browsers may ignore that Google X% false negative (Google may loose few % of users before it scrapes this policy). And there is 0 need for Google to actually do something when companies will misuse this API. In simple words the part that should worry you is not that "Google will destroy web by using this API on Chrome and it services", what must worry you is that other companies will do that for Google and Google will wash their hands from this by saying "We wanted good but didn't work". You can see that tone from the Google - We don't want that so we created these "holdouts". Don't let Google move Overton window, they are proposing thing that any sensible person see as clear cut attack (or stupid idea that can only work this way) on Privacy and Your Right to use Your Device (and for some people Your OS and/or Your Browser) as You want to use. They are at fault here.
superkuh 3y ago
His comment system is currently broken and will just 404 and return you to a URL at https://rants.org/%5Ehttp:/your.ip.addy.here/ https://rants.org/%5Ehttp:/your.ip.addy.here/. So I guess I might as well post here instead, >My web browser (currently Mozilla Firefox running on Debian GNU/Linux, thank you very much) will never cooperate with this bizarre and misguided proposal. Mozilla used to be about user freedoms. Lately Mozilla has been a front-runner on turning off and disabling non-TLS just HTTP support. They will likely be one of the first browsers to remove support for it and eventually HTTP/1.1 as a whole. ref: https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/ https://blog.mozilla.org/security/2015/04/30/deprecating-non... Given that HTTP/3 as implemented by Mozilla cannot connect to self-signed TLS cert websites this means the future of Firefox is as a browser that can only visit websites that third party TLS CA corporations periodically approve (even if those corporations are currently benign, like LetsEncrypt). Does this remind you of anything? That's not to say other browsers are better in this respect. Mozilla's Firefox and it's forks are the least worst... it's just everything is getting much worse all together.
- buildbuildbuild 3y ago
  “Least worst” is right. A quick nod to Tor Browser, the Firefox fork which will always support HTTP in order to support the vast majority of Tor hidden services.
  - yjftsjthsd-h 3y ago
    Onion addresses aren't CA-based TLS, but they aren't unencrypted HTTP either.
- nimbius 3y ago
  Couldn't I just stand up a quick CA with easyrsa scripts?
  - JoshTriplett 3y ago
    Yes, absolutely. Nobody else will trust it, but you can always set up your own CA for use by computers you use. Which is fundamentally still better than insecure HTTP, because it's at least possible to take steps to trust it and make sure it's the same server you expect to talk to.
aabedraba 3y ago
For crying out loud, Google
throwbadubadu 3y ago
We have come a long way since "don't be evil", would be funny if not so sad..
skybrian 3y ago
> If your computer can’t lie to other computers, then it’s not yours. And why is that not okay? I think this sort of attitude is left over from when computers were expensive. Nowadays, I have multiple computers, some of which are fun toys I mess with, while others are appliances that I just use for their intended purpose. And that's fine, because when I screw up, maybe I don't want to have broken the computer that I use for video chats and to do my banking? Maybe I don't want my main phone to stop working? It's okay to be a hacker and buy a router that you just use as a router and a Chromebook that you just use for web browsing. You can also buy a Raspberry Pi and mess with embedded programming on cheap devices. The appliance computers should be as low-maintenance as possible so you have more time for hacking. The nice thing about really cheap devices like a Raspberry Pi Pico is that if you actually build something useful for real work, you can deploy it, stop messing with it, and buy another computer for experiments.
- MildRant 3y ago
  I don't understand the point you are trying to make and how it relates to the quote or the post as a whole.
- caslon 3y ago
  Your bank and the company that hosts your video chatting software should pay for the computer, if it isn't yours.
  - skybrian 3y ago
    Why? Even if you leased it, you're still paying for it in the end. You're benefiting from using it.
- the_lego 3y ago
  > Maybe I don't want my main phone to stop working? You are conflating the alleged benefit of locking down devices to assure users don't break them [1], with websites and services getting the ability to remotely verify your software/hardware stack is "approved", and block you if it isn't. It's not about what you want - it's about taking away your ability to choose. The "fun toys" that can be modified to your liking will get increasingly useless as they'll be blocked from large chunks of the web, especially after Google will start pushing WEI if sites want ad revenue, under the logic of preventing click-fraud. [1] There are plenty of ways to limit unlocking to the technically-savvy, and making it tamper evident to the owner (e.g. a "bootloader unlocked" notification during boot), and many existing phones implement them, so any claims by phone or other device manufacturers that making devices impossible to unlock are outright lies.
tedunangst 3y ago
Funny that this was cross posted to fediverse, a network that is heavily reliant on digital signatures to prevent lying.
- gumby 3y ago
  The point is it’s optional, right?
  - tedunangst 3y ago
    Good luck getting another server to accept your post without cryptographic attestation of its origin.
    - surajrmal 3y ago
      Android apps can use safety net for a similar purpose but most don't. You are spreading FUD. Additionally, if a place of business asks you for state id, you are free to choose not to share it. It's not your choice whether they get to ask you nor your right to provide a fake id and expect it works. Views on the website make it sound like everyone should be allowed to own a gun without a licence. I bet most people don't feel that way in reality.y
hkt 3y ago
I can't convey how disgusted I am at the thought of WEI becoming a reality. It will lead to three webs: the remainder of the open web, the new closed web, and the pirate web. Personally I'll do my bit to preserve openness, even if that means working socially and technically to support the new world of piracy. It will always be a losing battle without institutions fighting for openness, though. This is a moment when Sun's old line - "the network is the computer" - starts to look hideous and dystopian. Prophetic, but maybe not how we thought.
- version_five 3y ago
  It's not immediately obvious to me that the closed web will have anything good on it. People that want other people to see their stuff won't lock down who can visit, it seems like it's mainly for ad supported crap? Optimistically, the web will break apart into some AOL Disneyland Cable shit experience and an actual good internet whose participants are not just pretending to have engaging content so they can get ad views. I know that sounds too optimistic, what's the flaw in it? Google will use it's monopoly on a few things to push it, I'm happy to move away from gmail and I don't use Google search anyway. What other practical changes will there be?
  - yakireev 3y ago
    > What other practical changes will there be? Your online banking will stop working on your unapproved software, just like your baking app stopped working on your rooted/old Android phone some 3-5 years ago.
  - TT-392 3y ago
    Every website with google ads becoming unusable. And also, every site using google captcha.
    - hkt 3y ago
      This has given me an idea for an SEO-spam-proof search engine along the lines of Marginalia: crawl the internet for sites with no Google Ads
EGreg 3y ago
My web browser (currently Mozilla Firefox running on Debian GNU/Linux, thank you very much) will never cooperate with this bizarre and misguided proposal. And along with the rest of the free software community, I will continue working to ensure we all live in a world where your web browser doesn’t have to either. That depends on Mozilla. As long as our software comes from corporations, we will just be reduced to begging.
TX81Z 3y ago
At no point does he explain what the hell the rant is about.
theteapot 3y ago
In other words, Google earnestly believes your browser belongs to them and your just using their tool. They're not really wrong either. What'd we think would happen when Google (an ad company) dominated browser market share ...
- euroderf 3y ago
  Render unto Caesar...
- okasaki 3y ago
  That attitude should have been apparent from the fact that you can't even change the new tab page, and a thousand other things.
  - greyface- 3y ago
    You can change the new tab page via extension. E.g. https://chrome.google.com/webstore/detail/empty-new-tab-page/dpjamkmjmigaoobjbekmfgabipmfilij https://chrome.google.com/webstore/detail/empty-new-tab-page...
    - SanchoPanda 3y ago
      Try that on mobile with their browser.
- Aerroon 3y ago
  If it belongs to them, then they assume legal liability for everything my browser does, right?
- jacquesm 3y ago
  Google is edging towards believing that the internet belongs to them.
  - userbinator 3y ago
    I suspect they already believe that.
liveoneggs 3y ago
I think the fundamental disconnect here is that Google's view of "user" is a "Chrome/Android User Who Shops from SERP Pages" -- google makes money vs the more nebulous "user" of "the (open) web" which is probably only understood by a few people who were alive in the pre-web world (people 35 and older who were also online). Google does not care about the later and only wishes to make more money from the former. Google has a clear and blatant monopoly position over ad-based web monetization so most of the web will follow Google's will. We all need paychecks. The group of old farts who saw the world change are growing older and irrelevant. I am extremely pessimistic about the future of "the (open) web" as the vehicle of our modern low-friction economy as these corporate gatekeepers (Google and Microsoft) are making such big wins recently. Good luck out there. The World Wide Web (old school) and Old Fashioned HTTP+HTML are under grave threat from carpetbaggers.
- amlib 3y ago
  Is there any chance of a hard fork? What about, let's say, a web 1.1 where we intentionally remove all the fancy new web APIs and mostly revert back to what we had in the late 90s? Sure, things like video support can remain but all the crazy stuff for building web apps would go away. Let the current web rot away under its corporate overlords and then, maybe, we can have the fork go back into being a fun way of publishing and sharing information.
  - airstrike 3y ago
    I'm down. Sign me up.
    - afandian 3y ago
      Here you go. https://en.m.wikipedia.org/wiki/Gemini_(protocol) https://en.m.wikipedia.org/wiki/Gemini_(protocol)
      - floren 3y ago
        "http get but we chopped off the low order byte of the return code" is not sufficient or necessary to implementing a non-Googlized web.
ranting-moth 3y ago
May I suggest something like "Enterprise Environment Integrity". How does the public know that the enterprise (i.e. google) it's dealing with is healthy? The public should have an entity that will receive detailed attestation data to assess that. Failing the attestation will revoke business permit along with an announcement.
- jacquesm 3y ago
  > How does the public know that the enterprise (i.e. google) it's dealing with is healthy? Because they will pinky promise. I find it funny that for some reason companies get the benefit of the doubt when it comes to dealing with data in a responsible matter. Yes, it's possible that they do. But it is also possible that they don't and no matter what they say in public that's just words, it doesn't prove anything about what is really going on and that's before we get to honest mistakes. There is simply no way to be sure, all you know is that once you transmit data to any other host on the internet that it is quite literally out of your hands whether or not that data will one day show up elsewhere.
  - mschuster91 3y ago
    > Because they will pinky promise. It goes a bit deeper than that. Many companies these days "choose" to get certified under a variety of standards (the most common one is ISO 27001), everyone who hasn't been completely ignorant is looking for or already got cybersecurity insurance and on top of that comes the entire GDPR saga. Basically, you got three levels of auditors that at least make sure the basics are covered, and on top of that come industry specific requirements such as TISAX [1], US SOX Act compliance or whatever AWS had to go through for GovCloud. [1] https://en.wikipedia.org/wiki/Trusted_Information_Security_Assessment_Exchange https://en.wikipedia.org/wiki/Trusted_Information_Security_A...
    - jacquesm 3y ago
      I'm well aware of those audits and the typical auditor output. Where to start... These audits check paper. They don't check what is actually going on, they will check that documentation is in place and that processes and various controls are in place and that periodic checks have been performed. They don't actually check any of the underlying tech. For instance: ISO27001 asks for 'regular pentests'. But it doesn't do anything to ensure that those pentests are of a good quality. There are plenty of 'check the box' automated pentest services that get you past that hurdle but that won't do much for your security. They might even give you a false sense of security. So yes, there are all kinds of audits. But like with everything else the devil is in the details and the quality of the work is very important (obviously!). Many companies treat these certifications like a 'license to operate'. You need to have them so then you do the absolute minimum required to satisfy the auditors rather than to see the certificate as a minimum level of proof required that you have your house in order and that your intent is to deal responsible with your data subjects (and customers) data. The latter is extremely rare.
thesuperbigfrog 3y ago
"If your computer can’t lie to other computers, then it’s not yours." This fundamentally comes down to "do you really control your computer, or does someone else?": https://youtu.be/Ag1AKIl_2GM?t=57 https://youtu.be/Ag1AKIl_2GM?t=57
- perihelions 3y ago
  And also (this one was written in 2002!) - "Who should your computer take its orders from? Most people think their computers should obey them, not obey someone else. With a plan they call “trusted computing,” large media corporations (including the movie companies and record companies), together with computer companies such as Microsoft and Intel, are planning to make your computer obey them instead of you. (Microsoft's version of this scheme is called Palladium.) Proprietary programs have included malicious features before, but this plan would make it universal." https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html
powera 3y ago
[flagged]
- always2slow 3y ago
  I was just thinking.. must have found the google employee. Checked your profile haha yep. about: Formerly of Google and Quip.
- deleted 3y ago
  [deleted]
- stoolpigeon 3y ago
  Almost anything one can do, of value to their fellow humans, is a crime somewhere.
- Zak 3y ago
  Where are you seeing that? This article discusses lying about one's user agent string, presumably to get better behavior out of a website that's making bad decisions based on it. That is not a crime last I checked.
- userbinator 3y ago
  "crimes" according to who?
- meindnoch 3y ago
  >Not looking at ads is a crime. Oookay, I had enough HackerNews for today.
Macha 3y ago
> In the normal world, you show up at the store with a five dollar bill, pick up a newspaper, and the store sells you the newspaper (and maybe some change) in exchange for the bill. In Google’s proposed world, five dollar bills aren’t fungible anymore: the store can ask you about the provenance of that bill, and if they don’t like the answer, they don’t sell you the newspaper. No, they’re not worried about the bill being fake or counterfeit or anything like that. It’s a real five dollar bill, they agree, but you can’t prove that you got it from the right bank. Please feel free to come back with the right sort of five dollar bill. Side note: This at least would occasionally happen if you tried to spend Scotland or NI £5 notes in England.
- HWR_14 3y ago
  That's closer to my inability to spend US dollars in England. Different countries have different currencies.
  - adamckay 3y ago
    No it's not, Scottish bank notes aren't of a different currency - they're still pound sterling. The reason they're typically not accepted in English shops (at least, those not on the Scottish border) is most often because they're rather uncommon so it's more difficult for cashiers to detect fakes. My understanding is also that some banks, when depositing, require the English and Scottish notes to be separated and may charge a fee to convert them to English notes, so it's more effort to accept and handle them.
    - HWR_14 3y ago
      Can you (British equivalent of Venmo/Paypal) Scottish pounds to someone who receives them as English pounds? I don't know why Britain doesn't just implement a national printing press.
      - adamckay 3y ago
        There's no such thing as Scottish pounds or English pounds, the UK uses pound sterling (internationally abbreviated to GBP). There are English banknotes and Scottish banknotes, but they're the same currency.
Pxtl 3y ago
On the one hand, I firmly do believe that we need a proper way to verify identity globally over the internet. The Turing Test is over and AI is going to destroy every user-submittable form online. On the other hand, it's infuriating that advertising is the first front in this war. I specifically don't want advertisers to have my identity. I'm fine with like my Mastodon server or a site like HN to know I'm me because I'm actively interested in interacting with them. I don't want to interact with advertisers, or for them to have my identity, but they're going to wall off half the internet for people who opt out.
- nickisnoble 3y ago
  On the internet, no one knows you're a dog. https://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_you%27re_a_dog https://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_...
  - captn3m0 3y ago
    Once WEI goes live: “On the internet, everyone knows if you’re using a stock Android device”
- wmf 3y ago
  WEI is not really an identity system. WEI is more like a binary "is this a real browser" signal.
oh_sigh 3y ago
The premise of this article is fundamentally wrong. > On that Web, if you send a valid request with the right data, you get a valid response. Explain DoS protection then.
userbinator 3y ago
The underlying hostile technology is "remote attestation" and it's what we should all be fighting against. People justify the latter by speaking about companies wanting control over employees' environments, but IMHO that shouldn't be allowed either. This is also why "zero trust" is problematic; they want to replace humanity with centralised control.
- fruitreunion1 3y ago
  I think in internal environments like within a company it's fine. Just not in the public, user-facing web.
- QuantumG 3y ago
  Yeah, cryptography is bad and consumers shouldn't be allowed to prove their browser hasn't been modified or have safety when using biometrics or making payments.
  - userbinator 3y ago
    "modified" according to whom? Users should be able to use software the way they want, not the way Big Tech dictates. Governments are scared because they realise cryptography is being used against them. Now users should realise the same. Strong encryption is classified as a weapon for good reason. Just like you'd want a gun in your hands, but not one pointed at you. Then again, the fact that you call them "consumers" instead of "users" already shows what side of the debate you're on.
    - QuantumG 3y ago
      I'm sorry but there's a class of users who want to be able to prove they haven't made modifications and they refer to themselves as consumers. They're the people who don't jailbreak their devices for exactly that reason and this protocol will support them. Oh, and they happen to be the bulk of the users.
      - Zuiii 3y ago
1vuio0pswjnm7 3y ago
"By analogy: right now, you can tell your browser to change its User-Agent string to anything you want." You can also choose not to send this header. By default I do not send it. The RFCs do not require it^1 and very rarely do I find sites that do. When I do find such sites,^2 I just add them to the proxy config so that a UA is added on the way out. Almost invariably these sites will accept a made-up UA, so long as it is well-formed, which is interesting.^3 It suggests no one knows what new UA strings will appear. The origin of changing the User-Agent header dates back to one of the earliest browsers, written in part by a well-known Silicon Valley VC.^4 It was always possible for the user to control HTTP headers such as UA and the designers knew it. Later in the "browser wars" Microsoft changed its UA header to match Mozilla's.^5 1. https://towardsdatascience.com/the-user-agent-that-crazy-string-underpinning-a-bunch-of-analytics-86507ef632f0?gi=e30981d0139f https://towardsdatascience.com/the-user-agent-that-crazy-str... 2. For example, www.federalregister.com and sec.gov. 3. Many users want to "blend in" and use common strings so perhaps use of made-up strings remains largely untested. 4. https://raw.githubusercontent.com/alandipert/ncsa-mosaic/master/mosaic-spoof-agents https://raw.githubusercontent.com/alandipert/ncsa-mosaic/mas... 5. https://webaim.org/blog/user-agent-string-history/comment-page-1/ https://webaim.org/blog/user-agent-string-history/comment-pa... https://humanwhocodes.com/blog/2010/01/12/history-of-the-user-agent-string/ https://humanwhocodes.com/blog/2010/01/12/history-of-the-use... As for WEI, I'm inclined to think that the terms "abuse" and "fraud" in the spec may actually refer to ad fraud, including potential fraud by Google itself in marketing its ad services because it hides the true extent of ad fraud from its customers. People who like to access the web with uncommon TCP/HTTP clients may not be a significant problem. There are no details given in the spec about this alleged "fraud"; perhaps that's intentional. Although by being vague in the spec, real humans that prefer not to use popular browsers may jump to conclusions.^6 It could be that we're on the cusp of exposing the true extent of ad fraud with respect to Google, and the ultimate unworkability of Google's core "business" (selling ad services). Perhaps Google believes its advertiser customers could begin to lose trust; maybe direct more ad spend to Apple. 6. Some pre-spec discussion: https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/XCAIgPtxAQAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_...
seo-speedwagon 3y ago
I figured I’d take a minute to try and find the proposal itself, so I could see what the proponents considered the virtues of this to be. https://github.com/mozilla/standards-positions/issues/852 https://github.com/mozilla/standards-positions/issues/852 https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/... I stopped reading after the explainer’s intro section. The first example is making it easier for websites to sell adds (lmao) and the other 3 are extremely questionable whether if the proposed remedy even helps. And it’s presented as a benevolent alternative to browser fingerprinting, as if we must choose between these two awful choices. It’s an absolute joke of a proposal.
recursive4 3y ago
Upvote if you actually read the proposal in question.
user6723 3y ago
The wei camp wants a world where you can have your open source OS with encryption that actually works but almost any commercial website won't talk to you. Wei will get integrated with your CBDC.
deleted 3y ago
[deleted]
puffyengineer 3y ago
What is so wrong with Web Environment Integrity? It's a great policy, and the notes CLEARLY outline how the main benefit is going to be for the users and website developers. If you're not doing anything wrong, then you shouldn't have an issue.
wdiamond 3y ago
people built internet just to destroy it. its not a tech problem. its economics. the forever decreasing profits because more people just know and re-sell for less. tor will become more and more expensive till people realize that needs the same hardware trick with another brand like internet2,3,4,5,... to seek the solution by hacking wont stop this foverer battle. its just ends when the imaginary of fair price for information meets the offer (the forever decrease of population to let universe in peace)

202 points by boramalper 3y ago

I'm not sure the title is helpful, or the analogy. It's more like, if you want to borrow a book from the library, you have to bring an FBI agent home with you too, so they can certify that you don't have a photocopier or scanner (or even a pen and paper), that only you can read the book, and not another family member, that if you want to read aloud, your windows can't open and let anyone else listen in, that you read it from cover to cover including the back-page ads for other books in the series, that you can't leave home with the book, to re-lend it out, and so on. NO. Not on my machines.

Georgelemental 3y ago

There is no right to lie. There is a right to remain silent. That is what "Web Environment Integrity" threatens.

reaperducer 3y ago
There is a right to remain silent. That is what "Web Environment Integrity" threatens. Google's WEI doesn't threaten your right to be silent. Based on Google's previous behavior, if your web site doesn't go along with its plan, it will be more than happy to silence/delist/derank it.
- Georgelemental 3y ago
  It threatens the right to not disclose certain information in your user agent.
- belthesar 3y ago
  That's the thing though. Even though Google's search quality has diminished, and they attempt to enforce things like WEI or other abjectly terrible things, they remain the market leader in search, and this threat still holds a lot of weight. The amount of inertia to go against this change feels Herculean, and I'm honestly not sure how we would go about educating the vast majority of the Internet's user base to care about it. Sure, as the technologists we are, we can see just how dangerous this can be, and why it's offensive to even consider. Without getting the masses on board though, we're pretty outmatched and outgunned.
- pravus 3y ago
  You need to include the first phrase. It is the right to lie that is being threatened.
quailfarmer 3y ago
I disagree, you have the right to set your user-agent to anything you’d like, or nothing at all.
- rolph 3y ago
  i found a page with some helpful suggestions for user-agent strings that could be adopted by default , ideally at ^scale^. Google Crawlers and User Agent Strings – 2023 List https://www.stanventures.com/blog/googlebot-user-agent-string/ https://www.stanventures.com/blog/googlebot-user-agent-strin...
- rileymat2 3y ago
  I am not sure where you are getting this as a right, because things like fraud are illegal. It might be good policy but where is the right?
  - emacsen2 3y ago
    [dead]
  - quailfarmer 3y ago
    Agreed there is no explicitly enumerated right, but in the context of computing, it is not illegal for a computer to transmit “untrue” information. Fraud is a significantly higher bar. I am not a cyber-lawyer.
    - aionaiodfgnio 3y ago
      In the U.S., most rights are not explicitly enumerated. People are assumed to have all conceivable rights, and the restrictions must be explicitly enumerated. There is no law against lying in general. There is, however, an explicitly enumerated right to freedom of speech. There are only a handful of recognized categories of non-protected speech. Lying isn't one of them.
  - aionaiodfgnio 3y ago
    In American law, the right to speak is assumed. It is the lack of a right to speech that is the exception. There are only a handful of categories of unprotected speech, which can be easily enumerated, and lies aren't one of them. Fraud, defamation, perjury, and obstruction of justice are illegal. That's a much narrower restriction than a ban on lies.
aionaiodfgnio 3y ago
[dead]
jtbayly 3y ago
Actually, it’s not a right to remain silent that is threatened. It’s a threat to refuse to let anybody else speak to you or you to anybody else unless you first give Google enough info that they can silence you.
greyface- 3y ago
There is no right to remain silent in the United States. Courts can compel testimony.
throw7 3y ago
> There is no right to lie. Tell that to the police.

gochi 3y ago

Is there a link to an article that actually goes into WEI on a technical level that isn't the proposal itself? So many things posted to HN about it have been the grand overview, which is a perspective worth diving into but also has drowned out every other perspective to the point where it's very difficult to figure out what's really happening with the proposal here.

tedunangst 3y ago
Not really. Every explainer assumes the proposal is lying, and explains how half of it means the opposite of what it says.
- daurentius523 3y ago
  Because any other option is not sensible: 1. Authors don't understand what tech they use. (I will leave it to your belief - but that would be even worse for Internet) 2. Authors don't understand that something unrealistic is unrealistic. Idea that you can give companies or corporations tools to check "did user modify his environment" and they would not use it to exclude users is stupid or disingenuous because advocates for this did exactly comment in such way: We want this proposal to do precisely that. Again Google tries to defend it by saying "we will return invalid 'false' for some of the users/times of Chrome users" [to make sure that website will not do that] which for me is not only bad because it then creates "when google revokes this policy we are in even worse situation" but then leaves the issue how google decides "who" to give back this 'false': I will reject times immediately not only because this can be easily circumvented by website [check n-times] to detriment of user but it would also contradict official documentation of WEI (same token for same input from user). And this leads us to another point - if Google wants to return false negatives it would need to either keep information that is supposed to return 'false' - EU will not be very happy with that (also it does contradict this "chrome users"); or more likely it will be implemented in chrome. Now when we established that implementation in chrome is most probable - we can also establish that: A) Implement this on profile basis - companies will ask you to reset profile if you are this false negative. B) Implement on connection basis - companies will ask you to refresh. C) Implement on device age / os version / type - Google can even make the manufacturers happy with this one. … as you can see at most this will be nuisance and if by some weird way: Z) Implement on Super-complicated basis - this will be still possible because… 3. Google plays disingenuous word game with us here by saying - We won't destroy open web Other Chromium browsers may ignore that Google X% false negative (Google may loose few % of users before it scrapes this policy). And there is 0 need for Google to actually do something when companies will misuse this API. In simple words the part that should worry you is not that "Google will destroy web by using this API on Chrome and it services", what must worry you is that other companies will do that for Google and Google will wash their hands from this by saying "We wanted good but didn't work". You can see that tone from the Google - We don't want that so we created these "holdouts". Don't let Google move Overton window, they are proposing thing that any sensible person see as clear cut attack (or stupid idea that can only work this way) on Privacy and Your Right to use Your Device (and for some people Your OS and/or Your Browser) as You want to use. They are at fault here.

superkuh 3y ago

His comment system is currently broken and will just 404 and return you to a URL at https://rants.org/%5Ehttp:/your.ip.addy.here/ https://rants.org/%5Ehttp:/your.ip.addy.here/. So I guess I might as well post here instead, >My web browser (currently Mozilla Firefox running on Debian GNU/Linux, thank you very much) will never cooperate with this bizarre and misguided proposal. Mozilla used to be about user freedoms. Lately Mozilla has been a front-runner on turning off and disabling non-TLS just HTTP support. They will likely be one of the first browsers to remove support for it and eventually HTTP/1.1 as a whole. ref: https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/ https://blog.mozilla.org/security/2015/04/30/deprecating-non... Given that HTTP/3 as implemented by Mozilla cannot connect to self-signed TLS cert websites this means the future of Firefox is as a browser that can only visit websites that third party TLS CA corporations periodically approve (even if those corporations are currently benign, like LetsEncrypt). Does this remind you of anything? That's not to say other browsers are better in this respect. Mozilla's Firefox and it's forks are the least worst... it's just everything is getting much worse all together.

buildbuildbuild 3y ago
“Least worst” is right. A quick nod to Tor Browser, the Firefox fork which will always support HTTP in order to support the vast majority of Tor hidden services.
- yjftsjthsd-h 3y ago
  Onion addresses aren't CA-based TLS, but they aren't unencrypted HTTP either.
nimbius 3y ago
Couldn't I just stand up a quick CA with easyrsa scripts?
- JoshTriplett 3y ago
  Yes, absolutely. Nobody else will trust it, but you can always set up your own CA for use by computers you use. Which is fundamentally still better than insecure HTTP, because it's at least possible to take steps to trust it and make sure it's the same server you expect to talk to.

aabedraba 3y ago

For crying out loud, Google

throwbadubadu 3y ago

We have come a long way since "don't be evil", would be funny if not so sad..

skybrian 3y ago

> If your computer can’t lie to other computers, then it’s not yours. And why is that not okay? I think this sort of attitude is left over from when computers were expensive. Nowadays, I have multiple computers, some of which are fun toys I mess with, while others are appliances that I just use for their intended purpose. And that's fine, because when I screw up, maybe I don't want to have broken the computer that I use for video chats and to do my banking? Maybe I don't want my main phone to stop working? It's okay to be a hacker and buy a router that you just use as a router and a Chromebook that you just use for web browsing. You can also buy a Raspberry Pi and mess with embedded programming on cheap devices. The appliance computers should be as low-maintenance as possible so you have more time for hacking. The nice thing about really cheap devices like a Raspberry Pi Pico is that if you actually build something useful for real work, you can deploy it, stop messing with it, and buy another computer for experiments.

MildRant 3y ago
I don't understand the point you are trying to make and how it relates to the quote or the post as a whole.
caslon 3y ago
Your bank and the company that hosts your video chatting software should pay for the computer, if it isn't yours.
- skybrian 3y ago
  Why? Even if you leased it, you're still paying for it in the end. You're benefiting from using it.
the_lego 3y ago
> Maybe I don't want my main phone to stop working? You are conflating the alleged benefit of locking down devices to assure users don't break them [1], with websites and services getting the ability to remotely verify your software/hardware stack is "approved", and block you if it isn't. It's not about what you want - it's about taking away your ability to choose. The "fun toys" that can be modified to your liking will get increasingly useless as they'll be blocked from large chunks of the web, especially after Google will start pushing WEI if sites want ad revenue, under the logic of preventing click-fraud. [1] There are plenty of ways to limit unlocking to the technically-savvy, and making it tamper evident to the owner (e.g. a "bootloader unlocked" notification during boot), and many existing phones implement them, so any claims by phone or other device manufacturers that making devices impossible to unlock are outright lies.

tedunangst 3y ago

Funny that this was cross posted to fediverse, a network that is heavily reliant on digital signatures to prevent lying.

gumby 3y ago
The point is it’s optional, right?
- tedunangst 3y ago
  Good luck getting another server to accept your post without cryptographic attestation of its origin.
  - surajrmal 3y ago
    Android apps can use safety net for a similar purpose but most don't. You are spreading FUD. Additionally, if a place of business asks you for state id, you are free to choose not to share it. It's not your choice whether they get to ask you nor your right to provide a fake id and expect it works. Views on the website make it sound like everyone should be allowed to own a gun without a licence. I bet most people don't feel that way in reality.y

hkt 3y ago

I can't convey how disgusted I am at the thought of WEI becoming a reality. It will lead to three webs: the remainder of the open web, the new closed web, and the pirate web. Personally I'll do my bit to preserve openness, even if that means working socially and technically to support the new world of piracy. It will always be a losing battle without institutions fighting for openness, though. This is a moment when Sun's old line - "the network is the computer" - starts to look hideous and dystopian. Prophetic, but maybe not how we thought.

version_five 3y ago
It's not immediately obvious to me that the closed web will have anything good on it. People that want other people to see their stuff won't lock down who can visit, it seems like it's mainly for ad supported crap? Optimistically, the web will break apart into some AOL Disneyland Cable shit experience and an actual good internet whose participants are not just pretending to have engaging content so they can get ad views. I know that sounds too optimistic, what's the flaw in it? Google will use it's monopoly on a few things to push it, I'm happy to move away from gmail and I don't use Google search anyway. What other practical changes will there be?
- yakireev 3y ago
  > What other practical changes will there be? Your online banking will stop working on your unapproved software, just like your baking app stopped working on your rooted/old Android phone some 3-5 years ago.
- TT-392 3y ago
  Every website with google ads becoming unusable. And also, every site using google captcha.
  - hkt 3y ago
    This has given me an idea for an SEO-spam-proof search engine along the lines of Marginalia: crawl the internet for sites with no Google Ads

EGreg 3y ago

My web browser (currently Mozilla Firefox running on Debian GNU/Linux, thank you very much) will never cooperate with this bizarre and misguided proposal. And along with the rest of the free software community, I will continue working to ensure we all live in a world where your web browser doesn’t have to either. That depends on Mozilla. As long as our software comes from corporations, we will just be reduced to begging.

TX81Z 3y ago

At no point does he explain what the hell the rant is about.

theteapot 3y ago

In other words, Google earnestly believes your browser belongs to them and your just using their tool. They're not really wrong either. What'd we think would happen when Google (an ad company) dominated browser market share ...

euroderf 3y ago
Render unto Caesar...
okasaki 3y ago
That attitude should have been apparent from the fact that you can't even change the new tab page, and a thousand other things.
- greyface- 3y ago
  You can change the new tab page via extension. E.g. https://chrome.google.com/webstore/detail/empty-new-tab-page/dpjamkmjmigaoobjbekmfgabipmfilij https://chrome.google.com/webstore/detail/empty-new-tab-page...
  - SanchoPanda 3y ago
    Try that on mobile with their browser.
Aerroon 3y ago
If it belongs to them, then they assume legal liability for everything my browser does, right?
jacquesm 3y ago
Google is edging towards believing that the internet belongs to them.
- userbinator 3y ago
  I suspect they already believe that.

liveoneggs 3y ago

I think the fundamental disconnect here is that Google's view of "user" is a "Chrome/Android User Who Shops from SERP Pages" -- google makes money vs the more nebulous "user" of "the (open) web" which is probably only understood by a few people who were alive in the pre-web world (people 35 and older who were also online). Google does not care about the later and only wishes to make more money from the former. Google has a clear and blatant monopoly position over ad-based web monetization so most of the web will follow Google's will. We all need paychecks. The group of old farts who saw the world change are growing older and irrelevant. I am extremely pessimistic about the future of "the (open) web" as the vehicle of our modern low-friction economy as these corporate gatekeepers (Google and Microsoft) are making such big wins recently. Good luck out there. The World Wide Web (old school) and Old Fashioned HTTP+HTML are under grave threat from carpetbaggers.

amlib 3y ago
Is there any chance of a hard fork? What about, let's say, a web 1.1 where we intentionally remove all the fancy new web APIs and mostly revert back to what we had in the late 90s? Sure, things like video support can remain but all the crazy stuff for building web apps would go away. Let the current web rot away under its corporate overlords and then, maybe, we can have the fork go back into being a fun way of publishing and sharing information.
- airstrike 3y ago
  I'm down. Sign me up.
  - afandian 3y ago
    Here you go. https://en.m.wikipedia.org/wiki/Gemini_(protocol) https://en.m.wikipedia.org/wiki/Gemini_(protocol)
    - floren 3y ago
      "http get but we chopped off the low order byte of the return code" is not sufficient or necessary to implementing a non-Googlized web.

ranting-moth 3y ago

May I suggest something like "Enterprise Environment Integrity". How does the public know that the enterprise (i.e. google) it's dealing with is healthy? The public should have an entity that will receive detailed attestation data to assess that. Failing the attestation will revoke business permit along with an announcement.

jacquesm 3y ago
> How does the public know that the enterprise (i.e. google) it's dealing with is healthy? Because they will pinky promise. I find it funny that for some reason companies get the benefit of the doubt when it comes to dealing with data in a responsible matter. Yes, it's possible that they do. But it is also possible that they don't and no matter what they say in public that's just words, it doesn't prove anything about what is really going on and that's before we get to honest mistakes. There is simply no way to be sure, all you know is that once you transmit data to any other host on the internet that it is quite literally out of your hands whether or not that data will one day show up elsewhere.
- mschuster91 3y ago
  > Because they will pinky promise. It goes a bit deeper than that. Many companies these days "choose" to get certified under a variety of standards (the most common one is ISO 27001), everyone who hasn't been completely ignorant is looking for or already got cybersecurity insurance and on top of that comes the entire GDPR saga. Basically, you got three levels of auditors that at least make sure the basics are covered, and on top of that come industry specific requirements such as TISAX [1], US SOX Act compliance or whatever AWS had to go through for GovCloud. [1] https://en.wikipedia.org/wiki/Trusted_Information_Security_Assessment_Exchange https://en.wikipedia.org/wiki/Trusted_Information_Security_A...
  - jacquesm 3y ago
    I'm well aware of those audits and the typical auditor output. Where to start... These audits check paper. They don't check what is actually going on, they will check that documentation is in place and that processes and various controls are in place and that periodic checks have been performed. They don't actually check any of the underlying tech. For instance: ISO27001 asks for 'regular pentests'. But it doesn't do anything to ensure that those pentests are of a good quality. There are plenty of 'check the box' automated pentest services that get you past that hurdle but that won't do much for your security. They might even give you a false sense of security. So yes, there are all kinds of audits. But like with everything else the devil is in the details and the quality of the work is very important (obviously!). Many companies treat these certifications like a 'license to operate'. You need to have them so then you do the absolute minimum required to satisfy the auditors rather than to see the certificate as a minimum level of proof required that you have your house in order and that your intent is to deal responsible with your data subjects (and customers) data. The latter is extremely rare.

thesuperbigfrog 3y ago

"If your computer can’t lie to other computers, then it’s not yours." This fundamentally comes down to "do you really control your computer, or does someone else?": https://youtu.be/Ag1AKIl_2GM?t=57 https://youtu.be/Ag1AKIl_2GM?t=57

perihelions 3y ago
And also (this one was written in 2002!) - "Who should your computer take its orders from? Most people think their computers should obey them, not obey someone else. With a plan they call “trusted computing,” large media corporations (including the movie companies and record companies), together with computer companies such as Microsoft and Intel, are planning to make your computer obey them instead of you. (Microsoft's version of this scheme is called Palladium.) Proprietary programs have included malicious features before, but this plan would make it universal." https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html

powera 3y ago

[flagged]

always2slow 3y ago
I was just thinking.. must have found the google employee. Checked your profile haha yep. about: Formerly of Google and Quip.
deleted 3y ago
[deleted]
stoolpigeon 3y ago
Almost anything one can do, of value to their fellow humans, is a crime somewhere.
Zak 3y ago
Where are you seeing that? This article discusses lying about one's user agent string, presumably to get better behavior out of a website that's making bad decisions based on it. That is not a crime last I checked.
userbinator 3y ago
"crimes" according to who?
meindnoch 3y ago
>Not looking at ads is a crime. Oookay, I had enough HackerNews for today.

Macha 3y ago

> In the normal world, you show up at the store with a five dollar bill, pick up a newspaper, and the store sells you the newspaper (and maybe some change) in exchange for the bill. In Google’s proposed world, five dollar bills aren’t fungible anymore: the store can ask you about the provenance of that bill, and if they don’t like the answer, they don’t sell you the newspaper. No, they’re not worried about the bill being fake or counterfeit or anything like that. It’s a real five dollar bill, they agree, but you can’t prove that you got it from the right bank. Please feel free to come back with the right sort of five dollar bill. Side note: This at least would occasionally happen if you tried to spend Scotland or NI £5 notes in England.

HWR_14 3y ago
That's closer to my inability to spend US dollars in England. Different countries have different currencies.
- adamckay 3y ago
  No it's not, Scottish bank notes aren't of a different currency - they're still pound sterling. The reason they're typically not accepted in English shops (at least, those not on the Scottish border) is most often because they're rather uncommon so it's more difficult for cashiers to detect fakes. My understanding is also that some banks, when depositing, require the English and Scottish notes to be separated and may charge a fee to convert them to English notes, so it's more effort to accept and handle them.
  - HWR_14 3y ago
    Can you (British equivalent of Venmo/Paypal) Scottish pounds to someone who receives them as English pounds? I don't know why Britain doesn't just implement a national printing press.
    - adamckay 3y ago
      There's no such thing as Scottish pounds or English pounds, the UK uses pound sterling (internationally abbreviated to GBP). There are English banknotes and Scottish banknotes, but they're the same currency.

Pxtl 3y ago

On the one hand, I firmly do believe that we need a proper way to verify identity globally over the internet. The Turing Test is over and AI is going to destroy every user-submittable form online. On the other hand, it's infuriating that advertising is the first front in this war. I specifically don't want advertisers to have my identity. I'm fine with like my Mastodon server or a site like HN to know I'm me because I'm actively interested in interacting with them. I don't want to interact with advertisers, or for them to have my identity, but they're going to wall off half the internet for people who opt out.

nickisnoble 3y ago
On the internet, no one knows you're a dog. https://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_you%27re_a_dog https://en.wikipedia.org/wiki/On_the_Internet,_nobody_knows_...
- captn3m0 3y ago
  Once WEI goes live: “On the internet, everyone knows if you’re using a stock Android device”
wmf 3y ago
WEI is not really an identity system. WEI is more like a binary "is this a real browser" signal.

oh_sigh 3y ago

The premise of this article is fundamentally wrong. > On that Web, if you send a valid request with the right data, you get a valid response. Explain DoS protection then.

userbinator 3y ago

The underlying hostile technology is "remote attestation" and it's what we should all be fighting against. People justify the latter by speaking about companies wanting control over employees' environments, but IMHO that shouldn't be allowed either. This is also why "zero trust" is problematic; they want to replace humanity with centralised control.

fruitreunion1 3y ago
I think in internal environments like within a company it's fine. Just not in the public, user-facing web.
QuantumG 3y ago
Yeah, cryptography is bad and consumers shouldn't be allowed to prove their browser hasn't been modified or have safety when using biometrics or making payments.
- userbinator 3y ago
  "modified" according to whom? Users should be able to use software the way they want, not the way Big Tech dictates. Governments are scared because they realise cryptography is being used against them. Now users should realise the same. Strong encryption is classified as a weapon for good reason. Just like you'd want a gun in your hands, but not one pointed at you. Then again, the fact that you call them "consumers" instead of "users" already shows what side of the debate you're on.
  - QuantumG 3y ago
    I'm sorry but there's a class of users who want to be able to prove they haven't made modifications and they refer to themselves as consumers. They're the people who don't jailbreak their devices for exactly that reason and this protocol will support them. Oh, and they happen to be the bulk of the users.
    - Zuiii 3y ago

1vuio0pswjnm7 3y ago

"By analogy: right now, you can tell your browser to change its User-Agent string to anything you want." You can also choose not to send this header. By default I do not send it. The RFCs do not require it^1 and very rarely do I find sites that do. When I do find such sites,^2 I just add them to the proxy config so that a UA is added on the way out. Almost invariably these sites will accept a made-up UA, so long as it is well-formed, which is interesting.^3 It suggests no one knows what new UA strings will appear. The origin of changing the User-Agent header dates back to one of the earliest browsers, written in part by a well-known Silicon Valley VC.^4 It was always possible for the user to control HTTP headers such as UA and the designers knew it. Later in the "browser wars" Microsoft changed its UA header to match Mozilla's.^5 1. https://towardsdatascience.com/the-user-agent-that-crazy-string-underpinning-a-bunch-of-analytics-86507ef632f0?gi=e30981d0139f https://towardsdatascience.com/the-user-agent-that-crazy-str... 2. For example, www.federalregister.com and sec.gov. 3. Many users want to "blend in" and use common strings so perhaps use of made-up strings remains largely untested. 4. https://raw.githubusercontent.com/alandipert/ncsa-mosaic/master/mosaic-spoof-agents https://raw.githubusercontent.com/alandipert/ncsa-mosaic/mas... 5. https://webaim.org/blog/user-agent-string-history/comment-page-1/ https://webaim.org/blog/user-agent-string-history/comment-pa... https://humanwhocodes.com/blog/2010/01/12/history-of-the-user-agent-string/ https://humanwhocodes.com/blog/2010/01/12/history-of-the-use... As for WEI, I'm inclined to think that the terms "abuse" and "fraud" in the spec may actually refer to ad fraud, including potential fraud by Google itself in marketing its ad services because it hides the true extent of ad fraud from its customers. People who like to access the web with uncommon TCP/HTTP clients may not be a significant problem. There are no details given in the spec about this alleged "fraud"; perhaps that's intentional. Although by being vague in the spec, real humans that prefer not to use popular browsers may jump to conclusions.^6 It could be that we're on the cusp of exposing the true extent of ad fraud with respect to Google, and the ultimate unworkability of Google's core "business" (selling ad services). Perhaps Google believes its advertiser customers could begin to lose trust; maybe direct more ad spend to Apple. 6. Some pre-spec discussion: https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_kGO22g/m/XCAIgPtxAQAJ https://groups.google.com/a/chromium.org/g/blink-dev/c/Ux5h_...

seo-speedwagon 3y ago

I figured I’d take a minute to try and find the proposal itself, so I could see what the proponents considered the virtues of this to be. https://github.com/mozilla/standards-positions/issues/852 https://github.com/mozilla/standards-positions/issues/852 https://github.com/RupertBenWiser/Web-Environment-Integrity/blob/main/explainer.md https://github.com/RupertBenWiser/Web-Environment-Integrity/... I stopped reading after the explainer’s intro section. The first example is making it easier for websites to sell adds (lmao) and the other 3 are extremely questionable whether if the proposed remedy even helps. And it’s presented as a benevolent alternative to browser fingerprinting, as if we must choose between these two awful choices. It’s an absolute joke of a proposal.

recursive4 3y ago

Upvote if you actually read the proposal in question.

user6723 3y ago

The wei camp wants a world where you can have your open source OS with encryption that actually works but almost any commercial website won't talk to you. Wei will get integrated with your CBDC.

deleted 3y ago

[deleted]

puffyengineer 3y ago

What is so wrong with Web Environment Integrity? It's a great policy, and the notes CLEARLY outline how the main benefit is going to be for the users and website developers. If you're not doing anything wrong, then you shouldn't have an issue.

wdiamond 3y ago

people built internet just to destroy it. its not a tech problem. its economics. the forever decreasing profits because more people just know and re-sell for less. tor will become more and more expensive till people realize that needs the same hardware trick with another brand like internet2,3,4,5,... to seek the solution by hacking wont stop this foverer battle. its just ends when the imaginary of fair price for information meets the offer (the forever decrease of population to let universe in peace)